Result Details
Install AIDExccdf_org.ssgproject.content_rule_package_aide_installed medium
Install AIDE
| Rule ID | xccdf_org.ssgproject.content_rule_package_aide_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_aide_installed:def:1 |
| Time | 2026-11-02T22:57:53+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9 | | cjis | 5.10.1.3 | | cobit5 | APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4 | | isa-62443-2013 | SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6 | | iso27001-2013 | A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3 | | nist | CM-6(a) | | nist-csf | DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3 | | pcidss | Req-11.5 | | os-srg | SRG-OS-000445-GPOS-00199 | | anssi | R76, R79 | | cis | 6.3.1 | | ism | 1034, 1288, 1341, 1417 | | pcidss4 | 11.5.2 |
|
| Description | The aide package can be installed with the following command:
$ apt-get install aide
|
| Rationale | The AIDE package must be installed if it is to be available for integrity checking. |
OVAL test results detailspackage aide is installed
oval:ssg-test_package_aide_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | aide | arm64 | 0 | 2+deb13u5 | 0.19.1 | 0.19.1-2+deb13u5 |
Build and Test AIDE Databasexccdf_org.ssgproject.content_rule_aide_build_database medium
Build and Test AIDE Database
| Rule ID | xccdf_org.ssgproject.content_rule_aide_build_database |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-aide_build_database:def:1 |
| Time | 2026-11-02T22:57:53+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9 | | cjis | 5.10.1.3 | | cobit5 | APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4 | | isa-62443-2013 | SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6 | | iso27001-2013 | A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3 | | nist | CM-6(a) | | nist-csf | DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3 | | pcidss | Req-11.5 | | os-srg | SRG-OS-000445-GPOS-00199 | | anssi | R76, R79 | | cis | 6.3.1 | | pcidss4 | 11.5.2 |
|
| Description | Run the following command to generate a new database:
$ sudo aideinit
By default, the database will be written to the file
/var/lib/aide/aide.db.new.
Storing the database, the configuration file /etc/aide.conf, and the binary
/usr/sbin/aide
(or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:
$ sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
To initiate a manual check, run the following command:
$ sudo /usr/sbin/aide --check
If this check produces any unexpected output, investigate. |
| Rationale | For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files. |
| Warnings | warning
In Debian 13 Image Mode (bootc) systems, the AIDE database must be regenerated after each system update.
Image Mode systems receive updates through new container images that may include modified files.
After applying system updates, run the following commands to regenerate the AIDE database:
$ sudo /usr/sbin/aide --init
Then replace the existing database:
$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
Failure to regenerate the AIDE database after updates will result in false positive alerts
for legitimate system changes introduced by the update process. |
OVAL test results detailspackage aide is installed
oval:ssg-test_package_aide_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | aide | arm64 | 0 | 2+deb13u5 | 0.19.1 | 0.19.1-2+deb13u5 |
Testing existence of operational aide database file
oval:ssg-test_aide_operational_database_absolute_path:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_operational_database_absolute_path:obj:1 of type
file_object
| Filepath |
|---|
| Referenced variable has no values (oval:ssg-variable_aide_operational_database_absolute_path:var:1) |
Testing existence of operational aide database file
oval:ssg-test_aide_operational_database_absolute_path_no_dbdir:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| not evaluated | /var/lib/aide/aide.db | regular | 0 | 0 | 12553828 | rw------- |
Testing existence of configuration for new databases
oval:ssg-test_aide_new_database_config:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_new_database_config:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/aide/aide.conf | ^database_out=file:@@{DBDIR}/([a-z.]+)$ | 1 |
Testing existence of dbdir variable
oval:ssg-test_aide_dbdir_config:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_build_database_dirpath:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/aide/aide.conf | ^@@define[\s]DBDIR[\s]+(/.*)$ | 1 |
Testing existence of configuration for new databases
oval:ssg-test_aide_new_database_config_no_dbdir:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/aide/aide.conf | database_out=file:/var/lib/aide/aide.db.new |
Configure Systemd Timer Execution of AIDExccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer medium
Configure Systemd Timer Execution of AIDE
| Rule ID | xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-aide_periodic_checking_systemd_timer:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9 | | cjis | 5.10.1.3 | | cobit5 | APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4 | | isa-62443-2013 | SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6 | | iso27001-2013 | A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3 | | nist | SI-7, SI-7(1), CM-6(a) | | nist-csf | DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3 | | pcidss | Req-11.5 | | os-srg | SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201 | | anssi | R76 | | cis | 6.3.2 | | pcidss4 | 11.5.2 |
|
| Description | At a minimum, AIDE should be configured to run a weekly scan.
To implement a systemd service and a timer unit to run the service periodically:
For example, if a systemd timer is expected to be started every day at 5AM
OnCalendar=*-*-* 05:00:0
[Timer] section in the timer unit and
a Unit section starting the AIDE check service unit should be referred. |
| Rationale | AIDE provides a means to check if unauthorized changes are made to the system.
AIDE itself does not setup a periodic execution, so in order to detect unauthorized
changes a systemd service to run the check and a systemd timer to take care
of periodical execution of that systemd service should be defined. |
OVAL test results detailspackage aide is installed
oval:ssg-test_package_aide_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | aide | arm64 | 0 | 2+deb13u5 | 0.19.1 | 0.19.1-2+deb13u5 |
systemd aidecheck.service enabled
oval:ssg-tst_aidecheck-service_enabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | aidecheck.service | UnitFileState | enabled |
systemd aidecheck.timer enabled
oval:ssg-tst_aidecheck-timer_enabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | aidecheck.timer | UnitFileState | enabled |
systemd aidecheck.timer active
oval:ssg-tst_aidecheck-timer_active:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | aidecheck.timer | ActiveState | active |
Disable Prelinkingxccdf_org.ssgproject.content_rule_disable_prelink medium
Disable Prelinking
| Rule ID | xccdf_org.ssgproject.content_rule_disable_prelink |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-disable_prelink:def:1 |
| Time | 2026-11-02T22:57:53+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 2, 3, 9 | | cjis | 5.10.1.3 | | cobit5 | APO01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS04.07, DSS05.03, DSS06.02, DSS06.06 | | cui | 3.13.11 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4 | | isa-62443-2013 | SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 7.6 | | iso27001-2013 | A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.3 | | nerc-cip | CIP-003-8 R4.2, CIP-007-3 R5.1 | | nist | SC-13, CM-6(a) | | nist-csf | PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1 | | pcidss | Req-11.5 | | cis | 1.5.6 |
|
| Description | The prelinking feature changes binaries in an attempt to decrease their startup
time. In order to disable it, change or add the following line inside the file
/etc/sysconfig/prelink:
PRELINKING=no
Next, run the following command to return binaries to a normal, non-prelinked state:
$ sudo /usr/sbin/prelink -ua
|
| Rationale | Because the prelinking feature changes binaries, it can interfere with the
operation of certain software and/or modes such as AIDE, FIPS, etc. |
OVAL test results detailspackage prelink is removed
oval:ssg-test_package_prelink_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_prelink_removed:obj:1 of type
dpkginfo_object
Tests whether prelinking is disabled
oval:ssg-test_prelinking_disabled:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_prelinking_disabled:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/sysconfig/prelink | ^[\s]*PRELINKING=no[\s]* | 1 |
Ensure /dev/shm is configuredxccdf_org.ssgproject.content_rule_partition_for_dev_shm low
Ensure /dev/shm is configured
| Rule ID | xccdf_org.ssgproject.content_rule_partition_for_dev_shm |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-partition_for_dev_shm:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | low |
| References: | |
| Description | The /dev/shm is a traditional shared memory concept.
One program will create a memory portion, which other processes
(if permitted) can access. If /dev/shm is not configured,
tmpfs will be mounted to /dev/shm by systemd. |
| Rationale | Any user can upload and execute files inside the /dev/shm similar to
the /tmp partition. Configuring /dev/shm allows an administrator
to set the noexec option on the mount, making /dev/shm useless for an attacker to
install executable code. It would also prevent an attacker from establishing a
hardlink to a system setuid program and wait for it to be updated. Once the program
was updated, the hardlink would be broken and the attacker would have his own copy
of the program. If the program happened to have a security vulnerability, the attacker
could continue to exploit the known flaw. |
| Warnings | warning
This rule does not have a remediation.
It is expected that this will be managed by systemd and will be a tmpfs partition. |
OVAL test results details/dev/shm on own partition
oval:ssg-testdev_shm_partition:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
Ensure /tmp Located On Separate Partitionxccdf_org.ssgproject.content_rule_partition_for_tmp low
Ensure /tmp Located On Separate Partition
| Rule ID | xccdf_org.ssgproject.content_rule_partition_for_tmp |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-partition_for_tmp:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | low |
| References: | | cis-csc | 12, 15, 8 | | cobit5 | APO13.01, DSS05.02 | | isa-62443-2013 | SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.13.1.1, A.13.2.1, A.14.1.3 | | nist | CM-6(a), SC-5(2) | | nist-csf | PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 1.1.2.1.1 |
|
| Description | The /tmp directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM. |
| Rationale | The /tmp partition is used as temporary storage by many programs.
Placing /tmp in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it. |
OVAL test results details/tmp on own partition
oval:ssg-testtmp_partition:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
Disable the GNOME3 Login User Listxccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list medium
Disable the GNOME3 Login User List
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | In the default graphical environment, users logging directly into the
system are greeted with a login screen that displays all known users.
This functionality should be disabled by setting disable-user-list
to true.
To disable, add or edit disable-user-list to
/etc/dconf/db/gdm.d/00-security-settings. For example:
[org/gnome/login-screen]
disable-user-list=true
Once the setting has been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent
user modification. For example:
/org/gnome/login-screen/disable-user-list
After the settings have been set, run dconf update. |
| Rationale | Leaving the user list enabled is a security risk since it allows anyone
with physical access to the system to quickly enumerate known user accounts
without logging in. |
Disable XDMCP in GDMxccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp high
Disable XDMCP in GDM
| Rule ID | xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | high |
| References: | |
| Description | XDMCP is an unencrypted protocol, and therefore, presents a security risk.
To disable XDMCP support in Gnome, set Enable to false under the [xdmcp] configuration section in /etc/gdm3/daemon.conf. For example:
[xdmcp]
Enable=false
|
| Rationale | XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does
not provide for the confidentiality and integrity of user passwords or the
remote session. If a privileged user were to login using XDMCP, the
privileged user password could be compromised due to typed XEvents
and keystrokes will traversing over the network in clear text. |
Disable GNOME3 Automountingxccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount medium
Disable GNOME3 Automounting
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 16 | | cobit5 | APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03 | | cui | 3.1.7 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.2, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.13, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1, SR 2.6 | | iso27001-2013 | A.11.2.6, A.13.1.1, A.13.2.1, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.AC-6 | | os-srg | SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227 | | cis | 1.7.6, 1.7.7 | | pcidss4 | 3.4.2, 3.4 |
|
| Description | The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount within GNOME3, add or set
automount to false in /etc/dconf/db/gdm.d/00-security-settings.
For example:
[org/gnome/desktop/media-handling]
automount=false
Once the settings have been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/desktop/media-handling/automount
After the settings have been set, run dconf update. |
| Rationale | Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media. |
Disable GNOME3 Automount Openingxccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open medium
Disable GNOME3 Automount Opening
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 16 | | cobit5 | APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03 | | cui | 3.1.7 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.2, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.13, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1, SR 2.6 | | iso27001-2013 | A.11.2.6, A.13.1.1, A.13.2.1, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.AC-6 | | os-srg | SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227 | | cis | 1.7.6, 1.7.7 | | pcidss4 | 3.4.2, 3.4 |
|
| Description | The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount-open within GNOME3, add or set
automount-open to false in /etc/dconf/db/gdm.d/00-security-settings.
For example:
[org/gnome/desktop/media-handling]
automount-open=false
Once the settings have been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/desktop/media-handling/automount-open
After the settings have been set, run dconf update. |
| Rationale | Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media. |
Disable GNOME3 Automount runningxccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun low
Disable GNOME3 Automount running
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | low |
| References: | | cis-csc | 12, 16 | | cobit5 | APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03 | | cui | 3.1.7 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.2, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.13, SR 1.2, SR 1.4, SR 1.5, SR 1.9, SR 2.1, SR 2.6 | | iso27001-2013 | A.11.2.6, A.13.1.1, A.13.2.1, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.AC-6 | | os-srg | SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227 | | cis | 1.7.8, 1.7.9 |
|
| Description | The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable autorun-never within GNOME3, add or set
autorun-never to true in /etc/dconf/db/gdm.d/00-security-settings.
For example:
[org/gnome/desktop/media-handling]
autorun-never=true
Once the settings have been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/desktop/media-handling/autorun-never
After the settings have been set, run dconf update. |
| Rationale | Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Disabling automatic mount running in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media. |
Set GNOME3 Screensaver Inactivity Timeoutxccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay medium
Set GNOME3 Screensaver Inactivity Timeout
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cjis | 5.5.5 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.10 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | AC-11(a), CM-6(a) | | nist-csf | PR.AC-7 | | pcidss | Req-8.1.8 | | os-srg | SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012 | | cis | 1.7.4, 1.7.5 | | pcidss4 | 8.2.8, 8.2 |
|
| Description | The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay
setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/gdm.d directory
and locked in /etc/dconf/db/gdm.d/locks directory to prevent user modification.
For example, to configure the system for a 15 minute delay, add the following to
/etc/dconf/db/gdm.d/00-security-settings:
[org/gnome/desktop/session]
idle-delay=uint32 900
|
| Rationale | A session time-out lock is a temporary action taken when a user stops work and moves away from
the immediate physical vicinity of the information system but does not logout because of the
temporary nature of the absence. Rather than relying on the user to manually lock their operating
system session prior to vacating the vicinity, GNOME3 can be configured to identify when
a user's session has idled and take action to initiate a session lock. |
Set GNOME3 Screensaver Lock Delay After Activation Periodxccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay medium
Set GNOME3 Screensaver Lock Delay After Activation Period
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.10 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | AC-11(a), CM-6(a) | | nist-csf | PR.AC-7 | | pcidss | Req-8.1.8 | | os-srg | SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012 | | cis | 1.7.4, 1.7.5 | | pcidss4 | 8.2.8, 8.2 |
|
| Description | To activate the locking delay of the screensaver in the GNOME3 desktop when
the screensaver is activated, add or set lock-delay to uint32 5
in
/etc/dconf/db/gdm.d/00-security-settings. For example:
[org/gnome/desktop/screensaver]
lock-delay=uint32 5
After the settings have been set, run dconf update. |
| Rationale | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absence. |
Enable GNOME3 Screensaver Lock After Idle Periodxccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled medium
Enable GNOME3 Screensaver Lock After Idle Period
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cjis | 5.5.5 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.10 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | CM-6(a) | | nist-csf | PR.AC-7 | | pcidss | Req-8.1.8 | | os-srg | SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011 | | cis | 1.7.4, 1.7.5 | | pcidss4 | 8.2.8, 8.2 |
|
| Description |
To activate locking of the screensaver in the GNOME3 desktop when it is activated,
add or set lock-enabled to true in
/etc/dconf/db/gdm.d/00-security-settings. For example:
[org/gnome/desktop/screensaver]
lock-enabled=true
Once the settings have been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run dconf update. |
| Rationale | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absence. |
Install sudo Packagexccdf_org.ssgproject.content_rule_package_sudo_installed medium
Install sudo Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_sudo_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_sudo_installed:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | The sudo package can be installed with the following command:
$ apt-get install sudo
|
| Rationale | sudo is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done.
|
OVAL test results detailspackage sudo is installed
oval:ssg-test_package_sudo_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | sudo | arm64 | 0 | 3+deb13u2 | 1.9.16p2 | 1.9.16p2-3+deb13u2 |
Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_ptyxccdf_org.ssgproject.content_rule_sudo_add_use_pty medium
Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_add_use_pty |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_add_use_pty:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | The sudo use_pty tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the use_pty tag exists in
/etc/sudoers configuration file or any sudo configuration snippets
in /etc/sudoers.d/. |
| Rationale | Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining
access to the user's terminal after the main program has finished executing. |
OVAL test results detailsuse_pty exists in /etc/sudoers or /etc/sudoers.d/
oval:ssg-test_use_pty_sudoers:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sudoers | Defaults use_pty |
Ensure Sudo Logfile Exists - sudo logfilexccdf_org.ssgproject.content_rule_sudo_custom_logfile low
Ensure Sudo Logfile Exists - sudo logfile
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_custom_logfile |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_custom_logfile:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | low |
| References: | |
| Description | A custom log sudo file can be configured with the 'logfile' tag. This rule configures
a sudo custom logfile at the default location suggested by CIS, which uses
/var/log/sudo.log. |
| Rationale | A sudo log file simplifies auditing of sudo commands. |
OVAL test results detailslogfile exists in /etc/sudoers or /etc/sudoers.d/
oval:ssg-test_logfile_sudoers:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sudoers | Defaults logfile=/var/log/sudo.log |
Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticatexccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate medium
Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_remove_no_authenticate:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-11, CM-6(a) | | nist-csf | PR.AC-1, PR.AC-7 | | os-srg | SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158 | | cis | 5.2.5 | | ism | 1546 |
|
| Description | The sudo !authenticate option, when specified, allows a user to execute commands using
sudo without having to authenticate. This should be disabled by making sure that the
!authenticate option does not exist in /etc/sudoers configuration file or
any sudo configuration snippets in /etc/sudoers.d/. |
| Rationale | Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate. |
OVAL test results details!authenticate does not exist in /etc/sudoers
oval:ssg-test_no_authenticate_etc_sudoers:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_no_authenticate_etc_sudoers:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/sudoers | ^(?!#).*[\s]+\!authenticate.*$ | 1 |
!authenticate does not exist in /etc/sudoers.d
oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /etc/sudoers.d | ^.*$ | ^(?!#).*[\s]+\!authenticate.*$ | 1 |
Require Re-Authentication When Using the sudo Commandxccdf_org.ssgproject.content_rule_sudo_require_reauthentication medium
Require Re-Authentication When Using the sudo Command
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_require_reauthentication |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_require_reauthentication:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | | nist | IA-11 | | os-srg | SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158 | | cis | 5.2.6 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | The sudo timestamp_timeout tag sets the amount of time sudo password prompt waits.
The default timestamp_timeout value is 5 minutes.
The timestamp_timeout should be configured by making sure that the
timestamp_timeout tag exists in
/etc/sudoers configuration file or any sudo configuration snippets
in /etc/sudoers.d/.
If the value is set to an integer less than 0, the user's time stamp will not expire
and the user will not have to re-authenticate for privileged actions until the user's session is terminated. |
| Rationale | Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate. |
OVAL test results detailscheck correct configuration in /etc/sudoers
oval:ssg-test_sudo_timestamp_timeout:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sudoers | Defaults timestamp_timeout=15 |
check correct configuration in /etc/sudoers
oval:ssg-test_sudo_timestamp_timeout_no_signs:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_sudo_timestamp_timeout_no_signs:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^\/etc\/(sudoers|sudoers\.d\/.*)$ | ^[\s]*Defaults[\s]+timestamp_timeout[\s]*=\s*[\-](\d*\.\d+|\d+\.\d*|\d+)$ | 1 |
Enable GNOME3 Login Warning Bannerxccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled medium
Enable GNOME3 Login Warning Banner
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.9 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | AC-8(a), AC-8(b), AC-8(c) | | nist-csf | PR.AC-7 | | os-srg | SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088 | | cis | 1.7.2 |
|
| Description | In the default graphical environment, displaying a login warning banner
in the GNOME Display Manager's login screen can be enabled on the login
screen by setting banner-message-enable to true.
To enable, add or edit banner-message-enable to
/etc/dconf/db/gdm.d/00-security-settings. For example:
[org/gnome/login-screen]
banner-message-enable=true
Once the setting has been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/login-screen/banner-message-enable
After the settings have been set, run dconf update.
The banner text must also be set. |
| Rationale | Display of a standardized and approved use notification before granting access to the operating system
ensures privacy and security notification verbiage used is consistent with applicable federal laws,
Executive Orders, directives, policies, regulations, standards, and guidance.
For U.S. Government systems, system use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not exist. |
Set the GNOME3 Login Warning Banner Textxccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text medium
Set the GNOME3 Login Warning Banner Text
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.9 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | AC-8(a), AC-8(c) | | nist-csf | PR.AC-7 | | os-srg | SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088 | | cis | 1.7.2 |
|
| Description | In the default graphical environment, configuring the login warning banner text
in the GNOME Display Manager's login screen can be configured on the login
screen by setting banner-message-text to 'APPROVED_BANNER'
where APPROVED_BANNER is the approved banner for your environment.
To enable, add or edit banner-message-text to
/etc/dconf/db/gdm.d/00-security-settings. For example:
[org/gnome/login-screen]
banner-message-text='APPROVED_BANNER'
Once the setting has been added, add a lock to
/etc/dconf/db/gdm.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/login-screen/banner-message-text
After the settings have been set, run dconf update.
When entering a warning banner that spans several lines, remember
to begin and end the string with ' and use \n for new lines. |
| Rationale | An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers. |
Ensure Local Login Warning Banner Is Configured Properlyxccdf_org.ssgproject.content_rule_banner_etc_issue_cis medium
Ensure Local Login Warning Banner Is Configured Properly
| Rule ID | xccdf_org.ssgproject.content_rule_banner_etc_issue_cis |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-banner_etc_issue_cis:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To configure the system local login warning banner edit the /etc/issue file.
The contents of this file is displayed to users prior to login to local terminals.
Replace the default text with a message compliant with the local site policy.
The message should not contain information about operating system version,
release, kernel version or patch level.
The recommended banner text can be tailored in the XCCDF Value xccdf_org.ssgproject.content_value_cis_banner_text:
Authorized users only. All activity may be monitored and reported.
|
| Rationale | Warning messages inform users who are attempting to login to the system of their legal
status regarding the system and must include the name of the organization that owns
the system and any monitoring policies that are in place. Displaying OS and patch level
information in login banners also has the side effect of providing detailed system
information to attackers attempting to target specific exploits of a system. Authorized
users can easily get this information by running the uname -a command once they
have logged in. |
OVAL test results detailsCheck that the given object does not exist
oval:ssg-test_banner_etc_issue_cis_file_nonempty:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/issue | Debian GNU/Linux 13 \n \l |
Check that the given object does not exist
oval:ssg-test_banner_etc_issue_cis:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_banner_etc_issue_cis:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/issue | (\\v|\\r|\\m|\\s|debian13|Debian 13) | 1 |
Ensure Remote Login Warning Banner Is Configured Properlyxccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis medium
Ensure Remote Login Warning Banner Is Configured Properly
| Rule ID | xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-banner_etc_issue_net_cis:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To configure the system remote login warning banner edit the /etc/issue.net file.
The contents of this file is displayed to users prior to login from remote connections.
Replace the default text with a message compliant with the local site policy.
The message should not contain information about operating system version,
release, kernel version or patch level.
The recommended banner text can be tailored in the XCCDF Value xccdf_org.ssgproject.content_value_cis_banner_text:
Authorized users only. All activity may be monitored and reported.
|
| Rationale | Warning messages inform users who are attempting to login to the system of their legal
status regarding the system and must include the name of the organization that owns
the system and any monitoring policies that are in place. Displaying OS and patch level
information in login banners also has the side effect of providing detailed system
information to attackers attempting to target specific exploits of a system. Authorized
users can easily get this information by running the uname -a command once they
have logged in. |
OVAL test results detailsCheck that the given object does not exist
oval:ssg-test_banner_etc_issue_net_cis_file_nonempty:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/issue.net | Debian GNU/Linux 13 |
Check that the given object does not exist
oval:ssg-test_banner_etc_issue_net_cis:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_banner_etc_issue_net_cis:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/issue.net | (\\v|\\r|\\m|\\s|debian13|Debian 13) | 1 |
Ensure Message Of The Day Is Configured Properlyxccdf_org.ssgproject.content_rule_banner_etc_motd_cis medium
Ensure Message Of The Day Is Configured Properly
| Rule ID | xccdf_org.ssgproject.content_rule_banner_etc_motd_cis |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-banner_etc_motd_cis:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To configure the system message of the day banner edit the /etc/motd file.
Replace the default text with a message compliant with the local site policy.
The message should not contain information about operating system version,
release, kernel version or patch level.
The recommended banner text can be tailored in the XCCDF Value xccdf_org.ssgproject.content_value_cis_banner_text:
Authorized users only. All activity may be monitored and reported.
|
| Rationale | Warning messages inform users who are attempting to login to the system of their legal
status regarding the system and must include the name of the organization that owns
the system and any monitoring policies that are in place. Displaying OS and patch level
information in login banners also has the side effect of providing detailed system
information to attackers attempting to target specific exploits of a system. Authorized
users can easily get this information by running the uname -a command once they
have logged in. |
OVAL test results detailsCheck that the given object does not exist
oval:ssg-test_banner_etc_motd_cis:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_banner_etc_motd_cis:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/motd | (\\v|\\r|\\m|\\s|debian13|Debian 13) | 1 |
Verify Group Ownership of System Login Bannerxccdf_org.ssgproject.content_rule_file_groupowner_etc_issue medium
Verify Group Ownership of System Login Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_issue:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/issue, run the command:
$ sudo chgrp root /etc/issue
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper group ownership will ensure that only root user can modify the banner. |
OVAL test results detailsTesting group ownership of /etc/issue
oval:ssg-test_file_groupowner_etc_issue_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_issue_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/issue | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_issue_0_0:ste:1 |
Verify Group Ownership of System Login Banner for Remote Connectionsxccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net medium
Verify Group Ownership of System Login Banner for Remote Connections
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_issue_net:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/issue.net, run the command:
$ sudo chgrp root /etc/issue.net
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper group ownership will ensure that only root user can modify the banner. |
OVAL test results detailsTesting group ownership of /etc/issue.net
oval:ssg-test_file_groupowner_etc_issue_net_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_issue_net_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/issue.net | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_issue_net_0_0:ste:1 |
Verify Group Ownership of Message of the Day Bannerxccdf_org.ssgproject.content_rule_file_groupowner_etc_motd medium
Verify Group Ownership of Message of the Day Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_motd:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/motd, run the command:
$ sudo chgrp root /etc/motd
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper group ownership will ensure that only root user can modify the banner. |
OVAL test results detailsTesting group ownership of /etc/motd
oval:ssg-test_file_groupowner_etc_motd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_motd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/motd | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_motd_0_0:ste:1 |
Verify ownership of System Login Bannerxccdf_org.ssgproject.content_rule_file_owner_etc_issue medium
Verify ownership of System Login Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_issue |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_issue:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/issue, run the command:
$ sudo chown root /etc/issue
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper ownership will ensure that only root user can modify the banner. |
OVAL test results detailsTesting user ownership of /etc/issue
oval:ssg-test_file_owner_etc_issue_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_issue_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/issue | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_issue_0_0:ste:1 |
Verify ownership of System Login Banner for Remote Connectionsxccdf_org.ssgproject.content_rule_file_owner_etc_issue_net medium
Verify ownership of System Login Banner for Remote Connections
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_issue_net:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/issue.net, run the command:
$ sudo chown root /etc/issue.net
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper ownership will ensure that only root user can modify the banner. |
OVAL test results detailsTesting user ownership of /etc/issue.net
oval:ssg-test_file_owner_etc_issue_net_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_issue_net_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/issue.net | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_issue_net_0_0:ste:1 |
Verify ownership of Message of the Day Bannerxccdf_org.ssgproject.content_rule_file_owner_etc_motd medium
Verify ownership of Message of the Day Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_motd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_motd:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/motd, run the command:
$ sudo chown root /etc/motd
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper ownership will ensure that only root user can modify the banner. |
OVAL test results detailsTesting user ownership of /etc/motd
oval:ssg-test_file_owner_etc_motd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_motd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/motd | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_motd_0_0:ste:1 |
Verify permissions on System Login Bannerxccdf_org.ssgproject.content_rule_file_permissions_etc_issue medium
Verify permissions on System Login Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_issue |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_issue:def:1 |
| Time | 2026-11-02T22:57:54+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/issue, run the command:
$ sudo chmod 0644 /etc/issue
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper permissions will ensure that only root user can modify the banner. |
OVAL test results detailsTesting mode of /etc/issue
oval:ssg-test_file_permissions_etc_issue_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_issue_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/issue | oval:ssg-exclude_symlinks__etc_issue:ste:1 | oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1 |
Verify permissions on System Login Banner for Remote Connectionsxccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net medium
Verify permissions on System Login Banner for Remote Connections
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_issue_net:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/issue.net, run the command:
$ sudo chmod 0644 /etc/issue.net
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper permissions will ensure that only root user can modify the banner. |
OVAL test results detailsTesting mode of /etc/issue.net
oval:ssg-test_file_permissions_etc_issue_net_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_issue_net_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/issue.net | oval:ssg-exclude_symlinks__etc_issue_net:ste:1 | oval:ssg-state_file_permissions_etc_issue_net_0_mode_0644or_stricter_:ste:1 |
Verify permissions on Message of the Day Bannerxccdf_org.ssgproject.content_rule_file_permissions_etc_motd medium
Verify permissions on Message of the Day Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_motd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_motd:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/motd, run the command:
$ sudo chmod 0644 /etc/motd
|
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
Proper permissions will ensure that only root user can modify the banner. |
OVAL test results detailsTesting mode of /etc/motd
oval:ssg-test_file_permissions_etc_motd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_motd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/motd | oval:ssg-exclude_symlinks__etc_motd:ste:1 | oval:ssg-state_file_permissions_etc_motd_0_mode_0644or_stricter_:ste:1 |
Verify pam_pwhistory module is activatedxccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enabled medium
Verify pam_pwhistory module is activated
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_pwhistory_enabled:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The pam_pwhistory.so module is part of the Pluggable Authentication Modules (PAM)
framework designed to increase password security. It works by storing a history of previously
used passwords for each user, ensuring users cannot alternate between the same passwords too frequently.
This module is incompatible with Kerberos. Furthermore, its usage with NIS or LDAP is
generally impractical, as other machines can not access local password histories. |
| Rationale | Enforcing strong passwords increases the difficulty and resources required
for password compromise. |
OVAL test results detailsCheck pam_pwhistory.so presence in /etc/pam.d/common-password
oval:ssg-test_accounts_password_pam_pwhistory_remember_common_password:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok |
Limit Password Reusexccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enforce_root medium
Limit Password Reuse
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enforce_root |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_pwhistory_enforce_root:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Do not allow root to reuse recent passwords. This can be
accomplished by using the enforce_for_root option for the
pam_pwhistory PAM modules.
In the file /etc/pam.d/common-password, make sure the parameters
enforce_for_root is present. |
| Rationale | Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user. |
OVAL test results detailsCheck pam_pwhistory.so presence in PAM file
oval:ssg-test_accounts_password_pam_pwhistory_enforce_root_enabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok |
Test if enforce_for_root attribute of pam_pwhistory.so is set correctly in /etc/pam.d/common-password
oval:ssg-test_accounts_password_pam_pwhistory_enforce_for_root_parameter:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok |
Limit Password Reusexccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember medium
Limit Password Reuse
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_pwhistory_remember:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Do not allow users to reuse recent passwords. This can be
accomplished by using the remember option for the
pam_pwhistory PAM modules.
In the file /etc/pam.d/common-password, make sure the parameters
remember and use_authtok are present, and that the value
for the remember parameter is 24 or greater. For example:
password requisite pam_pwhistory.so ...existing_options... remember=24 use_authtok
The profile requirement is 24 passwords. |
| Rationale | Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user. |
OVAL test results detailsVerify remember configuation of pam_pwhistory.so
oval:ssg-test_pam_password_pam_pwhistory_remember:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok |
Verify use_authtok configuation of pam_pwhistory.so
oval:ssg-test_pam_password_pam_pwhistory_use_authtok:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok
password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
|
Enforce Password History with use_authtokxccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok medium
Enforce Password History with use_authtok
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_pwhistory_use_authtok:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The use_authtok option ensures the pam_pwhistory module uses the new
password provided by a previously stacked PAM module during password
changes, rather than prompting the user again. |
| Rationale | The use_authtok option allows multiple PAM modules to validate the new
password before it is accepted, ensuring it meets all security requirements
without requiring the user to re-enter it multiple times. |
OVAL test results detailsAt least one pwhistory line exists
oval:ssg-accounts_password_pam_pwhistory_use_authtok_test_pwhistory_exists_common-password:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok |
use_authtok is configured in pam pwhistory in common_password file
oval:ssg-accounts_password_pam_pwhistory_use_authtok_test_password_pam_pwhistory_use_authtok_common-password:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/pam.d/common-password | password requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok |
Require use_authtok for pam_unix.soxccdf_org.ssgproject.content_rule_accounts_password_pam_unix_authtok medium
Require use_authtok for pam_unix.so
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_authtok |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_unix_authtok:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | When password changing enforce the module to set the new password to the one
provided by a previously stacked password module |
| Rationale | Require use_authtok in pam_unix.so configuration |
OVAL test results detailsAt least one pam_unix line exists
oval:ssg-test_accounts_password_pam_unix_authtok_pam_unix_exists_common-password:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt |
use_authtok is configured in pam unix in /etc/pam.d/common-password file, ignoring first line on stack
oval:ssg-test_accounts_password_pam_unix_authtok_prm_exists_not_initial_common-password:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/pam.d/common-password | password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt |
Lock Accounts After Failed Password Attemptsxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny medium
Lock Accounts After Failed Password Attempts
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_deny:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cjis | 5.5.3 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.8 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | CM-6(a), AC-7(a) | | nist-csf | PR.AC-7 | | ospp | FIA_AFL.1 | | pcidss | Req-8.1.6 | | os-srg | SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005 | | anssi | R31 | | cis | 5.3.3.1.1 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 8.3.4, 8.3 |
|
| Description | This rule configures the system to lock out accounts after a number of incorrect login attempts
using pam_faillock.so.
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected.
Ensure that the file /etc/security/faillock.conf contains the following entry:
deny = <count>
Where count should be less than or equal to
4 and greater than 0. |
| Rationale | By limiting the number of failed logon attempts, the risk of unauthorized system access via
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
the account. |
| Warnings | warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the /etc/security/faillock.conf file, the pam_faillock
parameters should be defined in faillock.conf file. |
OVAL test results detailsno more that one pam_unix.so is expected in auth section of common-auth
oval:ssg-test_accounts_passwords_pam_faillock_deny_common_pam_unix_auth:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_common_pam_unix_auth:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^\s*auth\N+pam_unix\.so | /etc/pam.d/common-auth | 1 |
One and only one occurrence is expected in auth section of common-auth
oval:ssg-test_accounts_passwords_pam_faillock_deny_common_pam_faillock_auth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-auth |
auth required pam_faillock.so preauth
# here are the per-package modules (the "Primary" block)
auth [success=1 default=ignore] pam_unix.so
auth [default=die] pam_faillock.so authfail
auth sufficient pam_faillock.so authsucc |
One and only one occurrence is expected in common-account
oval:ssg-test_accounts_passwords_pam_faillock_deny_common_pam_faillock_account:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-account | account required pam_faillock.so
|
Check the expected deny value in common-auth
oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_common:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_common:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| 4 | | ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+) |
| /etc/pam.d/common-auth | 1 |
Check the absence of deny parameter in /etc/security/faillock.conf
oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/security/faillock.conf | deny = 4 |
Check the absence of deny parameter in common-auth
oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_common:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_common:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+) | /etc/pam.d/common-auth | 1 |
Check the expected deny value in /etc/security/faillock.conf
oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/faillock.conf | deny = 4 |
Ensure pam_faillock module is enabledxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enabled medium
Ensure pam_faillock module is enabled
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_enabled:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The pam_faillock.so module maintains a list of failed authentication attempts per
user during a specified interval and locks the account in case there were more than the
configured number of consecutive failed authentications (this is defined by the deny
parameter in the faillock configuration). It stores the failure records into per-user files in
the tally directory. |
| Rationale | Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute
force password attacks against your systems. |
OVAL test results detailsno more that one pam_unix.so is expected in auth section of common-auth
oval:ssg-test_accounts_passwords_pam_faillock_common_pam_unix_auth:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_common_pam_unix_auth:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^\s*auth\N+pam_unix\.so | /etc/pam.d/common-auth | 1 |
One and only one occurrence is expected in auth section of common-auth
oval:ssg-test_accounts_passwords_pam_faillock_common_pam_faillock_auth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-auth |
auth required pam_faillock.so preauth
# here are the per-package modules (the "Primary" block)
auth [success=1 default=ignore] pam_unix.so
auth [default=die] pam_faillock.so authfail
auth sufficient pam_faillock.so authsucc |
One and only one occurrence is expected in common-account
oval:ssg-test_accounts_passwords_pam_faillock_common_pam_faillock_account:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-account | account required pam_faillock.so
|
Set Lockout Time for Failed Password Attemptsxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time medium
Set Lockout Time for Failed Password Attempts
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cjis | 5.5.3 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.8 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | CM-6(a), AC-7(b) | | nist-csf | PR.AC-7 | | ospp | FIA_AFL.1 | | pcidss | Req-8.1.7 | | os-srg | SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005 | | anssi | R31 | | cis | 5.3.3.1.2 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 8.3.4, 8.3 |
|
| Description | This rule configures the system to lock out accounts during a specified time period after a
number of incorrect login attempts using pam_faillock.so.
Ensure that the file /etc/security/faillock.conf contains the following entry:
unlock_time=<interval-in-seconds> where
interval-in-seconds is 900 or greater.
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid any errors when manually editing these files,
it is recommended to use the appropriate tools, such as authselect or authconfig,
depending on the OS version.
If unlock_time is set to 0, manual intervention by an administrator is required
to unlock a user. This should be done using the faillock tool. |
| Rationale | By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account. |
| Warnings | warning
If the system supports the new /etc/security/faillock.conf file but the
pam_faillock.so parameters are defined directly in /etc/pam.d/system-auth and
/etc/pam.d/password-auth, the remediation will migrate the unlock_time parameter
to /etc/security/faillock.conf to ensure compatibility with authselect tool.
The parameters deny and fail_interval, if used, also have to be migrated
by their respective remediation. warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the /etc/security/faillock.conf file, the pam_faillock
parameters should be defined in faillock.conf file. |
OVAL test results detailsno more that one pam_unix.so is expected in auth section of common-auth
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_common_pam_unix_auth:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_common_pam_unix_auth:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^\s*auth\N+pam_unix\.so | /etc/pam.d/common-auth | 1 |
One and only one occurrence is expected in auth section of common-auth
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_common_pam_faillock_auth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-auth |
auth required pam_faillock.so preauth
# here are the per-package modules (the "Primary" block)
auth [success=1 default=ignore] pam_unix.so
auth [default=die] pam_faillock.so authfail
auth sufficient pam_faillock.so authsucc |
One and only one occurrence is expected in common-account
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_common_pam_faillock_account:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-account | account required pam_faillock.so
|
Check the expected unlock_time value in common-auth
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_common:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_common:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| 900 | | ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) |
| /etc/pam.d/common-auth | 1 |
Check the absence of unlock_time parameter in /etc/security/faillock.conf
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/security/faillock.conf | unlock_time = 900 |
Check the absence of unlock_time parameter in common-auth
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_common:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_common:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) | /etc/pam.d/common-auth | 1 |
Check the expected unlock_time value in /etc/security/faillock.conf
oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/faillock.conf | unlock_time = 900 |
Ensure PAM Enforces Password Requirements - Minimum Digit Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit medium
Ensure PAM Enforces Password Requirements - Minimum Digit Characters
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_dcredit:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | ospp | FMT_SMF_EXT.1 | | pcidss | Req-8.2.3 | | os-srg | SRG-OS-000071-GPOS-00039 | | anssi | R31 | | cis | 5.3.3.2.3 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 8.3.6, 8.3 |
|
| Description | The pam_pwquality module's dcredit parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each digit. Modify the dcredit setting in
/etc/security/pwquality.conf to require the use of a digit in passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_dcredit:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | dcredit = -1
|
Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Wordsxccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck medium
Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_dictcheck:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | os-srg | SRG-OS-000480-GPOS-00225, SRG-OS-000072-GPOS-00040 | | cis | 5.3.3.2.6 |
|
| Description | The pam_pwquality module's dictcheck check if passwords contains dictionary words. When
dictcheck is set to 1 passwords will be checked for dictionary words. |
| Rationale | Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
Passwords with dictionary words may be more vulnerable to password-guessing attacks. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_dictcheck:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | dictcheck = 1
|
Ensure PAM Enforces Password Requirements - Minimum Different Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_difok medium
Ensure PAM Enforces Password Requirements - Minimum Different Characters
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_difok |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_difok:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.6.2.1.1 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(b), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | os-srg | SRG-OS-000072-GPOS-00040 | | cis | 5.3.3.2.1 |
|
| Description | The pam_pwquality module's difok parameter sets the number of characters
in a password that must not be present in and old password during a password change.
Modify the difok setting in /etc/security/pwquality.conf
to equal 2 to require differing characters
when changing passwords. |
| Rationale | Use of a complex password helps to increase the time and resources
required to compromise the password. Password complexity, or strength,
is a measure of the effectiveness of a password in resisting attempts
at guessing and brute–force attacks.
Password complexity is one factor of several that determines how long
it takes to crack a password. The more complex the password, the
greater the number of possible combinations that need to be tested
before the password is compromised.
Requiring a minimum number of different characters during password changes ensures that
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_difok:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | difok = 2
|
Ensure PAM Enforces Password Requirements - Enforce for root Userxccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root medium
Ensure PAM Enforces Password Requirements - Enforce for root User
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_enforce_root:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | os-srg | SRG-OS-000072-GPOS-00040, SRG-OS-000071-GPOS-00039, SRG-OS-000070-GPOS-00038, SRG-OS-000266-GPOS-00101, SRG-OS-000078-GPOS-00046, SRG-OS-000480-GPOS-00225, SRG-OS-000069-GPOS-00037 | | cis | 5.3.3.2.8 |
|
| Description | The pam_pwquality module's enforce_for_root parameter controls requirements for
enforcing password complexity for the root user. Enable the enforce_for_root
setting in /etc/security/pwquality.conf to require the root user
to use complex passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required to compromise
the password. Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a
password. The more complex the password, the greater the number of possible combinations
that need to be tested before the password is compromised. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of /etc/security/pwquality.conf
oval:ssg-test_password_pam_pwquality_enforce_for_root:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/security/pwquality.conf | enforce_for_root |
Ensure PAM Enforces Password Requirements - Enforcingxccdf_org.ssgproject.content_rule_accounts_password_pam_enforcing medium
Ensure PAM Enforces Password Requirements - Enforcing
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_enforcing |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_enforcing:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Verify that the operating system uses "pwquality" to enforce the
password complexity rules.
Verify the pwquality module is being enforced by operating system by
running the following command:
$ grep -i enforcing /etc/security/pwquality.conf
enforcing = 1
If the value of "enforcing" is not "1" or the line is commented out,
this is a finding. |
| Rationale | Use of a complex password helps to increase the time and resources
required to compromise the password. Password complexity, or strength,
is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks. Using enforcing=1 ensures "pwquality"
enforces complex password construction configuration and has the ability
to limit brute-force attacks on the system. |
OVAL test results detailstests the presence of 'enforcing = 1' setting in the /etc/security/pwquality.conf file
oval:ssg-test_accounts_password_pam_enforcing:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/security/pwquality.conf | enforcing = 1 |
Ensure PAM Enforces Password Requirements - Minimum Lowercase Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit medium
Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_lcredit:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | ospp | FMT_SMF_EXT.1 | | pcidss | Req-8.2.3 | | os-srg | SRG-OS-000070-GPOS-00038 | | anssi | R31 | | cis | 5.3.3.2.3 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 8.3.6, 8.3 |
|
| Description | The pam_pwquality module's lcredit parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each lowercase character. Modify the lcredit setting in
/etc/security/pwquality.conf to require the use of a lowercase character in passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_lcredit:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | lcredit = -1
|
Set Password Maximum Consecutive Repeating Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat medium
Set Password Maximum Consecutive Repeating Characters
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_maxrepeat:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | os-srg | SRG-OS-000072-GPOS-00040 | | cis | 5.3.3.2.4 |
|
| Description | The pam_pwquality module's maxrepeat parameter controls requirements for
consecutive repeating characters. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters. Modify the maxrepeat setting
in /etc/security/pwquality.conf to equal 3 to prevent a
run of ( 3 + 1) or more identical characters. |
| Rationale | Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | maxrepeat = 3
|
Limit the maximum number of sequential characters in passwordsxccdf_org.ssgproject.content_rule_accounts_password_pam_maxsequence medium
Limit the maximum number of sequential characters in passwords
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_maxsequence |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_maxsequence:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The pwquality maxsequence setting defines the maximum allowable length for consecutive
character sequences in a new password. Such sequences can be, e.g., 123 or abc. If the value is
set to 0, this check will be turned off.
Note: Passwords that consist mainly of such sequences are unlikely to meet the simplicity criteria
unless the sequence constitutes only a small portion of the overall password. |
| Rationale | Use of a strong password helps to increase the time and resources required to
compromise the password. Password complexity, or strength, is a measure of the
effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one important factor that determines the duration required to crack it.
A more intricate password results in a larger number of potential combinations that must be
tested before successfully compromising the password. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_maxsequence:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | maxsequence = 3
|
Ensure PAM Enforces Password Requirements - Minimum Different Categoriesxccdf_org.ssgproject.content_rule_accounts_password_pam_minclass medium
Ensure PAM Enforces Password Requirements - Minimum Different Categories
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_minclass:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | os-srg | SRG-OS-000072-GPOS-00040 | | anssi | R68 | | cis | 5.3.3.2.3 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 |
|
| Description | The pam_pwquality module's minclass parameter controls
requirements for usage of different character classes, or types, of character
that must exist in a password before it is considered valid. For example,
setting this value to three (3) requires that any password must have characters
from at least three different categories in order to be approved. The default
value is zero (0), meaning there are no required classes. There are four
categories available:
* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)
Modify the minclass setting in /etc/security/pwquality.conf entry
to require 4
differing categories of characters when changing passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.
Requiring a minimum number of character categories makes password guessing attacks more difficult
by ensuring a larger search space. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_minclass:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | minclass = 4
|
Ensure PAM Enforces Password Requirements - Minimum Lengthxccdf_org.ssgproject.content_rule_accounts_password_pam_minlen medium
Ensure PAM Enforces Password Requirements - Minimum Length
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_minlen:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.6.2.1.1 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | ospp | FMT_SMF_EXT.1 | | pcidss | Req-8.2.3 | | os-srg | SRG-OS-000078-GPOS-00046 | | anssi | R31, R68 | | cis | 5.3.3.2.2 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 8.3.6, 8.3 |
|
| Description | The pam_pwquality module's minlen parameter controls requirements for
minimum characters required in a password. Add minlen=14
after pam_pwquality to set minimum password length requirements. |
| Rationale | The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength
and how long it takes to crack a password. Use of more characters in a password
helps to exponentially increase the time and/or resources required to
compromise the password. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_minlen:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | minlen = 14
|
Ensure PAM Enforces Password Requirements - Minimum Special Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit medium
Ensure PAM Enforces Password Requirements - Minimum Special Characters
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_ocredit:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000266-GPOS-00101 | | anssi | R31 | | cis | 5.3.3.2.3 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 |
|
| Description | The pam_pwquality module's ocredit= parameter controls requirements for
usage of special (or "other") characters in a password. When set to a negative number,
any password will be required to contain that many special characters.
When set to a positive number, pam_pwquality will grant +1
additional length credit for each special character. Modify the ocredit setting
in /etc/security/pwquality.conf to equal -1
to require use of a special character in passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring a minimum number of special characters makes password guessing attacks
more difficult by ensuring a larger search space. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_ocredit:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | ocredit = -1
|
Verify pam_pwquality module is activatedxccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_enabled medium
Verify pam_pwquality module is activated
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_enabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The pam_pwquality.so module ensures password quality by evaluating user-created passwords
against a system dictionary and a set of rules designed to detect weak choices. Originally derived
from the pam_cracklib module, this module is backward-compatible with options of pam_cracklib.
The module's process includes prompting the user for a password, checking its strength, and if it
meets the criteria requesting the password again for confirmation. If both entries match, the
password is passed to subsequent modules to be set as the new authentication token. |
| Rationale | Strong passwords significantly increase the time and effort required for unauthorized access,
increasing overall system security. |
Evaluation messagesinfo
No candidate or applicable check found. |
Ensure PAM Enforces Password Requirements - Minimum Uppercase Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit medium
Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_ucredit:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | ospp | FMT_SMF_EXT.1 | | pcidss | Req-8.2.3 | | os-srg | SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038 | | anssi | R31 | | cis | 5.3.3.2.3 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 |
|
| Description | The pam_pwquality module's ucredit= parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each uppercase character. Modify the ucredit setting in
/etc/security/pwquality.conf to require the use of an uppercase character in passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised. |
OVAL test results detailscheck the configuration of /etc/pam.d/system-auth
oval:ssg-test_password_pam_pwquality:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password requisite pam_pwquality.so retry=3 |
check the configuration of ^/etc/security/pwquality.conf$
oval:ssg-test_password_pam_pwquality_ucredit:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/pwquality.conf | ucredit = -1
|
Set Password Hashing Algorithm in /etc/login.defsxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs medium
Set Password Hashing Algorithm in /etc/login.defs
| Rule ID | xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-set_password_hashing_algorithm_logindefs:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.6.2.2 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.13.11 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(c), CM-6(a) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | pcidss | Req-8.2.1 | | os-srg | SRG-OS-000073-GPOS-00041 | | cis | 5.4.1.4 | | ism | 0418, 1055, 1402 | | pcidss4 | 8.3.2, 8.3 |
|
| Description | In /etc/login.defs, add or update the following line to ensure the system will use
YESCRYPT|SHA512 as the hashing algorithm:
ENCRYPT_METHOD YESCRYPT|SHA512
|
| Rationale | Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
Using a stronger hashing algorithm makes password cracking attacks more difficult. |
OVAL test results detailsThe value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs
oval:ssg-test_password_hashing_algorithm_logindefs:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-local_variable_test_password_hashing_algorithm_logindefs:var:1 | YESCRYPT |
Set PAM Password Hashing Algorithm - system-authxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth medium
Set PAM Password Hashing Algorithm - system-auth
| Rule ID | xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-set_password_hashing_algorithm_systemauth:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.6.2.2 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.13.11 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(c), IA-5(1)(c), CM-6(a) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | pcidss | Req-8.2.1 | | os-srg | SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061 | | anssi | R68 | | cis | 5.3.3.4.3 | | ism | 0418, 1055, 1402 | | pcidss4 | 8.3.2, 8.3 |
|
| Description | The PAM system service can be configured to only store encrypted representations of passwords.
In "/etc/pam.d/common-password", the password section of the file controls which
PAM modules to execute during a password change.
Set the pam_unix.so module in the password section to include the option
yescrypt|sha512 and no other hashing
algorithms as shown below:
password [success=1 default=ignore] pam_unix.so yescrypt|sha512
other arguments...
This will help ensure that new passwords for local users will be stored using the
yescrypt|sha512 algorithm. |
| Rationale | Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
This setting ensures user and group account administration utilities are configured to store
only encrypted representations of passwords. Additionally, the crypt_style
configuration option in /etc/libuser.conf ensures the use of a strong hashing
algorithm that makes password cracking attacks more difficult. |
| Warnings | warning
The hashing algorithms to be used with pam_unix.so are defined with independent module
options. There are at least 7 possible algorithms and likely more algorithms will be
introduced along the time. Due the the number of options and its possible combinations,
the use of multiple hashing algorithm options may bring unexpected behaviors to the
system. For this reason the check will pass only when one hashing algorithm option is
defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The
remediation will ensure the correct option and remove any other extra hashing algorithm
option. |
OVAL test results detailscheck if pam_unix.so hashing algorithm option is correct and specified only once in /etc/pam.d/common-password
oval:ssg-test_pam_unix_hashing_algorithm_systemauth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/pam.d/common-password | password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt |
Install pam-modules Packagexccdf_org.ssgproject.content_rule_package_pam_modules_installed medium
Install pam-modules Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_pam_modules_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_pam_modules_installed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The libpam-modules package can be installed with the following command:
$ apt-get install libpam-modules
|
| Rationale | libpam-modules contains PAM modules that are needed
by other rules when configuring PAM options. |
OVAL test results detailspackage libpam-modules is installed
oval:ssg-test_package_libpam-modules_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | libpam-modules | arm64 | 0 | 5 | 1.7.0 | 1.7.0-5 |
Install pam_pwquality Packagexccdf_org.ssgproject.content_rule_package_pam_pwquality_installed medium
Install pam_pwquality Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_pam_pwquality_installed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description |
The libpam-pwquality package can be installed with the following command:
$ apt-get install libpam-pwquality
|
| Rationale | Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure
of the effectiveness of a password in resisting attempts at guessing and
brute-force attacks. "pwquality" enforces complex password construction
configuration and has the ability to limit brute-force attacks on the system. |
OVAL test results detailspackage libpam-pwquality is installed
oval:ssg-test_package_libpam-pwquality_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | libpam-pwquality | arm64 | 0 | 5 | 1.4.5 | 1.4.5-5 |
Install pam-runtime Packagexccdf_org.ssgproject.content_rule_package_pam_runtime_installed medium
Install pam-runtime Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_pam_runtime_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_pam_runtime_installed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The libpam-runtime package can be installed with the following command:
$ apt-get install libpam-runtime
|
| Rationale | libpam-runtime contains configuration that is needed
by other rules when configuring PAM options. |
OVAL test results detailspackage libpam-runtime is installed
oval:ssg-test_package_libpam-runtime_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | libpam-runtime | all | 0 | 5 | 1.7.0 | 1.7.0-5 |
Verify pam_unix module is activatedxccdf_org.ssgproject.content_rule_accounts_password_pam_unix_enabled medium
Verify pam_unix module is activated
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_unix_enabled:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | pam_unix is the standard Unix authentication module. It uses standard calls from the
system's libraries to retrieve and set account information as well as authentication.
Usually this is obtained from the /etc/passwd and if shadow is enabled, the
/etc/shadow file as well.
The account component performs the task of establishing the status of the user's
account and password based on the following shadow elements: expire,
last_change, max_change, min_change, warn_change. In the case of the latter, it may
offer advice to the user on changing their password or, through the
PAM_AUTHTOKEN_REQD return, delay giving service to the user until they have
established a new password. The entries listed above are documented in the shadow(5)
manual page. Should the user's record not contain one or more of these entries, the
corresponding shadow check is not performed.
The authentication component performs the task of checking the users credentials
(password). The default action of this module is to not permit the user access to a
service if their official password is blank.
|
| Rationale | The system should only provide access after performing authentication of a user. |
OVAL test results detailsNo more than one pam_unix.so is expected in auth section of /etc/pam.d/common-auth
oval:ssg-test_pam_unix_common_auth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-auth | auth [success=1 default=ignore] pam_unix.so |
No more than one pam_unix.so is expected in account section of /etc/pam.d/common-account
oval:ssg-test_pam_unix_common_account:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-account | account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so |
No more than one pam_unix.so is expected in password section of /etc/pam.d/common-password
oval:ssg-test_pam_unix_common_password:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-password | password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt |
No more than one pam_unix.so is expected in session section of /etc/pam.d/common-session
oval:ssg-test_pam_unix_common_session:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/common-session | session required pam_unix.so |
Set Account Expiration Following Inactivityxccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration medium
Set Account Expiration Following Inactivity
| Rule ID | xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-account_disable_post_pw_expiration:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8 | | cjis | 5.6.2.1.1 | | cobit5 | DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.5.6 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2 | | iso27001-2013 | A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3 | | nist | IA-4(e), AC-2(3), CM-6(a) | | nist-csf | DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7 | | pcidss | Req-8.1.4 | | os-srg | SRG-OS-000118-GPOS-00060 | | cis | 5.4.1.5 | | pcidss4 | 8.2.6, 8.2 |
|
| Description | To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in /etc/default/useradd:
INACTIVE=45
If a password is currently on the verge of expiration, then
45
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus 45 day(s) could
elapse until the account would be automatically disabled. See the
useradd man page for more information. |
| Rationale | Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system.
Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.
Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. |
OVAL test results detailsthe value INACTIVE parameter should be set appropriately in /etc/default/useradd
oval:ssg-test_etc_default_useradd_inactive:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/default/useradd |
INACTIVE=45
|
Ensure All Accounts on the System Have Unique Namesxccdf_org.ssgproject.content_rule_account_unique_name medium
Ensure All Accounts on the System Have Unique Names
| Rule ID | xccdf_org.ssgproject.content_rule_account_unique_name |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-account_unique_name:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Ensure accounts on the system have unique names.
To ensure all accounts have unique names, run the following command:
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
If a username is returned, change or delete the username. |
| Rationale | Unique usernames allow for accountability on the system. |
OVAL test results detailsThere should not exist duplicate user name entries in /etc/passwd
oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1 | 33 |
Ensure shadow Group is Emptyxccdf_org.ssgproject.content_rule_ensure_shadow_group_empty medium
Ensure shadow Group is Empty
| Rule ID | xccdf_org.ssgproject.content_rule_ensure_shadow_group_empty |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ensure_shadow_group_empty:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The shadow group allows system programs which require access the ability
to read the /etc/shadow file. No users should be assigned to the shadow group. |
| Rationale | Any users assigned to the shadow group would be granted read access to the
/etc/shadow file. If attackers can gain read access to the /etc/shadow file,
they can easily run a password cracking program against the hashed passwords
to break them. Other security information that is stored in the /etc/shadow
file (such as expiration) could also be useful to subvert additional user
accounts. |
| Warnings | warning
This rule remediation will ensure the group membership is empty in /etc/group. To avoid any
disruption the remediation won't change the primary group of users in /etc/passwd if any
user has the shadow GID as primary group. |
OVAL test results detailsshadow group is empty
oval:ssg-tst_shadow_group_empty:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/group | shadow:x:42: |
no user is assigned to the shadow group
oval:ssg-tst_no_user_assigned_shadow_group:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_etc_passwd_user_has_shadow_group:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^.*:.*:.*:42:.*:.*:.*$ | /etc/passwd | 1 |
Set Password Maximum Agexccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs medium
Set Password Maximum Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_maximum_age_login_defs:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.6.2.1 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.5.6 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(f), IA-5(1)(d), CM-6(a) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | pcidss | Req-8.2.4 | | os-srg | SRG-OS-000076-GPOS-00044 | | cis | 5.4.1.1 | | ism | 0418, 1055, 1402 | | pcidss4 | 8.3.9, 8.3 |
|
| Description | To specify password maximum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line:
PASS_MAX_DAYS 365
The profile requirement is 365. |
| Rationale | Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise. |
OVAL test results detailsThe value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs
oval:ssg-test_pass_max_days:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-local_variable_test_pass_max_days:var:1 | 365 |
Set Existing Passwords Maximum Agexccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing medium
Set Existing Passwords Maximum Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_set_max_life_existing:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Configure non-compliant accounts to enforce a 365-day maximum password lifetime
restriction by running the following command:
$ sudo chage -M 365
USER
|
| Rationale | Any password, no matter how complex, can eventually be cracked. Therefore,
passwords need to be changed periodically. If the operating system does
not limit the lifetime of passwords and force users to change their
passwords, there is the risk that the operating system passwords could be
compromised. |
OVAL test results detailsCompares a specific field in /etc/shadow with a specific variable value
oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/shadow | ^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){2}(\d+):(?:[^:]*:){3}(?:[^:]*)$ | 1 |
Compares a specific field in /etc/shadow with a specific variable value
oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/shadow | ^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){2}(\d+):(?:[^:]*:){3}(?:[^:]*)$ | 1 |
Passwords must have the maximum password age set non-empty in /etc/shadow.
oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_not_empty:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_set_max_life_existing_shadow_password_users_max_life_not_existing:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/shadow | ^(?:[^:]*:)(?:[^\!\*:]+:)(?:[^:]*:){2}():(?:[^:]*:){3}(?:[^:]*)$ | 1 |
Set Password Warning Agexccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs medium
Set Password Warning Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_warn_age_login_defs:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8 | | cobit5 | DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.5.8 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2 | | iso27001-2013 | A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nist | IA-5(f), IA-5(1)(d), CM-6(a) | | nist-csf | DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7 | | pcidss | Req-8.2.4 | | cis | 5.4.1.3 | | ism | 0418, 1055, 1402 | | pcidss4 | 8.3.9, 8.3 |
|
| Description | To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file /etc/login.defs and add or correct
the following line:
PASS_WARN_AGE 7
The profile requirement is 7. |
| Rationale | Setting the password warning age enables users to
make the change at a practical time. |
OVAL test results detailsThe value of PASS_WARN_AGE should be set appropriately in /etc/login.defs
oval:ssg-test_pass_warn_age:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-local_variable_test_pass_warn_age:var:1 | 7 |
Set existing passwords a period of inactivity before they been lockedxccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing medium
Set existing passwords a period of inactivity before they been locked
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_set_post_pw_existing:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cobit5 | DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.5.6 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2 | | iso27001-2013 | A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3 | | nist | IA-4(e), AC-2(3), CM-6(a) | | nist-csf | DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7 | | pcidss | Req-8.1.4 | | os-srg | SRG-OS-000118-GPOS-00060 | | cis | 5.4.1.5 | | pcidss4 | 8.2.6, 8.2 |
|
| Description | Configure user accounts that have been inactive for over a given period of time
to be automatically disabled by running the following command:
$ sudo chage --inactive 30 USER
|
| Rationale | Inactive accounts pose a threat to system security since the users are not logging in to
notice failed login attempts or other anomalies. |
OVAL test results detailsCompares a specific field in /etc/shadow with a specific variable value
oval:ssg-test_accounts_set_post_pw_existing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_test_accounts_set_post_pw_existing:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/shadow | ^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){4}(\d+):(?:[^:]*:)(?:[^:]*)$ | 1 |
Check the inexistence of users with a password defined
oval:ssg-test_accounts_set_post_pw_existing_no_pass:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_set_post_pw_existing_no_pass:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/shadow | ^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){4}(\d+):(?:[^:]*:)(?:[^:]*)$ | 1 |
Verify All Account Password Hashes are Shadowedxccdf_org.ssgproject.content_rule_accounts_password_all_shadowed medium
Verify All Account Password Hashes are Shadowed
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_all_shadowed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.5.2 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.5.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | IA-5(h), CM-6(a) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | pcidss | Req-8.2.1 | | cis | 7.2.1 | | ism | 1402 | | pcidss4 | 8.3.2, 8.3 |
|
| Description | If any password hashes are stored in /etc/passwd (in the second field,
instead of an x or *), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely. |
| Rationale | The hashes for all user account passwords should be stored in
the file /etc/shadow and never in /etc/passwd,
which is readable by all users. |
OVAL test results detailspassword hashes are shadowed
oval:ssg-test_accounts_password_all_shadowed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Username | Password | User id | Group id | Gcos | Home dir | Login shell | Last login |
|---|
| true | daemon | | 1 | 1 | daemon | /usr/sbin | /sbin/nologin | -1 |
| true | root | | 0 | 0 | root | /root | /bin/bash | -1 |
| true | bin | | 2 | 2 | bin | /bin | /sbin/nologin | -1 |
| true | sys | | 3 | 3 | sys | /dev | /sbin/nologin | -1 |
| true | sync | | 4 | 65534 | sync | /bin | /sbin/nologin | -1 |
| true | games | | 5 | 60 | games | /usr/games | /sbin/nologin | -1 |
| true | man | | 6 | 12 | man | /var/cache/man | /sbin/nologin | -1 |
| true | lp | | 7 | 7 | lp | /var/spool/lpd | /sbin/nologin | -1 |
| true | mail | | 8 | 8 | mail | /var/mail | /sbin/nologin | -1 |
| true | news | | 9 | 9 | news | /var/spool/news | /sbin/nologin | -1 |
| true | uucp | | 10 | 10 | uucp | /var/spool/uucp | /sbin/nologin | -1 |
| true | proxy | | 13 | 13 | proxy | /bin | /sbin/nologin | -1 |
| true | www-data | | 33 | 33 | www-data | /var/www | /sbin/nologin | -1 |
| true | backup | | 34 | 34 | backup | /var/backups | /sbin/nologin | -1 |
| true | list | | 38 | 38 | Mailing List Manager | /var/list | /sbin/nologin | -1 |
| true | irc | | 39 | 39 | ircd | /run/ircd | /sbin/nologin | -1 |
| true | _apt | | 42 | 65534 | | /nonexistent | /sbin/nologin | -1 |
| true | nobody | | 65534 | 65534 | nobody | /nonexistent | /usr/sbin/nologin | -1 |
| true | systemd-network | | 998 | 998 | systemd Network Management | / | /sbin/nologin | -1 |
| true | systemd-timesync | | 997 | 997 | systemd Time Synchronization | / | /sbin/nologin | -1 |
| true | dhcpcd | | 100 | 65534 | DHCP Client Daemon | /usr/lib/dhcpcd | /sbin/nologin | -1 |
| true | uuidd | | 101 | 101 | | /run/uuidd | /sbin/nologin | -1 |
| true | messagebus | | 996 | 996 | System Message Bus | /nonexistent | /sbin/nologin | -1 |
| true | tcpdump | | 102 | 102 | | /nonexistent | /sbin/nologin | -1 |
| true | systemd-resolve | | 990 | 990 | systemd Resolver | / | /sbin/nologin | -1 |
| true | sshd | | 989 | 65534 | sshd user | /run/sshd | /sbin/nologin | -1 |
| true | polkitd | | 988 | 988 | User for polkitd | / | /sbin/nologin | -1 |
| true | admin | | 1000 | 1000 | Debian | /home/admin | /bin/bash | -1 |
| true | _chrony | | 103 | 104 | Chrony daemon | /var/lib/chrony | /sbin/nologin | -1 |
| true | _aide | | 987 | 987 | Advanced Intrusion Detection Environment | /var/lib/aide | /sbin/nologin | -1 |
| true | systemd-journal-remote | | 986 | 986 | systemd Journal Remote | / | /usr/sbin/nologin | -1 |
| true | Debian-exim | | 104 | 105 | | /var/spool/exim4 | /usr/sbin/nologin | -1 |
| true | systemd-journal-upload | | 999 | 989 | | / | /usr/sbin/nologin | -1 |
Ensure all users last password change date is in the pastxccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past medium
Ensure all users last password change date is in the past
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_last_change_is_in_past:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | All users should have a password change date in the past. |
| Rationale | If a user recorded password change date is in the future then they could
bypass any set password expiration. |
| Warnings | warning
Automatic remediation is not available, in order to avoid any system disruption. |
OVAL test results detailsCheck if the password last chage time is less than or equal today.
oval:ssg-test_accounts_password_last_change_is_in_past:tst:1
unknown
Following items have been found on the system:
| Result of item-state comparison | Var ref |
|---|
| unknown | oval:ssg-var_accounts_password_last_change_is_in_past_time_diff:var:1 |
Check the inexistence of users with a password defined
oval:ssg-test_accounts_password_last_change_is_in_past_no_pass:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_last_change_is_in_past:obj:1 of type
shadow_object
| Username | Filter |
|---|
| .* | oval:ssg-state_accounts_password_all_chage_past_has_no_password:ste:1 |
Avoid using remember in pam_unix modulexccdf_org.ssgproject.content_rule_accounts_password_pam_unix_no_remember medium
Avoid using remember in pam_unix module
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_no_remember |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_unix_no_remember:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The remember option stores the last n passwords for each user in /etc/security/opasswd,
enforcing password history and preventing users from reusing the same passwords. However, this feature
relies on the MD5 password hash algorithm, which is less secure. Instead, the pam_pwhistory
module should be used. This module also stores the last n passwords in /etc/security/opasswd
and it uses the password hash algorithm configured in the pam_unix module, such as yescrypt or SHA512,
offering enhanced security.
On Debian-based systems, the remember option should be removed from the PAM configuration
in /etc/pam.d/common-* files. |
| Rationale | Removing the remember argument ensures the use of a stronger password hashing algorithm.
A more robust hash algorithm increases the difficulty for attackers to crack stored
passwords in /etc/security/opasswd, thereby improving system security and
protecting user credentials. |
| Warnings | warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report. |
OVAL test results detailsmake sure remember is not used in /etc/pam.d/common-auth
oval:ssg-test_pam_unix_no_remember:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_pam_unix_no_remember:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^/etc/pam.d/common-(password|auth|account|session|session-noninteractive)$ | ^\s*password\s+(?:(?:sufficient)|(?:required)|(?:\[.*\]))\s+pam_unix\.so[^#]+\bremember=\d+\b.*$ | 1 |
All GIDs referenced in /etc/passwd must be defined in /etc/groupxccdf_org.ssgproject.content_rule_gid_passwd_group_same low
All GIDs referenced in /etc/passwd must be defined in /etc/group
| Rule ID | xccdf_org.ssgproject.content_rule_gid_passwd_group_same |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-gid_passwd_group_same:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | low |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cjis | 5.5.2 | | cobit5 | DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1 | | iso27001-2013 | A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | IA-2, CM-6(a) | | nist-csf | PR.AC-1, PR.AC-6, PR.AC-7 | | pcidss | Req-8.5.a | | os-srg | SRG-OS-000104-GPOS-00051 | | cis | 7.2.3 | | pcidss4 | 8.2.2, 8.2 |
|
| Description | Add a group to the system for each GID referenced without a corresponding group. |
| Rationale | If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Group Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group. |
OVAL test results detailsVerify all GIDs referenced in /etc/passwd are defined in /etc/group
oval:ssg-test_gid_passwd_group_same:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/passwd | daemon:x:1:1: |
| true | /etc/passwd | root:x:0:0: |
| true | /etc/passwd | bin:x:2:2: |
| true | /etc/passwd | sys:x:3:3: |
| true | /etc/passwd | sync:x:4:65534: |
| true | /etc/passwd | games:x:5:60: |
| true | /etc/passwd | man:x:6:12: |
| true | /etc/passwd | lp:x:7:7: |
| true | /etc/passwd | mail:x:8:8: |
| true | /etc/passwd | news:x:9:9: |
| true | /etc/passwd | uucp:x:10:10: |
| true | /etc/passwd | proxy:x:13:13: |
| true | /etc/passwd | www-data:x:33:33: |
| true | /etc/passwd | backup:x:34:34: |
| true | /etc/passwd | list:x:38:38: |
| true | /etc/passwd | irc:x:39:39: |
| true | /etc/passwd | _apt:x:42:65534: |
| true | /etc/passwd | nobody:x:65534:65534: |
| true | /etc/passwd | systemd-network:x:998:998: |
| true | /etc/passwd | systemd-timesync:x:997:997: |
| true | /etc/passwd | dhcpcd:x:100:65534: |
| true | /etc/passwd | uuidd:x:101:101: |
| true | /etc/passwd | messagebus:x:996:996: |
| true | /etc/passwd | tcpdump:x:102:102: |
| true | /etc/passwd | systemd-resolve:x:990:990: |
| true | /etc/passwd | sshd:x:989:65534: |
| true | /etc/passwd | polkitd:x:988:988: |
| true | /etc/passwd | admin:x:1000:1000: |
| true | /etc/passwd | _chrony:x:103:104: |
| true | /etc/passwd | _aide:x:987:987: |
| true | /etc/passwd | systemd-journal-remote:x:986:986: |
| true | /etc/passwd | Debian-exim:x:104:105: |
| true | /etc/passwd | systemd-journal-upload:x:999:989: |
Ensure There Are No Accounts With Blank or Null Passwordsxccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow high
Ensure There Are No Accounts With Blank or Null Passwords
| Rule ID | xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_empty_passwords_etc_shadow:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | |
| Description | Check the "/etc/shadow" file for blank passwords with the
following command:
$ sudo awk -F: '!$2 {print $1}' /etc/shadow
If the command returns any results, this is a finding.
Configure all accounts on the system to have a password or lock
the account with the following commands:
Perform a password reset:
$ sudo passwd [username]
Lock an account:
$ sudo passwd -l [username]
|
| Rationale | If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments. |
| Warnings | warning
Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway. |
OVAL test results detailsmake sure there aren't blank or null passwords in /etc/shadow
oval:ssg-test_no_empty_passwords_etc_shadow:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/shadow | ^[^:]+::.*$ | 1 |
Prevent Login to Accounts With Empty Passwordxccdf_org.ssgproject.content_rule_no_empty_passwords_unix high
Prevent Login to Accounts With Empty Password
| Rule ID | xccdf_org.ssgproject.content_rule_no_empty_passwords_unix |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_empty_passwords_unix:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | |
| Description | If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the
nullok in
/etc/pam.d/common-{password,auth,account,session,session-noninteractive}
to prevent logins with empty passwords. |
| Rationale | If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments. |
OVAL test results detailsmake sure nullok is not used in /etc/pam.d/common-*
oval:ssg-test_no_empty_passwords_unix:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_no_empty_passwords_unix:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^/etc/pam.d/common-(password|auth|account|session|session-noninteractive)$ | ^[^#]*\bnullok\b.*$ | 1 |
Verify No .forward Files Existxccdf_org.ssgproject.content_rule_no_forward_files medium
Verify No .forward Files Exist
| Rule ID | xccdf_org.ssgproject.content_rule_no_forward_files |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_forward_files:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | The .forward file specifies an email address to forward the user's mail to. |
| Rationale | Use of the .forward file poses a security risk in that sensitive data may
be inadvertently transferred outside the organization. The .forward file
also poses a risk as it can be used to execute commands that may perform
unintended actions. |
OVAL test results details.forward files are not group or world accessible
oval:ssg-test_accounts_users_home_forward_file_existance:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_users_home_forward_file_existance:obj:1 of type
file_object
| Path | Filename |
|---|
| /home/admin | \.forward$ |
Verify No netrc Files Existxccdf_org.ssgproject.content_rule_no_netrc_files medium
Verify No netrc Files Exist
| Rule ID | xccdf_org.ssgproject.content_rule_no_netrc_files |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_netrc_files:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 14, 15, 16, 18, 3, 5 | | cobit5 | DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7 | | iso27001-2013 | A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R1.3, CIP-003-8 R3, CIP-003-8 R3.1, CIP-003-8 R3.2, CIP-003-8 R3.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | IA-5(h), IA-5(1)(c), CM-6(a), IA-5(7) | | nist-csf | PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3 | | cis | 7.2.10 |
|
| Description | The .netrc files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used. Any .netrc files should be removed. |
| Rationale | Unencrypted passwords for remote FTP servers may be stored in .netrc
files. |
OVAL test results detailslook for .netrc in /home
oval:ssg-test_no_netrc_files_home:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_netrc_files_home:obj:1 of type
file_object
| Behaviors | Path | Filename |
|---|
| no value | /home | ^\.netrc$ |
Verify Only Root Has UID 0xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero high
Verify Only Root Has UID 0
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_no_uid_except_zero:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10 | | cui | 3.1.1, 3.1.5 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | IA-2, AC-6(5), IA-4(b) | | nist-csf | PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5 | | pcidss | Req-8.5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 5.4.2.1 | | ism | 1546 | | pcidss4 | 8.2.1, 8.2 |
|
| Description | If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed, locked
or have their UID changed.
If the account is associated with system commands or applications the UID
should be changed to one greater than "0" but less than "1000."
Otherwise assign a UID greater than "1000" that has not already been
assigned. |
| Rationale | An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner. |
OVAL test results detailstest that there are no accounts with UID 0 except root in the /etc/passwd file
oval:ssg-test_accounts_no_uid_except_root:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_no_uid_except_root:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/passwd | ^(?!root:)([^:]+):[^:]+:0:.*$ | 1 |
Verify Root Has A Primary GID 0xccdf_org.ssgproject.content_rule_accounts_root_gid_zero high
Verify Root Has A Primary GID 0
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_root_gid_zero |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_root_gid_zero:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | |
| Description | The root user should have a primary group of 0. |
| Rationale | To help ensure that root-owned files are not inadvertently exposed to other users. |
OVAL test results detailstest that the root user has GID 0 in the /etc/passwd file
oval:ssg-test_accounts_root_gid_zero:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/passwd | root:x:0:0:root:/root:/bin/bash |
Ensure the Group Used by pam_wheel.so Module Exists on System and is Emptyxccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty medium
Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
| Rule ID | xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ensure_pam_wheel_group_empty:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Ensure that the group sugroup referenced by
var_pam_wheel_group_for_su variable and used as value for the pam_wheel.so
group option exists and has no members. This empty group used by
pam_wheel.so in /etc/pam.d/su ensures that no user can run commands with
altered privileges through the su command. |
| Rationale | The su program allows to run commands with a substitute user and group ID.
It is commonly used to run commands as the root user.
Limiting access to such command is considered a good security practice. |
| Warnings | warning
Note that this rule just ensures the group exists and has no members. This rule does not
configure pam_wheel.so module. The pam_wheel.so module configuration is
accomplished by use_pam_wheel_group_for_su rule. |
OVAL test results detailscheck if group in var_pam_wheel_group_for_su variable used by pam_wheel.so exists
oval:ssg-test_ensure_pam_wheel_group_empty_group_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/group | sugroup:x:1002: |
check if group defined by pam_wheel.so group option has no members
oval:ssg-test_ensure_pam_wheel_group_empty_has_no_members:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/group | sugroup:x:1002: |
Ensure root account access is controlledxccdf_org.ssgproject.content_rule_ensure_root_access_controlled medium
Ensure root account access is controlled
| Rule ID | xccdf_org.ssgproject.content_rule_ensure_root_access_controlled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ensure_root_access_controlled:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | There are a number of methods to access the root account directly.
Without a password set any user would be able to gain access and
thus control over the entire system. |
| Rationale | Access to root should be secured at all times. |
| Warnings | warning
This rule doesn't come with a remediation, as the exact requirement allows root to either have a password or be locked. |
OVAL test results detailsmake sure root password is set in /etc/shadow
oval:ssg-test_root_access_controlled_etc_shadow:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/shadow | root:!*:20752:0:99999:7::: |
Verify Only Group Root Has GID 0xccdf_org.ssgproject.content_rule_groups_no_zero_gid_except_root high
Verify Only Group Root Has GID 0
| Rule ID | xccdf_org.ssgproject.content_rule_groups_no_zero_gid_except_root |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-groups_no_zero_gid_except_root:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | |
| Description | If any group other than root has a GID of 0, this misconfiguration should
be investigated and the groups other than root should be removed or have
their GID changed. |
| Rationale | Ensuring that only the root group has a GID of 0 helps prevent
root group owned files from becoming accidentally accessible to
non-privileged users. |
| Warnings | warning
This rule doesn't come with a remediation. The removal of groups from a system
or reassigning the GID is considered too disruptive. |
OVAL test results detailsno groups with GID 0 except root in the /etc/group file
oval:ssg-test_groups_no_zero_gid_except_root:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_groups_no_zero_gid_except_root:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/group | ^(?!root:)[^:]*:[^:]*:0 | 1 |
Verify Non-Interactive Accounts Are Lockedxccdf_org.ssgproject.content_rule_no_invalid_shell_accounts_unlocked medium
Verify Non-Interactive Accounts Are Locked
| Rule ID | xccdf_org.ssgproject.content_rule_no_invalid_shell_accounts_unlocked |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_invalid_shell_accounts_unlocked:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Accounts meant for non-interactive purposes should be locked to prevent
unauthorized access. Accounts with non-standard shells (those not defined in
/etc/shells) should be locked using usermod -L. |
| Rationale | Locking non-interactive accounts improves security by preventing potential
misuse. While many systems configure these accounts with invalid strings,
setting the shell field to nologin is also suggested |
| Warnings | warning
Automatic remediation of this control is not recommended. Locking system accounts
could be highly disruptive. |
OVAL test results detailsVerify there is no account with invalid shell which is not locked exists
oval:ssg-test_no_invalid_shell_accounts_unlocked_no_invalid_shell_accounts:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_no_invalid_shell_accounts_unlocked_shells:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /bin/sh | | /usr/bin/sh | | /bin/bash | | /usr/bin/bash | | /bin/rbash | | /usr/bin/rbash | | /usr/bin/dash | | /usr/bin/screen | | root | | daemon | | bin | | sys | | sync | | games | | man | | lp | | mail | | news | | uucp | | proxy | | www-data | | backup | | list | | irc | | _apt | | nobody | | systemd-network | | systemd-timesync | | dhcpcd | | uuidd | | messagebus | | tcpdump | | systemd-resolve | | sshd | | polkitd | | admin | | _chrony | | _aide | | systemd-journal-remote | | Debian-exim | | systemd-journal-upload |
Referenced variable has no values (oval:ssg-variable_no_invalid_shell_accounts_unlocked_regex:var:1 | /etc/passwd | 1 |
Ensure that System Accounts Do Not Run a Shell Upon Loginxccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts medium
Ensure that System Accounts Do Not Run a Shell Upon Login
| Rule ID | xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_shelllogin_for_systemaccounts:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8 | | cobit5 | DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS06.03 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2 | | iso27001-2013 | A.12.4.1, A.12.4.3, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nist | AC-6, CM-6(a), CM-6(b), CM-6.1(iv) | | nist-csf | DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 5.4.2.7 | | ism | 1491 | | pcidss4 | 8.2.2, 8.2 |
|
| Description | Some accounts are not associated with a human user of the system, and exist to perform some
administrative functions. Should an attacker be able to log into these accounts, they should
not be granted access to a shell.
The login shell for each local account is stored in the last field of each line in
/etc/passwd. System accounts are those user accounts with a user ID less than
1000. The user ID is stored in the third field. If any system account
other than root has a login shell, disable it with the command:
$ sudo usermod -s /sbin/nologin account
|
| Rationale | Ensuring shells are not given to system accounts upon login makes it more difficult for
attackers to make use of system accounts. |
| Warnings | warning
Do not perform the steps in this section on the root account. Doing so might cause the
system to become inaccessible. |
OVAL test results detailsSYS_UID_MIN not defined in /etc/login.defs
oval:ssg-test_sys_uid_min_not_defined:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1 of type
textfilecontent54_object
| Behaviors | Filepath | Pattern | Instance |
|---|
| no value | /etc/login.defs | .*(?:^|\n)\s*(SYS_UID_MIN[\s]+[\d]+)\s*(?:$|\n) | 1 |
SYS_UID_MAX not defined in /etc/login.defs
oval:ssg-test_sys_uid_max_not_defined:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1 of type
textfilecontent54_object
| Behaviors | Filepath | Pattern | Instance |
|---|
| no value | /etc/login.defs | .*(?:^|\n)\s*(SYS_UID_MAX[\s]+[\d]+)\s*(?:$|\n) | 1 |
<0, UID_MIN - 1> system UIDs having shell set
oval:ssg-test_shell_defined_default_uid_range:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/passwd | admin:x:1000:1000:Debian:/home/admin:/bin/bash |
SYS_UID_MIN not defined in /etc/login.defs
oval:ssg-test_sys_uid_min_not_defined:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1 of type
textfilecontent54_object
| Behaviors | Filepath | Pattern | Instance |
|---|
| no value | /etc/login.defs | .*(?:^|\n)\s*(SYS_UID_MIN[\s]+[\d]+)\s*(?:$|\n) | 1 |
SYS_UID_MAX not defined in /etc/login.defs
oval:ssg-test_sys_uid_max_not_defined:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1 of type
textfilecontent54_object
| Behaviors | Filepath | Pattern | Instance |
|---|
| no value | /etc/login.defs | .*(?:^|\n)\s*(SYS_UID_MAX[\s]+[\d]+)\s*(?:$|\n) | 1 |
<0, SYS_UID_MIN> system UIDs having shell set
oval:ssg-test_shell_defined_reserved_uid_range:tst:1
error
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| error | /etc/passwd | admin:x:1000:1000:Debian:/home/admin:/bin/bash |
<SYS_UID_MIN, SYS_UID_MAX> system UIDS having shell set
oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1
error
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| error | /etc/passwd | admin:x:1000:1000:Debian:/home/admin:/bin/bash |
Enforce Usage of pam_wheel with Group Parameter for su Authenticationxccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su medium
Enforce Usage of pam_wheel with Group Parameter for su Authentication
| Rule ID | xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-use_pam_wheel_group_for_su:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | To ensure that only users who are members of the group set in the group option of
pam_wheel.so module can run commands with altered privileges through the su
command, make sure that the following line exists in the file /etc/pam.d/su:
auth required pam_wheel.so use_uid group=sugroup
|
| Rationale | The su program allows to run commands with a substitute user and group ID.
It is commonly used to run commands as the root user.
Limiting access to such command is considered a good security practice. |
| Warnings | warning
Note that ensure_pam_wheel_group_empty rule complements this requirement by
ensuring the referenced group exists and has no members. |
OVAL test results detailsVerify group configuation of pam_wheel.so
oval:ssg-test_pam_auth_pam_wheel_group:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/pam.d/su |
auth required pam_wheel.so group=sugroup use_uid |
Verify use_uid configuation of pam_wheel.so
oval:ssg-test_pam_auth_pam_wheel_use_uid:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/pam.d/su |
auth required pam_wheel.so group=sugroup use_uid
|
Ensure All Accounts on the System Have Unique User IDsxccdf_org.ssgproject.content_rule_account_unique_id medium
Ensure All Accounts on the System Have Unique User IDs
| Rule ID | xccdf_org.ssgproject.content_rule_account_unique_id |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-account_unique_id:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change user IDs (UIDs), or delete accounts, so each has a unique name. |
| Rationale | To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. |
| Warnings | warning
Automatic remediation of this control is not available due to unique requirements of each
system. |
OVAL test results detailsThere should not exist duplicate user ids in /etc/passwd
oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-variable_count_of_all_uids:var:1 | 33 |
Ensure All Groups on the System Have Unique Group IDxccdf_org.ssgproject.content_rule_group_unique_id medium
Ensure All Groups on the System Have Unique Group ID
| Rule ID | xccdf_org.ssgproject.content_rule_group_unique_id |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-group_unique_id:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change the group name or delete groups, so each has a unique id. |
| Rationale | To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system. |
| Warnings | warning
Automatic remediation of this control is not available due to the unique requirements of each system. |
OVAL test results detailsThere should not exist duplicate group ids in /etc/passwd
oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-variable_count_of_all_group_ids:var:1 | 61 |
Ensure All Groups on the System Have Unique Group Namesxccdf_org.ssgproject.content_rule_group_unique_name medium
Ensure All Groups on the System Have Unique Group Names
| Rule ID | xccdf_org.ssgproject.content_rule_group_unique_name |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-group_unique_name:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change the group name or delete groups, so each has a unique name. |
| Rationale | To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system. |
| Warnings | warning
Automatic remediation of this control is not available due to the unique requirements of each system. |
OVAL test results detailsThere should not exist duplicate group names in /etc/passwd
oval:ssg-test_etc_group_no_duplicate_group_names:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-variable_count_of_all_group_names:var:1 | 61 |
Ensure that Root's Path Does Not Include World or Group-Writable Directoriesxccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write medium
Ensure that Root's Path Does Not Include World or Group-Writable Directories
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_root_path_dirs_no_write:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4 | | nist | CM-6(a), CM-6(a) | | nist-csf | PR.IP-1 | | cis | 5.4.2.5 |
|
| Description | For each element in root's path, run:
# ls -ld DIR
and ensure that write permissions are disabled for group and
other. |
| Rationale | Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code. |
OVAL test results detailsCheck if there aren't directories in root's path having write permission set for group or other
oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /usr/local/sbin | | /usr/local/bin | | /usr/sbin | | /usr/bin | | /sbin | | /bin |
| no value | oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1 | oval:ssg-state_accounts_root_path_dirs_symlink:ste:1 |
Ensure that All Root's Path Directories Are Owned by Rootxccdf_org.ssgproject.content_rule_no_dirs_unowned_by_root medium
Ensure that All Root's Path Directories Are Owned by Root
| Rule ID | xccdf_org.ssgproject.content_rule_no_dirs_unowned_by_root |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_dirs_unowned_by_root:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | For each element in root's path, run:
# ls -ld DIR
and ensure that the directory is owned by the root user. |
| Rationale | Directories in root's path that are not owned by root could allow
unprivileged users to manipulate the execution environment of root,
potentially leading to privilege escalation or execution of malicious code. |
OVAL test results detailsCheck if there aren't directories in root's path not owned by root
oval:ssg-test_accounts_root_path_dirs_owned_by_root:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_root_path_dirs_not_owned_by_root:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /usr/local/sbin | | /usr/local/bin | | /usr/sbin | | /usr/bin | | /sbin | | /bin |
| no value | oval:ssg-state_accounts_root_path_dirs_not_owned_by_root:ste:1 | oval:ssg-state_accounts_root_path_dirs_symlink:ste:1 |
Ensure that All Entries in The Path of Root Are Directoriesxccdf_org.ssgproject.content_rule_root_path_all_dirs medium
Ensure that All Entries in The Path of Root Are Directories
| Rule ID | xccdf_org.ssgproject.content_rule_root_path_all_dirs |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-root_path_all_dirs:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | For each element in root's path, run:
# ls -ld DIR
and ensure that the entry is a directory. |
| Rationale | Locations in root's path that are not directories could cause unexpected behavior,
such as executing scripts from unintended locations. Ensuring that all locations in
root's path are directories helps maintain a secure environment for root. |
OVAL test results detailsCheck if all entries in root's path are directories
oval:ssg-test_accounts_root_path_dirs_are_directories:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_root_path_not_dirs:obj:1 of type
file_object
| Filepath | Filter |
|---|
| /usr/local/sbin | | /usr/local/bin | | /usr/sbin | | /usr/bin | | /sbin | | /bin |
| oval:ssg-state_accounts_root_path_dirs_symlink:ste:1 |
Check that all PATH directories exist by comparing counts
oval:ssg-test_accounts_root_path_dirs_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_accounts_root_path_existing_count:var:1 | 6 |
Ensure that Root's Path Does Not Include Relative Paths or Null Directoriesxccdf_org.ssgproject.content_rule_root_path_no_dot unknown
Ensure that Root's Path Does Not Include Relative Paths or Null Directories
| Rule ID | xccdf_org.ssgproject.content_rule_root_path_no_dot |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-root_path_no_dot:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4 | | nist | CM-6(a), CM-6(a) | | nist-csf | PR.IP-1 | | cis | 5.4.2.5 |
|
| Description | Ensure that none of the directories in root's path is equal to a single
. character, or
that it contains any instances that lead to relative path traversal, such as
.. or beginning a path without the slash ( /) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin
These empty elements have the same effect as a single . character. |
| Rationale | Including these entries increases the risk that root could
execute code from an untrusted location. |
OVAL test results detailsenvironment variable PATH starts with : or .
oval:ssg-test_env_var_begins:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Pid | Name | Value |
|---|
| false | 1987 | PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
environment variable PATH doesn't contain : twice in a row
oval:ssg-test_env_var_contains_doublecolon:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Pid | Name | Value |
|---|
| false | 1987 | PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
environment variable PATH doesn't contain . twice in a row
oval:ssg-test_env_var_contains_doubleperiod:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Pid | Name | Value |
|---|
| false | 1987 | PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
environment variable PATH ends with : or .
oval:ssg-test_env_var_ends:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Pid | Name | Value |
|---|
| false | 1987 | PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
environment variable PATH starts with an absolute path /
oval:ssg-test_env_var_begins_slash:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Pid | Name | Value |
|---|
| false | 1987 | PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
environment variable PATH contains relative paths
oval:ssg-test_env_var_contains_relative_path:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Pid | Name | Value |
|---|
| false | 1987 | PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
Ensure the Default Bash Umask is Set Correctlyxccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc medium
Ensure the Default Bash Umask is Set Correctly
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_etc_bashrc:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 18 | | cobit5 | APO13.01, BAI03.01, BAI03.02, BAI03.03 | | isa-62443-2009 | 4.3.4.3.3 | | iso27001-2013 | A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-6(1), CM-6(a) | | nist-csf | PR.IP-2 | | os-srg | SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227 | | anssi | R36 | | cis | 5.4.3.3 |
|
| Description | To ensure the default umask for users of the Bash shell is set properly,
add or correct the umask setting in /etc/bash.bashrc to read
as follows:
umask 027
|
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
OVAL test results detailsVerify the existence of var_accounts_user_umask_as_number variable
oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| not evaluated | oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/bash.bashrc umask value(s) match the var_accounts_user_umask requirement
oval:ssg-tst_accounts_umask_etc_bashrc:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_etc_bashrc_umask_as_number:var:1 | 23 |
Ensure the Default Umask is Set Correctly in login.defsxccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs medium
Ensure the Default Umask is Set Correctly in login.defs
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_etc_login_defs:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 18, 3, 9 | | cobit5 | APO13.01, BAI03.01, BAI03.02, BAI03.03, BAI10.01, BAI10.02, BAI10.03, BAI10.05 | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.1.1, A.14.2.1, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.5, A.6.1.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-6(1), CM-6(a) | | nist-csf | PR.IP-1, PR.IP-2 | | os-srg | SRG-OS-000480-GPOS-00228 | | anssi | R36 | | cis | 5.4.3.3 |
|
| Description | To ensure the default umask controlled by /etc/login.defs is set properly,
add or correct the UMASK setting in /etc/login.defs to read as follows:
UMASK 027
|
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and
written to by unauthorized users. |
OVAL test results detailsVerify the existence of var_accounts_user_umask_as_number variable
oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| not evaluated | oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement
oval:ssg-tst_accounts_umask_etc_login_defs:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_etc_login_defs_umask_as_number:var:1 | 23 |
Ensure the Default Umask is Set Correctly in /etc/profilexccdf_org.ssgproject.content_rule_accounts_umask_etc_profile medium
Ensure the Default Umask is Set Correctly in /etc/profile
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_etc_profile:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 18 | | cobit5 | APO13.01, BAI03.01, BAI03.02, BAI03.03 | | isa-62443-2009 | 4.3.4.3.3 | | iso27001-2013 | A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-6(1), CM-6(a) | | nist-csf | PR.IP-2 | | os-srg | SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227 | | anssi | R36 | | cis | 5.4.3.3 |
|
| Description | To ensure the default umask controlled by /etc/profile is set properly,
add or correct the umask setting in /etc/profile to read as follows:
umask 027
Note that /etc/profile also reads scripts within /etc/profile.d directory.
These scripts are also valid files to set umask value. Therefore, they should also be
considered during the check and properly remediated, if necessary. |
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
OVAL test results detailsVerify the existence of var_accounts_user_umask_as_number variable
oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| not evaluated | oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
umask value(s) from profile configuration files match the requirement
oval:ssg-tst_accounts_umask_etc_profile:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_etc_profile_umask_as_number:var:1 | 23 |
Ensure the Root Bash Umask is Set Correctlyxccdf_org.ssgproject.content_rule_accounts_umask_root medium
Ensure the Root Bash Umask is Set Correctly
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_root |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_root:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | To ensure the root user's umask of the Bash shell is set properly,
add or correct the umask setting in /root/.bashrc
or /root/.profile to read as follows:
umask 0027
|
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
OVAL test results detailsTest that no umask with lenient permissions exists
oval:ssg-tst_accounts_umask_root:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_accounts_umask_root:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^(/root/.bashrc|/root/.profile)$ | ^[^#]*\bumask\s+[0-7]?[0-7]([0-1][0-7]|[0-7][0-6])\s*$ | 1 |
Set Interactive Session Timeoutxccdf_org.ssgproject.content_rule_accounts_tmout medium
Set Interactive Session Timeout
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_tmout |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_tmout:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.11 | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nerc-cip | CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | AC-12, SC-10, AC-2(5), CM-6(a) | | nist-csf | PR.AC-7 | | os-srg | SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010 | | anssi | R32 | | cis | 5.4.3.2 | | pcidss4 | 8.6.1, 8.6 |
|
| Description | Setting the TMOUT option in /etc/profile ensures that
all user sessions will terminate based on inactivity. A value of 0 (zero)
disables the automatic logout feature and is therefore not a compliant setting.
The value of TMOUT should be a positive integer, exported, and read only.
The TMOUT
setting in a file loaded by /etc/profile, e.g.
/etc/profile.d/tmout.sh should read as follows:
typeset -xr TMOUT=900
or
declare -xr TMOUT=900
Using the typeset keyword is preferred for wider compatibility with ksh and other shells. |
| Rationale | Terminating an idle session within a short time period reduces
the window of opportunity for unauthorized personnel to take control of a
management session enabled on the console or console port that has been
left unattended. |
OVAL test results detailsTMOUT in /etc/profile
oval:ssg-test_etc_profile_tmout:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_etc_profile_tmout:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/profile | ^[\s]*(?:typeset|declare)[\s]+-xr[\s]+TMOUT=([\w$]+).*$ | 1 |
TMOUT in /etc/profile.d/*.sh
oval:ssg-test_etc_profiled_tmout:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/profile.d/tmout.sh | typeset -xr TMOUT=900 |
Check that at least one TMOUT is defined
oval:ssg-test_accounts_tmout_defined:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-variable_count_of_tmout_instances:var:1 | 1 |
All TMOUT values must be greater than or equal to 1
oval:ssg-test_accounts_tmout_lower_bound:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/profile.d/tmout.sh | typeset -xr TMOUT=900 |
User Initialization Files Must Be Group-Owned By The Primary Groupxccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership medium
User Initialization Files Must Be Group-Owned By The Primary Group
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_user_dot_group_ownership:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change the group owner of interactive users files to the group found
in /etc/passwd for the user. To change the group owner of a local
interactive user home directory, use the following command:
$ sudo chgrp USER_GROUP /home/USER/.INIT_FILE
This rule ensures every initialization file related to an interactive user
is group-owned by an interactive user. |
| Rationale | Local initialization files for interactive users are used to configure the
user's shell environment upon logon. Malicious modification of these files could
compromise accounts upon logon. |
| Warnings | warning
Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective initialization files. |
OVAL test results detailsAll user initialization files are group-owned by a local interactive user
oval:ssg-test_accounts_user_dot_group_ownership:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /home/admin/.profile | regular | 1000 | 1000 | 807 | rw-r----- |
| true | /home/admin/.sudo_as_admin_successful | regular | 1000 | 1000 | 0 | rw-r----- |
| true | /home/admin/.bash_logout | regular | 1000 | 1000 | 220 | rw-r----- |
| true | /home/admin/.bashrc | regular | 1000 | 1000 | 3526 | rw-r----- |
User Initialization Files Must Be Owned By the Primary Userxccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership medium
User Initialization Files Must Be Owned By the Primary User
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_user_dot_user_ownership:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Set the owner of the user initialization files for interactive users to
the primary owner with the following command:
$ sudo chown USER /home/USER/.*
This rule ensures every initialization file related to an interactive user
is owned by an interactive user. |
| Rationale | Local initialization files are used to configure the user's shell environment
upon logon. Malicious modification of these files could compromise accounts upon
logon. |
| Warnings | warning
Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the ownership of
their respective initialization files. |
OVAL test results detailsAll user initialization files are owned by a local interactive user
oval:ssg-test_accounts_user_dot_user_ownership:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /home/admin/.profile | regular | 1000 | 1000 | 807 | rw-r----- |
| true | /home/admin/.sudo_as_admin_successful | regular | 1000 | 1000 | 0 | rw-r----- |
| true | /home/admin/.bash_logout | regular | 1000 | 1000 | 220 | rw-r----- |
| true | /home/admin/.bashrc | regular | 1000 | 1000 | 3526 | rw-r----- |
All Interactive Users Home Directories Must Existxccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists medium
All Interactive Users Home Directories Must Exist
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_user_interactive_home_directory_exists:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Create home directories to all local interactive users that currently do not
have a home directory assigned. Use the following commands to create the user
home directory assigned in /etc/passwd:
$ sudo mkdir /home/USER
|
| Rationale | If a local interactive user has a home directory defined that does not exist,
the user may be given access to the / directory as the current working directory
upon logon. This could create a Denial of Service because the user would not be
able to access their logon configuration files, and it may give them visibility
to system files they normally would not be able to access. |
OVAL test results detailsCheck the existence of interactive users.
oval:ssg-test_accounts_user_interactive_home_directory_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count_fs:var:1 | 1 |
Check the existence of interactive users.
oval:ssg-test_accounts_user_interactive_home_directory_exists_users:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| not evaluated | oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1 | 1 |
All Interactive User Home Directories Must Be Group-Owned By The Primary Groupxccdf_org.ssgproject.content_rule_file_groupownership_home_directories medium
All Interactive User Home Directories Must Be Group-Owned By The Primary Group
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownership_home_directories |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownership_home_directories:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change the group owner of interactive user home directories to the
group found in getent passwd. To change the group owner of
an interactive user's home directory, use the following command:
$ sudo chgrp USER_GROUP /home/USER
This rule ensures every home directory related to an interactive user is
group-owned by that user's primary group. It also ensures that interactive users
are group-owners of one and only one home directory.
Interactive users are those with a UID greater than or equal to 1000
and a valid interactive shell (not /sbin/nologin, /usr/sbin/nologin,
/bin/false, or /usr/bin/false). |
| Rationale | If the Group Identifier (GID) of a local interactive users home directory is
not the same as the primary GID of the user, this would allow unauthorized
access to the users files, and users that share the same group may not be
able to access files that they legitimately should. |
| Warnings | warning
Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective home directories. |
OVAL test results detailsAll home directories are group-owned by an interactive user's primary group
oval:ssg-test_file_groupownership_home_directories:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /home/admin/ | directory | 1000 | 1000 | 4096 | rwx------ |
All Interactive User Home Directories Must Be Owned By The Primary Userxccdf_org.ssgproject.content_rule_file_ownership_home_directories medium
All Interactive User Home Directories Must Be Owned By The Primary User
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownership_home_directories |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownership_home_directories:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change the owner of interactive users home directories to that correct
owner. To change the owner of a interactive users home directory, use
the following command:
$ sudo chown USER /home/USER
This rule ensures every home directory related to an interactive user is
owned by an interactive user. It also ensures that interactive users are
owners of one and only one home directory. |
| Rationale | If a local interactive user does not own their home directory, unauthorized
users could access or modify the user's files, and the users may not be able to
access their own files. |
| Warnings | warning
Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the ownership of
their respective home directories. |
OVAL test results detailsAll home directories are owned by a local interactive user
oval:ssg-test_file_ownership_home_directories:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /home/admin/ | directory | 1000 | 1000 | 4096 | rwx------ |
It should not exist duplicated owners of home dirs
oval:ssg-test_file_ownership_home_directories_duplicated:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_file_ownership_home_directories_uids_count:var:1 | 1 |
Ensure User Bash History File Has Correct Permissionsxccdf_org.ssgproject.content_rule_file_permission_user_bash_history medium
Ensure User Bash History File Has Correct Permissions
| Rule ID | xccdf_org.ssgproject.content_rule_file_permission_user_bash_history |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permission_user_bash_history:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Set the mode of the bash history file to 0600 with the
following command:
$ sudo chmod 0600 /home/USER/.bash_history
|
| Rationale | Incorrect permissions may enable malicious users to recover
other users' command history. |
OVAL test results detailsNo regular .bash_history files have group or other permissions
oval:ssg-test_file_permission_user_bash_history:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permission_user_bash_history:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /home/admin | .bash_history | oval:ssg-state_file_permission_user_bash_history_group_other_permissions:ste:1 | oval:ssg-state_file_permission_user_bash_history_symlink:ste:1 |
Ensure All User Initialization Files Have Mode 0740 Or Less Permissivexccdf_org.ssgproject.content_rule_file_permission_user_init_files medium
Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
| Rule ID | xccdf_org.ssgproject.content_rule_file_permission_user_init_files |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permission_user_init_files:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Set the mode of the user initialization files to 0740 or less permissisive with the
following command:
$ sudo chmod u-s,g-wxs,o= /home/USER/.INIT_FILE
|
| Rationale | Local initialization files are used to configure the user's shell environment
upon logon. Malicious modification of these files could compromise accounts upon
logon. |
OVAL test results detailsInit files have mode 0740 or less permissive
oval:ssg-test_file_permission_user_init_files:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /home/admin/.profile | regular | 1000 | 1000 | 807 | rw-r----- |
| true | /home/admin/.sudo_as_admin_successful | regular | 1000 | 1000 | 0 | rw-r----- |
| true | /home/admin/.bash_logout | regular | 1000 | 1000 | 220 | rw-r----- |
| true | /home/admin/.bashrc | regular | 1000 | 1000 | 3526 | rw-r----- |
All Interactive User Home Directories Must Have mode 0750 Or Less Permissivexccdf_org.ssgproject.content_rule_file_permissions_home_directories medium
All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_home_directories |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_home_directories:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Change the mode of interactive users home directories to 0750. To
change the mode of interactive users home directory, use the
following command:
$ sudo chmod 0750 /home/USER
|
| Rationale | Excessive permissions on local interactive user home directories may allow
unauthorized access to user files by other users. |
OVAL test results detailsAll home directories have proper permissions
oval:ssg-test_file_permissions_home_directories:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /home/admin/ | directory | 1000 | 1000 | 4096 | rwx------ |
Ensure AppArmor Utils is installedxccdf_org.ssgproject.content_rule_package_apparmor-utils_installed medium
Ensure AppArmor Utils is installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_apparmor-utils_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_apparmor-utils_installed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | AppArmor provide Mandatory Access Controls. |
| Rationale | Without a Mandatory Access Control system installed only the default
Discretionary Access Control system will be available. |
OVAL test results detailspackage apparmor-utils is installed
oval:ssg-test_package_apparmor-utils_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | apparmor-utils | all | 0 | 1 | 4.1.0 | 4.1.0-1 |
Ensure AppArmor is installedxccdf_org.ssgproject.content_rule_package_apparmor_installed medium
Ensure AppArmor is installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_apparmor_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_apparmor_installed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | os-srg | SRG-OS-000368-GPOS-00154, SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000370-GPOS-00155 | | anssi | R45 | | cis | 1.3.1.1 |
|
| Description | AppArmor provide Mandatory Access Controls. |
| Rationale | Without a Mandatory Access Control system installed only the default
Discretionary Access Control system will be available. |
OVAL test results detailspackage apparmor is installed
oval:ssg-test_package_apparmor_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | apparmor | arm64 | 0 | 1 | 4.1.0 | 4.1.0-1 |
Ensure AppArmor is enabled in the bootloader configurationxccdf_org.ssgproject.content_rule_grub2_enable_apparmor medium
Ensure AppArmor is enabled in the bootloader configuration
| Rule ID | xccdf_org.ssgproject.content_rule_grub2_enable_apparmor |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-grub2_enable_apparmor:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Configure AppArmor to be enabled at boot time and verify that it has not been
overwritten by the bootloader boot parameters.
Note: This recommendation is designed around the grub bootloader, if LILO or
another bootloader is in use in your environment, enact equivalent settings. |
| Rationale | AppArmor must be enabled at boot time in your bootloader configuration to
ensure that the controls it provides are not overridden. |
OVAL test results detailsapparmor is enabled in bootloader
oval:ssg-test_apparmor_enabled_bootloader:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /boot/grub/grub.cfg | linux /boot/vmlinuz-6.12.115+deb13.1-cloud-arm64 root=PARTUUID=cb1e0e7e-66b2-441c-b514-68247ca55e19 ro apparmor=1 security=apparmor console=tty0 console=ttyS0 |
security=apparmor is set in bootloader
oval:ssg-test_apparmor_set_bootloader:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /boot/grub/grub.cfg | linux /boot/vmlinuz-6.12.115+deb13.1-cloud-arm64 root=PARTUUID=cb1e0e7e-66b2-441c-b514-68247ca55e19 ro apparmor=1 security=apparmor console=tty0 console=ttyS0 |
Verify /boot/grub/grub.cfg User Ownershipxccdf_org.ssgproject.content_rule_file_owner_grub2_cfg medium
Verify /boot/grub/grub.cfg User Ownership
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.4.5 | | hipaa | 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii) | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-7.1 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R29 | | cis | 1.4.2 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | The file /boot/grub/grub.cfg should
be owned by the root user to prevent destruction
or modification of the file.
To properly set the owner of /boot/grub/grub.cfg, run the command:
$ sudo chown root /boot/grub/grub.cfg
|
| Rationale | Only root should be able to modify important boot parameters. |
Verify /boot/grub/grub.cfg Permissionsxccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg medium
Verify /boot/grub/grub.cfg Permissions
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.4.5 | | hipaa | 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii) | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | anssi | R29 | | cis | 1.4.2 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | File permissions for /boot/grub/grub.cfg should be set to 600.
To properly set the permissions of /boot/grub/grub.cfg, run the command:
$ sudo chmod 600 /boot/grub/grub.cfg
|
| Rationale | Proper permissions ensure that only the root user can modify important boot
parameters. |
Set Boot Loader Password in grub2xccdf_org.ssgproject.content_rule_grub2_password high
Set Boot Loader Password in grub2
| Rule ID | xccdf_org.ssgproject.content_rule_grub2_password |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | | cis-csc | 1, 11, 12, 14, 15, 16, 18, 3, 5 | | cobit5 | DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10 | | cui | 3.4.5 | | hipaa | 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7 | | iso27001-2013 | A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nist | CM-6(a) | | nist-csf | PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3 | | ospp | FIA_UAU.1 | | os-srg | SRG-OS-000080-GPOS-00048 | | anssi | R5 | | cis | 1.4.1 |
|
| Description | The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:
# grub2-setpassword
When prompted, enter the password that was selected.
|
| Rationale | Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode. |
| Warnings | warning
To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.
Also, do NOT manually add the superuser account and password to the
grub.cfg file as the grub2-mkconfig command overwrites this file. |
Set the UEFI Boot Loader Passwordxccdf_org.ssgproject.content_rule_grub2_uefi_password high
Set the UEFI Boot Loader Password
| Rule ID | xccdf_org.ssgproject.content_rule_grub2_uefi_password |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-grub2_uefi_password:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 16, 18, 3, 5 | | cobit5 | DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06 | | cui | 3.4.5 | | hipaa | 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7 | | iso27001-2013 | A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a) | | nist-csf | PR.AC-4, PR.AC-6, PR.PT-3 | | ospp | FIA_UAU.1 | | os-srg | SRG-OS-000080-GPOS-00048 | | anssi | R5 | | cis | 1.4.1 |
|
| Description | The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:
# grub2-setpassword
When prompted, enter the password that was selected.
|
| Rationale | Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode. |
| Warnings | warning
To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.
Also, do NOT manually add the superuser account and password to the
grub.cfg file as the grub2-mkconfig command overwrites this file. |
OVAL test results detailsmake sure a password is defined in /boot/grub2/grub.cfg
oval:ssg-test_grub2_uefi_password_grubcfg:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /boot/grub2/grub.cfg | password_pbkdf2 root grub.pbkdf2.sha512.[redacted] |
superuser is defined in /boot/grub2/grub.cfg
oval:ssg-test_bootloader_uefi_superuser:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /boot/grub2/grub.cfg | set superusers="root" |
Install systemd-journal-remote Packagexccdf_org.ssgproject.content_rule_package_systemd-journal-remote_installed medium
Install systemd-journal-remote Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_systemd-journal-remote_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_systemd-journal-remote_installed:def:1 |
| Time | 2026-11-02T22:57:55+00:00 |
| Severity | medium |
| References: | |
| Description | Journald (via systemd-journal-remote ) supports the ability to send
log events it gathers to a remote log host or to receive messages
from remote hosts, thus enabling centralised log management. |
| Rationale | Storing log data on a remote host protects log integrity from local
attacks. If an attacker gains root access on the local system, they
could tamper with or remove log data that is stored on the local system. |
OVAL test results detailspackage systemd-journal-remote is installed
oval:ssg-test_package_systemd-journal-remote_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | systemd-journal-remote | arm64 | 0 | 1~deb13u1 | 257.13 | 257.13-1~deb13u1 |
Enable systemd-journald Servicexccdf_org.ssgproject.content_rule_service_systemd-journald_enabled medium
Enable systemd-journald Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_systemd-journald_enabled:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | The systemd-journald service is an essential component of
systemd.
The systemd-journald service can be enabled with the following command:
$ sudo systemctl enable systemd-journald.service
|
| Rationale | In the event of a system failure, Debian 13 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes. |
OVAL test results detailspackage systemd is installed
oval:ssg-test_service_systemd-journald_package_systemd_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | systemd | arm64 | 0 | 1~deb13u1 | 257.13 | 257.13-1~deb13u1 |
Test that the systemd-journald service is running
oval:ssg-test_service_running_systemd-journald:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | systemd-journald.socket | ActiveState | active |
| true | systemd-journald.service | ActiveState | active |
systemd test
oval:ssg-test_multi_user_wants_systemd-journald:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| true | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
systemd test
oval:ssg-test_multi_user_wants_systemd-journald_socket:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| true | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
Ensure journald is configured to compress large log filesxccdf_org.ssgproject.content_rule_journald_compress medium
Ensure journald is configured to compress large log files
| Rule ID | xccdf_org.ssgproject.content_rule_journald_compress |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-journald_compress:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | The journald system can compress large log files to avoid fill the system disk. |
| Rationale | Log files that are not properly compressed run the risk of growing so large that they fill up the log partition. Valuable logging information could be lost if the log partition becomes full. |
OVAL test results detailstests the value of Compress setting in the /etc/systemd/journald.conf file
oval:ssg-test_journald_compress:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/journald.conf | Compress=yes |
Ensure journald ForwardToSyslog is disabledxccdf_org.ssgproject.content_rule_journald_disable_forward_to_syslog medium
Ensure journald ForwardToSyslog is disabled
| Rule ID | xccdf_org.ssgproject.content_rule_journald_disable_forward_to_syslog |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-journald_disable_forward_to_syslog:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | Data from journald should be kept in the confines of the service and not forwarded to other services. |
| Rationale | If journald is the method for capturing logs, all logs of the system should be handled by journald and not forwarded to other logging mechanisms. |
OVAL test results detailstests the value of ForwardToSyslog setting in the /etc/systemd/journald.conf file
oval:ssg-test_journald_disable_forward_to_syslog:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/journald.conf | ForwardToSyslog=no |
Ensure journald is configured to write log files to persistent diskxccdf_org.ssgproject.content_rule_journald_storage medium
Ensure journald is configured to write log files to persistent disk
| Rule ID | xccdf_org.ssgproject.content_rule_journald_storage |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-journald_storage:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | The journald system may store log files in volatile memory or locally on disk.
If the logs are only stored in volatile memory they will be lost upon reboot. |
| Rationale | Log files contain valuable data and need to be persistent to aid in possible investigations. |
OVAL test results detailstests the value of Storage setting in the /etc/systemd/journald.conf file
oval:ssg-test_journald_storage:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/journald.conf | Storage=persistent |
Disable systemd-journal-remote Socketxccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled medium
Disable systemd-journal-remote Socket
| Rule ID | xccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-socket_systemd-journal-remote_disabled:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | Journald supports the ability to receive messages from remote hosts,
thus acting as a log server. Clients should not receive data from
other hosts.
NOTE:
The same package, systemd-journal-remote , is used for both sending
logs to remote hosts and receiving incoming logs.
With regards to receiving logs, there are two Systemd unit files;
systemd-journal-remote.socket and systemd-journal-remote.service. |
| Rationale | If a client is configured to also receive data, thus turning it into
a server, the client system is acting outside it's operational boundary. |
OVAL test results detailsTest that the property LoadState from the systemd-journal-remote.socket is masked
oval:ssg-test_socket_loadstate_is_masked_systemd-journal-remote:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | systemd-journal-remote.socket | LoadState | masked |
Configure systemd-journal-upload TLS parameters: ServerKeyFile, ServerCertificateFile and TrustedCertificateFilexccdf_org.ssgproject.content_rule_systemd_journal_upload_server_tls medium
Configure systemd-journal-upload TLS parameters: ServerKeyFile, ServerCertificateFile and TrustedCertificateFile
| Rule ID | xccdf_org.ssgproject.content_rule_systemd_journal_upload_server_tls |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-systemd_journal_upload_server_tls:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | Debian 13 must offload rsyslog messages for networked systems in real time and
offload standalone systems at least weekly |
| Rationale | Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Offloading is a common process in information systems with limited audit storage capacity |
OVAL test results detailssystemd-journal-upload ServerKeyFile
oval:ssg-test_systemd_journal_upload_server_key_file:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/journal-upload.conf | [Upload]
TrustedCertificateFile=/etc/pki/systemd/ca/trusted.pem
ServerCertificateFile=/etc/pki/systemd/certs/journal-upload.pem
ServerKeyFile=/etc/pki/systemd/private/journal-upload.pem |
systemd-journal-upload ServerCertificateFile
oval:ssg-test_systemd_journal_upload_server_certificate_file:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/journal-upload.conf | [Upload]
TrustedCertificateFile=/etc/pki/systemd/ca/trusted.pem
ServerCertificateFile=/etc/pki/systemd/certs/journal-upload.pem |
systemd-journal-upload TrustedCertificateFile
oval:ssg-test_systemd_journal_upload_server_trusted_certificate_file:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/journal-upload.conf | [Upload]
TrustedCertificateFile=/etc/pki/systemd/ca/trusted.pem |
Configure Accepting Router Advertisements on All IPv6 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra medium
Configure Accepting Router Advertisements on All IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 3.3.2.7 |
|
| Description | To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_ra = 0
|
| Rationale | An illicit router advertisement message could result in a man-in-the-middle attack. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_ra static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.all.accept_ra = 0 |
net.ipv6.conf.all.accept_ra static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.all.accept_ra = 0 |
net.ipv6.conf.all.accept_ra static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.all.accept_ra | 0 |
Disable Accepting ICMP Redirects for All IPv6 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects medium
Disable Accepting ICMP Redirects for All IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R13 | | cis | 3.3.2.3 |
|
| Description | To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_redirects = 0
|
| Rationale | An illicit ICMP redirect message could result in a man-in-the-middle attack. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.all.accept_redirects = 0 |
net.ipv6.conf.all.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.all.accept_redirects = 0 |
net.ipv6.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.all.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route medium
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9 | | cobit5 | APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.4.3.3 | | isa-62443-2013 | SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R13 | | cis | 3.3.2.5 |
|
| Description | To set the runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_source_route = 0
|
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.all.accept_source_route = 0 |
net.ipv6.conf.all.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.all.accept_source_route = 0 |
net.ipv6.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.all.accept_source_route | 0 |
Disable Kernel Parameter for IPv6 Forwardingxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding medium
Disable Kernel Parameter for IPv6 Forwarding
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9 | | cobit5 | APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv) | | nist-csf | DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 3.3.2.1 |
|
| Description | To set the runtime status of the net.ipv6.conf.all.forwarding kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.forwarding=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.forwarding = 0
|
| Rationale | IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.forwarding static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.all.forwarding = 0 |
net.ipv6.conf.all.forwarding static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.all.forwarding = 0 |
net.ipv6.conf.all.forwarding static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.all.forwarding | 0 |
Disable Accepting Router Advertisements on all IPv6 Interfaces by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra medium
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 3.3.2.8 |
|
| Description | To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_ra = 0
|
| Rationale | An illicit router advertisement message could result in a man-in-the-middle attack. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_ra static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.default.accept_ra = 0 |
net.ipv6.conf.default.accept_ra static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.default.accept_ra = 0 |
net.ipv6.conf.default.accept_ra static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.default.accept_ra | 0 |
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects medium
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R13 | | cis | 3.3.2.4 |
|
| Description | To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_redirects = 0
|
| Rationale | An illicit ICMP redirect message could result in a man-in-the-middle attack. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.default.accept_redirects = 0 |
net.ipv6.conf.default.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.default.accept_redirects = 0 |
net.ipv6.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.default.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route medium
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9 | | cobit5 | APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.4.3.3 | | isa-62443-2013 | SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv) | | nist-csf | DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4 | | pcidss | Req-1.4.3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R13 | | cis | 3.3.2.6 | | pcidss4 | 1.4.2, 1.4 |
|
| Description | To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_source_route = 0
|
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.default.accept_source_route = 0 |
net.ipv6.conf.default.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.default.accept_source_route = 0 |
net.ipv6.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.default.accept_source_route | 0 |
Disable Kernel Parameter for IPv6 Forwarding by defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_forwarding medium
Disable Kernel Parameter for IPv6 Forwarding by default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_forwarding |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_forwarding:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | To set the runtime status of the net.ipv6.conf.default.forwarding kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.forwarding=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.forwarding = 0
|
| Rationale | IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers. |
OVAL test results detailsnet.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Set |
|---|
|
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1
|
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1
oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| false | net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.forwarding static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv6.conf.default.forwarding = 0 |
net.ipv6.conf.default.forwarding static configuration
oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv6.conf.default.forwarding = 0 |
net.ipv6.conf.default.forwarding static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_forwarding:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.forwarding[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv6.conf.default.forwarding set to the appropriate value
oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv6.conf.default.forwarding | 0 |
Disable Accepting ICMP Redirects for All IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects medium
Disable Accepting ICMP Redirects for All IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), SC-7(a) | | nist-csf | DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.8 |
|
| Description | To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_redirects = 0
|
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be
disabled unless absolutely required." |
OVAL test results detailsnet.ipv4.conf.all.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.accept_redirects = 0 |
net.ipv4.conf.all.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.accept_redirects = 0 |
net.ipv4.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route medium
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.14 |
|
| Description | To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_source_route = 0
|
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required. |
OVAL test results detailsnet.ipv4.conf.all.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.accept_source_route = 0 |
net.ipv4.conf.all.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.accept_source_route = 0 |
net.ipv4.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.accept_source_route | 0 |
Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding medium
Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_forwarding:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | |
| Description | To set the runtime status of the net.ipv4.conf.all.forwarding kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.forwarding=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.forwarding = 0
|
| Rationale | IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers. |
| Warnings | warning
There might be cases when certain applications can systematically override this option.
One such case is Libvirt; a toolkit for managing of virtualization platforms.
By default, Libvirt requires IP forwarding to be enabled to facilitate
network communication between the virtualization host and guest
machines. It enables IP forwarding after every reboot. |
OVAL test results detailsnet.ipv4.conf.all.forwarding static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.forwarding = 0 |
net.ipv4.conf.all.forwarding static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.forwarding = 0 |
net.ipv4.conf.all.forwarding static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.forwarding set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.forwarding | 0 |
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians unknown
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | unknown |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9 | | cobit5 | APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), SC-5(3)(a) | | nist-csf | DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 3.3.1.16 |
|
| Description | To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.log_martians = 1
|
| Rationale | The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected. |
OVAL test results detailsnet.ipv4.conf.all.log_martians static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.log_martians = 1 |
net.ipv4.conf.all.log_martians static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.log_martians = 1 |
net.ipv4.conf.all.log_martians static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.log_martians | 1 |
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter medium
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9 | | cobit5 | APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.4.3.3 | | isa-62443-2013 | SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4 | | pcidss | Req-1.4.3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.12 | | pcidss4 | 1.4.3, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.rp_filter = 1
|
| Rationale | Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks. |
OVAL test results detailsnet.ipv4.conf.all.rp_filter static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.rp_filter = 1 |
net.ipv4.conf.all.rp_filter static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.rp_filter = 1 |
net.ipv4.conf.all.rp_filter static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.rp_filter | 1 |
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects medium
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1 |
| Time | 2026-11-02T22:57:56+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | pcidss | Req-1.4.3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.10 | | pcidss4 | 1.4.3, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.secure_redirects = 0
|
| Rationale | Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required. |
OVAL test results detailsnet.ipv4.conf.all.secure_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.secure_redirects = 0 |
net.ipv4.conf.all.secure_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.secure_redirects = 0 |
net.ipv4.conf.all.secure_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.secure_redirects | 0 |
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects medium
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | pcidss | Req-1.4.3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.9 | | pcidss4 | 1.4.3, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.accept_redirects = 0
|
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should
be disabled unless absolutely required. |
OVAL test results detailsnet.ipv4.conf.default.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.default.accept_redirects = 0 |
net.ipv4.conf.default.accept_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.default.accept_redirects = 0 |
net.ipv4.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.accept_redirects | 0 |
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route medium
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5, SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.15 |
|
| Description | To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.accept_source_route = 0
|
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required, such as when
IPv4 forwarding is enabled and the system is legitimately functioning as a
router. |
OVAL test results detailsnet.ipv4.conf.default.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /lib/sysctl.d/50-default.conf | net.ipv4.conf.default.accept_source_route = 0 |
net.ipv4.conf.default.accept_source_route static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /lib/sysctl.d/50-default.conf | net.ipv4.conf.default.accept_source_route = 0 |
net.ipv4.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_pkg_correct:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /usr/lib/sysctl.d/50-default.conf | net.ipv4.conf.default.accept_source_route = 0 |
kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.accept_source_route | 0 |
Disable Kernel Parameter for IPv4 Forwarding By Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_forwarding medium
Disable Kernel Parameter for IPv4 Forwarding By Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_forwarding |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_forwarding:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | |
| Description | To set the runtime status of the net.ipv4.conf.default.forwarding kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.forwarding=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.forwarding = 0
|
| Rationale | IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers. |
| Warnings | warning
There might be cases when certain applications can systematically override this option.
One such case is Libvirt; a toolkit for managing of virtualization platforms.
By default, Libvirt requires IP forwarding to be enabled to facilitate
network communication between the virtualization host and guest
machines. It enables IP forwarding after every reboot. |
OVAL test results detailsnet.ipv4.conf.default.forwarding static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_forwarding_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.default.forwarding = 0 |
net.ipv4.conf.default.forwarding static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_forwarding_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.default.forwarding = 0 |
net.ipv4.conf.default.forwarding static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_forwarding_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_forwarding:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.forwarding[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.forwarding set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_default_forwarding_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.forwarding | 0 |
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians unknown
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | unknown |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9 | | cobit5 | APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), SC-5(3)(a) | | nist-csf | DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 3.3.1.17 |
|
| Description | To set the runtime status of the net.ipv4.conf.default.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.log_martians = 1
|
| Rationale | The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected. |
OVAL test results detailsnet.ipv4.conf.default.log_martians static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.default.log_martians = 1 |
net.ipv4.conf.default.log_martians static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.default.log_martians = 1 |
net.ipv4.conf.default.log_martians static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.log_martians | 1 |
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter medium
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9 | | cobit5 | APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.4.3.3 | | isa-62443-2013 | SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.13 |
|
| Description | To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.rp_filter = 1
|
| Rationale | Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks. |
OVAL test results detailsnet.ipv4.conf.default.rp_filter static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.default.rp_filter = 1 |
net.ipv4.conf.default.rp_filter static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.default.rp_filter = 1 |
net.ipv4.conf.default.rp_filter static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.rp_filter | 1 |
Configure Kernel Parameter for Accepting Secure Redirects By Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects medium
Configure Kernel Parameter for Accepting Secure Redirects By Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5, SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.11 |
|
| Description | To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.secure_redirects = 0
|
| Rationale | Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required. |
OVAL test results detailsnet.ipv4.conf.default.secure_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.default.secure_redirects = 0 |
net.ipv4.conf.default.secure_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.default.secure_redirects = 0 |
net.ipv4.conf.default.secure_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.secure_redirects | 0 |
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts medium
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5 | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | pcidss | Req-1.4.3 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 3.3.1.7 | | pcidss4 | 1.4.2, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.icmp_echo_ignore_broadcasts = 1
|
| Rationale | Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network. |
OVAL test results detailsnet.ipv4.icmp_echo_ignore_broadcasts static configuration
oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.icmp_echo_ignore_broadcasts = 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration
oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.icmp_echo_ignore_broadcasts = 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.icmp_echo_ignore_broadcasts | 1 |
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses unknown
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | unknown |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9 | | cobit5 | APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5 | | nist-csf | DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3 | | pcidss | Req-1.4.3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.6 | | pcidss4 | 1.4.2, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.icmp_ignore_bogus_error_responses = 1
|
| Rationale | Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged. |
OVAL test results detailsnet.ipv4.icmp_ignore_bogus_error_responses static configuration
oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.icmp_ignore_bogus_error_responses = 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration
oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.icmp_ignore_bogus_error_responses = 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.icmp_ignore_bogus_error_responses | 1 |
Enable Kernel Parameter to Use TCP Syncookies on Network Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies medium
Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.4.3.3 | | isa-62443-2013 | SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), SC-5(1), SC-5(2), SC-5(3)(a), CM-6(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4 | | pcidss | Req-1.4.1 | | os-srg | SRG-OS-000480-GPOS-00227, SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00071 | | anssi | R12 | | cis | 3.3.1.18 | | pcidss4 | 1.4.3, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.tcp_syncookies = 1
|
| Rationale | A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests. |
OVAL test results detailsnet.ipv4.tcp_syncookies static configuration
oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.tcp_syncookies = 1 |
net.ipv4.tcp_syncookies static configuration
oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.tcp_syncookies = 1 |
net.ipv4.tcp_syncookies static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value
oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.tcp_syncookies | 1 |
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects medium
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.4 | | pcidss4 | 1.4.5, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.send_redirects = 0
|
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers. |
OVAL test results detailsnet.ipv4.conf.all.send_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.all.send_redirects = 0 |
net.ipv4.conf.all.send_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.all.send_redirects = 0 |
net.ipv4.conf.all.send_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0
oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.all.send_redirects | 0 |
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects medium
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9 | | cjis | 5.10.1.1 | | cobit5 | APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06 | | cui | 3.1.20 | | isa-62443-2009 | 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1 | | nist | CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a) | | nist-csf | DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R12 | | cis | 3.3.1.5 | | pcidss4 | 1.4.5, 1.4 |
|
| Description | To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.send_redirects = 0
|
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers. |
OVAL test results detailsnet.ipv4.conf.default.send_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | net.ipv4.conf.default.send_redirects = 0 |
net.ipv4.conf.default.send_redirects static configuration
oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | net.ipv4.conf.default.send_redirects = 0 |
net.ipv4.conf.default.send_redirects static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0
oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | net.ipv4.conf.default.send_redirects | 0 |
Install ufw Packagexccdf_org.ssgproject.content_rule_package_ufw_installed medium
Install ufw Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_ufw_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_ufw_installed:def:1 |
| Time | 2026-11-02T22:57:57+00:00 |
| Severity | medium |
| References: | |
| Description | The ufw package can be installed with the following command:
$ apt-get install ufw
|
| Rationale | ufw controls the Linux kernel network packet filtering
code. ufw allows system operators to set up firewalls and IP
masquerading, etc.
|
OVAL test results detailspackage ufw is installed
oval:ssg-test_package_ufw_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | ufw | all | 0 | 9 | 0.36.2 | 0.36.2-9 |
Verify ufw Enabledxccdf_org.ssgproject.content_rule_service_ufw_enabled medium
Verify ufw Enabled
| Rule ID | xccdf_org.ssgproject.content_rule_service_ufw_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_ufw_enabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | |
| Description |
The ufw service can be enabled with the following command:
$ sudo systemctl enable ufw.service
|
| Rationale | The ufw service must be enabled and running in order for ufw to protect the system |
OVAL test results detailspackage ufw is installed
oval:ssg-test_service_ufw_package_ufw_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | ufw | all | 0 | 9 | 0.36.2 | 0.36.2-9 |
Test that the ufw service is running
oval:ssg-test_service_running_ufw:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | ufw.service | ActiveState | active |
systemd test
oval:ssg-test_multi_user_wants_ufw:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| true | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
systemd test
oval:ssg-test_multi_user_wants_ufw_socket:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| false | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
Verify ufw Activexccdf_org.ssgproject.content_rule_check_ufw_active medium
Verify ufw Active
| Rule ID | xccdf_org.ssgproject.content_rule_check_ufw_active |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-check_ufw_active:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | |
| Description | Verify the ufw is enabled on the system with the following command:
# sudo ufw status
If the above command returns the status as "inactive" or any type of error, this is a finding. |
| Rationale | Remote access services, such as those providing remote access to network devices and information systems,
which lack automated control capabilities, increase risk and make remote user access management difficult at best.
Remote access is access to nonpublic information systems by an authorized user (or an information system) communicating
through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Ubuntu 22.04 LTS functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity.
Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by
enforcing connection rules of remote access applications on a variety of information system components. |
OVAL test results detailsCheck ENABLED=yes in /etc/ufw/ufw.conf
oval:ssg-check_ufw_active_test_ufw_enabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ufw/ufw.conf | ENABLED=yes |
Ensure ufw Default Deny Policy for Incoming Connectionsxccdf_org.ssgproject.content_rule_ufw_default_incoming_rule medium
Ensure ufw Default Deny Policy for Incoming Connections
| Rule ID | xccdf_org.ssgproject.content_rule_ufw_default_incoming_rule |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ufw_default_incoming_rule:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | |
| Description | A default deny policy on incoming connections ensures that any unconfigured
inbound network traffic will be rejected.
Set DEFAULT_INPUT_POLICY to DROP or REJECT
in /etc/default/ufw.
Note: Any port or protocol without an explicit allow before the default
deny will be blocked. |
| Rationale | With a default accept policy the firewall will accept any incoming packet
that is not configured to be denied. It is easier to allow acceptable
usage than to block unacceptable usage. |
| Warnings | warning
Changing firewall settings while connected over network can
result in being locked out of the system. |
OVAL test results detailsCheck DEFAULT_INPUT_POLICY is DROP or REJECT in /etc/default/ufw
oval:ssg-ufw_default_incoming_rule_test_default_input_policy:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/default/ufw | DEFAULT_INPUT_POLICY="DROP" |
Ensure ufw Default Policy for Routed (Forwarded) Traffic is Disabledxccdf_org.ssgproject.content_rule_ufw_disabled_routed medium
Ensure ufw Default Policy for Routed (Forwarded) Traffic is Disabled
| Rule ID | xccdf_org.ssgproject.content_rule_ufw_disabled_routed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ufw_disabled_routed:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | |
| Description | The default policy for routed (forwarded) traffic in ufw should be set to
disabled or deny, ensuring that the system does not forward packets between
interfaces unless explicitly configured to do so. |
| Rationale | Unless the system is intended to act as a router, forwarding traffic between
network interfaces should be disabled. Disabling the routed default policy
prevents the system from accidentally or maliciously forwarding traffic. |
| Warnings | warning
Changing firewall settings while connected over network can
result in being locked out of the system. |
OVAL test results detailsCheck DEFAULT_FORWARD_POLICY is DROP or REJECT in /etc/default/ufw
oval:ssg-ufw_disabled_routed_test_default_forward_policy:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/default/ufw | DEFAULT_FORWARD_POLICY="DROP" |
Disable ATM Supportxccdf_org.ssgproject.content_rule_kernel_module_atm_disabled medium
Disable ATM Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_atm_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | | nist | AC-18 | | os-srg | SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227 | | cis | 3.2.1 |
|
| Description | The Asynchronous Transfer Mode (ATM) is a protocol operating on
network, data link, and physical layers, based on virtual circuits
and virtual paths.
To configure the system to prevent the atm
kernel module from being loaded, add the following line to the file /etc/modprobe.d/atm.conf:
install atm /bin/false
This entry will cause a non-zero return value during a atm module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install atm /bin/true
|
| Rationale | Disabling ATM protects the system against exploitation of any
flaws in its implementation. |
OVAL test results detailskernel module atm disabled
oval:ssg-test_kernmod_atm_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/atm.conf | install atm /bin/false |
kernel module atm disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_atm_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_atm_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+atm\s+(/bin/false|/bin/true)$ | 1 |
Disable CAN Supportxccdf_org.ssgproject.content_rule_kernel_module_can_disabled medium
Disable CAN Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_can_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_can_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | | nist | AC-18 | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227 | | cis | 3.2.2 |
|
| Description | The Controller Area Network (CAN) is a serial communications
protocol which was initially developed for automotive and
is now also used in marine, industrial, and medical applications.
To configure the system to prevent the can
kernel module from being loaded, add the following line to the file /etc/modprobe.d/can.conf:
install can /bin/false
This entry will cause a non-zero return value during a can module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install can /bin/true
|
| Rationale | Disabling CAN protects the system against exploitation of any
flaws in its implementation. |
OVAL test results detailskernel module can disabled
oval:ssg-test_kernmod_can_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/can.conf | install can /bin/false |
kernel module can disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_can_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_can_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+can\s+(/bin/false|/bin/true)$ | 1 |
Disable DCCP Supportxccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled medium
Disable DCCP Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_dccp_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cjis | 5.10.1 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | pcidss | Req-1.4.2 | | os-srg | SRG-OS-000096-GPOS-00050, SRG-OS-000378-GPOS-00163 | | cis | 3.2.3 | | pcidss4 | 1.4.2, 1.4 |
|
| Description | The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.
To configure the system to prevent the dccp
kernel module from being loaded, add the following line to the file /etc/modprobe.d/dccp.conf:
install dccp /bin/false
This entry will cause a non-zero return value during a dccp module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install dccp /bin/true
|
| Rationale | Disabling DCCP protects
the system against exploitation of any flaws in its implementation. |
OVAL test results detailskernel module dccp disabled
oval:ssg-test_kernmod_dccp_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/dccp.conf | install dccp /bin/false |
kernel module dccp disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_dccp_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+dccp\s+(/bin/false|/bin/true)$ | 1 |
Disable IEEE 1394 (FireWire) Supportxccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled low
Disable IEEE 1394 (FireWire) Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_firewire-core_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | low |
| References: | |
| Description | The IEEE 1394 (FireWire) is a serial bus standard for
high-speed real-time communication.
To configure the system to prevent the firewire-core
kernel module from being loaded, add the following line to the file /etc/modprobe.d/firewire-core.conf:
install firewire-core /bin/false
This entry will cause a non-zero return value during a firewire-core module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install firewire-core /bin/true
|
| Rationale | Disabling FireWire protects the system against exploitation of any
flaws in its implementation. |
OVAL test results detailskernel module firewire-core disabled
oval:ssg-test_kernmod_firewire-core_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/firewire-core.conf | install firewire-core /bin/false |
kernel module firewire-core disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$ | 1 |
Disable RDS Supportxccdf_org.ssgproject.content_rule_kernel_module_rds_disabled low
Disable RDS Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_rds_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 3.2.4 |
|
| Description | The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high-bandwidth,
low-latency communications between nodes in a cluster.
To configure the system to prevent the rds
kernel module from being loaded, add the following line to the file /etc/modprobe.d/rds.conf:
install rds /bin/false
This entry will cause a non-zero return value during a rds module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install rds /bin/true
|
| Rationale | Disabling RDS protects
the system against exploitation of any flaws in its implementation. |
OVAL test results detailskernel module rds disabled
oval:ssg-test_kernmod_rds_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/rds.conf | install rds /bin/false |
kernel module rds disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_rds_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_rds_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+rds\s+(/bin/false|/bin/true)$ | 1 |
Disable SCTP Supportxccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled medium
Disable SCTP Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_sctp_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cjis | 5.10.1 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | ospp | FMT_SMF_EXT.1 | | pcidss | Req-1.4.2 | | os-srg | SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227 | | cis | 3.2.5 | | pcidss4 | 1.4.2, 1.4 |
|
| Description | The Stream Control Transmission Protocol (SCTP) is a
transport layer protocol, designed to support the idea of
message-oriented communication, with several streams of messages
within one connection.
To configure the system to prevent the sctp
kernel module from being loaded, add the following line to the file /etc/modprobe.d/sctp.conf:
install sctp /bin/false
This entry will cause a non-zero return value during a sctp module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install sctp /bin/true
|
| Rationale | Disabling SCTP protects
the system against exploitation of any flaws in its implementation. |
OVAL test results detailskernel module sctp disabled
oval:ssg-test_kernmod_sctp_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/sctp.conf | install sctp /bin/false |
kernel module sctp disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_sctp_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_sctp_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ | 1 |
Disable TIPC Supportxccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled low
Disable TIPC Support
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_tipc_disabled:def:1 |
| Time | 2026-11-02T22:57:58+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000095-GPOS-00049 | | cis | 3.2.6 |
|
| Description | The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.
To configure the system to prevent the tipc
kernel module from being loaded, add the following line to the file /etc/modprobe.d/tipc.conf:
install tipc /bin/false
This entry will cause a non-zero return value during a tipc module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install tipc /bin/true
|
| Rationale | Disabling TIPC protects
the system against exploitation of any flaws in its implementation. |
| Warnings | warning
This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as
a node in High Performance Computing cluster, it is expected that
the tipc kernel module will be loaded. |
OVAL test results detailskernel module tipc disabled
oval:ssg-test_kernmod_tipc_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/tipc.conf | install tipc /bin/false |
kernel module tipc disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_tipc_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ | 1 |
Disable Bluetooth Servicexccdf_org.ssgproject.content_rule_service_bluetooth_disabled medium
Disable Bluetooth Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_bluetooth_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_bluetooth_disabled:def:1 |
| Time | 2026-11-02T22:57:59+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | cui | 3.1.16 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7 | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | cis | 3.1.3 |
|
| Description |
The bluetooth service can be disabled with the following command:
$ sudo systemctl mask --now bluetooth.service
$ sudo service bluetooth stop
|
| Rationale | Disabling the bluetooth service prevents the system from attempting
connections to Bluetooth devices, which entails some security risk.
Nevertheless, variation in this risk decision may be expected due to the
utility of Bluetooth connectivity and its limited range. |
OVAL test results detailspackage bluez is removed
oval:ssg-service_bluetooth_disabled_test_service_bluetooth_package_bluez_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_bluetooth_disabled_test_service_bluetooth_package_bluez_removed:obj:1 of type
dpkginfo_object
Test that the bluetooth service is not running
oval:ssg-test_service_not_running_service_bluetooth_disabled_bluetooth:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_bluetooth_disabled_bluetooth:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^bluetooth\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service bluetooth is masked
oval:ssg-test_service_loadstate_is_masked_service_bluetooth_disabled_bluetooth:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_bluetooth_disabled_bluetooth:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^bluetooth\.(service|socket)$ | LoadState |
Test that the service bluetooth is not found
oval:ssg-test_service_not_found_service_bluetooth_disabled_bluetooth:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_bluetooth_disabled_bluetooth:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^bluetooth\.(service|socket)$ | LoadState |
Deactivate Wireless Network Interfacesxccdf_org.ssgproject.content_rule_wireless_disable_interfaces medium
Deactivate Wireless Network Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_wireless_disable_interfaces |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:57:59+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | cui | 3.1.16 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7 | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | pcidss | Req-1.3.3 | | os-srg | SRG-OS-000299-GPOS-00117, SRG-OS-000300-GPOS-00118, SRG-OS-000424-GPOS-00188, SRG-OS-000481-GPOS-00481 | | cis | 3.1.2 | | ism | 1315, 1319 | | pcidss4 | 1.3.3, 1.3 |
|
| Description | Deactivating wireless network interfaces should prevent normal usage of the wireless
capability.
Configure the system to disable all wireless network interfaces with the following command:
$ sudo nmcli radio all off
|
| Rationale | The use of wireless networking can introduce many different attack vectors into
the organization's network. Common attack vectors such as malicious association
and ad hoc networks will allow an attacker to spoof a wireless access point
(AP), allowing validated systems to connect to the malicious AP and enabling the
attacker to monitor and record network traffic. These malicious APs can also
serve to create a man-in-the-middle attack or be used to create a denial of
service to valid network resources. |
Verify Group Who Owns Backup group Filexccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group medium
Verify Group Who Owns Backup group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_group:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/group-, run the command:
$ sudo chgrp root /etc/group-
|
| Rationale | The /etc/group- file is a backup file of /etc/group, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security. |
OVAL test results detailsTesting group ownership of /etc/group-
oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/group- | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_backup_etc_group_0_0:ste:1 |
Verify Group Who Owns Backup gshadow Filexccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow medium
Verify Group Who Owns Backup gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_gshadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/gshadow-, run the command:
$ sudo chgrp shadow /etc/gshadow-
|
| Rationale | The /etc/gshadow- file is a backup of /etc/gshadow, and as such,
it contains group password hashes. Protection of this file is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/gshadow-
oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/gshadow- | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_backup_etc_gshadow_0_0:ste:1 |
Verify Group Who Owns Backup passwd Filexccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd medium
Verify Group Who Owns Backup passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_passwd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/passwd-, run the command:
$ sudo chgrp root /etc/passwd-
|
| Rationale | The /etc/passwd- file is a backup file of /etc/passwd, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/passwd-
oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/passwd- | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_backup_etc_passwd_0_0:ste:1 |
Verify User Who Owns Backup shadow Filexccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow medium
Verify User Who Owns Backup shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_shadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/shadow-, run the command:
$ sudo chgrp shadow /etc/shadow-
|
| Rationale | The /etc/shadow- file is a backup file of /etc/shadow, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/shadow-
oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shadow- | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_backup_etc_shadow_0_42:ste:1 |
Verify Group Who Owns group Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_group medium
Verify Group Who Owns group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_group |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_group:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/group, run the command:
$ sudo chgrp root /etc/group
|
| Rationale | The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
OVAL test results detailsTesting group ownership of /etc/group
oval:ssg-test_file_groupowner_etc_group_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_group_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/group | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_group_0_0:ste:1 |
Verify Group Who Owns gshadow Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow medium
Verify Group Who Owns gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_gshadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.7 |
|
| Description | To properly set the group owner of /etc/gshadow, run the command:
$ sudo chgrp shadow /etc/gshadow
|
| Rationale | The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/gshadow
oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/gshadow | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_gshadow_0_42:ste:1 |
Verify Group Who Owns passwd Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd medium
Verify Group Who Owns passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_passwd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.1 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/passwd, run the command:
$ sudo chgrp root /etc/passwd
|
| Rationale | The /etc/passwd file contains information about the users that are configured on
the system. Protection of this file is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/passwd
oval:ssg-test_file_groupowner_etc_passwd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_passwd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/passwd | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_passwd_0_0:ste:1 |
Verify Group Who Owns /etc/security/opasswd Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_security_opasswd medium
Verify Group Who Owns /etc/security/opasswd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_security_opasswd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_security_opasswd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/security/opasswd, run the command:
$ sudo chgrp root /etc/security/opasswd
|
| Rationale | The /etc/security/opasswd file stores old passwords to prevent
password reuse. Protection of this file is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/security/opasswd
oval:ssg-test_file_groupowner_etc_security_opasswd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_security_opasswd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/security/opasswd | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_security_opasswd_0_0:ste:1 |
Verify Group Who Owns /etc/security/opasswd.old Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_security_opasswd_old medium
Verify Group Who Owns /etc/security/opasswd.old File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_security_opasswd_old |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_security_opasswd_old:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/security/opasswd.old, run the command:
$ sudo chgrp root /etc/security/opasswd.old
|
| Rationale | The /etc/security/opasswd.old file stores backups of old passwords to prevent
password reuse. Protection of this file is critical for system security. |
OVAL test results detailsTesting group ownership of /etc/security/opasswd.old
oval:ssg-test_file_groupowner_etc_security_opasswd_old_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_security_opasswd_old_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/security/opasswd.old | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_security_opasswd_old_0_0:ste:1 |
Verify Group Who Owns shadow Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow medium
Verify Group Who Owns shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_shadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.5 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/shadow, run the command:
$ sudo chgrp shadow /etc/shadow
|
| Rationale | The /etc/shadow file stores password hashes. Protection of this file is
critical for system security. |
OVAL test results detailsTesting group ownership of /etc/shadow
oval:ssg-test_file_groupowner_etc_shadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_shadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shadow | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_shadow_0_42:ste:1 |
Verify Group Who Owns /etc/shells Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_shells medium
Verify Group Who Owns /etc/shells File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_shells:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /etc/shells, run the command:
$ sudo chgrp root /etc/shells
|
| Rationale | The /etc/shells file contains the list of full pathnames to shells on the system.
Since this file is used by many system programs this file should be protected. |
OVAL test results detailsTesting group ownership of /etc/shells
oval:ssg-test_file_groupowner_etc_shells_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_shells_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shells | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_etc_shells_0_0:ste:1 |
Verify User Who Owns Backup group Filexccdf_org.ssgproject.content_rule_file_owner_backup_etc_group medium
Verify User Who Owns Backup group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_group:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/group-, run the command:
$ sudo chown root /etc/group-
|
| Rationale | The /etc/group- file is a backup file of /etc/group, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security. |
OVAL test results detailsTesting user ownership of /etc/group-
oval:ssg-test_file_owner_backup_etc_group_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_group_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/group- | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_backup_etc_group_0_0:ste:1 |
Verify User Who Owns Backup gshadow Filexccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow medium
Verify User Who Owns Backup gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_gshadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/gshadow-, run the command:
$ sudo chown root /etc/gshadow-
|
| Rationale | The /etc/gshadow- file is a backup of /etc/gshadow, and as such,
it contains group password hashes. Protection of this file is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/gshadow-
oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/gshadow- | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_backup_etc_gshadow_0_0:ste:1 |
Verify User Who Owns Backup passwd Filexccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd medium
Verify User Who Owns Backup passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_passwd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/passwd-, run the command:
$ sudo chown root /etc/passwd-
|
| Rationale | The /etc/passwd- file is a backup file of /etc/passwd, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/passwd-
oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/passwd- | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_backup_etc_passwd_0_0:ste:1 |
Verify Group Who Owns Backup shadow Filexccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow medium
Verify Group Who Owns Backup shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_shadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/shadow-, run the command:
$ sudo chown root /etc/shadow-
|
| Rationale | The /etc/shadow- file is a backup file of /etc/shadow, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/shadow-
oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shadow- | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_backup_etc_shadow_0_0:ste:1 |
Verify User Who Owns group Filexccdf_org.ssgproject.content_rule_file_owner_etc_group medium
Verify User Who Owns group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_group |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_group:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/group, run the command:
$ sudo chown root /etc/group
|
| Rationale | The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
OVAL test results detailsTesting user ownership of /etc/group
oval:ssg-test_file_owner_etc_group_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_group_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/group | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_group_0_0:ste:1 |
Verify User Who Owns gshadow Filexccdf_org.ssgproject.content_rule_file_owner_etc_gshadow medium
Verify User Who Owns gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_gshadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.7 |
|
| Description | To properly set the owner of /etc/gshadow, run the command:
$ sudo chown root /etc/gshadow
|
| Rationale | The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/gshadow
oval:ssg-test_file_owner_etc_gshadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_gshadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/gshadow | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_gshadow_0_0:ste:1 |
Verify User Who Owns passwd Filexccdf_org.ssgproject.content_rule_file_owner_etc_passwd medium
Verify User Who Owns passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_passwd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_passwd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.1 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/passwd, run the command:
$ sudo chown root /etc/passwd
|
| Rationale | The /etc/passwd file contains information about the users that are configured on
the system. Protection of this file is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/passwd
oval:ssg-test_file_owner_etc_passwd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_passwd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/passwd | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_passwd_0_0:ste:1 |
Verify User Who Owns /etc/security/opasswd Filexccdf_org.ssgproject.content_rule_file_owner_etc_security_opasswd medium
Verify User Who Owns /etc/security/opasswd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_security_opasswd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_security_opasswd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/security/opasswd, run the command:
$ sudo chown root /etc/security/opasswd
|
| Rationale | The /etc/security/opasswd file stores old passwords to prevent
password reuse. Protection of this file is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/security/opasswd
oval:ssg-test_file_owner_etc_security_opasswd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_security_opasswd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/security/opasswd | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_security_opasswd_0_0:ste:1 |
Verify User Who Owns /etc/security/opasswd.old Filexccdf_org.ssgproject.content_rule_file_owner_etc_security_opasswd_old medium
Verify User Who Owns /etc/security/opasswd.old File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_security_opasswd_old |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_security_opasswd_old:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/security/opasswd.old, run the command:
$ sudo chown root /etc/security/opasswd.old
|
| Rationale | The /etc/security/opasswd.old file stores backups of old passwords to prevent
password reuse. Protection of this file is critical for system security. |
OVAL test results detailsTesting user ownership of /etc/security/opasswd.old
oval:ssg-test_file_owner_etc_security_opasswd_old_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_security_opasswd_old_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/security/opasswd.old | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_security_opasswd_old_0_0:ste:1 |
Verify User Who Owns shadow Filexccdf_org.ssgproject.content_rule_file_owner_etc_shadow medium
Verify User Who Owns shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_shadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.5 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/shadow, run the command:
$ sudo chown root /etc/shadow
|
| Rationale | The /etc/shadow file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture. |
OVAL test results detailsTesting user ownership of /etc/shadow
oval:ssg-test_file_owner_etc_shadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_shadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shadow | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_shadow_0_0:ste:1 |
Verify Who Owns /etc/shells Filexccdf_org.ssgproject.content_rule_file_owner_etc_shells medium
Verify Who Owns /etc/shells File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_shells |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_shells:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /etc/shells, run the command:
$ sudo chown root /etc/shells
|
| Rationale | The /etc/shells file contains the list of full pathnames to shells on the system.
Since this file is used by many system programs this file should be protected. |
OVAL test results detailsTesting user ownership of /etc/shells
oval:ssg-test_file_owner_etc_shells_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_shells_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shells | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_etc_shells_0_0:ste:1 |
Verify Permissions on Backup group Filexccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group medium
Verify Permissions on Backup group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_backup_etc_group:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/group-, run the command:
$ sudo chmod 0644 /etc/group-
|
| Rationale | The /etc/group- file is a backup file of /etc/group, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security. |
OVAL test results detailsTesting mode of /etc/group-
oval:ssg-test_file_permissions_backup_etc_group_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_backup_etc_group_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/group- | oval:ssg-exclude_symlinks__backup_etc_group:ste:1 | oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on Backup gshadow Filexccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow medium
Verify Permissions on Backup gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_backup_etc_gshadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/gshadow-, run the command:
$ sudo chmod 0640 /etc/gshadow-
|
| Rationale | The /etc/gshadow- file is a backup of /etc/gshadow, and as such,
it contains group password hashes. Protection of this file is critical for system security. |
OVAL test results detailsTesting mode of /etc/gshadow-
oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/gshadow- | oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1 | oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1 |
Verify Permissions on Backup passwd Filexccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd medium
Verify Permissions on Backup passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_backup_etc_passwd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/passwd-, run the command:
$ sudo chmod 0644 /etc/passwd-
|
| Rationale | The /etc/passwd- file is a backup file of /etc/passwd, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security. |
OVAL test results detailsTesting mode of /etc/passwd-
oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/passwd- | oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1 | oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on Backup shadow Filexccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow medium
Verify Permissions on Backup shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_backup_etc_shadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/shadow-, run the command:
$ sudo chmod 0640 /etc/shadow-
|
| Rationale | The /etc/shadow- file is a backup file of /etc/shadow, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security. |
OVAL test results detailsTesting mode of /etc/shadow-
oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shadow- | oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1 | oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1 |
Verify Permissions on group Filexccdf_org.ssgproject.content_rule_file_permissions_etc_group medium
Verify Permissions on group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_group |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_group:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/group, run the command:
$ sudo chmod 0644 /etc/group
|
| Rationale | The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
OVAL test results detailsTesting mode of /etc/group
oval:ssg-test_file_permissions_etc_group_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_group_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/group | oval:ssg-exclude_symlinks__etc_group:ste:1 | oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on gshadow Filexccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow medium
Verify Permissions on gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_gshadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.7 |
|
| Description | To properly set the permissions of /etc/gshadow, run the command:
$ sudo chmod 0640 /etc/gshadow
|
| Rationale | The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
OVAL test results detailsTesting mode of /etc/gshadow
oval:ssg-test_file_permissions_etc_gshadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_gshadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/gshadow | oval:ssg-exclude_symlinks__etc_gshadow:ste:1 | oval:ssg-state_file_permissions_etc_gshadow_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on passwd Filexccdf_org.ssgproject.content_rule_file_permissions_etc_passwd medium
Verify Permissions on passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_passwd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.1 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/passwd, run the command:
$ sudo chmod 0644 /etc/passwd
|
| Rationale | If the /etc/passwd file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security. |
OVAL test results detailsTesting mode of /etc/passwd
oval:ssg-test_file_permissions_etc_passwd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_passwd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/passwd | oval:ssg-exclude_symlinks__etc_passwd:ste:1 | oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on /etc/security/opasswd Filexccdf_org.ssgproject.content_rule_file_permissions_etc_security_opasswd medium
Verify Permissions on /etc/security/opasswd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_security_opasswd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_security_opasswd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/security/opasswd, run the command:
$ sudo chmod 0600 /etc/security/opasswd
|
| Rationale | The /etc/security/opasswd file stores old passwords to prevent
password reuse. Protection of this file is critical for system security. |
OVAL test results detailsTesting mode of /etc/security/opasswd
oval:ssg-test_file_permissions_etc_security_opasswd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_security_opasswd_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/security/opasswd | oval:ssg-exclude_symlinks__etc_security_opasswd:ste:1 | oval:ssg-state_file_permissions_etc_security_opasswd_0_mode_0600or_stricter_:ste:1 |
Verify Permissions on /etc/security/opasswd.old Filexccdf_org.ssgproject.content_rule_file_permissions_etc_security_opasswd_old medium
Verify Permissions on /etc/security/opasswd.old File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_security_opasswd_old |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_security_opasswd_old:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/security/opasswd.old, run the command:
$ sudo chmod 0600 /etc/security/opasswd.old
|
| Rationale | The /etc/security/opasswd.old file stores backups of old passwords to prevent
password reuse. Protection of this file is critical for system security. |
OVAL test results detailsTesting mode of /etc/security/opasswd.old
oval:ssg-test_file_permissions_etc_security_opasswd_old_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_security_opasswd_old_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/security/opasswd.old | oval:ssg-exclude_symlinks__etc_security_opasswd_old:ste:1 | oval:ssg-state_file_permissions_etc_security_opasswd_old_0_mode_0600or_stricter_:ste:1 |
Verify Permissions on shadow Filexccdf_org.ssgproject.content_rule_file_permissions_etc_shadow medium
Verify Permissions on shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_shadow:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.2.2 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-8.7.c | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 7.1.5 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/shadow, run the command:
$ sudo chmod 0640 /etc/shadow
|
| Rationale | The /etc/shadow file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture. |
OVAL test results detailsTesting mode of /etc/shadow
oval:ssg-test_file_permissions_etc_shadow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_shadow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shadow | oval:ssg-exclude_symlinks__etc_shadow:ste:1 | oval:ssg-state_file_permissions_etc_shadow_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on /etc/shells Filexccdf_org.ssgproject.content_rule_file_permissions_etc_shells medium
Verify Permissions on /etc/shells File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_etc_shells |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_etc_shells:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /etc/shells, run the command:
$ sudo chmod 0644 /etc/shells
|
| Rationale | The /etc/shells file contains the list of full pathnames to shells on the system.
Since this file is used by many system programs this file should be protected. |
OVAL test results detailsTesting mode of /etc/shells
oval:ssg-test_file_permissions_etc_shells_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_etc_shells_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/shells | oval:ssg-exclude_symlinks__etc_shells:ste:1 | oval:ssg-state_file_permissions_etc_shells_0_mode_0644or_stricter_:ste:1 |
Verify Group Who Owns /var/log/auth.log Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_auth medium
Verify Group Who Owns /var/log/auth.log File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_auth |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_auth:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/auth.log, run the command:
$ sudo chgrp adm /var/log/auth.log or
$ sudo chgrp root /var/log/auth.log
|
| Rationale | The /var/log/auth.log file contains records information about user
login attempts and authentication processes and should only be accessed by
authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/auth.log
oval:ssg-test_file_groupowner_var_log_auth_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_auth_0:obj:1 of type
file_object
| Filepath | Filter | Filter | Filter |
|---|
| /var/log/auth.log | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_auth_0_adm:ste:1 | oval:ssg-state_file_groupowner_var_log_auth_1_root:ste:1 |
Verify Group Who Owns /var/log/cloud-init.log* Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_cloud_init medium
Verify Group Who Owns /var/log/cloud-init.log* File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_cloud_init |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_cloud_init:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/cloud-init.log*, run the command:
$ sudo chgrp adm /var/log/cloud-init.log* or
$ sudo chgrp root /var/log/cloud-init.log*
|
| Rationale | The /var/log/cloud-init.log* file contains detailed debugging information that
helps users troubleshoot cloud-init and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_cloud_init_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_cloud_init_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*cloud-init\.log.* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_cloud_init_0_adm:ste:1 | oval:ssg-state_file_groupowner_var_log_cloud_init_1_root:ste:1 |
Verify Group Who Owns /var/log/*.journal(~) Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_journal medium
Verify Group Who Owns /var/log/*.journal(~) File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_journal |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_journal:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/*.journal(~), run the command:
$ sudo chgrp systemd-journal /var/log/*.journal(~) or
$ sudo chgrp root /var/log/*.journal(~)
|
| Rationale | The /var/log/*.journal(~) files are system logs managed by the "systemd" service. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_journal_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_journal_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter |
|---|
| no value | /var/log | .*\.journal[~]? | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_journal_0_systemd-journal:ste:1 | oval:ssg-state_file_groupowner_var_log_journal_1_root:ste:1 |
Verify Group Who Owns /var/log/lastlog Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_lastlog medium
Verify Group Who Owns /var/log/lastlog File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_lastlog |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_lastlog:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/lastlog, run the command:
$ sudo chgrp utmp /var/log/lastlog or
$ sudo chgrp root /var/log/lastlog
|
| Rationale | The /var/log/lastlog file contains logs of reports the most recent login of all users
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_lastlog_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_lastlog_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*lastlog(\.[^\/]+)? | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_lastlog_0_utmp:ste:1 | oval:ssg-state_file_groupowner_var_log_lastlog_1_root:ste:1 |
Verify Group Who Owns /var/log/localmessages* Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_localmessages medium
Verify Group Who Owns /var/log/localmessages* File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_localmessages |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_localmessages:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/localmessages*, run the command:
$ sudo chgrp adm /var/log/localmessages* or
$ sudo chgrp root /var/log/localmessages*
|
| Rationale | The /var/log/localmessages* file contains log messages from certain boot scripts,
including the DHCP client, and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_localmessages_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_localmessages_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*localmessages.* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_localmessages_0_adm:ste:1 | oval:ssg-state_file_groupowner_var_log_localmessages_1_root:ste:1 |
Verify Group Who Owns /var/log/messages Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages medium
Verify Group Who Owns /var/log/messages File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_messages:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/messages, run the command:
$ sudo chgrp adm /var/log/messages or
$ sudo chgrp root /var/log/messages
|
| Rationale | The /var/log/messages file contains logs of error messages in
the system and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/messages
oval:ssg-test_file_groupowner_var_log_messages_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_messages_0:obj:1 of type
file_object
| Filepath | Filter | Filter | Filter |
|---|
| /var/log/messages | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_messages_0_adm:ste:1 | oval:ssg-state_file_groupowner_var_log_messages_1_root:ste:1 |
Verify Group Who Owns /var/log/secure Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_secure medium
Verify Group Who Owns /var/log/secure File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_secure |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_secure:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/secure, run the command:
$ sudo chgrp adm /var/log/secure or
$ sudo chgrp root /var/log/secure
|
| Rationale | The /var/log/secure file contains information related to authentication
and authorization privileges and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_secure_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_secure_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*secure(.*[-\.].*)? | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_secure_0_adm:ste:1 | oval:ssg-state_file_groupowner_var_log_secure_1_root:ste:1 |
Verify Group Who Owns /var/log/syslog Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog medium
Verify Group Who Owns /var/log/syslog File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/syslog, run the command:
$ sudo chgrp adm /var/log/syslog
|
| Rationale | The /var/log/syslog file contains logs of error messages in
the system and should only be accessed by authorized personnel. |
Verify Group Who Owns /var/log/waagent.log Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_waagent medium
Verify Group Who Owns /var/log/waagent.log File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_waagent |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_waagent:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/waagent.log, run the command:
$ sudo chgrp adm /var/log/waagent.log or
$ sudo chgrp root /var/log/waagent.log
|
| Rationale | The /var/log/waagent.log file contains Azure Linux Guest Agent records
events that can be used for troubleshooting and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_waagent_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_waagent_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*waagent.log.* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_waagent_0_adm:ste:1 | oval:ssg-state_file_groupowner_var_log_waagent_1_root:ste:1 |
Verify Group Who Owns /var/log/(b|w)tmp(.*|-*) Filexccdf_org.ssgproject.content_rule_file_groupowner_var_log_wbtmp medium
Verify Group Who Owns /var/log/(b|w)tmp(.*|-*) File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_var_log_wbtmp |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_var_log_wbtmp:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/(b|w)tmp(.*|-*), run the command:
$ sudo chgrp utmp /var/log/(b|w)tmp(.*|-*) or
$ sudo chgrp root /var/log/(b|w)tmp(.*|-*)
|
| Rationale | The /var/log/(b|w)tmp(.*|-*) file contains logs of reports the most recent login of all users
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/
oval:ssg-test_file_groupowner_var_log_wbtmp_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_var_log_wbtmp_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*(b|w)tmp((\.|-)[^\/]+)? | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_var_log_wbtmp_0_utmp:ste:1 | oval:ssg-state_file_groupowner_var_log_wbtmp_1_root:ste:1 |
Verify ownership of log filesxccdf_org.ssgproject.content_rule_file_groupownerships_var_log medium
Verify ownership of log files
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownerships_var_log |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownerships_var_log:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | Any operating system providing too much information in error messages
risks compromising the data and security of the structure, and content
of error messages needs to be carefully considered by the organization.
Organizations carefully consider the structure/content of error messages.
The extent to which information systems are able to identify and handle
error conditions is guided by organizational policy and operational
requirements. Information that could be exploited by adversaries includes,
for example, erroneous logon attempts with passwords entered by mistake
as the username, mission/business information that can be derived from
(if not stated explicitly by) information recorded, and personal
information, such as account numbers, social security numbers, and credit
card numbers. |
| Rationale | The Debian 13 must generate error messages that provide information
necessary for corrective actions without revealing information that could
be exploited by adversaries. |
OVAL test results details/var/log/* group owner is root|adm
oval:ssg-test_group_ownership_var_log:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /var/log/exim4/mainlog | regular | 104 | 4 | 373 | rw-r----- |
| true | /var/log/sudo.log | regular | 0 | 0 | 1325 | rw------- |
| true | /var/log/unattended-upgrades/unattended-upgrades-shutdown.log | regular | 0 | 0 | 242 | rw-r----- |
| true | /var/log/cloud-init-output.log | regular | 0 | 4 | 4256 | rw-r----- |
| true | /var/log/alternatives.log | regular | 0 | 0 | 0 | rw-r----- |
| true | /var/log/aide/aideinit.log | regular | 987 | 4 | 1156 | rw-r----- |
| true | /var/log/aide/aideinit.errors | regular | 987 | 4 | 263 | rw-r----- |
| true | /var/log/dpkg.log | regular | 0 | 0 | 0 | rw-r----- |
Verify Groupownership of Files in /var/log/aptxccdf_org.ssgproject.content_rule_file_groupownerships_var_log_apt medium
Verify Groupownership of Files in /var/log/apt
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_apt |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownerships_var_log_apt:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/apt/*, run the command:
$ sudo chgrp adm /var/log/apt/* or
$ sudo chgrp root /var/log/apt/*
|
| Rationale | The /var/log/apt directory contains information about APT
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/apt/
oval:ssg-test_file_groupownerships_var_log_apt_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerships_var_log_apt_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log/apt | .* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupownerships_var_log_apt_0_adm:ste:1 | oval:ssg-state_file_groupownerships_var_log_apt_1_root:ste:1 |
Verify Groupownership of Files in /var/log/gdmxccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm medium
Verify Groupownership of Files in /var/log/gdm
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownerships_var_log_gdm:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/gdm/*, run the command:
$ sudo chgrp gdm /var/log/gdm/* or
$ sudo chgrp root /var/log/gdm/*
|
| Rationale | The /var/log/gdm directory contains information about the GDM daemon
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/gdm/
oval:ssg-test_file_groupownerships_var_log_gdm_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerships_var_log_gdm_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter |
|---|
| no value | /var/log/gdm | .* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupownerships_var_log_gdm_0_gdm:ste:1 | oval:ssg-state_file_groupownerships_var_log_gdm_1_root:ste:1 |
Verify Groupownership of Files in /var/log/gdm3xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm3 medium
Verify Groupownership of Files in /var/log/gdm3
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm3 |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownerships_var_log_gdm3:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/gdm3/*, run the command:
$ sudo chgrp gdm /var/log/gdm3/* or
$ sudo chgrp gdm3 /var/log/gdm3/* or
$ sudo chgrp root /var/log/gdm3/*
|
| Rationale | The /var/log/gdm3 directory contains information about the GDM daemon
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/gdm3/
oval:ssg-test_file_groupownerships_var_log_gdm3_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerships_var_log_gdm3_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter | Filter |
|---|
| no value | /var/log/gdm3 | .* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupownerships_var_log_gdm3_0_gdm:ste:1 | oval:ssg-state_file_groupownerships_var_log_gdm3_1_gdm3:ste:1 | oval:ssg-state_file_groupownerships_var_log_gdm3_2_root:ste:1 |
Verify Groupownership of Files in /var/log/landscapexccdf_org.ssgproject.content_rule_file_groupownerships_var_log_landscape medium
Verify Groupownership of Files in /var/log/landscape
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_landscape |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownerships_var_log_landscape:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/landscape/*, run the command:
$ sudo chgrp root /var/log/landscape/* or
$ sudo chgrp landscape /var/log/landscape/*
|
| Rationale | The /var/log/landscape directory contains information about
the landscape-client and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/landscape/
oval:ssg-test_file_groupownerships_var_log_landscape_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerships_var_log_landscape_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log/landscape | ^.*$ | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupownerships_var_log_landscape_0_root:ste:1 | oval:ssg-state_file_groupownerships_var_log_landscape_1_landscape:ste:1 |
Verify Grouponwership of Files in /var/log/sssdxccdf_org.ssgproject.content_rule_file_groupownerships_var_log_sssd medium
Verify Grouponwership of Files in /var/log/sssd
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_sssd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownerships_var_log_sssd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the group owner of /var/log/sssd/*, run the command:
$ sudo chgrp sssd /var/log/sssd/* or
$ sudo chgrp root /var/log/sssd/*
|
| Rationale | The /var/log/sssd directory contains debug logs for the System
Security Services Daemon (SSSD) and should only be accessed by authorized personnel. |
OVAL test results detailsTesting group ownership of /var/log/sssd/
oval:ssg-test_file_groupownerships_var_log_sssd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerships_var_log_sssd_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter |
|---|
| no value | /var/log/sssd | .* | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupownerships_var_log_sssd_0_sssd:ste:1 | oval:ssg-state_file_groupownerships_var_log_sssd_1_root:ste:1 |
Verify User Who Owns /var/log/auth.log Filexccdf_org.ssgproject.content_rule_file_owner_var_log_auth medium
Verify User Who Owns /var/log/auth.log File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_auth |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_auth:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/auth.log, run the command:
$ sudo chown syslog /var/log/auth.log or
$ sudo chown root /var/log/auth.log
|
| Rationale | The /var/log/auth.log file contains records information about user
login attempts and authentication processes and should only be accessed by
authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/auth.log
oval:ssg-test_file_owner_var_log_auth_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_auth_0:obj:1 of type
file_object
| Filepath | Filter | Filter | Filter |
|---|
| /var/log/auth.log | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_auth_0_syslog:ste:1 | oval:ssg-state_file_owner_var_log_auth_1_root:ste:1 |
Verify User Who Owns /var/log/cloud-init.log Filexccdf_org.ssgproject.content_rule_file_owner_var_log_cloud_init medium
Verify User Who Owns /var/log/cloud-init.log File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_cloud_init |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_cloud_init:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/cloud-init.log, run the command:
$ sudo chown syslog /var/log/cloud-init.log or
$ sudo chown root /var/log/cloud-init.log
|
| Rationale | The /var/log/cloud-init.log file contains detailed debugging information that
helps users troubleshoot cloud-init and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_cloud_init_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_cloud_init_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*cloud-init\.log.* | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_cloud_init_0_syslog:ste:1 | oval:ssg-state_file_owner_var_log_cloud_init_1_root:ste:1 |
Verify User Who Owns /var/log/*.journal(~) Filesxccdf_org.ssgproject.content_rule_file_owner_var_log_journal medium
Verify User Who Owns /var/log/*.journal(~) Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_journal |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_journal:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/*.journal(~), run the command:
$ sudo chown root /var/log/*.journal(~)
|
| Rationale | The /var/log/*.journal(~) files are system logs managed by the "systemd" service. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_journal_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_journal_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| no value | /var/log | .*\.journal(~)?$ | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_journal_0_0:ste:1 |
Verify User Who Owns /var/log/lastlog Filexccdf_org.ssgproject.content_rule_file_owner_var_log_lastlog medium
Verify User Who Owns /var/log/lastlog File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_lastlog |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_lastlog:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/lastlog, run the command:
$ sudo chown root /var/log/lastlog
|
| Rationale | The /var/log/lastlog file contains logs of reports the most recent login of all users
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_lastlog_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_lastlog_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*lastlog(\.[^\/]+)?$ | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_lastlog_0_0:ste:1 |
Verify User Who Owns /var/log/localmessages Filexccdf_org.ssgproject.content_rule_file_owner_var_log_localmessages medium
Verify User Who Owns /var/log/localmessages File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_localmessages |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_localmessages:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/localmessages, run the command:
$ sudo chown syslog /var/log/localmessages or
$ sudo chown root /var/log/localmessages
|
| Rationale | The /var/log/localmessages file contains log messages from certain boot scripts,
including the DHCP client, and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_localmessages_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_localmessages_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*localmessages.* | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_localmessages_0_syslog:ste:1 | oval:ssg-state_file_owner_var_log_localmessages_1_root:ste:1 |
Verify User Who Owns /var/log/messages Filexccdf_org.ssgproject.content_rule_file_owner_var_log_messages medium
Verify User Who Owns /var/log/messages File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_messages |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_messages:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/messages, run the command:
$ sudo chown root /var/log/messages
|
| Rationale | The /var/log/messages file contains logs of error messages in
the system and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/messages
oval:ssg-test_file_owner_var_log_messages_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_messages_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /var/log/messages | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_messages_0_0:ste:1 |
Verify User Who Owns /var/log/secure Filexccdf_org.ssgproject.content_rule_file_owner_var_log_secure medium
Verify User Who Owns /var/log/secure File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_secure |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_secure:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/secure, run the command:
$ sudo chown syslog /var/log/secure or
$ sudo chown root /var/log/secure
|
| Rationale | The /var/log/secure file contains information related to authentication
and authorization privileges and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_secure_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_secure_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*secure(.*[-\.].*)? | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_secure_0_syslog:ste:1 | oval:ssg-state_file_owner_var_log_secure_1_root:ste:1 |
Verify User Who Owns /var/log/syslog Filexccdf_org.ssgproject.content_rule_file_owner_var_log_syslog medium
Verify User Who Owns /var/log/syslog File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_syslog:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/syslog, run the command:
$ sudo chown root /var/log/syslog
|
| Rationale | The /var/log/syslog file contains logs of error messages in
the system and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/syslog
oval:ssg-test_file_owner_var_log_syslog_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_syslog_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /var/log/syslog | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_syslog_0_root:ste:1 |
Verify User Who Owns /var/log/waagent.log Filexccdf_org.ssgproject.content_rule_file_owner_var_log_waagent medium
Verify User Who Owns /var/log/waagent.log File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_waagent |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_waagent:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/waagent.log, run the command:
$ sudo chown syslog /var/log/waagent.log or
$ sudo chown root /var/log/waagent.log
|
| Rationale | The /var/log/waagent.log file contains Azure Linux Guest Agent records
events that can be used for troubleshooting and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_waagent_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_waagent_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log | .*waagent.log.* | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_waagent_0_syslog:ste:1 | oval:ssg-state_file_owner_var_log_waagent_1_root:ste:1 |
Verify User Who Owns /var/log/(b|w)tmp(.*|-*) Filexccdf_org.ssgproject.content_rule_file_owner_var_log_wbtmp medium
Verify User Who Owns /var/log/(b|w)tmp(.*|-*) File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_var_log_wbtmp |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_var_log_wbtmp:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/(b|w)tmp(.*|-*), run the command:
$ sudo chown root /var/log/(b|w)tmp(.*|-*)
|
| Rationale | The /var/log/(b|w)tmp(.*|-*) file contains logs of reports the most recent login of all users
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/
oval:ssg-test_file_owner_var_log_wbtmp_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_var_log_wbtmp_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*(b|w)tmp((\.|-)[^\/]+)?$ | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_var_log_wbtmp_0_0:ste:1 |
Verify ownership of log filesxccdf_org.ssgproject.content_rule_file_ownerships_var_log medium
Verify ownership of log files
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownerships_var_log |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownerships_var_log:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | Any operating system providing too much information in error messages
risks compromising the data and security of the structure, and content
of error messages needs to be carefully considered by the organization.
Organizations carefully consider the structure/content of error messages.
The extent to which information systems are able to identify and handle
error conditions is guided by organizational policy and operational
requirements. Information that could be exploited by adversaries includes,
for example, erroneous logon attempts with passwords entered by mistake
as the username, mission/business information that can be derived from
(if not stated explicitly by) information recorded, and personal
information, such as account numbers, social security numbers, and credit
card numbers. |
| Rationale | The Debian 13 must generate error messages that provide information
necessary for corrective actions without revealing information that could
be exploited by adversaries. |
OVAL test results details/var/log/* owner is root|syslog
oval:ssg-test_file_ownership_var_log:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| true | /var/log/sudo.log | regular | 0 | 0 | 1325 | rw------- |
| true | /var/log/unattended-upgrades/unattended-upgrades-shutdown.log | regular | 0 | 0 | 242 | rw-r----- |
| true | /var/log/cloud-init-output.log | regular | 0 | 4 | 4256 | rw-r----- |
| true | /var/log/alternatives.log | regular | 0 | 0 | 0 | rw-r----- |
| true | /var/log/dpkg.log | regular | 0 | 0 | 0 | rw-r----- |
Verify Ownership of Files in /var/log/aptxccdf_org.ssgproject.content_rule_file_ownerships_var_log_apt medium
Verify Ownership of Files in /var/log/apt
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownerships_var_log_apt |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownerships_var_log_apt:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/apt/*, run the command:
$ sudo chown root /var/log/apt/*
|
| Rationale | The /var/log/apt directory contains information about APT
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/apt/
oval:ssg-test_file_ownerships_var_log_apt_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerships_var_log_apt_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log/apt | ^.*$ | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_ownerships_var_log_apt_0_0:ste:1 |
Verify Ownership of Files in /var/log/gdmxccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm medium
Verify Ownership of Files in /var/log/gdm
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownerships_var_log_gdm:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/gdm/*, run the command:
$ sudo chown root /var/log/gdm/*
|
| Rationale | The /var/log/gdm directory contains information about the GDM daemon
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/gdm/
oval:ssg-test_file_ownerships_var_log_gdm_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerships_var_log_gdm_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| no value | /var/log/gdm | .* | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_ownerships_var_log_gdm_0_0:ste:1 |
Verify Ownership of Files in /var/log/gdm3xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm3 medium
Verify Ownership of Files in /var/log/gdm3
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm3 |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownerships_var_log_gdm3:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/gdm3/*, run the command:
$ sudo chown root /var/log/gdm3/*
|
| Rationale | The /var/log/gdm3 directory contains information about the GDM daemon
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/gdm3/
oval:ssg-test_file_ownerships_var_log_gdm3_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerships_var_log_gdm3_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| no value | /var/log/gdm3 | .* | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_ownerships_var_log_gdm3_0_0:ste:1 |
Verify Ownership of Files in /var/log/landscapexccdf_org.ssgproject.content_rule_file_ownerships_var_log_landscape medium
Verify Ownership of Files in /var/log/landscape
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownerships_var_log_landscape |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownerships_var_log_landscape:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/landscape/*, run the command:
$ sudo chown root /var/log/landscape/* or
$ sudo chown landscape /var/log/landscape/*
|
| Rationale | The /var/log/landscape directory contains information about
the landscape-client and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/landscape/
oval:ssg-test_file_ownerships_var_log_landscape_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerships_var_log_landscape_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter | Filter |
|---|
| /var/log/landscape | ^.*$ | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_ownerships_var_log_landscape_0_root:ste:1 | oval:ssg-state_file_ownerships_var_log_landscape_1_landscape:ste:1 |
Verify Ownership of Files in /var/log/sssdxccdf_org.ssgproject.content_rule_file_ownerships_var_log_sssd medium
Verify Ownership of Files in /var/log/sssd
| Rule ID | xccdf_org.ssgproject.content_rule_file_ownerships_var_log_sssd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_ownerships_var_log_sssd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the owner of /var/log/sssd/*, run the command:
$ sudo chown sssd /var/log/sssd/* or
$ sudo chown root /var/log/sssd/*
|
| Rationale | The /var/log/sssd directory contains debug logs for the System
Security Services Daemon (SSSD) and should only be accessed by authorized personnel. |
OVAL test results detailsTesting user ownership of /var/log/sssd/
oval:ssg-test_file_ownerships_var_log_sssd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerships_var_log_sssd_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter |
|---|
| no value | /var/log/sssd | .* | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_ownerships_var_log_sssd_0_sssd:ste:1 | oval:ssg-state_file_ownerships_var_log_sssd_1_root:ste:1 |
Verify Permissions on files in the /var/log/apt/.* directoryxccdf_org.ssgproject.content_rule_file_permissions_var_log_apt medium
Verify Permissions on files in the /var/log/apt/.* directory
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_apt |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_apt:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/apt/.*, run the command:
$ sudo chmod 0644 /var/log/apt/.*
|
| Rationale | The /var/log/apt directory contains information about APT
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/apt/
oval:ssg-test_file_permissions_var_log_apt_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_apt_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log/apt | ^.*$ | oval:ssg-exclude_symlinks__var_log_apt:ste:1 | oval:ssg-state_file_permissions_var_log_apt_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on /var/log/auth.log Filexccdf_org.ssgproject.content_rule_file_permissions_var_log_auth medium
Verify Permissions on /var/log/auth.log File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_auth |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_auth:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/auth.log, run the command:
$ sudo chmod 0640 /var/log/auth.log
|
| Rationale | The /var/log/auth.log file contains records information about user
login attempts and authentication processes and should only be accessed by
authorized personnel. |
OVAL test results detailsTesting mode of /var/log/auth.log
oval:ssg-test_file_permissions_var_log_auth_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_auth_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /var/log/auth.log | oval:ssg-exclude_symlinks__var_log_auth:ste:1 | oval:ssg-state_file_permissions_var_log_auth_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on /var/log/cloud-init.log(.*) Filesxccdf_org.ssgproject.content_rule_file_permissions_var_log_cloud-init medium
Verify Permissions on /var/log/cloud-init.log(.*) Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_cloud-init |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_cloud-init:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/cloud-init.log, run the command:
$ sudo chmod 0644 /var/log/cloud-init.log
|
| Rationale | The /var/log/cloud-init.log file contains detailed debugging information that
helps users troubleshoot cloud-init and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/
oval:ssg-test_file_permissions_var_log_cloud-init_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_cloud-init_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*cloud-init.log([^\/]+)?$ | oval:ssg-exclude_symlinks__var_log_cloud-init:ste:1 | oval:ssg-state_file_permissions_var_log_cloud-init_0_mode_0644or_stricter_:ste:1 |
Verify Permissions of Files in /var/log/gdmxccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm medium
Verify Permissions of Files in /var/log/gdm
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_gdm:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/gdm/*, run the command:
$ sudo chmod 0660 /var/log/gdm/*
|
| Rationale | The /var/log/gdm directory contains information about the GDM daemon
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/gdm/
oval:ssg-test_file_permissions_var_log_gdm_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_gdm_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| no value | /var/log/gdm | .* | oval:ssg-exclude_symlinks__var_log_gdm:ste:1 | oval:ssg-state_file_permissions_var_log_gdm_0_mode_0660or_stricter_:ste:1 |
Verify Permissions of Files in /var/log/gdm3xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm3 medium
Verify Permissions of Files in /var/log/gdm3
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm3 |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_gdm3:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/gdm3/*, run the command:
$ sudo chmod 0660 /var/log/gdm3/*
|
| Rationale | The /var/log/gdm3 directory contains information about the GDM daemon
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/gdm3/
oval:ssg-test_file_permissions_var_log_gdm3_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_gdm3_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| no value | /var/log/gdm3 | .* | oval:ssg-exclude_symlinks__var_log_gdm3:ste:1 | oval:ssg-state_file_permissions_var_log_gdm3_0_mode_0660or_stricter_:ste:1 |
Verify Permissions on /var/log/lastlog(.*) Filesxccdf_org.ssgproject.content_rule_file_permissions_var_log_lastlog medium
Verify Permissions on /var/log/lastlog(.*) Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_lastlog |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_lastlog:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/lastlog, run the command:
$ sudo chmod 0664 /var/log/lastlog
|
| Rationale | The /var/log/lastlog file contains logs of reports the most recent login of all users
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/
oval:ssg-test_file_permissions_var_log_lastlog_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_lastlog_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*lastlog(\.[^\/]+)?$ | oval:ssg-exclude_symlinks__var_log_lastlog:ste:1 | oval:ssg-state_file_permissions_var_log_lastlog_0_mode_0664or_stricter_:ste:1 |
Verify Permissions on /var/log/localmessages(.*) Filesxccdf_org.ssgproject.content_rule_file_permissions_var_log_localmessages medium
Verify Permissions on /var/log/localmessages(.*) Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_localmessages |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_localmessages:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/localmessages, run the command:
$ sudo chmod 0644 /var/log/localmessages
|
| Rationale | The /var/log/localmessages file contains log messages from certain boot scripts,
including the DHCP client, and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/
oval:ssg-test_file_permissions_var_log_localmessages_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_localmessages_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*localmessages([^\/]+)?$ | oval:ssg-exclude_symlinks__var_log_localmessages:ste:1 | oval:ssg-state_file_permissions_var_log_localmessages_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on /var/log/messages Filexccdf_org.ssgproject.content_rule_file_permissions_var_log_messages medium
Verify Permissions on /var/log/messages File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_messages:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/messages, run the command:
$ sudo chmod 0640 /var/log/messages
|
| Rationale | The /var/log/messages file contains logs of error messages in
the system and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/messages
oval:ssg-test_file_permissions_var_log_messages_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_messages_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /var/log/messages | oval:ssg-exclude_symlinks__var_log_messages:ste:1 | oval:ssg-state_file_permissions_var_log_messages_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on /var/log/secure Filexccdf_org.ssgproject.content_rule_file_permissions_var_log_secure medium
Verify Permissions on /var/log/secure File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_secure |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_secure:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/secure, run the command:
$ sudo chmod 0640 /var/log/secure
|
| Rationale | The /var/log/secure file contains information related to authentication
and authorization privileges and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/secure
oval:ssg-test_file_permissions_var_log_secure_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_secure_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /var/log/secure | oval:ssg-exclude_symlinks__var_log_secure:ste:1 | oval:ssg-state_file_permissions_var_log_secure_0_mode_0640or_stricter_:ste:1 |
Verify Permissions of Files in /var/log/sssdxccdf_org.ssgproject.content_rule_file_permissions_var_log_sssd medium
Verify Permissions of Files in /var/log/sssd
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_sssd |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_sssd:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/sssd/*, run the command:
$ sudo chmod 0660 /var/log/sssd/*
|
| Rationale | The /var/log/sssd directory contains debug logs for the System
Security Services Daemon (SSSD) and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/sssd/
oval:ssg-test_file_permissions_var_log_sssd_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_sssd_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log/sssd | .* | oval:ssg-exclude_symlinks__var_log_sssd:ste:1 | oval:ssg-state_file_permissions_var_log_sssd_0_mode_0660or_stricter_:ste:1 |
Verify Permissions on /var/log/syslog Filexccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog medium
Verify Permissions on /var/log/syslog File
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_syslog:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/syslog, run the command:
$ sudo chmod 0640 /var/log/syslog
|
| Rationale | The /var/log/syslog file contains logs of error messages in
the system and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/syslog
oval:ssg-test_file_permissions_var_log_syslog_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_syslog_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /var/log/syslog | oval:ssg-exclude_symlinks__var_log_syslog:ste:1 | oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on /var/log/waagent.log(.*) Filesxccdf_org.ssgproject.content_rule_file_permissions_var_log_waagent medium
Verify Permissions on /var/log/waagent.log(.*) Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_waagent |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_waagent:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/waagent.log, run the command:
$ sudo chmod 0644 /var/log/waagent.log
|
| Rationale | The /var/log/waagent.log file contains Azure Linux Guest Agent records
events that can be used for troubleshooting and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/
oval:ssg-test_file_permissions_var_log_waagent_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_waagent_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*waagent.log([^\/]+)?$ | oval:ssg-exclude_symlinks__var_log_waagent:ste:1 | oval:ssg-state_file_permissions_var_log_waagent_0_mode_0644or_stricter_:ste:1 |
Verify Permissions on /var/log/wtmp(.*) Filesxccdf_org.ssgproject.content_rule_file_permissions_var_log_wbtmp medium
Verify Permissions on /var/log/wtmp(.*) Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_var_log_wbtmp |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_var_log_wbtmp:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To properly set the permissions of /var/log/(b|w)tmp(.*|-*), run the command:
$ sudo chmod 0664 /var/log/(b|w)tmp(.*|-*)
|
| Rationale | The /var/log/(b|w)tmp(.*|-*) files contains logs of reports the most recent login of all users
and should only be accessed by authorized personnel. |
OVAL test results detailsTesting mode of /var/log/
oval:ssg-test_file_permissions_var_log_wbtmp_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_var_log_wbtmp_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /var/log | .*(b|w)tmp((\.|-)[^\/]+)?$ | oval:ssg-exclude_symlinks__var_log_wbtmp:ste:1 | oval:ssg-state_file_permissions_var_log_wbtmp_0_mode_0664or_stricter_:ste:1 |
Ensure No World-Writable Files Existxccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable medium
Ensure No World-Writable Files Exist
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_unauthorized_world_writable:def:1 |
| Time | 2026-11-02T22:58:08+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | anssi | R54 | | cis | 7.1.11 | | ism | 1409 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | It is generally a good idea to remove global (other) write access to a file when it is
discovered. However, check with documentation for specific applications before making changes.
Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured
application or user account. Finally, this applies to real files and not virtual files that
are a part of pseudo file systems such as sysfs or procfs. |
| Rationale | Data in world-writable files can be modified by any user on the system. In almost all
circumstances, files can be configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk caused by world-writable files. |
| Warnings | warning
This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See https://access.redhat.com/articles/6999111. |
OVAL test results detailsCheck the existence of world-writable files
oval:ssg-test_file_permissions_unauthorized_world_write:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_unauthorized_world_write:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter |
|---|
| no value | / | oval:ssg-state_file_permissions_unauthorized_world_write:ste:1 | oval:ssg-state_file_permissions_unauthorized_world_write_special_selinux_files:ste:1 | oval:ssg-state_file_permissions_unauthorized_world_write_sysroot:ste:1 |
Ensure All Files Are Owned by a Groupxccdf_org.ssgproject.content_rule_file_permissions_ungroupowned medium
Ensure All Files Are Owned by a Group
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_ungroupowned:def:1 |
| Time | 2026-11-02T22:58:38+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.06, DSS06.10 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R53 | | cis | 7.1.12 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | If any file is not group-owned by a valid defined group, the cause of the lack of
group-ownership must be investigated. Following this, those files should be deleted or
assigned to an appropriate group. The groups need to be defined in /etc/group
or in /usr/lib/group if nss-altfiles are configured to be used
in /etc/nsswitch.conf.
Locate the mount points related to local devices by the following command:
$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
For all mount points listed by the previous command, it is necessary to search for files which
do not belong to a valid group using the following command:
$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null
|
| Rationale | Unowned files do not directly imply a security problem, but they are generally a sign that
something is amiss. They may be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging to a deleted account, or
other similar cases. The files should be repaired so they will not cause problems when
accounts are created in the future, and the cause should be discovered and addressed. |
| Warnings | warning
This rule only considers local groups as valid groups.
If you have your groups defined outside /etc/group or /usr/lib/group, the rule won't consider those. warning
This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See https://access.redhat.com/articles/6999111. |
OVAL test results detailsTest if /etc/nssswitch.conf contains 'altfiles' in 'group' key
oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| false | /etc/nsswitch.conf | group: files |
package nss-altfiles is installed
oval:ssg-test_file_permissions_ungroupowned_package_nss-altfiles_installed:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_file_permissions_ungroupowned_package_nss-altfiles_installed:obj:1 of type
dpkginfo_object
there are no files with group owner different than local groups
oval:ssg-test_file_permissions_ungroupowned:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_ungroupowned:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| / | | /boot/efi | | 2 | | 0 | | 1 | | 3 | | 4 | | 5 | | 6 | | 7 | | 8 | | 9 | | 10 | | 12 | | 13 | | 15 | | 20 | | 21 | | 22 | | 24 | | 25 | | 26 | | 27 | | 29 | | 30 | | 33 | | 34 | | 37 | | 38 | | 39 | | 40 | | 42 | | 43 | | 44 | | 45 | | 46 | | 50 | | 60 | | 100 | | 65534 | | 999 | | 998 | | 997 | | 101 | | 996 | | 102 | | 995 | | 994 | | 993 | | 992 | | 991 | | 990 | | 103 | | 988 | | 1000 | | 104 | | 987 | | 1001 | | 1002 | | 986 | | 985 | | 105 | | 989 |
| no value | / | oval:ssg-state_file_permissions_ungroupowned_local_group_owner:ste:1 | oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1 |
Test if /etc/nssswitch.conf contains 'altfiles' in 'group' key
oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| false | /etc/nsswitch.conf | group: files |
package nss-altfiles is installed
oval:ssg-test_file_permissions_ungroupowned_package_nss-altfiles_installed:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_file_permissions_ungroupowned_package_nss-altfiles_installed:obj:1 of type
dpkginfo_object
there are no files with group owner different than local groups
oval:ssg-test_file_permissions_ungroupowned_with_usrlib:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_ungroupowned_with_usrlib:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter |
|---|
| / | | /boot/efi | | 2 | | 0 | | 1 | | 3 | | 4 | | 5 | | 6 | | 7 | | 8 | | 9 | | 10 | | 12 | | 13 | | 15 | | 20 | | 21 | | 22 | | 24 | | 25 | | 26 | | 27 | | 29 | | 30 | | 33 | | 34 | | 37 | | 38 | | 39 | | 40 | | 42 | | 43 | | 44 | | 45 | | 46 | | 50 | | 60 | | 100 | | 65534 | | 999 | | 998 | | 997 | | 101 | | 996 | | 102 | | 995 | | 994 | | 993 | | 992 | | 991 | | 990 | | 103 | | 988 | | 1000 | | 104 | | 987 | | 1001 | | 1002 | | 986 | | 985 | | 105 | | 989 |
| no value | / | oval:ssg-state_file_permissions_ungroupowned_local_group_owner_with_usrlib:ste:1 | oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1 |
Ensure All Files Are Owned by a Userxccdf_org.ssgproject.content_rule_no_files_unowned_by_user medium
Ensure All Files Are Owned by a User
| Rule ID | xccdf_org.ssgproject.content_rule_no_files_unowned_by_user |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_files_unowned_by_user:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 12, 13, 14, 15, 16, 18, 3, 5, 9 | | cobit5 | APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R53 | | cis | 7.1.12 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | If any files are not owned by a user, then the cause of their lack of ownership should be
investigated. Following this, the files should be deleted or assigned to an appropriate user.
Locate the mount points related to local devices by the following command:
$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
For all mount points listed by the previous command, it is necessary to search for files which
do not belong to a valid user using the following command:
$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null
|
| Rationale | Unowned files do not directly imply a security problem, but they are generally a sign that
something is amiss. They may be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging to a deleted account, or
other similar cases. The files should be repaired so they will not cause problems when
accounts are created in the future, and the cause should be discovered and addressed. |
| Warnings | warning
For this rule to evaluate centralized user accounts, getent must be working properly
so that running the command getent passwd returns a list of all users in your organization.
If using the System Security Services Daemon (SSSD), enumerate = true must be configured
in your organization's domain to return a complete list of users warning
This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See https://access.redhat.com/articles/6999111. |
OVAL test results detailsthere are no files without a known owner
oval:ssg-test_no_files_unowned_by_user:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_no_files_unowned_by_user:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter |
|---|
| 1 | | 0 | | 2 | | 3 | | 4 | | 5 | | 6 | | 7 | | 8 | | 9 | | 10 | | 13 | | 33 | | 34 | | 38 | | 39 | | 42 | | 65534 | | 998 | | 997 | | 100 | | 101 | | 996 | | 102 | | 990 | | 989 | | 988 | | 1000 | | 103 | | 987 | | 986 | | 104 | | 999 | | / | | /boot/efi |
| no value | / | oval:ssg-state_no_files_unowned_by_user_uids_list:ste:1 |
Verify permissions of log filesxccdf_org.ssgproject.content_rule_permissions_local_var_log medium
Verify permissions of log files
| Rule ID | xccdf_org.ssgproject.content_rule_permissions_local_var_log |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-permissions_local_var_log:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | Any operating system providing too much information in error messages
risks compromising the data and security of the structure, and content
of error messages needs to be carefully considered by the organization.
Organizations carefully consider the structure/content of error messages.
The extent to which information systems are able to identify and handle
error conditions is guided by organizational policy and operational
requirements. Information that could be exploited by adversaries includes,
for example, erroneous logon attempts with passwords entered by mistake
as the username, mission/business information that can be derived from
(if not stated explicitly by) information recorded, and personal
information, such as account numbers, social security numbers, and credit
card numbers. |
| Rationale | The Debian 13 must generate error messages that provide information
necessary for corrective actions without revealing information that could
be exploited by adversaries. |
OVAL test results detailsTesting mode of /var/log/
oval:ssg-test_file_permissionspermissions_local_var_log_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissionspermissions_local_var_log_0:obj:1 of type
file_object
| Behaviors | Path | Filename | Filter | Filter | Filter | Filter | Filter | Filter | Filter | Filter | Filter |
|---|
| no value | /var/log | .* | oval:ssg-exclude_files_permissions_local_var_log_0:ste:1 | oval:ssg-exclude_files_permissions_local_var_log_1:ste:1 | oval:ssg-exclude_files_permissions_local_var_log_2:ste:1 | oval:ssg-exclude_files_permissions_local_var_log_3:ste:1 | oval:ssg-exclude_files_permissions_local_var_log_4:ste:1 | oval:ssg-exclude_files_permissions_local_var_log_5:ste:1 | oval:ssg-exclude_files_permissions_local_var_log_6:ste:1 | oval:ssg-exclude_symlinks_permissions_local_var_log:ste:1 | oval:ssg-state_file_permissionspermissions_local_var_log_0_mode_0640or_stricter_:ste:1 |
Enable Kernel Parameter to Enforce DAC on Hardlinksxccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks medium
Enable Kernel Parameter to Enforce DAC on Hardlinks
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_fs_protected_hardlinks:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-6(a), AC-6(1) | | os-srg | SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000324-GPOS-00125 | | anssi | R14 | | cis | 1.5.1 |
|
| Description | To set the runtime status of the fs.protected_hardlinks kernel parameter, run the following command: $ sudo sysctl -w fs.protected_hardlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: fs.protected_hardlinks = 1
|
| Rationale | By enabling this kernel parameter, users can no longer create soft or hard links to
files which they do not own. Disallowing such hardlinks mitigate vulnerabilities
based on insecure file system accessed by privileged programs, avoiding an
exploitation vector exploiting unsafe use of open() or creat(). |
OVAL test results detailsfs.protected_hardlinks static configuration
oval:ssg-test_sysctl_fs_protected_hardlinks_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /lib/sysctl.d/50-default.conf | fs.protected_hardlinks = 1 |
fs.protected_hardlinks static configuration
oval:ssg-test_sysctl_fs_protected_hardlinks_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /lib/sysctl.d/50-default.conf | fs.protected_hardlinks = 1 |
fs.protected_hardlinks static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_fs_protected_hardlinks_static_pkg_correct:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /usr/lib/sysctl.d/50-default.conf | fs.protected_hardlinks = 1 |
kernel runtime parameter fs.protected_hardlinks set to 1
oval:ssg-test_sysctl_fs_protected_hardlinks_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | fs.protected_hardlinks | 1 |
Remove autofs Packagexccdf_org.ssgproject.content_rule_package_autofs_removed low
Remove autofs Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_autofs_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_autofs_removed:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | |
| Description | autofs allows automatic mounting of devices, typically including CD/DVDs and USB
drives.
The autofs package can be removed with the following command:
$ apt-get remove autofs
|
| Rationale | With automounting enabled anyone with physical access could attach a USB drive or
disc and have its contents available in the filesystem even if they lacked permissions to
mount it themselves. |
OVAL test results detailspackage autofs is removed
oval:ssg-test_package_autofs_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_autofs_removed:obj:1 of type
dpkginfo_object
Disable the Automounterxccdf_org.ssgproject.content_rule_service_autofs_disabled medium
Disable the Automounter
| Rule ID | xccdf_org.ssgproject.content_rule_service_autofs_disabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.4.6 | | hipaa | 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6 | | iso27001-2013 | A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | CM-7(a), CM-7(b), CM-6(a), MP-7 | | nist-csf | PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7 | | os-srg | SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227 | | cis | 2.1.1 |
|
| Description | The autofs daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as /misc/cd.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
possible to configure filesystem mounts statically by editing /etc/fstab
rather than relying on the automounter.
The autofs service can be disabled with the following command:
$ sudo systemctl mask --now autofs.service
|
| Rationale | Disabling the automounter permits the administrator to
statically control filesystem mounting through /etc/fstab.
Additionally, automatically mounting filesystems permits easy introduction of
unknown devices, thereby facilitating malicious activity. |
Disable Mounting of cramfsxccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled low
Disable Mounting of cramfs
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_cramfs_disabled:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000095-GPOS-00049 | | cis | 1.1.1.1 |
|
| Description |
To configure the system to prevent the cramfs
kernel module from being loaded, add the following line to the file /etc/modprobe.d/cramfs.conf:
install cramfs /bin/false
This entry will cause a non-zero return value during a cramfs module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install cramfs /bin/true
This effectively prevents usage of this uncommon filesystem.
The cramfs filesystem type is a compressed read-only
Linux filesystem embedded in small footprint systems. A
cramfs image can be used without having to first
decompress the image. |
| Rationale | Removing support for unneeded filesystem types reduces the local attack surface
of the server. |
OVAL test results detailskernel module cramfs disabled
oval:ssg-test_kernmod_cramfs_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/cramfs.conf | install cramfs /bin/false |
kernel module cramfs disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ | 1 |
Disable Mounting of freevxfsxccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled low
Disable Mounting of freevxfs
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_freevxfs_disabled:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 1.1.1.2 |
|
| Description |
To configure the system to prevent the freevxfs
kernel module from being loaded, add the following line to the file /etc/modprobe.d/freevxfs.conf:
install freevxfs /bin/false
This entry will cause a non-zero return value during a freevxfs module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install freevxfs /bin/true
This effectively prevents usage of this uncommon filesystem. |
| Rationale | Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled. |
OVAL test results detailskernel module freevxfs disabled
oval:ssg-test_kernmod_freevxfs_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/freevxfs.conf | install freevxfs /bin/false |
kernel module freevxfs disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$ | 1 |
Disable Mounting of hfsxccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled low
Disable Mounting of hfs
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_hfs_disabled:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 1.1.1.3 |
|
| Description |
To configure the system to prevent the hfs
kernel module from being loaded, add the following line to the file /etc/modprobe.d/hfs.conf:
install hfs /bin/false
This entry will cause a non-zero return value during a hfs module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install hfs /bin/true
This effectively prevents usage of this uncommon filesystem. |
| Rationale | Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled. |
OVAL test results detailskernel module hfs disabled
oval:ssg-test_kernmod_hfs_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/hfs.conf | install hfs /bin/false |
kernel module hfs disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_hfs_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+hfs\s+(/bin/false|/bin/true)$ | 1 |
Disable Mounting of hfsplusxccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled low
Disable Mounting of hfsplus
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_hfsplus_disabled:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 1.1.1.4 |
|
| Description |
To configure the system to prevent the hfsplus
kernel module from being loaded, add the following line to the file /etc/modprobe.d/hfsplus.conf:
install hfsplus /bin/false
This entry will cause a non-zero return value during a hfsplus module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install hfsplus /bin/true
This effectively prevents usage of this uncommon filesystem. |
| Rationale | Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled. |
OVAL test results detailskernel module hfsplus disabled
oval:ssg-test_kernmod_hfsplus_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/hfsplus.conf | install hfsplus /bin/false |
kernel module hfsplus disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$ | 1 |
Disable Mounting of jffs2xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled low
Disable Mounting of jffs2
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_jffs2_disabled:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | cui | 3.4.6 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 1.1.1.5 |
|
| Description |
To configure the system to prevent the jffs2
kernel module from being loaded, add the following line to the file /etc/modprobe.d/jffs2.conf:
install jffs2 /bin/false
This entry will cause a non-zero return value during a jffs2 module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install jffs2 /bin/true
This effectively prevents usage of this uncommon filesystem. |
| Rationale | Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled. |
OVAL test results detailskernel module jffs2 disabled
oval:ssg-test_kernmod_jffs2_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/jffs2.conf | install jffs2 /bin/false |
kernel module jffs2 disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+jffs2\s+(/bin/false|/bin/true)$ | 1 |
Disable Modprobe Loading of USB Storage Driverxccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled medium
Disable Modprobe Loading of USB Storage Driver
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_usb-storage_disabled:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 15, 16, 5 | | cobit5 | APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.1.21 | | hipaa | 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6 | | iso27001-2013 | A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | CM-7(a), CM-7(b), CM-6(a), MP-7 | | nist-csf | PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7 | | os-srg | SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227 | | app-srg-ctr | SRG-APP-000141-CTR-000315 | | cis | 1.1.1.10 | | pcidss4 | 3.4.2, 3.4 |
|
| Description | To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.
To configure the system to prevent the usb-storage
kernel module from being loaded, add the following line to the file /etc/modprobe.d/usb-storage.conf:
install usb-storage /bin/false
This entry will cause a non-zero return value during a usb-storage module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both /bin/true and /bin/false are allowed by OVAL and will be accepted by the scan):
install usb-storage /bin/true
This will prevent the modprobe program from loading the usb-storage
module, but will not prevent an administrator (or another program) from using the
insmod program to load the module manually. |
| Rationale | USB storage devices such as thumb drives can be used to introduce
malicious software. |
OVAL test results detailskernel module usb-storage disabled
oval:ssg-test_kernmod_usb-storage_disabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/modprobe.d/usb-storage.conf | install usb-storage /bin/false |
kernel module usb-storage disabled in /etc/modprobe.conf
oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/modprobe.conf | ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ | 1 |
Add nodev Option to /dev/shmxccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev medium
Add nodev Option to /dev/shm
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_dev_shm_nodev:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.2.2 | | ism | 1409 |
|
| Description | The nodev mount option can be used to prevent creation of device
files in /dev/shm. Legitimate character and block devices should
not exist within temporary directories like /dev/shm.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
OVAL test results detailsnodev on /dev/shm
oval:ssg-test_dev_shm_partition_nodev_expected:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| true | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
/dev/shm exists
oval:ssg-test_dev_shm_partition_nodev_expected_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
nodev on /dev/shm in /etc/fstab
oval:ssg-test_dev_shm_partition_nodev_expected_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/fstab | tmpfs /dev/shm tmpfs defaults,nosuid,inode64,nodev,noexec |
Add noexec Option to /dev/shmxccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec medium
Add noexec Option to /dev/shm
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_dev_shm_noexec:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.2.4 | | ism | 1409 |
|
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /dev/shm.
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as /dev/shm.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm. |
| Rationale | Allowing users to execute binaries from world-writable directories
such as /dev/shm can expose the system to potential compromise. |
OVAL test results detailsnoexec on /dev/shm
oval:ssg-test_dev_shm_partition_noexec_expected:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| true | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
/dev/shm exists
oval:ssg-test_dev_shm_partition_noexec_expected_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
noexec on /dev/shm in /etc/fstab
oval:ssg-test_dev_shm_partition_noexec_expected_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/fstab | tmpfs /dev/shm tmpfs defaults,nosuid,inode64,nodev,noexec |
Add nosuid Option to /dev/shmxccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid medium
Add nosuid Option to /dev/shm
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_dev_shm_nosuid:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.2.3 | | ism | 1409 |
|
| Description | The nosuid mount option can be used to prevent execution
of setuid programs in /dev/shm. The SUID and SGID permissions should not
be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
OVAL test results detailsnosuid on /dev/shm
oval:ssg-test_dev_shm_partition_nosuid_expected:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| true | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
/dev/shm exists
oval:ssg-test_dev_shm_partition_nosuid_expected_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /dev/shm | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | inode64 | 237921 | 0 | 237921 | 4096 |
nosuid on /dev/shm in /etc/fstab
oval:ssg-test_dev_shm_partition_nosuid_expected_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/fstab | tmpfs /dev/shm tmpfs defaults,nosuid,inode64,nodev,noexec |
Add nodev Option to /homexccdf_org.ssgproject.content_rule_mount_option_home_nodev unknown
Add nodev Option to /home
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_home_nodev |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | unknown |
| References: | |
| Description | The nodev mount option can be used to prevent device files from
being created in /home.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/home. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
Add nosuid Option to /homexccdf_org.ssgproject.content_rule_mount_option_home_nosuid medium
Add nosuid Option to /home
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_home_nosuid |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227 | | anssi | R28 | | cis | 1.1.2.3.3 |
|
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /home. The SUID and SGID permissions
should not be required in these user data directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/home. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from user home directory partitions. |
Add nodev Option to /tmpxccdf_org.ssgproject.content_rule_mount_option_tmp_nodev medium
Add nodev Option to /tmp
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_tmp_nodev:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.1.2 |
|
| Description | The nodev mount option can be used to prevent device files from
being created in /tmp. Legitimate character and block devices
should not exist within temporary directories like /tmp.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/tmp. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
OVAL test results detailsnodev on /tmp
oval:ssg-test_tmp_partition_nodev_optional:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| true | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
/tmp exists
oval:ssg-test_tmp_partition_nodev_optional_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
nodev on /tmp in /etc/fstab
oval:ssg-test_tmp_partition_nodev_optional_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/fstab | tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime |
/tmp exists in /etc/fstab
oval:ssg-test_tmp_partition_nodev_optional_exist_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/fstab | tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime |
Add noexec Option to /tmpxccdf_org.ssgproject.content_rule_mount_option_tmp_noexec medium
Add noexec Option to /tmp
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_tmp_noexec:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | anssi | R28 | | cis | 1.1.2.1.4 |
|
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /tmp.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/tmp. |
| Rationale | Allowing users to execute binaries from world-writable directories
such as /tmp should never be necessary in normal operation and
can expose the system to potential compromise. |
OVAL test results detailsnoexec on /tmp
oval:ssg-test_tmp_partition_noexec_optional:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| true | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
/tmp exists
oval:ssg-test_tmp_partition_noexec_optional_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
noexec on /tmp in /etc/fstab
oval:ssg-test_tmp_partition_noexec_optional_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/fstab | tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime |
/tmp exists in /etc/fstab
oval:ssg-test_tmp_partition_noexec_optional_exist_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/fstab | tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime |
Add nosuid Option to /tmpxccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid medium
Add nosuid Option to /tmp
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_tmp_nosuid:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 13, 14, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | anssi | R28 | | cis | 1.1.2.1.3 |
|
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /tmp. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/tmp. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
OVAL test results detailsnosuid on /tmp
oval:ssg-test_tmp_partition_nosuid_optional:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| true | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
/tmp exists
oval:ssg-test_tmp_partition_nosuid_optional_exist:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left | Block size |
|---|
| not evaluated | /tmp | tmpfs | | tmpfs | rw | nosuid | nodev | noexec | relatime | nr_inodes=1048576 | inode64 | bind | 237921 | 104 | 237817 | 4096 |
nosuid on /tmp in /etc/fstab
oval:ssg-test_tmp_partition_nosuid_optional_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/fstab | tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime |
/tmp exists in /etc/fstab
oval:ssg-test_tmp_partition_nosuid_optional_exist_in_fstab:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/fstab | tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime |
Add nodev Option to /var/log/auditxccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev medium
Add nodev Option to /var/log/audit
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.7.2 |
|
| Description | The nodev mount option can be used to prevent device files from
being created in /var/log/audit.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
Add noexec Option to /var/log/auditxccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec medium
Add noexec Option to /var/log/audit
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.7.4 |
|
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/log/audit.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit. |
| Rationale | Allowing users to execute binaries from directories containing audit log files
such as /var/log/audit should never be necessary in normal operation and
can expose the system to potential compromise. |
Add nosuid Option to /var/log/auditxccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid medium
Add nosuid Option to /var/log/audit
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.7.3 |
|
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/log/audit. The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files. |
Add nodev Option to /var/logxccdf_org.ssgproject.content_rule_mount_option_var_log_nodev medium
Add nodev Option to /var/log
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.6.2 |
|
| Description | The nodev mount option can be used to prevent device files from
being created in /var/log.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
Add noexec Option to /var/logxccdf_org.ssgproject.content_rule_mount_option_var_log_noexec medium
Add noexec Option to /var/log
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | anssi | R28 | | cis | 1.1.2.6.4 |
|
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/log.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log. |
| Rationale | Allowing users to execute binaries from directories containing log files
such as /var/log should never be necessary in normal operation and
can expose the system to potential compromise. |
Add nosuid Option to /var/logxccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid medium
Add nosuid Option to /var/log
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | anssi | R28 | | cis | 1.1.2.6.3 |
|
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/log. The SUID and SGID permissions
should not be required in directories containing log files.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files. |
Add nodev Option to /varxccdf_org.ssgproject.content_rule_mount_option_var_nodev medium
Add nodev Option to /var
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_nodev |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7 | | nist-csf | PR.IP-1, PR.PT-2, PR.PT-3 | | os-srg | SRG-OS-000368-GPOS-00154 | | cis | 1.1.2.4.2 |
|
| Description | The nodev mount option can be used to prevent device files from
being created in /var.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
Add nosuid Option to /varxccdf_org.ssgproject.content_rule_mount_option_var_nosuid medium
Add nosuid Option to /var
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_nosuid |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var. The SUID and SGID permissions
should not be required for this directory.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. |
Add nodev Option to /var/tmpxccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev medium
Add nodev Option to /var/tmp
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | The nodev mount option can be used to prevent device files from
being created in /var/tmp. Legitimate character and block devices
should not exist within temporary directories like /var/tmp.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
Add noexec Option to /var/tmpxccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec medium
Add noexec Option to /var/tmp
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/tmp.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp. |
| Rationale | Allowing users to execute binaries from world-writable directories
such as /var/tmp should never be necessary in normal operation and
can expose the system to potential compromise. |
Add nosuid Option to /var/tmpxccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid medium
Add nosuid Option to /var/tmp
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/tmp. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/tmp. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
Disable core dump backtracesxccdf_org.ssgproject.content_rule_coredump_disable_backtraces medium
Disable core dump backtraces
| Rule ID | xccdf_org.ssgproject.content_rule_coredump_disable_backtraces |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-coredump_disable_backtraces:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | |
| Description | The ProcessSizeMax option in [Coredump] section
of /etc/systemd/coredump.conf or in a drop-in file under
/etc/systemd/coredump.conf.d/ specifies the maximum size in bytes
of a core which will be processed. Core dumps exceeding this size may be
stored, but the backtrace will not be generated. |
| Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.
Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debugging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy. |
| Warnings | warning
If the /etc/systemd/coredump.conf file or a drop-in file under /etc/systemd/coredump.conf.d/
does not already contain the [Coredump] section,
the value will not be configured correctly. |
OVAL test results detailstests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file
oval:ssg-test_coredump_disable_backtraces:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_coredump_disable_backtraces:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/systemd/coredump.conf | ^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*ProcessSizeMax\h*=\h*(.+?)[ \t]*(?:$|#) | 1 |
tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf.d file
oval:ssg-test_coredump_disable_backtraces_config_dir:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/coredump.conf.d/complianceascode_hardening.conf | [Coredump]
Storage=none
ProcessSizeMax=0 |
Disable storing core dumpxccdf_org.ssgproject.content_rule_coredump_disable_storage medium
Disable storing core dump
| Rule ID | xccdf_org.ssgproject.content_rule_coredump_disable_storage |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-coredump_disable_storage:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | |
| Description | The Storage option in [Coredump] section
of /etc/systemd/coredump.conf or a drop-in file in
/etc/systemd/coredump.conf.d/*.conf
can be set to none to disable storing core dumps permanently. |
| Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debugging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy. |
| Warnings | warning
If the /etc/systemd/coredump.conf file or a drop-in file under /etc/systemd/coredump.conf.d/
does not already contain the [Coredump] section,
the value will not be configured correctly. |
OVAL test results detailstests the value of Storage setting in the /etc/systemd/coredump.conf file
oval:ssg-test_coredump_disable_storage:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_coredump_disable_storage:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/systemd/coredump.conf | ^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*Storage\h*=\h*(.+?)[ \t]*(?:$|#) | 1 |
tests the value of Storage setting in the /etc/systemd/coredump.conf.d file
oval:ssg-test_coredump_disable_storage_config_dir:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/systemd/coredump.conf.d/complianceascode_hardening.conf | [Coredump]
Storage=none |
Disable Core Dumps for All Usersxccdf_org.ssgproject.content_rule_disable_users_coredumps medium
Disable Core Dumps for All Users
| Rule ID | xccdf_org.ssgproject.content_rule_disable_users_coredumps |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-disable_users_coredumps:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 15, 16, 2, 7, 8 | | cobit5 | APO13.01, BAI04.04, DSS01.03, DSS03.05, DSS05.07 | | isa-62443-2013 | SR 6.2, SR 7.1, SR 7.2 | | iso27001-2013 | A.12.1.3, A.17.2.1 | | nist | CM-6, SC-7(10) | | nist-csf | DE.CM-1, PR.DS-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 1.5.11 | | pcidss4 | 3.3.1.1, 3.3.1, 3.3 |
|
| Description | To disable core dumps for all users, add the following line to
/etc/security/limits.conf, or to a file within the
/etc/security/limits.d/ directory:
* hard core 0
|
| Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems. |
OVAL test results detailsTests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory
oval:ssg-test_core_dumps_limits_d:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/security/limits.d/10-ssg-hardening.conf | * hard core 0 |
Tests for existence of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory
oval:ssg-test_core_dumps_limits_d_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/security/limits.d/10-ssg-hardening.conf | * hard core |
Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file
oval:ssg-test_core_dumps_limitsconf:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_core_dumps_limitsconf:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/security/limits.conf | ^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\S]+) | 1 |
Disable Core Dumps for SUID programsxccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable medium
Disable Core Dumps for SUID programs
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_fs_suid_dumpable:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | hipaa | 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e) | | nist | SI-11(a), SI-11(b) | | anssi | R14 | | cis | 1.5.4 | | pcidss4 | 3.3.1.1, 3.3.1, 3.3 |
|
| Description | To set the runtime status of the fs.suid_dumpable kernel parameter, run the following command: $ sudo sysctl -w fs.suid_dumpable=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: fs.suid_dumpable = 0
|
| Rationale | The core dump of a setuid program is more likely to contain
sensitive data, as the program itself runs with greater privileges than the
user who initiated execution of the program. Disabling the ability for any
setuid program to write a core file decreases the risk of unauthorized access
of such data. |
OVAL test results detailsfs.suid_dumpable static configuration
oval:ssg-test_sysctl_fs_suid_dumpable_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | fs.suid_dumpable = 0 |
fs.suid_dumpable static configuration
oval:ssg-test_sysctl_fs_suid_dumpable_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | fs.suid_dumpable = 0 |
fs.suid_dumpable static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_fs_suid_dumpable_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_suid_dumpable:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter fs.suid_dumpable set to 0
oval:ssg-test_sysctl_fs_suid_dumpable_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | fs.suid_dumpable | 0 |
Restrict Exposed Kernel Pointer Addresses Accessxccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict medium
Restrict Exposed Kernel Pointer Addresses Access
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_kernel_kptr_restrict:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | nerc-cip | CIP-002-5 R1.1, CIP-002-5 R1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 4.1, CIP-004-6 4.2, CIP-004-6 R2.2.3, CIP-004-6 R2.2.4, CIP-004-6 R2.3, CIP-004-6 R4, CIP-005-6 R1, CIP-005-6 R1.1, CIP-005-6 R1.2, CIP-007-3 R3, CIP-007-3 R3.1, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R8.4, CIP-009-6 R.1.1, CIP-009-6 R4 | | nist | SC-30, SC-30(2), SC-30(5), CM-6(a) | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000132-GPOS-00067, SRG-OS-000433-GPOS-00192, SRG-OS-000480-GPOS-00227 | | anssi | R9 | | cis | 1.5.8 | | ism | 1409 |
|
| Description | To set the runtime status of the kernel.kptr_restrict kernel parameter, run the following command: $ sudo sysctl -w kernel.kptr_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.kptr_restrict = 1
|
| Rationale | Exposing kernel pointers (through procfs or seq_printf()) exposes kernel
writeable structures which may contain functions pointers. If a write vulnerability
occurs in the kernel, allowing write access to any of this structure, the kernel can
be compromised. This option disallow any program without the CAP_SYSLOG capability
to get the addresses of kernel pointers by replacing them with 0. |
OVAL test results detailskernel.kptr_restrict static configuration
oval:ssg-test_sysctl_kernel_kptr_restrict_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | kernel.kptr_restrict = 1 |
kernel.kptr_restrict static configuration
oval:ssg-test_sysctl_kernel_kptr_restrict_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | kernel.kptr_restrict = 1 |
kernel.kptr_restrict static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_kernel_kptr_restrict_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_kptr_restrict:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter kernel.kptr_restrict set to the appropriate value
oval:ssg-test_sysctl_kernel_kptr_restrict_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | kernel.kptr_restrict | 1 |
Enable Randomized Layout of Virtual Address Spacexccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space medium
Enable Randomized Layout of Virtual Address Space
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_kernel_randomize_va_space:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | cui | 3.1.7 | | hipaa | 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e) | | nerc-cip | CIP-002-5 R1.1, CIP-002-5 R1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 4.1, CIP-004-6 4.2, CIP-004-6 R2.2.3, CIP-004-6 R2.2.4, CIP-004-6 R2.3, CIP-004-6 R4, CIP-005-6 R1, CIP-005-6 R1.1, CIP-005-6 R1.2, CIP-007-3 R3, CIP-007-3 R3.1, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R8.4, CIP-009-6 R.1.1, CIP-009-6 R4 | | nist | SC-30, SC-30(2), CM-6(a) | | pcidss | Req-2.2.1 | | os-srg | SRG-OS-000433-GPOS-00193, SRG-OS-000480-GPOS-00227 | | app-srg-ctr | SRG-APP-000450-CTR-001105 | | anssi | R9 | | cis | 1.5.9 | | ism | 1409 | | pcidss4 | 3.3.1.1, 3.3.1, 3.3 |
|
| Description | To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command: $ sudo sysctl -w kernel.randomize_va_space=2
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.randomize_va_space = 2
|
| Rationale | Address space layout randomization (ASLR) makes it more difficult for an
attacker to predict the location of attack code they have introduced into a
process's address space during an attempt at exploitation. Additionally,
ASLR makes it more difficult for an attacker to know the location of
existing code in order to re-purpose it using return oriented programming
(ROP) techniques. |
OVAL test results detailskernel.randomize_va_space static configuration
oval:ssg-test_sysctl_kernel_randomize_va_space_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | kernel.randomize_va_space = 2
|
kernel.randomize_va_space static configuration
oval:ssg-test_sysctl_kernel_randomize_va_space_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | kernel.randomize_va_space = 2
|
kernel.randomize_va_space static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_kernel_randomize_va_space_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter kernel.randomize_va_space set to 2
oval:ssg-test_sysctl_kernel_randomize_va_space_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | kernel.randomize_va_space | 2 |
Restrict Access to Kernel Message Bufferxccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict low
Restrict Access to Kernel Message Buffer
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_kernel_dmesg_restrict:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | low |
| References: | | cui | 3.1.5 | | hipaa | 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e) | | nist | SI-11(a), SI-11(b) | | ospp | FMT_SMF_EXT.1 | | os-srg | SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069 | | app-srg-ctr | SRG-APP-000243-CTR-000600 | | anssi | R9 | | cis | 1.5.5 | | ism | 1546 |
|
| Description | To set the runtime status of the kernel.dmesg_restrict kernel parameter, run the following command: $ sudo sysctl -w kernel.dmesg_restrict=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.dmesg_restrict = 1
|
| Rationale | Unprivileged access to the kernel syslog can expose sensitive kernel
address information. |
OVAL test results detailskernel.dmesg_restrict static configuration
oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | kernel.dmesg_restrict = 1 |
kernel.dmesg_restrict static configuration
oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | kernel.dmesg_restrict = 1 |
kernel.dmesg_restrict static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_kernel_dmesg_restrict_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter kernel.dmesg_restrict set to 1
oval:ssg-test_sysctl_kernel_dmesg_restrict_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | kernel.dmesg_restrict | 1 |
Restrict usage of ptrace to descendant processesxccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope medium
Restrict usage of ptrace to descendant processes
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1 |
| Time | 2026-11-02T22:58:48+00:00 |
| Severity | medium |
| References: | |
| Description | To set the runtime status of the kernel.yama.ptrace_scope kernel parameter, run the following command: $ sudo sysctl -w kernel.yama.ptrace_scope=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.yama.ptrace_scope = 1
|
| Rationale | Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user. Like this, the attacker can steal
sensitive information from the target processes (e.g. SSH sessions, web browser, ...)
without any additional assistance from the user (i.e. without resorting to phishing).
|
OVAL test results detailskernel.yama.ptrace_scope static configuration
oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/sysctl.conf | kernel.yama.ptrace_scope = 1 |
kernel.yama.ptrace_scope static configuration
oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user_missing:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/sysctl.conf | kernel.yama.ptrace_scope = 1 |
kernel.yama.ptrace_scope static configuration in /usr/lib/sysctl.d/*.conf
oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_pkg_correct:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1 of type
textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|
| /usr/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*\S)[\s]*$ | 1 |
kernel runtime parameter kernel.yama.ptrace_scope set to 1
oval:ssg-test_sysctl_kernel_yama_ptrace_scope_runtime:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Value |
|---|
| true | kernel.yama.ptrace_scope | 1 |
Ensure sysctl network settings are re-applied after network interfaces come upxccdf_org.ssgproject.content_rule_sysctl_reapply_after_network medium
Ensure sysctl network settings are re-applied after network interfaces come up
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_reapply_after_network |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_reapply_after_network:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | |
| Description | On Debian systems, the kernel resets certain network sysctl values when a
network interface is brought up, overriding hardened settings applied at
early boot by systemd-sysctl.service.
Create a systemd oneshot service
/etc/systemd/system/sysctl-reapply-network.service:
[Unit]
Description=Re-apply sysctl hardening after network interfaces come up
After=networking.service systemd-networkd.service
DefaultDependencies=no
[Service]
Type=oneshot
ExecStart=/sbin/sysctl --system
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
Then reload the systemd daemon and enable the service:
$ sudo systemctl daemon-reload
$ sudo systemctl enable sysctl-reapply-network.service
|
| Rationale | When a network interface is initialized, the Linux kernel may reset interface-level
and global sysctl values to their defaults. Running sysctl --system after
network interfaces are up ensures the hardened values from /etc/sysctl.conf
and /etc/sysctl.d/ are the final values in effect at runtime.
Using DefaultDependencies=no prevents the ordering cycle that would arise
from modifying systemd-sysctl.service itself to depend on
network-online.target. |
OVAL test results detailssysctl-reapply-network.service file exists
oval:ssg-test_sysctl_reapply_after_network_file_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| not evaluated | /etc/systemd/system/sysctl-reapply-network.service | regular | 0 | 0 | 265 | rw-r--r-- |
sysctl-reapply-network.service is enabled
oval:ssg-test_sysctl_reapply_after_network_enabled:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | sysctl-reapply-network.service | UnitFileState | enabled |
Uninstall avahi Server Packagexccdf_org.ssgproject.content_rule_package_avahi_removed medium
Uninstall avahi Server Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_avahi_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_avahi_removed:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.2 |
|
| Description | If the system does not need to have an Avahi server which implements
the DNS Service Discovery and Multicast DNS protocols,
the avahi-autoipd and avahi packages can be uninstalled. |
| Rationale | Automatic discovery of network services is not normally required for
system functionality. It is recommended to remove this package to reduce
the potential attack surface. |
OVAL test results detailspackage avahi-daemon is removed
oval:ssg-test_package_avahi-daemon_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_avahi-daemon_removed:obj:1 of type
dpkginfo_object
Disable Avahi Server Softwarexccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled medium
Disable Avahi Server Software
| Rule ID | xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.2 | | ism | 1409 | | pcidss4 | 2.2.4, 2.2 |
|
| Description |
The avahi-daemon service can be disabled with the following command:
$ sudo systemctl mask --now avahi-daemon.service
|
| Rationale | Because the Avahi daemon service keeps an open network
port, it is subject to network attacks. Its functionality
is convenient but is only appropriate if the local network
can be trusted. |
Ensure that /etc/at.allow existsxccdf_org.ssgproject.content_rule_file_at_allow_exists medium
Ensure that /etc/at.allow exists
| Rule ID | xccdf_org.ssgproject.content_rule_file_at_allow_exists |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_at_allow_exists:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | The file /etc/at.allow should exist and should be used instead
of /etc/at.deny. |
| Rationale | Using the at.allow file to control who can run at jobs enforces this who can schedule jobs.
It is easier to manage an allow list than a deny list. |
OVAL test results detailsTest that that /etc/at.allow does exist
oval:ssg-test_file_at_allow_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| not evaluated | /etc/at.allow | regular | 0 | 0 | 0 | rw-r----- |
Ensure that /etc/cron.allow existsxccdf_org.ssgproject.content_rule_file_cron_allow_exists medium
Ensure that /etc/cron.allow exists
| Rule ID | xccdf_org.ssgproject.content_rule_file_cron_allow_exists |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_cron_allow_exists:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | The file /etc/cron.allow should exist and should be used instead
of /etc/cron.deny. |
| Rationale | Access to crontab should be restricted.
It is easier to manage an allow list than a deny list.
Therefore, /etc/cron.allow needs to be created and used instead of /etc/cron.deny.
Regardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab. |
OVAL test results detailsTest that that /etc/cron.allow does exist
oval:ssg-test_file_cron_allow_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Type | UID | GID | Size (B) | Permissions |
|---|
| not evaluated | /etc/cron.allow | regular | 0 | 0 | 0 | rw-r----- |
Ensure that /etc/cron.deny does not existxccdf_org.ssgproject.content_rule_file_cron_deny_not_exist medium
Ensure that /etc/cron.deny does not exist
| Rule ID | xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_cron_deny_not_exist:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | The file /etc/cron.deny should not exist.
Use /etc/cron.allow instead. |
| Rationale | Access to cron should be restricted.
It is easier to manage an allow list than a deny list. |
OVAL test results detailsTest that that /etc/cron.deny does not exist
oval:ssg-test_file_cron_deny_not_exist:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_cron_deny_not_exist:obj:1 of type
file_object
Verify Group Who Owns /etc/at.allow filexccdf_org.ssgproject.content_rule_file_groupowner_at_allow medium
Verify Group Who Owns /etc/at.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_at_allow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_at_allow:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/at.allow exists, it must be group-owned by root.
To properly set the group owner of /etc/at.allow, run the command:
$ sudo chgrp root /etc/at.allow
|
| Rationale | If the owner of the at.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting group ownership of /etc/at.allow
oval:ssg-test_file_groupowner_at_allow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_at_allow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/at.allow | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_at_allow_0_0:ste:1 |
Verify Group Who Owns /etc/at.deny filexccdf_org.ssgproject.content_rule_file_groupowner_at_deny medium
Verify Group Who Owns /etc/at.deny file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_at_deny |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_at_deny:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/at.deny exists, it must be group-owned by root.
To properly set the group owner of /etc/at.deny, run the command:
$ sudo chgrp root /etc/at.deny
|
| Rationale | If the owner of the at.deny file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting group ownership of /etc/at.deny
oval:ssg-test_file_groupowner_at_deny_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_at_deny_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/at.deny | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_at_deny_0_0:ste:1 |
Verify Group Who Owns /etc/cron.allow filexccdf_org.ssgproject.content_rule_file_groupowner_cron_allow medium
Verify Group Who Owns /etc/cron.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_allow:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.9 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | If /etc/cron.allow exists, it must be group-owned by root.
To properly set the group owner of /etc/cron.allow, run the command:
$ sudo chgrp root /etc/cron.allow
|
| Rationale | If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting group ownership of /etc/cron.allow
oval:ssg-test_file_groupowner_cron_allow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_allow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/cron.allow | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_allow_0_0:ste:1 |
Verify User Who Owns /etc/at.allow filexccdf_org.ssgproject.content_rule_file_owner_at_allow medium
Verify User Who Owns /etc/at.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_at_allow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_at_allow:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/at.allow exists, it must be owned by root.
To properly set the owner of /etc/at.allow, run the command:
$ sudo chown root /etc/at.allow
|
| Rationale | If the owner of the at.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting user ownership of /etc/at.allow
oval:ssg-test_file_owner_at_allow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_at_allow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/at.allow | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_at_allow_0_0:ste:1 |
Verify User Who Owns /etc/at.deny filexccdf_org.ssgproject.content_rule_file_owner_at_deny medium
Verify User Who Owns /etc/at.deny file
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_at_deny |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_at_deny:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/at.deny exists, it must be owned by root.
To properly set the owner of /etc/at.deny, run the command:
$ sudo chown root /etc/at.deny
|
| Rationale | If the owner of the at.deny file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting user ownership of /etc/at.deny
oval:ssg-test_file_owner_at_deny_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_at_deny_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/at.deny | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_at_deny_0_0:ste:1 |
Verify User Who Owns /etc/cron.allow filexccdf_org.ssgproject.content_rule_file_owner_cron_allow medium
Verify User Who Owns /etc/cron.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_allow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_allow:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.9 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | If /etc/cron.allow exists, it must be owned by root.
To properly set the owner of /etc/cron.allow, run the command:
$ sudo chown root /etc/cron.allow
|
| Rationale | If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting user ownership of /etc/cron.allow
oval:ssg-test_file_owner_cron_allow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_allow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/cron.allow | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_allow_0_0:ste:1 |
Verify Permissions on /etc/at.allow filexccdf_org.ssgproject.content_rule_file_permissions_at_allow medium
Verify Permissions on /etc/at.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_at_allow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_at_allow:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/at.allow exists, it must have permissions 0640
or more restrictive.
To properly set the permissions of /etc/at.allow, run the command:
$ sudo chmod 0640 /etc/at.allow
|
| Rationale | If the permissions of the at.allow file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting mode of /etc/at.allow
oval:ssg-test_file_permissions_at_allow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_at_allow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/at.allow | oval:ssg-exclude_symlinks__at_allow:ste:1 | oval:ssg-state_file_permissions_at_allow_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on /etc/at.deny filexccdf_org.ssgproject.content_rule_file_permissions_at_deny medium
Verify Permissions on /etc/at.deny file
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_at_deny |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_at_deny:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/at.deny exists, it must have permissions 0640
or more restrictive.
To properly set the permissions of /etc/at.deny, run the command:
$ sudo chmod 0640 /etc/at.deny
|
| Rationale | If the permissions of the at.deny file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting mode of /etc/at.deny
oval:ssg-test_file_permissions_at_deny_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_at_deny_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/at.deny | oval:ssg-exclude_symlinks__at_deny:ste:1 | oval:ssg-state_file_permissions_at_deny_0_mode_0640or_stricter_:ste:1 |
Verify Permissions on /etc/cron.allow filexccdf_org.ssgproject.content_rule_file_permissions_cron_allow medium
Verify Permissions on /etc/cron.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_allow |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_allow:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If /etc/cron.allow exists, it must have permissions 0640
or more restrictive.
To properly set the permissions of /etc/cron.allow, run the command:
$ sudo chmod 0640 /etc/cron.allow
|
| Rationale | If the permissions of the cron.allow file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information. |
OVAL test results detailsTesting mode of /etc/cron.allow
oval:ssg-test_file_permissions_cron_allow_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_allow_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/cron.allow | oval:ssg-exclude_symlinks__cron_allow:ste:1 | oval:ssg-state_file_permissions_cron_allow_0_mode_0640or_stricter_:ste:1 |
Install the cron servicexccdf_org.ssgproject.content_rule_package_cron_installed medium
Install the cron service
| Rule ID | xccdf_org.ssgproject.content_rule_package_cron_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_cron_installed:def:1 |
| Time | 2026-11-02T22:58:49+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.1 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | The Cron service should be installed. |
| Rationale | The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only. |
OVAL test results detailspackage cron is installed
oval:ssg-test_package_cron_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | cron | arm64 | 0 | 197 | 3.0pl1 | 3.0pl1-197 |
Enable cron Servicexccdf_org.ssgproject.content_rule_service_cron_enabled medium
Enable cron Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_cron_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_cron_enabled:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.4.1.1 |
|
| Description | The crond service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
The cron service can be enabled with the following command:
$ sudo systemctl enable cron.service
|
| Rationale | Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential. |
OVAL test results detailspackage cron is installed
oval:ssg-test_service_cron_package_cron_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | cron | arm64 | 0 | 197 | 3.0pl1 | 3.0pl1-197 |
Test that the cron service is running
oval:ssg-test_service_running_cron:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | cron.service | ActiveState | active |
systemd test
oval:ssg-test_multi_user_wants_cron:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| true | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
systemd test
oval:ssg-test_multi_user_wants_cron_socket:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| false | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
Verify Group Who Owns cron.dxccdf_org.ssgproject.content_rule_file_groupowner_cron_d medium
Verify Group Who Owns cron.d
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_d |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_d:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.8 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/cron.d, run the command:
$ sudo chgrp root /etc/cron.d
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/cron.d/
oval:ssg-test_file_groupowner_cron_d_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_d_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.d | no value | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_d_0_0:ste:1 |
Verify Group Who Owns cron.dailyxccdf_org.ssgproject.content_rule_file_groupowner_cron_daily medium
Verify Group Who Owns cron.daily
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_daily:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.4 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/cron.daily, run the command:
$ sudo chgrp root /etc/cron.daily
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/cron.daily/
oval:ssg-test_file_groupowner_cron_daily_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_daily_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.daily | no value | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_daily_0_0:ste:1 |
Verify Group Who Owns cron.hourlyxccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly medium
Verify Group Who Owns cron.hourly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_hourly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/cron.hourly, run the command:
$ sudo chgrp root /etc/cron.hourly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/cron.hourly/
oval:ssg-test_file_groupowner_cron_hourly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_hourly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.hourly | no value | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_hourly_0_0:ste:1 |
Verify Group Who Owns cron.monthlyxccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly medium
Verify Group Who Owns cron.monthly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_monthly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.6 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/cron.monthly, run the command:
$ sudo chgrp root /etc/cron.monthly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/cron.monthly/
oval:ssg-test_file_groupowner_cron_monthly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_monthly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.monthly | no value | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_monthly_0_0:ste:1 |
Verify Group Who Owns cron.weeklyxccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly medium
Verify Group Who Owns cron.weekly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_weekly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.5 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/cron.weekly, run the command:
$ sudo chgrp root /etc/cron.weekly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/cron.weekly/
oval:ssg-test_file_groupowner_cron_weekly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_weekly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.weekly | no value | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_weekly_0_0:ste:1 |
Verify Group Who Owns cron.yearlyxccdf_org.ssgproject.content_rule_file_groupowner_cron_yearly medium
Verify Group Who Owns cron.yearly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_yearly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_yearly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.7 |
|
| Description | To properly set the group owner of /etc/cron.yearly, run the command:
$ sudo chgrp root /etc/cron.yearly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/cron.yearly/
oval:ssg-test_file_groupowner_cron_yearly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_yearly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.yearly | no value | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_cron_yearly_0_0:ste:1 |
Verify Group Who Owns Crontabxccdf_org.ssgproject.content_rule_file_groupowner_crontab medium
Verify Group Who Owns Crontab
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_crontab |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_crontab:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.2 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the group owner of /etc/crontab, run the command:
$ sudo chgrp root /etc/crontab
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/crontab
oval:ssg-test_file_groupowner_crontab_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_crontab_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/crontab | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_crontab_0_0:ste:1 |
Verify Owner on cron.dxccdf_org.ssgproject.content_rule_file_owner_cron_d medium
Verify Owner on cron.d
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_d |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_d:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.8 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/cron.d, run the command:
$ sudo chown root /etc/cron.d
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/cron.d/
oval:ssg-test_file_owner_cron_d_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_d_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.d | no value | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_d_0_0:ste:1 |
Verify Owner on cron.dailyxccdf_org.ssgproject.content_rule_file_owner_cron_daily medium
Verify Owner on cron.daily
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_daily |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_daily:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.4 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/cron.daily, run the command:
$ sudo chown root /etc/cron.daily
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/cron.daily/
oval:ssg-test_file_owner_cron_daily_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_daily_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.daily | no value | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_daily_0_0:ste:1 |
Verify Owner on cron.hourlyxccdf_org.ssgproject.content_rule_file_owner_cron_hourly medium
Verify Owner on cron.hourly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_hourly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_hourly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/cron.hourly, run the command:
$ sudo chown root /etc/cron.hourly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/cron.hourly/
oval:ssg-test_file_owner_cron_hourly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_hourly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.hourly | no value | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_hourly_0_0:ste:1 |
Verify Owner on cron.monthlyxccdf_org.ssgproject.content_rule_file_owner_cron_monthly medium
Verify Owner on cron.monthly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_monthly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_monthly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.6 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/cron.monthly, run the command:
$ sudo chown root /etc/cron.monthly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/cron.monthly/
oval:ssg-test_file_owner_cron_monthly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_monthly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.monthly | no value | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_monthly_0_0:ste:1 |
Verify Owner on cron.weeklyxccdf_org.ssgproject.content_rule_file_owner_cron_weekly medium
Verify Owner on cron.weekly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_weekly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_weekly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.5 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/cron.weekly, run the command:
$ sudo chown root /etc/cron.weekly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/cron.weekly/
oval:ssg-test_file_owner_cron_weekly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_weekly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.weekly | no value | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_weekly_0_0:ste:1 |
Verify Owner on cron.yearlyxccdf_org.ssgproject.content_rule_file_owner_cron_yearly medium
Verify Owner on cron.yearly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_yearly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_yearly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.7 |
|
| Description | To properly set the owner of /etc/cron.yearly, run the command:
$ sudo chown root /etc/cron.yearly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/cron.yearly/
oval:ssg-test_file_owner_cron_yearly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_yearly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.yearly | no value | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_cron_yearly_0_0:ste:1 |
Verify Owner on crontabxccdf_org.ssgproject.content_rule_file_owner_crontab medium
Verify Owner on crontab
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_crontab |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_crontab:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.2 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the owner of /etc/crontab, run the command:
$ sudo chown root /etc/crontab
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/crontab
oval:ssg-test_file_owner_crontab_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_crontab_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/crontab | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_crontab_0_0:ste:1 |
Verify Permissions on cron.dxccdf_org.ssgproject.content_rule_file_permissions_cron_d medium
Verify Permissions on cron.d
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_d |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_d:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.8 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/cron.d, run the command:
$ sudo chmod 0700 /etc/cron.d
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/cron.d/
oval:ssg-test_file_permissions_cron_d_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_d_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.d | no value | oval:ssg-exclude_symlinks__cron_d:ste:1 | oval:ssg-state_file_permissions_cron_d_0_mode_0700or_stricter_:ste:1 |
Verify Permissions on cron.dailyxccdf_org.ssgproject.content_rule_file_permissions_cron_daily medium
Verify Permissions on cron.daily
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_daily |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_daily:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.4 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/cron.daily, run the command:
$ sudo chmod 0700 /etc/cron.daily
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/cron.daily/
oval:ssg-test_file_permissions_cron_daily_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_daily_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.daily | no value | oval:ssg-exclude_symlinks__cron_daily:ste:1 | oval:ssg-state_file_permissions_cron_daily_0_mode_0700or_stricter_:ste:1 |
Verify Permissions on cron.hourlyxccdf_org.ssgproject.content_rule_file_permissions_cron_hourly medium
Verify Permissions on cron.hourly
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_hourly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/cron.hourly, run the command:
$ sudo chmod 0700 /etc/cron.hourly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/cron.hourly/
oval:ssg-test_file_permissions_cron_hourly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_hourly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.hourly | no value | oval:ssg-exclude_symlinks__cron_hourly:ste:1 | oval:ssg-state_file_permissions_cron_hourly_0_mode_0700or_stricter_:ste:1 |
Verify Permissions on cron.monthlyxccdf_org.ssgproject.content_rule_file_permissions_cron_monthly medium
Verify Permissions on cron.monthly
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_monthly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.6 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/cron.monthly, run the command:
$ sudo chmod 0700 /etc/cron.monthly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/cron.monthly/
oval:ssg-test_file_permissions_cron_monthly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_monthly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.monthly | no value | oval:ssg-exclude_symlinks__cron_monthly:ste:1 | oval:ssg-state_file_permissions_cron_monthly_0_mode_0700or_stricter_:ste:1 |
Verify Permissions on cron.weeklyxccdf_org.ssgproject.content_rule_file_permissions_cron_weekly medium
Verify Permissions on cron.weekly
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_weekly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.5 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/cron.weekly, run the command:
$ sudo chmod 0700 /etc/cron.weekly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/cron.weekly/
oval:ssg-test_file_permissions_cron_weekly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_weekly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.weekly | no value | oval:ssg-exclude_symlinks__cron_weekly:ste:1 | oval:ssg-state_file_permissions_cron_weekly_0_mode_0700or_stricter_:ste:1 |
Verify Permissions on cron.yearlyxccdf_org.ssgproject.content_rule_file_permissions_cron_yearly medium
Verify Permissions on cron.yearly
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_cron_yearly |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_cron_yearly:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.7 |
|
| Description | To properly set the permissions of /etc/cron.yearly, run the command:
$ sudo chmod 0700 /etc/cron.yearly
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/cron.yearly/
oval:ssg-test_file_permissions_cron_yearly_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_cron_yearly_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/cron.yearly | no value | oval:ssg-exclude_symlinks__cron_yearly:ste:1 | oval:ssg-state_file_permissions_cron_yearly_0_mode_0700or_stricter_:ste:1 |
Verify Permissions on crontabxccdf_org.ssgproject.content_rule_file_permissions_crontab medium
Verify Permissions on crontab
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_crontab |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_crontab:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 2.4.1.2 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/crontab, run the command:
$ sudo chmod 0600 /etc/crontab
|
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/crontab
oval:ssg-test_file_permissions_crontab_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_crontab_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/crontab | oval:ssg-exclude_symlinks__crontab:ste:1 | oval:ssg-state_file_permissions_crontab_0_mode_0600or_stricter_:ste:1 |
Uninstall the inet-based telnet serverxccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed high
Uninstall the inet-based telnet server
| Rule ID | xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_inetutils-telnetd_removed:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | cis | 2.1.16 |
|
| Description | The inet-based telnet daemon should be uninstalled. |
| Rationale | telnet allows clear text communications, and does not protect any
data transmission between client and server. Any confidential data can be
listened and no integrity checking is made.
|
OVAL test results detailspackage inetutils-telnetd is removed
oval:ssg-test_package_inetutils-telnetd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1 of type
dpkginfo_object
Uninstall the nis packagexccdf_org.ssgproject.content_rule_package_nis_removed low
Uninstall the nis package
| Rule ID | xccdf_org.ssgproject.content_rule_package_nis_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_nis_removed:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | low |
| References: | |
| Description | The support for Yellowpages should not be installed unless it is required. |
| Rationale | NIS is the historical SUN service for central account management, more and more replaced by LDAP.
NIS does not support efficiently security constraints, ACL, etc. and should not be used. |
OVAL test results detailspackage nis is removed
oval:ssg-test_package_nis_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_nis_removed:obj:1 of type
dpkginfo_object
Uninstall the telnet serverxccdf_org.ssgproject.content_rule_package_telnetd_removed high
Uninstall the telnet server
| Rule ID | xccdf_org.ssgproject.content_rule_package_telnetd_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_telnetd_removed:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | cis | 2.1.16 |
|
| Description | The telnet daemon should be uninstalled. |
| Rationale | telnet allows clear text communications, and does not protect
any data transmission between client and server. Any confidential data
can be listened and no integrity checking is made.'
|
OVAL test results detailspackage telnetd is removed
oval:ssg-test_package_telnetd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_telnetd_removed:obj:1 of type
dpkginfo_object
Uninstall kea Packagexccdf_org.ssgproject.content_rule_package_kea_removed medium
Uninstall kea Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_kea_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_kea_removed:def:1 |
| Time | 2026-11-02T22:58:50+00:00 |
| Severity | medium |
| References: | |
| Description | If the system does not need to act as a DHCP server,
the kea package can be uninstalled. |
| Rationale | Removing the DHCP server ensures that it cannot be easily or
accidentally reactivated and disrupt network operation. |
OVAL test results detailspackage kea is removed
oval:ssg-test_package_kea_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_kea_removed:obj:1 of type
dpkginfo_object
Disable kea-dhcp4-server Servicexccdf_org.ssgproject.content_rule_service_kea_dhcp4_server_disabled medium
Disable kea-dhcp4-server Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_kea_dhcp4_server_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_kea_dhcp4_server_disabled:def:1 |
| Time | 2026-11-02T22:58:51+00:00 |
| Severity | medium |
| References: | |
| Description | The kea-dhcp4-server service should be disabled on
any system that does not need to act as a DHCPv4 server.
The kea-dhcp4-server service can be disabled with the following command:
$ sudo systemctl mask --now kea-dhcp4-server.service
|
| Rationale | Unmanaged or unintentionally activated DHCP servers may provide faulty information
to clients, interfering with the operation of a legitimate site
DHCP server if there is one. |
OVAL test results detailspackage kea is removed
oval:ssg-service_kea_dhcp4_server_disabled_test_service_kea-dhcp4-server_package_kea_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_kea_dhcp4_server_disabled_test_service_kea-dhcp4-server_package_kea_removed:obj:1 of type
dpkginfo_object
Test that the kea-dhcp4-server service is not running
oval:ssg-test_service_not_running_service_kea_dhcp4_server_disabled_kea-dhcp4-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_kea_dhcp4_server_disabled_kea-dhcp4-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp4-server\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service kea-dhcp4-server is masked
oval:ssg-test_service_loadstate_is_masked_service_kea_dhcp4_server_disabled_kea-dhcp4-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_kea_dhcp4_server_disabled_kea-dhcp4-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp4-server\.(service|socket)$ | LoadState |
Test that the service kea-dhcp4-server is not found
oval:ssg-test_service_not_found_service_kea_dhcp4_server_disabled_kea-dhcp4-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_kea_dhcp4_server_disabled_kea-dhcp4-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp4-server\.(service|socket)$ | LoadState |
Disable kea-dhcp6-server Servicexccdf_org.ssgproject.content_rule_service_kea_dhcp6_server_disabled medium
Disable kea-dhcp6-server Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_kea_dhcp6_server_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_kea_dhcp6_server_disabled:def:1 |
| Time | 2026-11-02T22:58:51+00:00 |
| Severity | medium |
| References: | |
| Description | The kea-dhcp6-server service should be disabled on
any system that does not need to act as a DHCPv6 server.
The kea-dhcp6-server service can be disabled with the following command:
$ sudo systemctl mask --now kea-dhcp6-server.service
|
| Rationale | Unmanaged or unintentionally activated DHCP servers may provide faulty information
to clients, interfering with the operation of a legitimate site
DHCP server if there is one. |
OVAL test results detailspackage kea is removed
oval:ssg-service_kea_dhcp6_server_disabled_test_service_kea-dhcp6-server_package_kea_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_kea_dhcp6_server_disabled_test_service_kea-dhcp6-server_package_kea_removed:obj:1 of type
dpkginfo_object
Test that the kea-dhcp6-server service is not running
oval:ssg-test_service_not_running_service_kea_dhcp6_server_disabled_kea-dhcp6-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_kea_dhcp6_server_disabled_kea-dhcp6-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp6-server\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service kea-dhcp6-server is masked
oval:ssg-test_service_loadstate_is_masked_service_kea_dhcp6_server_disabled_kea-dhcp6-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_kea_dhcp6_server_disabled_kea-dhcp6-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp6-server\.(service|socket)$ | LoadState |
Test that the service kea-dhcp6-server is not found
oval:ssg-test_service_not_found_service_kea_dhcp6_server_disabled_kea-dhcp6-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_kea_dhcp6_server_disabled_kea-dhcp6-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp6-server\.(service|socket)$ | LoadState |
Disable kea-dhcp-ddns-server Servicexccdf_org.ssgproject.content_rule_service_kea_dhcp_ddns_server_disabled medium
Disable kea-dhcp-ddns-server Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_kea_dhcp_ddns_server_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_kea_dhcp_ddns_server_disabled:def:1 |
| Time | 2026-11-02T22:58:52+00:00 |
| Severity | medium |
| References: | |
| Description | The kea-dhcp-ddns-server service should be disabled on
any system that does not need to act as a DHCP Dynamic DNS update server.
The kea-dhcp-ddns-server service can be disabled with the following command:
$ sudo systemctl mask --now kea-dhcp-ddns-server.service
|
| Rationale | Unmanaged or unintentionally activated DHCP servers may provide faulty information
to clients, interfering with the operation of a legitimate site
DHCP server if there is one. |
OVAL test results detailspackage kea is removed
oval:ssg-service_kea_dhcp_ddns_server_disabled_test_service_kea-dhcp-ddns-server_package_kea_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_kea_dhcp_ddns_server_disabled_test_service_kea-dhcp-ddns-server_package_kea_removed:obj:1 of type
dpkginfo_object
Test that the kea-dhcp-ddns-server service is not running
oval:ssg-test_service_not_running_service_kea_dhcp_ddns_server_disabled_kea-dhcp-ddns-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_kea_dhcp_ddns_server_disabled_kea-dhcp-ddns-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp-ddns-server\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service kea-dhcp-ddns-server is masked
oval:ssg-test_service_loadstate_is_masked_service_kea_dhcp_ddns_server_disabled_kea-dhcp-ddns-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_kea_dhcp_ddns_server_disabled_kea-dhcp-ddns-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp-ddns-server\.(service|socket)$ | LoadState |
Test that the service kea-dhcp-ddns-server is not found
oval:ssg-test_service_not_found_service_kea_dhcp_ddns_server_disabled_kea-dhcp-ddns-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_kea_dhcp_ddns_server_disabled_kea-dhcp-ddns-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^kea-dhcp-ddns-server\.(service|socket)$ | LoadState |
Uninstall bind Packagexccdf_org.ssgproject.content_rule_package_bind_removed low
Uninstall bind Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_bind_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_bind_removed:def:1 |
| Time | 2026-11-02T22:58:53+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.4 |
|
| Description | The named service is provided by the bind package.
The bind package can be removed with the following command:
$ apt-get remove bind
|
| Rationale | If there is no need to make DNS server software available,
removing it provides a safeguard against its activation. |
OVAL test results detailspackage bind9 is removed
oval:ssg-test_package_bind9_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_bind9_removed:obj:1 of type
dpkginfo_object
Disable named Servicexccdf_org.ssgproject.content_rule_service_named_disabled medium
Disable named Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_named_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_named_disabled:def:1 |
| Time | 2026-11-02T22:58:53+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.4 |
|
| Description |
The named service can be disabled with the following command:
$ sudo systemctl mask --now named.service
|
| Rationale | All network services involve some risk of compromise due to
implementation flaws and should be disabled if possible. |
OVAL test results detailspackage bind9 is removed
oval:ssg-service_named_disabled_test_service_named_package_bind9_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_named_disabled_test_service_named_package_bind9_removed:obj:1 of type
dpkginfo_object
Test that the named service is not running
oval:ssg-test_service_not_running_service_named_disabled_named:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_named_disabled_named:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^named\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service named is masked
oval:ssg-test_service_loadstate_is_masked_service_named_disabled_named:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_named_disabled_named:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^named\.(service|socket)$ | LoadState |
Test that the service named is not found
oval:ssg-test_service_not_found_service_named_disabled_named:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_named_disabled_named:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^named\.(service|socket)$ | LoadState |
Uninstall dnsmasq Packagexccdf_org.ssgproject.content_rule_package_dnsmasq_removed low
Uninstall dnsmasq Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_dnsmasq_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_dnsmasq_removed:def:1 |
| Time | 2026-11-02T22:58:52+00:00 |
| Severity | low |
| References: | |
| Description | dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and
DHCP (Dynamic Host Configuration Protocol) services.
The dnsmasq package can be removed with the following command:
$ apt-get remove dnsmasq
|
| Rationale | Unless a system is specifically designated to act as a DNS
caching, DNS forwarding and/or DHCP server, it is recommended that the
package be removed to reduce the potential attack surface. |
OVAL test results detailspackage dnsmasq is removed
oval:ssg-test_package_dnsmasq_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_dnsmasq_removed:obj:1 of type
dpkginfo_object
Disable dnsmasq Servicexccdf_org.ssgproject.content_rule_service_dnsmasq_disabled medium
Disable dnsmasq Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_dnsmasq_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_dnsmasq_disabled:def:1 |
| Time | 2026-11-02T22:58:53+00:00 |
| Severity | medium |
| References: | |
| Description |
The dnsmasq service can be disabled with the following command:
$ sudo systemctl mask --now dnsmasq.service
|
| Rationale | Unless a system is specifically designated to act as a DNS
caching, DNS forwarding and/or DHCP server, it is recommended
that the package be removed to reduce the potential attack surface. |
OVAL test results detailspackage dnsmasq is removed
oval:ssg-service_dnsmasq_disabled_test_service_dnsmasq_package_dnsmasq_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_dnsmasq_disabled_test_service_dnsmasq_package_dnsmasq_removed:obj:1 of type
dpkginfo_object
Test that the dnsmasq service is not running
oval:ssg-test_service_not_running_service_dnsmasq_disabled_dnsmasq:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_dnsmasq_disabled_dnsmasq:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^dnsmasq\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service dnsmasq is masked
oval:ssg-test_service_loadstate_is_masked_service_dnsmasq_disabled_dnsmasq:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_dnsmasq_disabled_dnsmasq:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^dnsmasq\.(service|socket)$ | LoadState |
Test that the service dnsmasq is not found
oval:ssg-test_service_not_found_service_dnsmasq_disabled_dnsmasq:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_dnsmasq_disabled_dnsmasq:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^dnsmasq\.(service|socket)$ | LoadState |
Uninstall vsftpd Packagexccdf_org.ssgproject.content_rule_package_vsftpd_removed high
Uninstall vsftpd Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_vsftpd_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_vsftpd_removed:def:1 |
| Time | 2026-11-02T22:58:53+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c), IA-5(1).1(v), CM-7, CM-7.1(ii) | | nist-csf | PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000074-GPOS-00042, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227 | | cis | 2.1.6 |
|
| Description | The vsftpd package can be removed with the following command: $ apt-get remove vsftpd
|
| Rationale | Removing the vsftpd package decreases the risk of its
accidental activation. |
OVAL test results detailspackage vsftpd is removed
oval:ssg-test_package_vsftpd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_vsftpd_removed:obj:1 of type
dpkginfo_object
Disable vsftpd Servicexccdf_org.ssgproject.content_rule_service_vsftpd_disabled medium
Disable vsftpd Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_vsftpd_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_vsftpd_disabled:def:1 |
| Time | 2026-11-02T22:58:54+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.6 |
|
| Description |
The vsftpd service can be disabled with the following command:
$ sudo systemctl mask --now vsftpd.service
|
| Rationale | Running FTP server software provides a network-based avenue
of attack, and should be disabled if not needed.
Furthermore, the FTP protocol is unencrypted and creates
a risk of compromising sensitive information. |
OVAL test results detailspackage vsftpd is removed
oval:ssg-service_vsftpd_disabled_test_service_vsftpd_package_vsftpd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_vsftpd_disabled_test_service_vsftpd_package_vsftpd_removed:obj:1 of type
dpkginfo_object
Test that the vsftpd service is not running
oval:ssg-test_service_not_running_service_vsftpd_disabled_vsftpd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_vsftpd_disabled_vsftpd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^vsftpd\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service vsftpd is masked
oval:ssg-test_service_loadstate_is_masked_service_vsftpd_disabled_vsftpd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_vsftpd_disabled_vsftpd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^vsftpd\.(service|socket)$ | LoadState |
Test that the service vsftpd is not found
oval:ssg-test_service_not_found_service_vsftpd_disabled_vsftpd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_vsftpd_disabled_vsftpd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^vsftpd\.(service|socket)$ | LoadState |
Remove ftp Packagexccdf_org.ssgproject.content_rule_package_ftp_removed low
Remove ftp Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_ftp_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_ftp_removed:def:1 |
| Time | 2026-11-02T22:58:53+00:00 |
| Severity | low |
| References: | |
| Description | FTP (File Transfer Protocol) is a traditional and widely used standard tool for
transferring files between a server and clients over a network, especially where no
authentication is necessary (permits anonymous users to connect to a server).
The ftp package can be removed with the following command:
$ apt-get remove ftp
|
| Rationale | FTP does not protect the confidentiality of data or authentication credentials. It
is recommended SFTP be used if file transfer is required. Unless there is a need
to run the system as a FTP server (for example, to allow anonymous downloads), it is
recommended that the package be removed to reduce the potential attack surface. |
OVAL test results detailspackage ftp is removed
oval:ssg-test_package_ftp_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_ftp_removed:obj:1 of type
dpkginfo_object
Remove tnftp Packagexccdf_org.ssgproject.content_rule_package_tnftp_removed low
Remove tnftp Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_tnftp_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_tnftp_removed:def:1 |
| Time | 2026-11-02T22:58:53+00:00 |
| Severity | low |
| References: | |
| Description | tnftp an enhanced FTP client, is the user interface to the Internet standard File
Transfer Protocol. The program allows a user to transfer files to and from a remote
network site.
The ftp package can be removed with the following command:
$ apt-get remove ftp
|
| Rationale | Unless there is a need to run the system using Internet standard File Transfer Protocol
(for example, to allow anonymous downloads), it is recommended that the package be
removed to reduce the potential attack surface. |
OVAL test results detailspackage tnftp is removed
oval:ssg-test_package_tnftp_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_tnftp_removed:obj:1 of type
dpkginfo_object
Uninstall apache2 Packagexccdf_org.ssgproject.content_rule_package_httpd_removed unknown
Uninstall apache2 Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_httpd_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_httpd_removed:def:1 |
| Time | 2026-11-02T22:58:54+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.19 |
|
| Description | The apache2 package can be removed with the following command:
$ apt-get remove apache2
|
| Rationale | If there is no need to make the web server software available,
removing it provides a safeguard against its activation. |
OVAL test results detailspackage apache2 is removed
oval:ssg-test_package_apache2_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_apache2_removed:obj:1 of type
dpkginfo_object
Disable apache2 Servicexccdf_org.ssgproject.content_rule_service_httpd_disabled unknown
Disable apache2 Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_httpd_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_httpd_disabled:def:1 |
| Time | 2026-11-02T22:58:55+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.19 |
|
| Description |
The apache2 service can be disabled with the following command:
$ sudo systemctl mask --now apache2.service
|
| Rationale | Running web server software provides a network-based avenue
of attack, and should be disabled if not needed. |
OVAL test results detailspackage apache2 is removed
oval:ssg-service_httpd_disabled_test_service_apache2_package_apache2_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_httpd_disabled_test_service_apache2_package_apache2_removed:obj:1 of type
dpkginfo_object
Test that the apache2 service is not running
oval:ssg-test_service_not_running_service_httpd_disabled_apache2:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_httpd_disabled_apache2:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^apache2\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service apache2 is masked
oval:ssg-test_service_loadstate_is_masked_service_httpd_disabled_apache2:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_httpd_disabled_apache2:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^apache2\.(service|socket)$ | LoadState |
Test that the service apache2 is not found
oval:ssg-test_service_not_found_service_httpd_disabled_apache2:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_httpd_disabled_apache2:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^apache2\.(service|socket)$ | LoadState |
Uninstall nginx Packagexccdf_org.ssgproject.content_rule_package_nginx_removed unknown
Uninstall nginx Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_nginx_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_nginx_removed:def:1 |
| Time | 2026-11-02T22:58:55+00:00 |
| Severity | unknown |
| References: | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.19 |
|
| Description | The nginx package can be removed with the following command:
$ apt-get remove nginx
|
| Rationale | If there is no need to make the web server software available,
removing it provides a safeguard against its activation. |
OVAL test results detailspackage nginx is removed
oval:ssg-test_package_nginx_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_nginx_removed:obj:1 of type
dpkginfo_object
Disable nginx Servicexccdf_org.ssgproject.content_rule_service_nginx_disabled unknown
Disable nginx Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_nginx_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_nginx_disabled:def:1 |
| Time | 2026-11-02T22:58:55+00:00 |
| Severity | unknown |
| References: | |
| Description |
The nginx service can be disabled with the following command:
$ sudo systemctl mask --now nginx.service
|
| Rationale | Running web server software provides a network-based avenue
of attack, and should be disabled if not needed. |
OVAL test results detailspackage nginx is removed
oval:ssg-service_nginx_disabled_test_service_nginx_package_nginx_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_nginx_disabled_test_service_nginx_package_nginx_removed:obj:1 of type
dpkginfo_object
Test that the nginx service is not running
oval:ssg-test_service_not_running_service_nginx_disabled_nginx:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_nginx_disabled_nginx:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^nginx\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service nginx is masked
oval:ssg-test_service_loadstate_is_masked_service_nginx_disabled_nginx:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_nginx_disabled_nginx:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^nginx\.(service|socket)$ | LoadState |
Test that the service nginx is not found
oval:ssg-test_service_not_found_service_nginx_disabled_nginx:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_nginx_disabled_nginx:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^nginx\.(service|socket)$ | LoadState |
Uninstall dovecot Packagexccdf_org.ssgproject.content_rule_package_dovecot_removed unknown
Uninstall dovecot Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_dovecot_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_dovecot_removed:def:1 |
| Time | 2026-11-02T22:58:55+00:00 |
| Severity | unknown |
| References: | |
| Description | The dovecot-core package can be removed with the following command:
$ apt-get remove dovecot-core
|
| Rationale | If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation. |
OVAL test results detailspackage dovecot-core is removed
oval:ssg-test_package_dovecot-core_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_dovecot-core_removed:obj:1 of type
dpkginfo_object
Disable Dovecot Servicexccdf_org.ssgproject.content_rule_service_dovecot_disabled unknown
Disable Dovecot Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_dovecot_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_dovecot_disabled:def:1 |
| Time | 2026-11-02T22:58:56+00:00 |
| Severity | unknown |
| References: | |
| Description |
The dovecot service can be disabled with the following command:
$ sudo systemctl mask --now dovecot.service
|
| Rationale | Running an IMAP or POP3 server provides a network-based
avenue of attack, and should be disabled if not needed. |
OVAL test results detailspackage dovecot-core is removed
oval:ssg-service_dovecot_disabled_test_service_dovecot_package_dovecot-core_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_dovecot_disabled_test_service_dovecot_package_dovecot-core_removed:obj:1 of type
dpkginfo_object
Test that the dovecot service is not running
oval:ssg-test_service_not_running_service_dovecot_disabled_dovecot:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_dovecot_disabled_dovecot:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^dovecot\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service dovecot is masked
oval:ssg-test_service_loadstate_is_masked_service_dovecot_disabled_dovecot:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_dovecot_disabled_dovecot:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^dovecot\.(service|socket)$ | LoadState |
Test that the service dovecot is not found
oval:ssg-test_service_not_found_service_dovecot_disabled_dovecot:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_dovecot_disabled_dovecot:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^dovecot\.(service|socket)$ | LoadState |
Ensure LDAP client is not installedxccdf_org.ssgproject.content_rule_package_openldap-clients_removed low
Ensure LDAP client is not installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_openldap-clients_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_openldap-clients_removed:def:1 |
| Time | 2026-11-02T22:58:56+00:00 |
| Severity | low |
| References: | |
| Description | The Lightweight Directory Access Protocol (LDAP) is a service that provides
a method for looking up information from a central database.
The ldap-utils package can be removed with the following command:
$ apt-get remove ldap-utils
|
| Rationale | If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface. |
OVAL test results detailspackage ldap-utils is removed
oval:ssg-test_package_ldap-utils_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_ldap-utils_removed:obj:1 of type
dpkginfo_object
Uninstall slapd Packagexccdf_org.ssgproject.content_rule_package_openldap-servers_removed low
Uninstall slapd Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_openldap-servers_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_openldap-servers_removed:def:1 |
| Time | 2026-11-02T22:58:56+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.7 |
|
| Description | The slapd package is not installed by default on a Debian 13
system. It is needed only by the OpenLDAP server, not by the
clients which use LDAP for authentication. If the system is not
intended for use as an LDAP Server it should be removed. |
| Rationale | Unnecessary packages should not be installed to decrease the attack
surface of the system. While this software is clearly essential on an LDAP
server, it is not necessary on typical desktop or workstation systems. |
OVAL test results detailspackage slapd is removed
oval:ssg-test_package_slapd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_slapd_removed:obj:1 of type
dpkginfo_object
Disable LDAP Server (slapd)xccdf_org.ssgproject.content_rule_service_slapd_disabled medium
Disable LDAP Server (slapd)
| Rule ID | xccdf_org.ssgproject.content_rule_service_slapd_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_slapd_disabled:def:1 |
| Time | 2026-11-02T22:58:57+00:00 |
| Severity | medium |
| References: | |
| Description | The Lightweight Directory Access Protocol (LDAP) is a service that
provides a method for looking up information from a central database. |
| Rationale | If the system will not need to act as an LDAP server, it is recommended
that the software be disabled to reduce the potential attack surface. |
OVAL test results detailspackage slapd is removed
oval:ssg-service_slapd_disabled_test_service_slapd_package_slapd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_slapd_disabled_test_service_slapd_package_slapd_removed:obj:1 of type
dpkginfo_object
Test that the slapd service is not running
oval:ssg-test_service_not_running_service_slapd_disabled_slapd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_slapd_disabled_slapd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^slapd\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service slapd is masked
oval:ssg-test_service_loadstate_is_masked_service_slapd_disabled_slapd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_slapd_disabled_slapd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^slapd\.(service|socket)$ | LoadState |
Test that the service slapd is not found
oval:ssg-test_service_not_found_service_slapd_disabled_slapd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_slapd_disabled_slapd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^slapd\.(service|socket)$ | LoadState |
Disable Postfix Network Listeningxccdf_org.ssgproject.content_rule_postfix_network_listening_disabled medium
Disable Postfix Network Listening
| Rule ID | xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:57+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | anssi | R74 | | cis | 2.1.22 | | pcidss4 | 1.4.2, 1.4 |
|
| Description | Edit the file /etc/postfix/main.cf to ensure that only the following
inet_interfaces line appears:
inet_interfaces = loopback-only
|
| Rationale | This ensures postfix accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack. |
Ensure Mail Transfer Agent is not Listening on any non-loopback Addressxccdf_org.ssgproject.content_rule_has_nonlocal_mta medium
Ensure Mail Transfer Agent is not Listening on any non-loopback Address
| Rule ID | xccdf_org.ssgproject.content_rule_has_nonlocal_mta |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-has_nonlocal_mta:def:1 |
| Time | 2026-11-02T22:58:57+00:00 |
| Severity | medium |
| References: | |
| Description | Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to
listen for incoming mail and transfer the messages to the appropriate
user or mail server. If the system is not intended to be a mail server,
it is recommended that the MTA be configured to only process local mail. |
| Rationale | The software for all Mail Transfer Agents is complex and most have a
long history of security issues. While it is important to ensure that
the system can process local mail messages, it is not necessary to have
the MTA's daemon listening on a port unless the server is intended to
be a mail server that receives and processes mail from other systems. |
OVAL test results detailsmta is not listening on any non-loopback address 25
oval:ssg-tst_nothing_listening_external_mta_port_25:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_listening_port_25:obj:1 of type
inetlisteningservers_object
| Protocol | Local address | Local port | Filter | Filter |
|---|
| tcp | 127.0.0.1 | 25 | oval:ssg-ste_not_port_25:ste:1 | oval:ssg-ste_not_on_localhost:ste:1 |
Uninstall rpcbind Packagexccdf_org.ssgproject.content_rule_package_rpcbind_removed low
Uninstall rpcbind Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_rpcbind_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_rpcbind_removed:def:1 |
| Time | 2026-11-02T22:58:57+00:00 |
| Severity | low |
| References: | |
| Description | The rpcbind utility maps RPC services to the ports on which they listen.
RPC processes notify rpcbind when they start, registering the ports they
are listening on and the RPC program numbers they expect to serve. The
rpcbind service redirects the client to the proper port number so it can
communicate with the requested service. If the system does not require RPC
(such as for NFS servers) then this service should be disabled.
The rpcbind package can be removed with the following command:
$ apt-get remove rpcbind
|
| Rationale | If the system does not require rpc based services, it is recommended that
rpcbind be disabled to reduce the attack surface. |
OVAL test results detailspackage rpcbind is removed
oval:ssg-test_package_rpcbind_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_rpcbind_removed:obj:1 of type
dpkginfo_object
Disable rpcbind Servicexccdf_org.ssgproject.content_rule_service_rpcbind_disabled low
Disable rpcbind Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_rpcbind_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_rpcbind_disabled:def:1 |
| Time | 2026-11-02T22:58:57+00:00 |
| Severity | low |
| References: | |
| Description | The rpcbind utility maps RPC services to the ports on which they listen.
RPC processes notify rpcbind when they start, registering the ports they
are listening on and the RPC program numbers they expect to serve. The
rpcbind service redirects the client to the proper port number so it can
communicate with the requested service. If the system does not require RPC
(such as for NFS servers) then this service should be disabled.
The rpcbind service can be disabled with the following command:
$ sudo systemctl mask --now rpcbind.service
|
| Rationale | If the system does not require rpc based services, it is recommended that
rpcbind be disabled to reduce the attack surface. |
OVAL test results detailspackage rpcbind is removed
oval:ssg-service_rpcbind_disabled_test_service_rpcbind_package_rpcbind_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_rpcbind_disabled_test_service_rpcbind_package_rpcbind_removed:obj:1 of type
dpkginfo_object
Test that the rpcbind service is not running
oval:ssg-test_service_not_running_service_rpcbind_disabled_rpcbind:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_rpcbind_disabled_rpcbind:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^rpcbind\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service rpcbind is masked
oval:ssg-test_service_loadstate_is_masked_service_rpcbind_disabled_rpcbind:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_rpcbind_disabled_rpcbind:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^rpcbind\.(service|socket)$ | LoadState |
Test that the service rpcbind is not found
oval:ssg-test_service_not_found_service_rpcbind_disabled_rpcbind:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_rpcbind_disabled_rpcbind:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^rpcbind\.(service|socket)$ | LoadState |
Disable Network File System (nfs)xccdf_org.ssgproject.content_rule_service_nfs_disabled unknown
Disable Network File System (nfs)
| Rule ID | xccdf_org.ssgproject.content_rule_service_nfs_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_nfs_disabled:def:1 |
| Time | 2026-11-02T22:58:58+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 12, 14, 15, 16, 18, 3, 5 | | cobit5 | DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7 | | iso27001-2013 | A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-4, PR.AC-6, PR.PT-3 | | cis | 2.1.9 |
|
| Description | The Network File System (NFS) service allows remote hosts to mount
and interact with shared filesystems on the local system. If the local system
is not designated as a NFS server then this service should be disabled.
The nfs-server service can be disabled with the following command:
$ sudo systemctl mask --now nfs-server.service
|
| Rationale | Unnecessary services should be disabled to decrease the attack surface of the system. |
OVAL test results detailspackage nfs-kernel-server is removed
oval:ssg-service_nfs_disabled_test_service_nfs-server_package_nfs-kernel-server_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_nfs_disabled_test_service_nfs-server_package_nfs-kernel-server_removed:obj:1 of type
dpkginfo_object
Test that the nfs-server service is not running
oval:ssg-test_service_not_running_service_nfs_disabled_nfs-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_nfs_disabled_nfs-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^nfs-server\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service nfs-server is masked
oval:ssg-test_service_loadstate_is_masked_service_nfs_disabled_nfs-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_nfs_disabled_nfs-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^nfs-server\.(service|socket)$ | LoadState |
Test that the service nfs-server is not found
oval:ssg-test_service_not_found_service_nfs_disabled_nfs-server:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_nfs_disabled_nfs-server:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^nfs-server\.(service|socket)$ | LoadState |
Uninstall nfs-kernel-server Packagexccdf_org.ssgproject.content_rule_package_nfs-kernel-server_removed low
Uninstall nfs-kernel-server Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_nfs-kernel-server_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_nfs-kernel-server_removed:def:1 |
| Time | 2026-11-02T22:58:57+00:00 |
| Severity | low |
| References: | |
| Description | The nfs-kernel-server package can be removed with the following command:
$ apt-get remove nfs-kernel-server
|
| Rationale | If the system does not export NFS shares or act as an NFS client, it is
recommended that these services be removed to reduce the remote attack
surface. |
OVAL test results detailspackage nfs-kernel-server is removed
oval:ssg-test_package_nfs-kernel-server_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_nfs-kernel-server_removed:obj:1 of type
dpkginfo_object
The Chrony package is installedxccdf_org.ssgproject.content_rule_package_chrony_installed medium
The Chrony package is installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_chrony_installed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_chrony_installed:def:1 |
| Time | 2026-11-02T22:58:58+00:00 |
| Severity | medium |
| References: | |
| Description | System time should be synchronized between all systems in an environment. This is
typically done by establishing an authoritative time server or set of servers and having all
systems synchronize their clocks to them.
The chrony package can be installed with the following command:
$ apt-get install chrony
|
| Rationale | Time synchronization is important to support time sensitive security mechanisms like
Kerberos and also ensures log files have consistent time records across the enterprise,
which aids in forensic investigations. |
OVAL test results detailspackage chrony is installed
oval:ssg-test_package_chrony_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | chrony | arm64 | 0 | 3+deb13u2 | 4.6.1 | 4.6.1-3+deb13u2 |
The Chronyd service is enabledxccdf_org.ssgproject.content_rule_service_chronyd_enabled medium
The Chronyd service is enabled
| Rule ID | xccdf_org.ssgproject.content_rule_service_chronyd_enabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_chronyd_enabled:def:1 |
| Time | 2026-11-02T22:58:59+00:00 |
| Severity | medium |
| References: | |
| Description | chrony is a daemon which implements the Network Time Protocol (NTP) is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at
https://chrony-project.org/.
Chrony can be configured to be a client and/or a server.
To enable Chronyd service, you can run:
# systemctl enable chronyd.service
This recommendation only applies if chrony is in use on the system. |
| Rationale | If chrony is in use on the system proper configuration is vital to ensuring time
synchronization is working properly. |
OVAL test results detailspackage chrony is installed
oval:ssg-test_service_chrony_package_chrony_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | chrony | arm64 | 0 | 3+deb13u2 | 4.6.1 | 4.6.1-3+deb13u2 |
Test that the chrony service is running
oval:ssg-test_service_running_chrony:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Property | Value |
|---|
| true | chrony.service | ActiveState | active |
systemd test
oval:ssg-test_multi_user_wants_chrony:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| true | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
systemd test
oval:ssg-test_multi_user_wants_chrony_socket:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|
| false | multi-user.target | basic.target | -.mount | sysinit.target | proc-sys-fs-binfmt_misc.automount | systemd-ask-password-console.path | ldconfig.service | systemd-random-seed.service | systemd-resolved.service | systemd-udev-trigger.service | systemd-sysusers.service | swap.target | systemd-modules-load.service | sys-kernel-debug.mount | systemd-pstore.service | systemd-timesyncd.service | systemd-firstboot.service | systemd-binfmt.service | systemd-pcrphase-sysinit.service | systemd-tmpfiles-setup-dev.service | systemd-journal-catalog-update.service | systemd-machine-id-commit.service | systemd-pcrmachine.service | systemd-sysctl.service | systemd-journal-flush.service | systemd-hibernate-clear.service | systemd-tpm2-setup-early.service | sys-kernel-tracing.mount | sys-kernel-config.mount | systemd-hwdb-update.service | dev-mqueue.mount | apparmor.service | kmod-static-nodes.service | systemd-udevd.service | sys-fs-fuse-connections.mount | systemd-network-generator.service | systemd-update-done.service | systemd-tmpfiles-setup-dev-early.service | systemd-tmpfiles-setup.service | systemd-journald.service | systemd-tpm2-setup.service | systemd-pcrphase.service | dev-hugepages.mount | local-fs.target | boot-efi.mount | tmp.mount | systemd-fsck-root.service | run-lock.mount | systemd-remount-fs.service | paths.target | timers.target | dpkg-db-backup.timer | fstrim.timer | exim4-base.timer | apt-daily.timer | man-db.timer | e2scrub_all.timer | apt-daily-upgrade.timer | apt-listchanges.timer | systemd-tmpfiles-clean.timer | slices.target | -.slice | system.slice | sockets.target | systemd-sysext.socket | uuidd.socket | systemd-journald.socket | dbus.socket | systemd-pcrextend.socket | systemd-networkd.socket | systemd-udevd-control.socket | systemd-creds.socket | sshd-unix-local.socket | systemd-journald-dev-log.socket | systemd-pcrlock.socket | systemd-udevd-kernel.socket | systemd-initctl.socket | systemd-hostnamed.socket | cron.service | systemd-logind.service | ufw.service | grub-common.service | sysctl-reapply-network.service | cloud-init.target | cloud-final.service | cloud-config.service | cloud-init-local.service | cloud-init-network.service | cloud-init-main.service | aidecheck.service | ttn-firstboot.service | e2scrub_reap.service | aidecheck.timer | dbus.service | remote-fs.target | systemd-ask-password-wall.path | ssh.service | systemd-user-sessions.service | systemd-networkd.service | exim4.service | getty.target | getty@tty1.service | getty-static.service | serial-getty@ttyS0.service | unattended-upgrades.service | chrony.service |
Disable systemd_timesyncd Servicexccdf_org.ssgproject.content_rule_service_timesyncd_disabled medium
Disable systemd_timesyncd Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_timesyncd_disabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:58:59+00:00 |
| Severity | medium |
| References: | |
| Description |
The systemd_timesyncd service can be disabled with the following command:
$ sudo systemctl mask --now systemd_timesyncd.service
|
| Rationale | |
Chrony Configure Pool and Serverxccdf_org.ssgproject.content_rule_chronyd_configure_pool_and_server medium
Chrony Configure Pool and Server
| Rule ID | xccdf_org.ssgproject.content_rule_chronyd_configure_pool_and_server |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-chronyd_configure_pool_and_server:def:1 |
| Time | 2026-11-02T22:58:59+00:00 |
| Severity | medium |
| References: | |
| Description | Chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at
https://chrony-project.org/.
Chrony can be configured to be a client and/or a server.
Add or edit server or pool lines to /etc/chrony/chrony.conf as appropriate:
server <remote-server>
Multiple servers may be configured. |
| Rationale | If chrony is in use on the system proper configuration is vital to ensuring time
synchronization is working properly. |
OVAL test results detailsEnsure remote NTP server is set
oval:ssg-test_chrony_remote_server_configuration:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-object_chrony_remote_server_configuration:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| 0.debian.pool.ntp.org,1.debian.pool.ntp.org,2.debian.pool.ntp.org,3.debian.pool.ntp.org | | ^(?:server)[[:space:]]0.debian.pool.ntp.org([[:space:]].*)?$ | | ^(?:server)[[:space:]]1.debian.pool.ntp.org([[:space:]].*)?$ | | ^(?:server)[[:space:]]2.debian.pool.ntp.org([[:space:]].*)?$ | | ^(?:server)[[:space:]]3.debian.pool.ntp.org([[:space:]].*)?$ |
| /etc/chrony/chrony.conf | 1 |
Ensure remote NTP pool is set
oval:ssg-test_chrony_remote_pool_configuration:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/chrony/chrony.conf | pool 2.debian.pool.ntp.org iburst |
Ensure that chronyd is running under chrony user accountxccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user medium
Ensure that chronyd is running under chrony user account
| Rule ID | xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-chronyd_run_as_chrony_user:def:1 |
| Time | 2026-11-02T22:58:59+00:00 |
| Severity | medium |
| References: | |
| Description | chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at
https://chrony-project.org/.
Chrony can be configured to be a client and/or a server.
To ensure that chronyd is running under chrony user account,
add or edit the
OPTIONS variable in /etc/sysconfig/chronyd to include -u chrony:
OPTIONS="-u chrony"
This recommendation only applies if chrony is in use on the system. |
| Rationale | If chrony is in use on the system proper configuration is vital to ensuring time synchronization
is working properly. |
OVAL test results detailstests the value of user setting in the /etc/chrony/chrony.conf file
oval:ssg-test_chronyd_run_as_chrony_user:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_chronyd_run_as_chrony_user:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/chrony/chrony.conf | ^[ \t]*user[[:space:]](.+?)[ \t]*(?:$|#) | 1 |
tests the absence of user setting in the /etc/chrony/chrony.conf file
oval:ssg-test_chronyd_run_as_chrony_user_default_not_overriden:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_chronyd_run_as_chrony_user_default_not_overriden:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| /etc/chrony/chrony.conf | ^[ \t]*user[[:space:]] | 1 |
Ensure a Single Time Synchronization Service is in Usexccdf_org.ssgproject.content_rule_ntp_single_service_active medium
Ensure a Single Time Synchronization Service is in Use
| Rule ID | xccdf_org.ssgproject.content_rule_ntp_single_service_active |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ntp_single_service_active:def:1 |
| Time | 2026-11-02T22:58:59+00:00 |
| Severity | medium |
| References: | |
| Description | The system must have exactly one active time synchronization service to avoid conflicts
and ensure consistent time synchronization. Only one of the following services should be
enabled and active at any time:
- chrony - A versatile NTP implementation
- systemd-timesyncd - A lightweight NTP client
Having zero active time synchronization services leaves the system without accurate
time synchronization, while having multiple active services can lead to unexpected and
unreliable results. |
| Rationale | Running multiple time synchronization services simultaneously can lead to conflicts
in time synchronization, unpredictable behavior, and unreliable results. A single service
ensures consistent and accurate time synchronization.
Having no active time synchronization service leaves the system without accurate
time synchronization, which can affect security mechanisms, log consistency, and forensic
investigations. |
| Warnings | warning
This rule does not come with a remediation. There are specific rules
for enabling each time synchronization service, which should be used instead. |
OVAL test results detailsVerify exactly one time synchronization service is active
oval:ssg-test_ntp_single_service_active_single_active_timesync:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-var_ntp_single_service_active_timesync_active_count:var:1 | 1 |
Uninstall xinetd package if not used by network servicesxccdf_org.ssgproject.content_rule_package_xinetd_removed low
Uninstall xinetd package if not used by network services
| Rule ID | xccdf_org.ssgproject.content_rule_package_xinetd_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_xinetd_removed:def:1 |
| Time | 2026-11-02T22:59:00+00:00 |
| Severity | low |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | anssi | R62 | | cis | 2.1.20 | | ism | 1409 | | pcidss4 | 2.2.4, 2.2 |
|
| Description | The xinetd package can be removed with the following command:
$ apt-get remove xinetd
|
| Rationale | Removing the xinetd package decreases the risk of the
xinetd service's accidental (or intentional) activation. |
OVAL test results detailspackage xinetd is removed
oval:ssg-test_package_xinetd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_xinetd_removed:obj:1 of type
dpkginfo_object
Disable xinetd Servicexccdf_org.ssgproject.content_rule_service_xinetd_disabled medium
Disable xinetd Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_xinetd_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_xinetd_disabled:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | cui | 3.4.7 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | cis | 2.1.20 | | ism | 1409 |
|
| Description |
The xinetd service can be disabled with the following command:
$ sudo systemctl mask --now xinetd.service
|
| Rationale | The xinetd service provides a dedicated listener service for some programs,
which is no longer necessary for commonly-used network services. Disabling
it ensures that these uncommon services are not running, and also prevents
attacks against xinetd itself. |
OVAL test results detailspackage xinetd is removed
oval:ssg-service_xinetd_disabled_test_service_xinetd_package_xinetd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_xinetd_disabled_test_service_xinetd_package_xinetd_removed:obj:1 of type
dpkginfo_object
Test that the xinetd service is not running
oval:ssg-test_service_not_running_service_xinetd_disabled_xinetd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_xinetd_disabled_xinetd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^xinetd\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service xinetd is masked
oval:ssg-test_service_loadstate_is_masked_service_xinetd_disabled_xinetd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_xinetd_disabled_xinetd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^xinetd\.(service|socket)$ | LoadState |
Test that the service xinetd is not found
oval:ssg-test_service_not_found_service_xinetd_disabled_xinetd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_xinetd_disabled_xinetd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^xinetd\.(service|socket)$ | LoadState |
Uninstall ypserv Packagexccdf_org.ssgproject.content_rule_package_ypserv_removed high
Uninstall ypserv Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_ypserv_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_ypserv_removed:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | pcidss | Req-2.2.2 | | os-srg | SRG-OS-000095-GPOS-00049 | | anssi | R62 | | cis | 2.1.10 | | pcidss4 | 2.2.4, 2.2 |
|
| Description | The ypserv package can be removed with the following command:
$ apt-get remove ypserv
|
| Rationale | The NIS service provides an unencrypted authentication service which does
not provide for the confidentiality and integrity of user passwords or the
remote session.
Removing the ypserv package decreases the risk of the accidental
(or intentional) activation of NIS or NIS+ services. |
OVAL test results detailspackage ypserv is removed
oval:ssg-test_package_ypserv_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_ypserv_removed:obj:1 of type
dpkginfo_object
Disable ypserv Servicexccdf_org.ssgproject.content_rule_service_ypserv_disabled medium
Disable ypserv Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_ypserv_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_ypserv_disabled:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | medium |
| References: | |
| Description | The ypserv service, which allows the system to act as a client in
a NIS or NIS+ domain, should be disabled.
The ypserv service can be disabled with the following command:
$ sudo systemctl mask --now ypserv.service
|
| Rationale | Disabling the ypserv service ensures the system is not acting
as a client in a NIS or NIS+ domain. This service should be disabled
unless in use. |
OVAL test results detailspackage ypserv is removed
oval:ssg-service_ypserv_disabled_test_service_ypserv_package_ypserv_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_ypserv_disabled_test_service_ypserv_package_ypserv_removed:obj:1 of type
dpkginfo_object
Test that the ypserv service is not running
oval:ssg-test_service_not_running_service_ypserv_disabled_ypserv:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_ypserv_disabled_ypserv:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^ypserv\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service ypserv is masked
oval:ssg-test_service_loadstate_is_masked_service_ypserv_disabled_ypserv:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_ypserv_disabled_ypserv:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^ypserv\.(service|socket)$ | LoadState |
Test that the service ypserv is not found
oval:ssg-test_service_not_found_service_ypserv_disabled_ypserv:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_ypserv_disabled_ypserv:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^ypserv\.(service|socket)$ | LoadState |
Uninstall rsh Packagexccdf_org.ssgproject.content_rule_package_rsh_removed unknown
Uninstall rsh Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_rsh_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_rsh_removed:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | unknown |
| References: | | cui | 3.1.13 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | iso27001-2013 | A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3 | | anssi | R62 | | cis | 2.2.2 | | pcidss4 | 2.2.4, 2.2 |
|
| Description |
The rsh-client package contains the client commands
for the rsh services |
| Rationale | These legacy clients contain numerous security exposures and have
been replaced with the more secure SSH package. Even if the server is removed,
it is best to ensure the clients are also removed to prevent users from
inadvertently attempting to use these commands and therefore exposing
their credentials. Note that removing the rsh-client package removes
the clients for rsh,rcp, and rlogin. |
OVAL test results detailspackage rsh-client is removed
oval:ssg-test_package_rsh-client_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_rsh-client_removed:obj:1 of type
dpkginfo_object
Remove Rsh Trust Filesxccdf_org.ssgproject.content_rule_no_rsh_trust_files high
Remove Rsh Trust Files
| Rule ID | xccdf_org.ssgproject.content_rule_no_rsh_trust_files |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | cis | 7.2.10 |
|
| Description | The files /etc/hosts.equiv and ~/.rhosts (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
$ sudo rm /etc/hosts.equiv
$ rm ~/.rhosts
|
| Rationale | This action is only meaningful if .rhosts support is permitted
through PAM. Trust files are convenient, but when used in conjunction with
the R-services, they can allow unauthenticated access to a system. |
Uninstall talk Packagexccdf_org.ssgproject.content_rule_package_talk_removed medium
Uninstall talk Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_talk_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_talk_removed:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | medium |
| References: | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | anssi | R62 | | cis | 2.2.3 | | pcidss4 | 2.2.4, 2.2 |
|
| Description | The talk package contains the client program for the
Internet talk protocol, which allows the user to chat with other users on
different systems. Talk is a communication program which copies lines from one
terminal to the terminal of another user.
The talk package can be removed with the following command:
$ apt-get remove talk
|
| Rationale | The talk software presents a security risk as it uses unencrypted protocols
for communications. Removing the talk package decreases the
risk of the accidental (or intentional) activation of talk client program. |
OVAL test results detailspackage talk is removed
oval:ssg-test_package_talk_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_talk_removed:obj:1 of type
dpkginfo_object
Remove telnet Clientsxccdf_org.ssgproject.content_rule_package_inetutils-telnet_removed low
Remove telnet Clients
| Rule ID | xccdf_org.ssgproject.content_rule_package_inetutils-telnet_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_inetutils-telnet_removed:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | low |
| References: | |
| Description | The telnet client allows users to start connections to other systems via
the telnet protocol. |
| Rationale | The telnet protocol is insecure and unencrypted. The use
of an unencrypted transmission medium could allow an unauthorized user
to steal credentials. The ssh package provides an
encrypted session and stronger security and is included in Debian 13. |
OVAL test results detailspackage inetutils-telnet is removed
oval:ssg-test_package_inetutils-telnet_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_inetutils-telnet_removed:obj:1 of type
dpkginfo_object
Remove telnet Clientsxccdf_org.ssgproject.content_rule_package_telnet_removed low
Remove telnet Clients
| Rule ID | xccdf_org.ssgproject.content_rule_package_telnet_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_telnet_removed:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | low |
| References: | | cui | 3.1.13 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | iso27001-2013 | A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3 | | anssi | R62 | | cis | 2.2.4 | | ism | 1409 | | pcidss4 | 2.2.4, 2.2 |
|
| Description | The telnet client allows users to start connections to other systems via
the telnet protocol. |
| Rationale | The telnet protocol is insecure and unencrypted. The use
of an unencrypted transmission medium could allow an unauthorized user
to steal credentials. The ssh package provides an
encrypted session and stronger security and is included in Debian 13. |
OVAL test results detailspackage telnet is removed
oval:ssg-test_package_telnet_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_telnet_removed:obj:1 of type
dpkginfo_object
Uninstall tftpd-hpa Packagexccdf_org.ssgproject.content_rule_package_tftp-server_removed high
Uninstall tftpd-hpa Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_tftp-server_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_tftp-server_removed:def:1 |
| Time | 2026-11-02T22:59:01+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R62 | | cis | 2.1.17 | | pcidss4 | 2.2.4, 2.2 |
|
| Description | The tftpd-hpa package can be removed with the following command: $ apt-get remove tftpd-hpa
|
| Rationale | Removing the tftpd-hpa package decreases the risk of the accidental
(or intentional) activation of tftp services.
If TFTP is required for operational support (such as transmission of router
configurations), its use must be documented with the Information Systems
Security Manager (ISSM), restricted to only authorized personnel, and have
access control rules established. |
OVAL test results detailspackage tftpd-hpa is removed
oval:ssg-test_package_tftpd-hpa_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_tftpd-hpa_removed:obj:1 of type
dpkginfo_object
Disable tftpd-hpa Servicexccdf_org.ssgproject.content_rule_service_tftp_disabled high
Disable tftpd-hpa Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_tftp_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_tftp_disabled:def:1 |
| Time | 2026-11-02T22:59:02+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 14, 15, 3, 8, 9 | | cobit5 | APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6 | | iso27001-2013 | A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4 | | cis | 2.1.17 |
|
| Description | The tftpd-hpa service should be disabled.
The tftpd-hpa service can be disabled with the following command:
$ sudo systemctl mask --now tftpd-hpa.service
|
| Rationale | Disabling the tftpd-hpa service ensures the system is not acting
as a TFTP server, which does not provide encryption or authentication. |
OVAL test results detailspackage tftpd-hpa is removed
oval:ssg-service_tftp_disabled_test_service_tftpd-hpa_package_tftpd-hpa_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_tftp_disabled_test_service_tftpd-hpa_package_tftpd-hpa_removed:obj:1 of type
dpkginfo_object
Test that the tftpd-hpa service is not running
oval:ssg-test_service_not_running_service_tftp_disabled_tftpd-hpa:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_tftp_disabled_tftpd-hpa:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^tftpd-hpa\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service tftpd-hpa is masked
oval:ssg-test_service_loadstate_is_masked_service_tftp_disabled_tftpd-hpa:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_tftp_disabled_tftpd-hpa:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^tftpd-hpa\.(service|socket)$ | LoadState |
Test that the service tftpd-hpa is not found
oval:ssg-test_service_not_found_service_tftp_disabled_tftpd-hpa:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_tftp_disabled_tftpd-hpa:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^tftpd-hpa\.(service|socket)$ | LoadState |
Uninstall rsync Packagexccdf_org.ssgproject.content_rule_package_rsync_removed medium
Uninstall rsync Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_rsync_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_rsync_removed:def:1 |
| Time | 2026-11-02T22:58:59+00:00 |
| Severity | medium |
| References: | |
| Description | The rsyncd service can be used to synchronize files between systems over network links.
The rsync package can be removed with the following command:
$ apt-get remove rsync
|
| Rationale | The rsyncd service presents a security risk as it uses unencrypted protocols for
communication. |
OVAL test results detailspackage rsync is removed
oval:ssg-test_package_rsync_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_rsync_removed:obj:1 of type
dpkginfo_object
Ensure rsyncd service is disabledxccdf_org.ssgproject.content_rule_service_rsyncd_disabled medium
Ensure rsyncd service is disabled
| Rule ID | xccdf_org.ssgproject.content_rule_service_rsyncd_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_rsyncd_disabled:def:1 |
| Time | 2026-11-02T22:59:00+00:00 |
| Severity | medium |
| References: | |
| Description |
The rsyncd service can be disabled with the following command:
$ sudo systemctl mask --now rsyncd.service
|
| Rationale | The rsyncd service presents a security risk as it uses unencrypted protocols for
communication. |
OVAL test results detailspackage rsync is removed
oval:ssg-service_rsyncd_disabled_test_service_rsync_package_rsync_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_rsyncd_disabled_test_service_rsync_package_rsync_removed:obj:1 of type
dpkginfo_object
Test that the rsync service is not running
oval:ssg-test_service_not_running_service_rsyncd_disabled_rsync:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_rsyncd_disabled_rsync:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^rsync\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service rsync is masked
oval:ssg-test_service_loadstate_is_masked_service_rsyncd_disabled_rsync:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_rsyncd_disabled_rsync:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^rsync\.(service|socket)$ | LoadState |
Test that the service rsync is not found
oval:ssg-test_service_not_found_service_rsyncd_disabled_rsync:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_rsyncd_disabled_rsync:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^rsync\.(service|socket)$ | LoadState |
Uninstall CUPS Packagexccdf_org.ssgproject.content_rule_package_cups_removed unknown
Uninstall CUPS Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_cups_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_cups_removed:def:1 |
| Time | 2026-11-02T22:59:02+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.11 |
|
| Description | The cups package can be removed with the following command:
$ apt-get remove cups
|
| Rationale | If the system does not need to print jobs or accept print jobs from other systems, it is
recommended that CUPS be removed to reduce the potential attack surface. |
OVAL test results detailspackage cups is removed
oval:ssg-test_package_cups_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_cups_removed:obj:1 of type
dpkginfo_object
Disable the CUPS Servicexccdf_org.ssgproject.content_rule_service_cups_disabled unknown
Disable the CUPS Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_cups_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_cups_disabled:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 14, 3, 9 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06 | | isa-62443-2009 | 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2 | | nist | CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1, PR.PT-3 | | cis | 2.1.11 |
|
| Description |
The cups service can be disabled with the following command:
$ sudo systemctl mask --now cups.service
|
| Rationale | Turn off unneeded services to reduce attack surface. |
OVAL test results detailspackage cups is removed
oval:ssg-service_cups_disabled_test_service_cups_package_cups_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_cups_disabled_test_service_cups_package_cups_removed:obj:1 of type
dpkginfo_object
Test that the cups service is not running
oval:ssg-test_service_not_running_service_cups_disabled_cups:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_cups_disabled_cups:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^cups\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service cups is masked
oval:ssg-test_service_loadstate_is_masked_service_cups_disabled_cups:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_cups_disabled_cups:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^cups\.(service|socket)$ | LoadState |
Test that the service cups is not found
oval:ssg-test_service_not_found_service_cups_disabled_cups:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_cups_disabled_cups:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^cups\.(service|socket)$ | LoadState |
Uninstall squid Packagexccdf_org.ssgproject.content_rule_package_squid_removed unknown
Uninstall squid Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_squid_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_squid_removed:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | unknown |
| References: | |
| Description | The squid package can be removed with the following command: $ apt-get remove squid
|
| Rationale | If there is no need to make the proxy server software available,
removing it provides a safeguard against its activation. |
OVAL test results detailspackage squid is removed
oval:ssg-test_package_squid_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_squid_removed:obj:1 of type
dpkginfo_object
Disable Squidxccdf_org.ssgproject.content_rule_service_squid_disabled unknown
Disable Squid
| Rule ID | xccdf_org.ssgproject.content_rule_service_squid_disabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | unknown |
| References: | |
| Description |
The squid service can be disabled with the following command:
$ sudo systemctl mask --now squid.service
|
| Rationale | Running proxy server software provides a network-based avenue
of attack, and should be removed if not needed. |
Uninstall Samba Packagexccdf_org.ssgproject.content_rule_package_samba_removed unknown
Uninstall Samba Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_samba_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_samba_removed:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | unknown |
| References: | |
| Description | The samba package can be removed with the following command: $ apt-get remove samba
|
| Rationale | If there is no need to make the Samba software available,
removing it provides a safeguard against its activation. |
OVAL test results detailspackage samba is removed
oval:ssg-test_package_samba_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_samba_removed:obj:1 of type
dpkginfo_object
Disable Sambaxccdf_org.ssgproject.content_rule_service_smb_disabled low
Disable Samba
| Rule ID | xccdf_org.ssgproject.content_rule_service_smb_disabled |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_smb_disabled:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | low |
| References: | |
| Description |
The smb service can be disabled with the following command:
$ sudo systemctl mask --now smb.service
|
| Rationale | Running a Samba server provides a network-based avenue of attack, and
should be disabled if not needed. |
OVAL test results detailspackage samba is removed
oval:ssg-service_smb_disabled_test_service_smbd_package_samba_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_smb_disabled_test_service_smbd_package_samba_removed:obj:1 of type
dpkginfo_object
Test that the smbd service is not running
oval:ssg-test_service_not_running_service_smb_disabled_smbd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_service_smb_disabled_smbd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^smbd\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service smbd is masked
oval:ssg-test_service_loadstate_is_masked_service_smb_disabled_smbd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_smb_disabled_smbd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^smbd\.(service|socket)$ | LoadState |
Test that the service smbd is not found
oval:ssg-test_service_not_found_service_smb_disabled_smbd:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_service_smb_disabled_smbd:obj:1 of type
systemdunitproperty_object
| Unit | Property |
|---|
| ^smbd\.(service|socket)$ | LoadState |
Uninstall net-snmp Packagexccdf_org.ssgproject.content_rule_package_net-snmp_removed unknown
Uninstall net-snmp Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_net-snmp_removed |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_net-snmp_removed:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | unknown |
| References: | |
| Description |
The snmp package provides the snmpd service.
The snmp package can be removed with the following command:
$ apt-get remove snmp
|
| Rationale | If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation. |
OVAL test results detailspackage snmpd is removed
oval:ssg-test_package_snmpd_removed:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_snmpd_removed:obj:1 of type
dpkginfo_object
Disable snmpd Servicexccdf_org.ssgproject.content_rule_service_snmpd_disabled low
Disable snmpd Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_snmpd_disabled |
| Result | |
| Multi-check rule | no |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | low |
| References: | |
| Description |
The snmpd service can be disabled with the following command:
$ sudo systemctl mask --now snmpd.service
|
| Rationale | Running SNMP software provides a network-based avenue of attack, and
should be disabled if not needed. |
Set SSH Client Alive Count Maxxccdf_org.ssgproject.content_rule_sshd_set_keepalive medium
Set SSH Client Alive Count Max
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_keepalive |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_keepalive:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8 | | cjis | 5.5.6 | | cobit5 | APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.1.11 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2 | | iso27001-2013 | A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a) | | nist-csf | DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2 | | pcidss | Req-8.1.8 | | os-srg | SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109 | | cis | 5.1.7 | | pcidss4 | 8.2.8, 8.2 |
|
| Description | The SSH server sends at most ClientAliveCountMax messages
during a SSH session and waits for a response from the SSH client.
The option ClientAliveInterval configures timeout after
each ClientAliveCountMax message. If the SSH server does not
receive a response from the client, then the connection is considered unresponsive
and terminated.
For SSH earlier than v8.2, a ClientAliveCountMax value of 0
causes a timeout precisely when the ClientAliveInterval is set.
Starting with v8.2, a value of 0 disables the timeout functionality
completely. If the option is set to a number greater than 0, then
the session will be disconnected after
ClientAliveInterval * ClientAliveCountMax seconds without receiving
a keep alive message. |
| Rationale | This ensures a user login will be terminated as soon as the ClientAliveInterval
is reached. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_set_keepalive:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | ClientAliveCountMax 3 |
Verify that the value of ClientAliveCountMax is present
oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | ClientAliveCountMax 3 |
Set SSH Client Alive Intervalxccdf_org.ssgproject.content_rule_sshd_set_idle_timeout medium
Set SSH Client Alive Interval
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_idle_timeout:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8 | | cjis | 5.5.6 | | cobit5 | APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10 | | cui | 3.1.11 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2 | | iso27001-2013 | A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | CM-6(a), AC-17(a), AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a) | | nist-csf | DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2 | | pcidss | Req-8.1.8 | | os-srg | SRG-OS-000126-GPOS-00066, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175 | | cis | 5.1.7 | | pcidss4 | 8.2.8, 8.2 |
|
| Description | SSH allows administrators to set a network responsiveness timeout interval.
After this interval has passed, the unresponsive client will be automatically logged out.
To set this timeout interval, edit the following line in /etc/ssh/sshd_config as
follows:
ClientAliveInterval 300
The timeout interval is given in seconds. For example, have a timeout
of 10 minutes, set interval to 600.
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that
some processes may stop SSH from correctly detecting that the user is idle. |
| Rationale | Terminating an idle ssh session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management session
enabled on the console or console port that has been let unattended. |
| Warnings | warning
SSH disconnecting unresponsive clients will not have desired effect without also
configuring ClientAliveCountMax in the SSH service configuration. warning
Following conditions may prevent the SSH session to time out:
- Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.
- Any
scp or sftp activity by the same user to the host resets the timeout.
|
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
timeout is configured
oval:ssg-test_sshd_idle_timeout:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | ClientAliveInterval 300 |
Verify that the value of ClientAliveInterval is present
oval:ssg-test_clientaliveinterval_present:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | ClientAliveInterval 300 |
Verify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_set_keepalive:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | ClientAliveCountMax 3 |
Verify that the value of ClientAliveCountMax is present
oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | ClientAliveCountMax 3 |
Disable Host-Based Authenticationxccdf_org.ssgproject.content_rule_disable_host_auth medium
Disable Host-Based Authentication
| Rule ID | xccdf_org.ssgproject.content_rule_disable_host_auth |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-disable_host_auth:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 12, 14, 15, 16, 18, 3, 5, 9 | | cjis | 5.5.6 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06 | | cui | 3.1.12 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | AC-3, AC-17(a), CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3 | | ospp | FIA_UAU.1 | | os-srg | SRG-OS-000480-GPOS-00229 | | cis | 5.1.10 | | ism | 0421, 0422, 0484, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 8.3.1, 8.3 |
|
| Description | SSH's cryptographic host-based authentication is
more secure than .rhosts authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
The default SSH configuration disables host-based authentication. The appropriate
configuration is used if no value is set for HostbasedAuthentication.
To explicitly disable host-based authentication, add or correct the
following line in
/etc/ssh/sshd_config:
HostbasedAuthentication no
|
| Rationale | SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file
oval:ssg-test_disable_host_auth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | HostbasedAuthentication no |
Verify that the value of HostbasedAuthentication is present
oval:ssg-test_HostbasedAuthentication_present_disable_host_auth:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | HostbasedAuthentication no |
Disable SSH Access via Empty Passwordsxccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords high
Disable SSH Access via Empty Passwords
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_disable_empty_passwords:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | high |
| References: | | cis-csc | 11, 12, 13, 14, 15, 16, 18, 3, 5, 9 | | cjis | 5.5.6 | | cobit5 | APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06 | | cui | 3.1.1, 3.1.5 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | AC-17(a), CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3 | | ospp | FIA_UAU.1 | | pcidss | Req-2.2.4 | | os-srg | SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00227 | | cis | 5.1.20 | | ism | 1546 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | Disallow SSH login with empty passwords.
The default SSH configuration disables logins with empty passwords. The appropriate
configuration is used if no value is set for PermitEmptyPasswords.
To explicitly disallow SSH login from accounts with empty passwords,
add or correct the following line in
/etc/ssh/sshd_config:
PermitEmptyPasswords no
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords. |
| Rationale | Configuring this setting for the SSH daemon provides additional assurance
that remote login via SSH will require a password, even in the event of
misconfiguration elsewhere. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_disable_empty_passwords:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | PermitEmptyPasswords no |
Verify that the value of PermitEmptyPasswords is present
oval:ssg-test_PermitEmptyPasswords_present_sshd_disable_empty_passwords:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | PermitEmptyPasswords no |
Disable SSH Support for .rhosts Filesxccdf_org.ssgproject.content_rule_sshd_disable_rhosts medium
Disable SSH Support for .rhosts Files
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_rhosts |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_disable_rhosts:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 12, 14, 15, 16, 18, 3, 5, 9 | | cjis | 5.5.6 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06 | | cui | 3.1.12 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nist | AC-17(a), CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3 | | os-srg | SRG-OS-000480-GPOS-00227 | | cis | 5.1.11 | | ism | 1546 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | SSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via .rhosts files.
The default SSH configuration disables support for .rhosts. The appropriate
configuration is used if no value is set for IgnoreRhosts.
To explicitly disable support for .rhosts files, add or correct the following line in
/etc/ssh/sshd_config:
IgnoreRhosts yes
|
| Rationale | SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_disable_rhosts:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | IgnoreRhosts yes |
Verify that the value of IgnoreRhosts is present
oval:ssg-test_IgnoreRhosts_present_sshd_disable_rhosts:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | IgnoreRhosts yes |
Disable SSH Root Loginxccdf_org.ssgproject.content_rule_sshd_disable_root_login medium
Disable SSH Root Login
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_root_login |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_disable_root_login:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 1, 11, 12, 13, 14, 15, 16, 18, 3, 5 | | cjis | 5.5.6 | | cobit5 | APO01.06, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.06, DSS06.10 | | cui | 3.1.1, 3.1.5 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | AC-6(2), AC-17(a), IA-2, IA-2(5), CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, PR.PT-3 | | ospp | FAU_GEN.1 | | pcidss | Req-2.2.4 | | os-srg | SRG-OS-000109-GPOS-00056, SRG-OS-000480-GPOS-00227 | | app-srg-ctr | SRG-APP-000148-CTR-000335, SRG-APP-000190-CTR-000500 | | anssi | R33 | | cis | 5.1.21 | | ism | 1546 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | The root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line in
/etc/ssh/sshd_config:
PermitRootLogin no
|
| Rationale | Even though the communications channel may be encrypted, an additional layer of
security is gained by extending the policy of not logging directly on as root.
In addition, logging in with a user-specific account provides individual
accountability of actions performed on the system and also helps to minimize
direct attack attempts on root's password. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_disable_root_login:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | PermitRootLogin no |
Verify that the value of PermitRootLogin is present
oval:ssg-test_PermitRootLogin_present_sshd_disable_root_login:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | PermitRootLogin no |
Do Not Allow SSH Environment Optionsxccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env medium
Do Not Allow SSH Environment Options
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_do_not_permit_user_env:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 11, 3, 9 | | cjis | 5.5.6 | | cobit5 | BAI10.01, BAI10.02, BAI10.03, BAI10.05 | | cui | 3.1.12 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.4.3.2, 4.3.4.3.3 | | isa-62443-2013 | SR 7.6 | | iso27001-2013 | A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4 | | nist | AC-17(a), CM-7(a), CM-7(b), CM-6(a) | | nist-csf | PR.IP-1 | | pcidss | Req-2.2.4 | | os-srg | SRG-OS-000480-GPOS-00229 | | cis | 5.1.22 | | ism | 1546 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | Ensure that users are not able to override environment variables of the SSH daemon.
The default SSH configuration disables environment processing. The appropriate
configuration is used if no value is set for PermitUserEnvironment.
To explicitly disable Environment options, add or correct the following
/etc/ssh/sshd_config:
PermitUserEnvironment no
|
| Rationale | SSH environment options potentially allow users to bypass
access restriction in some configurations. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_do_not_permit_user_env:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | PermitUserEnvironment no |
Verify that the value of PermitUserEnvironment is present
oval:ssg-test_PermitUserEnvironment_present_sshd_do_not_permit_user_env:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | PermitUserEnvironment no |
Enable PAMxccdf_org.ssgproject.content_rule_sshd_enable_pam medium
Enable PAM
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_enable_pam |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_enable_pam:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
enable PAM authentication using ChallengeResponseAuthentication and
PasswordAuthentication in addition to PAM account and session module processing for all
authentication types.
To enable PAM authentication, add or correct the following line in
/etc/ssh/sshd_config:
UsePAM yes
|
| Rationale | When UsePAM is set to yes, PAM runs through account and session types properly. This is
important if you want to restrict access to services based off of IP, time or other factors of
the account. Additionally, you can make sure users inherit certain environment variables
on login or disallow access to the server. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of UsePAM setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_enable_pam:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | UsePAM yes |
Verify that the value of UsePAM is present
oval:ssg-test_UsePAM_present_sshd_enable_pam:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | UsePAM yes |
Enable SSH Warning Bannerxccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net medium
Enable SSH Warning Banner
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_enable_warning_banner_net:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cjis | 5.5.6 | | cobit5 | DSS05.04, DSS05.10, DSS06.10 | | cui | 3.1.9 | | hipaa | 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) | | isa-62443-2009 | 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9 | | iso27001-2013 | A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3 | | nist | AC-8(a), AC-8(c), AC-17(a), CM-6(a) | | nist-csf | PR.AC-7 | | os-srg | SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088 | | cis | 5.1.5 |
|
| Description | To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in
/etc/ssh/sshd_config:
Banner /etc/issue.net
Another section contains information on how to create an
appropriate system-wide warning banner. |
| Rationale | The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of Banner setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_enable_warning_banner_net:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | Banner /etc/issue.net |
Verify that the value of Banner is present
oval:ssg-test_Banner_present_sshd_enable_warning_banner_net:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | Banner /etc/issue.net |
Limit Users' SSH Accessxccdf_org.ssgproject.content_rule_sshd_limit_user_access unknown
Limit Users' SSH Access
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_limit_user_access |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_limit_user_access:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | unknown |
| References: | | cis-csc | 11, 12, 14, 15, 16, 18, 3, 5 | | cobit5 | DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06 | | cui | 3.1.12 | | isa-62443-2009 | 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4 | | isa-62443-2013 | SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7 | | iso27001-2013 | A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3 | | nist | AC-3, CM-6(a) | | nist-csf | PR.AC-4, PR.AC-6, PR.PT-3 | | pcidss | Req-2.2.4 | | cis | 5.1.4 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | By default, the SSH configuration allows any user with an account
to access the system. There are several options available to limit
which users and group can access the system via SSH. It is
recommended that at least one of the following options be leveraged:
- AllowUsers variable gives the system administrator the option of
allowing specific users to ssh into the system. The list consists of
space separated user names. Numeric user IDs are not recognized with
this variable. If a system administrator wants to restrict user
access further by specifically allowing a user's access only from a
particular host, the entry can be specified in the form of user@host.
- AllowGroups variable gives the system administrator the option of
allowing specific groups of users to ssh into the system. The list
consists of space separated group names. Numeric group IDs are not
recognized with this variable.
- DenyUsers variable gives the system administrator the option of
denying specific users to ssh into the system. The list consists of
space separated user names. Numeric user IDs are not recognized with
this variable. If a system administrator wants to restrict user
access further by specifically denying a user's access from a
particular host, the entry can be specified in the form of user@host.
- DenyGroups variable gives the system administrator the option of
denying specific groups of users to ssh into the system. The list
consists of space separated group names. Numeric group IDs are not
recognized with this variable. |
| Rationale | Specifying which accounts are allowed SSH access into the system reduces the
possibility of unauthorized access to the system. |
| Warnings | warning
Automated remediation is not available for this configuration check
because each system has unique user names and group names. |
OVAL test results detailsCheck if there is an AllowUsers entry
oval:ssg-test_allow_user_is_configured:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_allow_user:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^(/etc/ssh/sshd_config|/etc/ssh/sshd_config\.d/.*\.conf)$ | (?i)^[ ]*AllowUsers[ ]+((?:[^ \n]+[ ]*)+)$ | 1 |
Check if there is an AllowGroups entry
oval:ssg-test_allow_group_is_configured:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config.d/00-ttn.conf | AllowGroups sshusers |
Check if there is a DenyUsers entry
oval:ssg-test_deny_user_is_configured:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_deny_user:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^(/etc/ssh/sshd_config|/etc/ssh/sshd_config\.d/.*\.conf)$ | (?i)^[ ]*DenyUsers[ ]+((?:[^ \n]+[ ]*)+)$ | 1 |
Check if there is a DenyGroups entry
oval:ssg-test_deny_group_is_configured:tst:1
false
No items have been found conforming to the following objects:
Object oval:ssg-obj_deny_group:obj:1 of type
textfilecontent54_object
| Filepath | Pattern | Instance |
|---|
| ^(/etc/ssh/sshd_config|/etc/ssh/sshd_config\.d/.*\.conf)$ | (?i)^[ ]*DenyGroups[ ]+((?:[^ \n]+[ ]*)+)$ | 1 |
Ensure SSH LoginGraceTime is configuredxccdf_org.ssgproject.content_rule_sshd_set_login_grace_time medium
Ensure SSH LoginGraceTime is configured
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_login_grace_time:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | The LoginGraceTime parameter to the SSH server specifies the time allowed for successful authentication to
the SSH server. The longer the Grace period is the more open unauthenticated connections
can exist. Like other session controls in this session the Grace Period should be limited to
appropriate limits to ensure the service is available for needed access. |
| Rationale | Setting the LoginGraceTime parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. It will also limit the number of concurrent
unauthenticated connections. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
LoginGraceTime is configured
oval:ssg-test_sshd_login_grace_time:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | LoginGraceTime 60 |
Verify that the value of LoginGraceTime is present
oval:ssg-test_LoginGraceTime_present_sshd_set_login_grace_time:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | LoginGraceTime 60 |
Set LogLevel to INFOxccdf_org.ssgproject.content_rule_sshd_set_loglevel_info low
Set LogLevel to INFO
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_loglevel_info |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_loglevel_info:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | low |
| References: | |
| Description | The INFO parameter specifies that record login and logout activity will be logged.
The default SSH configuration sets the log level to INFO. The appropriate
configuration is used if no value is set for LogLevel.
To explicitly specify the log level in SSH, add or correct the following line in
/etc/ssh/sshd_config:
LogLevel INFO
|
| Rationale | SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. INFO level is the
basic level that only records login activity of SSH users. In many situations, such as Incident
Response, it is important to determine when a particular user was active on a system. The
logout record can eliminate those users who disconnected, which helps narrow the field. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of LogLevel setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_set_loglevel_info:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | LogLevel INFO |
Verify that the value of LogLevel is present
oval:ssg-test_LogLevel_present_sshd_set_loglevel_info:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | LogLevel INFO |
Set SSH authentication attempt limitxccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries medium
Set SSH authentication attempt limit
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_max_auth_tries:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis | 5.1.17 | | ism | 0421, 0422, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | The MaxAuthTries parameter specifies the maximum number of authentication attempts
permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
to set MaxAUthTries edit /etc/ssh/sshd_config as follows:
MaxAuthTries 4
|
| Rationale | Setting the MaxAuthTries parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
MaxAuthTries is configured
oval:ssg-test_sshd_max_auth_tries:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | MaxAuthTries 4 |
Verify that the value of MaxAuthTries is present
oval:ssg-test_MaxAuthTries_present_sshd_set_max_auth_tries:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | MaxAuthTries 4 |
Set SSH MaxSessions limitxccdf_org.ssgproject.content_rule_sshd_set_max_sessions medium
Set SSH MaxSessions limit
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_max_sessions |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_max_sessions:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | The MaxSessions parameter specifies the maximum number of open sessions permitted
from a given connection. To set MaxSessions edit
/etc/ssh/sshd_config as follows: MaxSessions 10
|
| Rationale | To protect a system from denial of service due to a large number of concurrent
sessions, use the rate limiting function of MaxSessions to protect availability
of sshd logins and prevent overwhelming the daemon. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
MaxSessions is configured
oval:ssg-test_sshd_max_sessions:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | MaxSessions 10 |
Verify that the value of MaxSessions is present
oval:ssg-test_MaxSessions_present_sshd_set_max_sessions:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | MaxSessions 10 |
Ensure SSH MaxStartups is configuredxccdf_org.ssgproject.content_rule_sshd_set_maxstartups medium
Ensure SSH MaxStartups is configured
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_maxstartups |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_maxstartups:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | The MaxStartups parameter specifies the maximum number of concurrent unauthenticated
connections to the SSH daemon. Additional connections will be dropped until authentication
succeeds or the LoginGraceTime expires for a connection. To configure MaxStartups, you should
add or edit the following line in the /etc/ssh/sshd_config file:
MaxStartups 10:30:60
|
| Rationale | To protect a system from denial of service due to a large number of pending authentication
connection attempts, use the rate limiting function of MaxStartups to protect availability of
sshd logins and prevent overwhelming the daemon. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
SSH MaxStartups start parameter is less than or equal to the expected value
oval:ssg-tst_maxstartups_start_parameter:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | MaxStartups 10:30:60 |
SSH MaxStartups rate parameter is greater than or equal to the expected value
oval:ssg-tst_maxstartups_rate_parameter:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | MaxStartups 10:30:60 |
SSH MaxStartups full parameter is less than or equal to the expected value
oval:ssg-tst_maxstartups_full_parameter:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | MaxStartups 10:30:60 |
Use Only Strong Ciphersxccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers medium
Use Only Strong Ciphers
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_use_strong_ciphers:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | Limit the ciphers to strong algorithms.
Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
The following line in /etc/ssh/sshd_config
demonstrates use of those ciphers:
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
The man page sshd_config(5) contains a list of supported ciphers. |
| Rationale | Based on research conducted at various institutions, it was determined that the symmetric
portion of the SSH Transport Protocol (as described in RFC 4253) has security weaknesses
that allowed recovery of up to 32 bits of plaintext from a block of ciphertext that was
encrypted with the Cipher Block Chaining (CBD) method. From that research, new Counter
mode algorithms (as described in RFC4344) were designed that are not vulnerable to these
types of attacks and these algorithms are now recommended for standard use. |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of Ciphers setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_use_strong_ciphers:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| true | /etc/ssh/sshd_config | Ciphers aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com |
Verify that the value of Ciphers is present
oval:ssg-test_Ciphers_present_sshd_use_strong_ciphers:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | Ciphers aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com |
Use Only Strong Key Exchange algorithmsxccdf_org.ssgproject.content_rule_sshd_use_strong_kex medium
Use Only Strong Key Exchange algorithms
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_use_strong_kex |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_use_strong_kex:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | Limit the Key Exchange to strong algorithms.
The following line in /etc/ssh/sshd_config demonstrates use
of those:
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
| Rationale | Key exchange is any method in cryptography by which cryptographic keys are exchanged
between two parties, allowing use of a cryptographic algorithm. If the sender and receiver
wish to exchange encrypted messages, each must be equipped to encrypt messages to be
sent and decrypt messages received |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of KexAlgorithms setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_use_strong_kex:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value | Value | Value | Value | Value | Value | Value | Value | Value | Value | Value |
|---|
| true | oval:ssg-var_sshd_config_kex:var:1 | mlkem768x25519-sha256 | sntrup761x25519-sha512@openssh.com | curve25519-sha256 | curve25519-sha256@libssh.org | ecdh-sha2-nistp256 | ecdh-sha2-nistp384 | ecdh-sha2-nistp521 | diffie-hellman-group-exchange-sha256 | diffie-hellman-group16-sha512 | diffie-hellman-group18-sha512 | diffie-hellman-group14-sha256 |
Verify that the value of KexAlgorithms is present
oval:ssg-test_sshd_kexalgorithms_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 |
Use Only Strong MACsxccdf_org.ssgproject.content_rule_sshd_use_strong_macs medium
Use Only Strong MACs
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_use_strong_macs |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_use_strong_macs:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | |
| Description | Limit the MACs to strong hash algorithms.
The following line in /etc/ssh/sshd_config demonstrates use
of those MACs:
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
|
| Rationale | MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase
exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of
attention as a weak spot that can be exploited with expanded computing power. An
attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the
SSH tunnel and capture credentials and information |
OVAL test results detailsVerify if Profile set Value sshd_required as not required
oval:ssg-test_sshd_not_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed
oval:ssg-test_package_openssh-server_removed:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
Verify if Profile set Value sshd_required as required
oval:ssg-test_sshd_required:tst:1
false
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| false | oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default
oval:ssg-test_sshd_requirement_unset:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value |
|---|
| true | oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed
oval:ssg-test_package_openssh-server_installed:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Name | Arch | Epoch | Release | Version | Evr |
|---|
| not evaluated | openssh-server | arm64 | 1 | 7+deb13u4 | 10.0p1 | 1:10.0p1-7+deb13u4 |
tests the value of MACs setting in the /etc/ssh/sshd_config file
oval:ssg-test_sshd_use_strong_macs:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Var ref | Value | Value | Value | Value |
|---|
| true | oval:ssg-var_sshd_config_strong_macs:var:1 | hmac-sha2-512-etm@openssh.com | hmac-sha2-256-etm@openssh.com | hmac-sha2-512 | hmac-sha2-256 |
Verify that the value of MACs is present
oval:ssg-test_sshd_macs_exists:tst:1
true
Following items have been found on the system:
| Result of item-state comparison | Path | Content |
|---|
| not evaluated | /etc/ssh/sshd_config | MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 |
Verify Group Who Owns SSH Server config filexccdf_org.ssgproject.content_rule_file_groupowner_sshd_config medium
Verify Group Who Owns SSH Server config file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_sshd_config:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-17(a), CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 5.1.1 |
|
| Description | To properly set the group owner of /etc/ssh/sshd_config, run the command:
$ sudo chgrp root /etc/ssh/sshd_config
|
| Rationale | Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting group ownership of /etc/ssh/sshd_config
oval:ssg-test_file_groupowner_sshd_config_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_sshd_config_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/ssh/sshd_config | oval:ssg-symlink_file_groupowner:ste:1 | oval:ssg-state_file_groupowner_sshd_config_0_0:ste:1 |
Verify Owner on SSH Server config filexccdf_org.ssgproject.content_rule_file_owner_sshd_config medium
Verify Owner on SSH Server config file
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_sshd_config |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_sshd_config:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-17(a), CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 5.1.1 |
|
| Description | To properly set the owner of /etc/ssh/sshd_config, run the command:
$ sudo chown root /etc/ssh/sshd_config
|
| Rationale | Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting user ownership of /etc/ssh/sshd_config
oval:ssg-test_file_owner_sshd_config_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_sshd_config_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/ssh/sshd_config | oval:ssg-symlink_file_owner:ste:1 | oval:ssg-state_file_owner_sshd_config_0_0:ste:1 |
Verify Permissions on SSH Server config filexccdf_org.ssgproject.content_rule_file_permissions_sshd_config medium
Verify Permissions on SSH Server config file
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_sshd_config |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_sshd_config:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-17(a), CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 5.1.1 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/ssh/sshd_config, run the command:
$ sudo chmod 0600 /etc/ssh/sshd_config
|
| Rationale | Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
OVAL test results detailsTesting mode of /etc/ssh/sshd_config
oval:ssg-test_file_permissions_sshd_config_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_sshd_config_0:obj:1 of type
file_object
| Filepath | Filter | Filter |
|---|
| /etc/ssh/sshd_config | oval:ssg-exclude_symlinks__sshd_config:ste:1 | oval:ssg-state_file_permissions_sshd_config_0_mode_0600or_stricter_:ste:1 |
Verify Permissions on SSH Server Private *_key Key Filesxccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key medium
Verify Permissions on SSH Server Private *_key Key Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_sshd_private_key:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.13, 3.13.10 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-17(a), CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-2.2.4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 5.1.2 | | ism | 1449 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | SSH server private keys - files that match the /etc/ssh/*_key glob, have to have restricted permissions.
If those files are owned by the root user and the root group, they have to have the 0600 permission or stricter. |
| Rationale | If an unauthorized user obtains the private SSH host key file, the host could be
impersonated. |
| Warnings | warning
Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment. |
OVAL test results detailsNo keys that have unsafe ownership/permissions combination exist
oval:ssg-test_no_offending_keys:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_offending_keys:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/ssh | .*_key$ | oval:ssg-exclude_symlinks__sshd_private_key:ste:1 | oval:ssg-filter_ssh_key_owner_root:ste:1 |
Verify Permissions on SSH Server Public *.pub Key Filesxccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key medium
Verify Permissions on SSH Server Public *.pub Key Files
| Rule ID | xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key |
| Result | |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_permissions_sshd_pub_key:def:1 |
| Time | 2026-11-02T22:59:03+00:00 |
| Severity | medium |
| References: | | cis-csc | 12, 13, 14, 15, 16, 18, 3, 5 | | cobit5 | APO01.06, DSS05.04, DSS05.07, DSS06.02 | | cui | 3.1.13, 3.13.10 | | isa-62443-2009 | 4.3.3.7.3 | | isa-62443-2013 | SR 2.1, SR 5.2 | | iso27001-2013 | A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5 | | nerc-cip | CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2 | | nist | AC-17(a), CM-6(a), AC-6(1) | | nist-csf | PR.AC-4, PR.DS-5 | | pcidss | Req-2.2.4 | | os-srg | SRG-OS-000480-GPOS-00227 | | anssi | R50 | | cis | 5.1.3 | | pcidss4 | 2.2.6, 2.2 |
|
| Description | To properly set the permissions of /etc/ssh/*.pub, run the command: $ sudo chmod 0644 /etc/ssh/*.pub
|
| Rationale | If a public host key file is modified by an unauthorized user, the SSH service
may be compromised. |
| Warnings | warning
Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment. |
OVAL test results detailsTesting mode of /etc/ssh/
oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1
true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1 of type
file_object
| Path | Filename | Filter | Filter |
|---|
| /etc/ssh | ^.*\.pub$ | oval:ssg-exclude_symlinks__sshd_pub_key:ste:1 | oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1 |