stig_rhel8.yml

policy: Red Hat Enterprise Linux 8 Security Technical Implementation Guide
title: Red Hat Enterprise Linux 8 Security Technical Implementation Guide
id: stig_rhel8
source: https://public.cyber.mil/stigs/downloads/
levels:
    -   id: high
    -   id: medium
    -   id: low
controls:
    -   id: RHEL-08-010000
        levels:
            - high
        title: RHEL 8 must be a vendor-supported release.
        rules:
            - installed_OS_is_vendor_supported
        status: automated
    -   id: RHEL-08-010010
        levels:
            - medium
        title: RHEL 8 vendor packaged system security patches and updates must be installed
            and up to date.
        rules:
            - security_patches_up_to_date
        status: automated
    -   id: RHEL-08-010020
        levels:
            - high
        title: 'RHEL 8 must implement NIST FIPS-validated cryptography for the following:
    to provision digital signatures, to generate cryptographic hashes, and to protect
    data requiring data-at-rest protections in accordance with applicable federal
    laws, Executive Orders, directives, policies, regulations, and standards.'
        rules:
            - configure_bind_crypto_policy
            - configure_crypto_policy
            - configure_kerberos_crypto_policy
            - configure_libreswan_crypto_policy
            - enable_dracut_fips_module
            - enable_fips_mode
            - sysctl_crypto_fips_enabled
        status: automated
    -   id: RHEL-08-010030
        levels:
            - medium
        title: All RHEL 8 local disk partitions must implement cryptographic mechanisms
            to prevent unauthorized disclosure or modification of all information that requires
            at rest protection.
        rules:
            - encrypt_partitions
        status: automated
    -   id: RHEL-08-010040
        levels:
            - medium
        title: RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner
            before granting local or remote access to the system via a ssh logon.
        rules:
            - sshd_enable_warning_banner
        status: automated
    -   id: RHEL-08-010050
        levels:
            - medium
        title: RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner
            before granting local or remote access to the system via a graphical user logon.
        rules:
            - dconf_gnome_login_banner_text
        status: automated
    -   id: RHEL-08-010060
        levels:
            - medium
        title: RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner
            before granting local or remote access to the system via a command line user logon.
        rules:
            - banner_etc_issue
            - login_banner_text=dod_banners
        status: automated
    -   id: RHEL-08-010070
        levels:
            - medium
        title: All RHEL 8 remote access methods must be monitored.
        rules:
            - rsyslog_remote_access_monitoring
        status: automated
    -   id: RHEL-08-010090
        levels:
            - medium
        title: RHEL 8, for PKI-based authentication, must validate certificates by constructing
            a certification path (which includes status information) to an accepted trust
            anchor.
        status: pending
    -   id: RHEL-08-010100
        levels:
            - medium
        title: RHEL 8, for certificate-based authentication, must enforce authorized access
            to the corresponding private key.
        status: pending
    -   id: RHEL-08-010110
        levels:
            - medium
        title: RHEL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic
            hashing algorithm.
        rules:
            - set_password_hashing_algorithm_logindefs
        status: automated
    -   id: RHEL-08-010120
        levels:
            - medium
        title: RHEL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for
            all stored passwords.
        rules:
            - accounts_password_all_shadowed_sha512
        status: automated
    -   id: RHEL-08-010130
        levels:
            - medium
        title: The RHEL 8 password-auth file must be configured to use a sufficient number
            of hashing rounds.
        rules:
            - accounts_password_pam_unix_rounds_password_auth
        status: automated
    -   id: RHEL-08-010140
        levels:
            - high
        title: RHEL 8 operating systems booted with United Extensible Firmware Interface
            (UEFI) must require authentication upon booting into single-user mode and maintenance.
        rules:
            - grub2_uefi_password
        status: automated
    -   id: RHEL-08-010150
        levels:
            - high
        title: RHEL 8 operating systems booted with a BIOS must require authentication upon
            booting into single-user and maintenance modes.
        rules:
            - grub2_password
        status: automated
    -   id: RHEL-08-010151
        levels:
            - medium
        title: RHEL 8 operating systems must require authentication upon booting into rescue
            mode.
        rules:
            - require_singleuser_auth
        status: automated
    -   id: RHEL-08-010160
        levels:
            - medium
        title: The RHEL 8 pam_unix.so module must be configured in the password-auth file
            to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
        rules:
            - set_password_hashing_algorithm_systemauth
        status: automated
    -   id: RHEL-08-010161
        levels:
            - medium
        title: RHEL 8 must prevent system daemons from using Kerberos for authentication.
        rules:
            - kerberos_disable_no_keytab
        status: automated
    -   id: RHEL-08-010162
        levels:
            - medium
        title: The krb5-workstation package must not be installed on RHEL 8.
        rules:
            - package_krb5-workstation_removed
        status: automated
    -   id: RHEL-08-010170
        levels:
            - medium
        title: RHEL 8 must use a Linux Security Module configured to enforce limits on system
            services.
        rules:
            - selinux_state
        status: automated
    -   id: RHEL-08-010171
        levels:
            - low
        title: RHEL 8 must have policycoreutils package installed.
        rules:
            - package_policycoreutils_installed
        status: automated
    -   id: RHEL-08-010190
        levels:
            - medium
        title: A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized
            and unintended information transferred via shared system resources.
        rules:
            - dir_perms_world_writable_sticky_bits
        status: automated
    -   id: RHEL-08-010200
        levels:
            - medium
        title: RHEL 8 must be configured so that all network connections associated with
            SSH traffic are terminated at the end of the session or after 10 minutes of inactivity,
            except to fulfill documented and validated mission requirements.
        rules:
            - sshd_set_keepalive_0
        status: automated
    -   id: RHEL-08-010210
        levels:
            - medium
        title: The RHEL 8 /var/log/messages file must have mode 0640 or less permissive.
        rules:
            - file_permissions_var_log_messages
        status: automated
    -   id: RHEL-08-010220
        levels:
            - medium
        title: The RHEL 8 /var/log/messages file must be owned by root.
        rules:
            - file_owner_var_log_messages
        status: automated
    -   id: RHEL-08-010230
        levels:
            - medium
        title: The RHEL 8 /var/log/messages file must be group-owned by root.
        rules:
            - file_groupowner_var_log_messages
        status: automated
    -   id: RHEL-08-010240
        levels:
            - medium
        title: The RHEL 8 /var/log directory must have mode 0755 or less permissive.
        rules:
            - file_permissions_var_log
        status: automated
    -   id: RHEL-08-010250
        levels:
            - medium
        title: The RHEL 8 /var/log directory must be owned by root.
        rules:
            - file_owner_var_log
        status: automated
    -   id: RHEL-08-010260
        levels:
            - medium
        title: The RHEL 8 /var/log directory must be group-owned by root.
        rules:
            - file_groupowner_var_log
        status: automated
    -   id: RHEL-08-010290
        levels:
            - medium
        title: The RHEL 8 SSH server must be configured to use only Message Authentication
            Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
        rules:
            - harden_sshd_macs_opensshserver_conf_crypto_policy
        status: automated
    -   id: RHEL-08-010291
        levels:
            - medium
        title: The RHEL 8 operating system must implement DoD-approved encryption to protect
            the confidentiality of SSH server connections.
        rules:
            - harden_sshd_ciphers_opensshserver_conf_crypto_policy
        status: automated
    -   id: RHEL-08-010292
        levels:
            - low
        title: RHEL 8 must ensure the SSH server uses strong entropy.
        rules:
            - sshd_use_strong_rng
        status: automated
    -   id: RHEL-08-010293
        levels:
            - medium
        title: The RHEL 8 operating system must implement DoD-approved encryption in the
            OpenSSL package.
        rules:
            - configure_openssl_crypto_policy
        status: automated
    -   id: RHEL-08-010294
        levels:
            - medium
        title: The RHEL 8 operating system must implement DoD-approved TLS encryption in
            the OpenSSL package.
        rules:
            - configure_openssl_tls_crypto_policy
        status: automated
    -   id: RHEL-08-010295
        levels:
            - medium
        title: The RHEL 8 operating system must implement DoD-approved TLS encryption in
            the GnuTLS package.
        rules:
            - configure_gnutls_tls_crypto_policy
        status: automated
    -   id: RHEL-08-010300
        levels:
            - medium
        title: RHEL 8 system commands must have mode 0755 or less permissive.
        rules:
            - file_permissions_binary_dirs
        status: automated
    -   id: RHEL-08-010310
        levels:
            - medium
        title: RHEL 8 system commands must be owned by root.
        rules:
            - file_ownership_binary_dirs
        status: automated
    -   id: RHEL-08-010320
        levels:
            - medium
        title: RHEL 8 system commands must be group-owned by root or a system account.
        rules:
            - file_groupownership_system_commands_dirs
        status: automated
    -   id: RHEL-08-010330
        levels:
            - medium
        title: RHEL 8 library files must have mode 0755 or less permissive.
        rules:
            - file_permissions_library_dirs
        status: automated
    -   id: RHEL-08-010340
        levels:
            - medium
        title: RHEL 8 library files must be owned by root.
        rules:
            - file_ownership_library_dirs
        status: automated
    -   id: RHEL-08-010350
        levels:
            - medium
        title: RHEL 8 library files must be group-owned by root or a system account.
        rules:
            - dir_group_ownership_library_dirs
            - root_permissions_syslibrary_files
        status: automated
    -   id: RHEL-08-010360
        levels:
            - medium
        title: The RHEL 8 file integrity tool must notify the system administrator when
            changes to the baseline configuration or anomalies in the operation of any security
            functions are discovered within an organizationally defined frequency.
        rules:
            - aide_scan_notification
            - package_aide_installed
        status: automated
    -   id: RHEL-08-010370
        levels:
            - high
        title: RHEL 8 must prevent the installation of software, patches, service packs,
            device drivers, or operating system components from a repository without verification
            they have been digitally signed using a certificate that is issued by a Certificate
            Authority (CA) that is recognized and approved by the organization.
        rules:
            - ensure_gpgcheck_globally_activated
        status: automated
    -   id: RHEL-08-010371
        levels:
            - high
        title: RHEL 8 must prevent the installation of software, patches, service packs,
            device drivers, or operating system components of local packages without verification
            they have been digitally signed using a certificate that is issued by a Certificate
            Authority (CA) that is recognized and approved by the organization.
        rules:
            - ensure_gpgcheck_local_packages
        status: automated
    -   id: RHEL-08-010372
        levels:
            - medium
        title: RHEL 8 must prevent the loading of a new kernel for later execution.
        rules:
            - sysctl_kernel_kexec_load_disabled
        status: automated
    -   id: RHEL-08-010373
        levels:
            - medium
        title: RHEL 8 must enable kernel parameters to enforce discretionary access control
            on symlinks.
        rules:
            - sysctl_fs_protected_symlinks
        status: automated
    -   id: RHEL-08-010374
        levels:
            - medium
        title: RHEL 8 must enable kernel parameters to enforce discretionary access control
            on hardlinks.
        rules:
            - sysctl_fs_protected_hardlinks
        status: automated
    -   id: RHEL-08-010375
        levels:
            - low
        title: RHEL 8 must restrict access to the kernel message buffer.
        rules:
            - sysctl_kernel_dmesg_restrict
        status: automated
    -   id: RHEL-08-010376
        levels:
            - low
        title: RHEL 8 must prevent kernel profiling by unprivileged users.
        rules:
            - sysctl_kernel_perf_event_paranoid
        status: automated
    -   id: RHEL-08-010380
        levels:
            - medium
        title: RHEL 8 must require users to provide a password for privilege escalation.
        rules:
            - sudo_remove_nopasswd
        status: automated
    -   id: RHEL-08-010381
        levels:
            - medium
        title: RHEL 8 must require users to reauthenticate for privilege escalation.
        rules:
            - sudo_remove_no_authenticate
        status: automated
    -   id: RHEL-08-010390
        levels:
            - medium
        title: RHEL 8 must have the packages required for multifactor authentication installed.
        rules:
            - install_smartcard_packages
        status: automated
    -   id: RHEL-08-010400
        levels:
            - medium
        title: RHEL 8 must implement certificate status checking for multifactor authentication.
        rules:
            - sssd_certificate_verification
        status: automated
    -   id: RHEL-08-010410
        levels:
            - medium
        title: RHEL 8 must accept Personal Identity Verification (PIV) credentials.
        rules:
            - package_opensc_installed
        status: automated
    -   id: RHEL-08-010420
        levels:
            - medium
        title: RHEL 8 must implement non-executable data to protect its memory from unauthorized
            code execution.
        rules:
            - bios_enable_execution_restrictions
        status: automated
    -   id: RHEL-08-010421
        levels:
            - medium
        title: RHEL 8 must clear the page allocator to prevent use-after-free attacks.
        rules:
            - grub2_page_poison_argument
        status: automated
    -   id: RHEL-08-010422
        levels:
            - medium
        title: RHEL 8 must disable virtual syscalls.
        rules:
            - grub2_vsyscall_argument
        status: automated
    -   id: RHEL-08-010423
        levels:
            - medium
        title: RHEL 8 must clear SLUB/SLAB objects to prevent use-after-free attacks.
        rules:
            - grub2_slub_debug_argument
        status: automated
    -   id: RHEL-08-010430
        levels:
            - medium
        title: RHEL 8 must implement address space layout randomization (ASLR) to protect
            its memory from unauthorized code execution.
        rules:
            - sysctl_kernel_randomize_va_space
        status: automated
    -   id: RHEL-08-010440
        levels:
            - low
        title: YUM must remove all software components after updated versions have been
            installed on RHEL 8.
        rules:
            - clean_components_post_updating
        status: automated
    -   id: RHEL-08-010450
        levels:
            - medium
        title: RHEL 8 must enable the SELinux targeted policy.
        rules:
            - selinux_policytype
        status: automated
    -   id: RHEL-08-010460
        levels:
            - high
        title: There must be no shosts.equiv files on the RHEL 8 operating system.
        rules:
            - no_host_based_files
        status: automated
    -   id: RHEL-08-010470
        levels:
            - high
        title: There must be no .shosts files on the RHEL 8 operating system.
        rules:
            - no_user_host_based_files
        status: automated
    -   id: RHEL-08-010471
        levels:
            - low
        title: RHEL 8 must enable the hardware random number generator entropy gatherer
            service.
        rules:
            - service_rngd_enabled
        status: automated
    -   id: RHEL-08-010480
        levels:
            - medium
        title: The RHEL 8 SSH public host key files must have mode 0644 or less permissive.
        rules:
            - file_permissions_sshd_pub_key
        status: automated
    -   id: RHEL-08-010490
        levels:
            - medium
        title: The RHEL 8 SSH private host key files must have mode 0600 or less permissive.
        rules:
            - file_permissions_sshd_private_key
        status: automated
    -   id: RHEL-08-010500
        levels:
            - medium
        title: The RHEL 8 SSH daemon must perform strict mode checking of home directory
            configuration files.
        rules:
            - sshd_enable_strictmodes
        status: automated
    -   id: RHEL-08-010510
        levels:
            - medium
        title: The RHEL 8 SSH daemon must not allow compression or must only allow compression
            after successful authentication.
        rules:
            - sshd_disable_compression
        status: automated
    -   id: RHEL-08-010520
        levels:
            - medium
        title: "The RHEL 8 SSH daemon must not allow authentication using known host\u2019\
    s authentication."
        rules:
            - sshd_disable_user_known_hosts
        status: automated
    -   id: RHEL-08-010521
        levels:
            - medium
        title: The RHEL 8 SSH daemon must not allow Kerberos authentication, except to fulfill
            documented and validated mission requirements.
        rules:
            - sshd_disable_kerb_auth
        status: automated
    -   id: RHEL-08-010540
        levels:
            - low
        title: RHEL 8 must use a separate file system for /var.
        rules:
            - partition_for_var
        status: automated
    -   id: RHEL-08-010541
        levels:
            - low
        title: RHEL 8 must use a separate file system for /var/log.
        rules:
            - partition_for_var_log
        status: automated
    -   id: RHEL-08-010542
        levels:
            - low
        title: RHEL 8 must use a separate file system for the system audit data path.
        rules:
            - partition_for_var_log_audit
        status: automated
    -   id: RHEL-08-010543
        levels:
            - medium
        title: A separate RHEL 8 filesystem must be used for the /tmp directory.
        rules:
            - partition_for_tmp
        status: automated
    -   id: RHEL-08-010550
        levels:
            - medium
        title: RHEL 8 must not permit direct logons to the root account using remote access
            via SSH.
        rules:
            - sshd_disable_root_login
        status: automated
    -   id: RHEL-08-010561
        levels:
            - medium
        title: The rsyslog service must be running in RHEL 8.
        rules:
            - service_rsyslog_enabled
        status: automated
    -   id: RHEL-08-010570
        levels:
            - medium
        title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed
            on file systems that contain user home directories.
        rules:
            - mount_option_home_nosuid
        status: automated
    -   id: RHEL-08-010571
        levels:
            - medium
        title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed
            on the /boot directory.
        rules:
            - mount_option_boot_nosuid
        status: automated
    -   id: RHEL-08-010580
        levels:
            - medium
        title: RHEL 8 must prevent special devices on non-root local partitions.
        rules:
            - mount_option_nodev_nonroot_local_partitions
        status: automated
    -   id: RHEL-08-010590
        levels:
            - medium
        title: RHEL 8 must prevent code from being executed on file systems that contain
            user home directories.
        rules:
            - mount_option_home_noexec
        status: automated
    -   id: RHEL-08-010600
        levels:
            - medium
        title: RHEL 8 must prevent special devices on file systems that are used with removable
            media.
        rules:
            - mount_option_nodev_removable_partitions
        status: automated
    -   id: RHEL-08-010610
        levels:
            - medium
        title: RHEL 8 must prevent code from being executed on file systems that are used
            with removable media.
        rules:
            - mount_option_noexec_removable_partitions
        status: automated
    -   id: RHEL-08-010620
        levels:
            - medium
        title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed
            on file systems that are used with removable media.
        rules:
            - mount_option_nosuid_removable_partitions
        status: automated
    -   id: RHEL-08-010630
        levels:
            - medium
        title: RHEL 8 must prevent code from being executed on file systems that are imported
            via Network File System (NFS).
        rules:
            - mount_option_noexec_remote_filesystems
        status: automated
    -   id: RHEL-08-010640
        levels:
            - medium
        title: RHEL 8 must prevent special devices on file systems that are imported via
            Network File System (NFS).
        rules:
            - mount_option_nodev_remote_filesystems
        status: automated
    -   id: RHEL-08-010650
        levels:
            - medium
        title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed
            on file systems that are imported via Network File System (NFS).
        rules:
            - mount_option_nosuid_remote_filesystems
        status: automated
    -   id: RHEL-08-010660
        levels:
            - medium
        title: Local RHEL 8 initialization files must not execute world-writable programs.
        rules:
            - accounts_user_dot_no_world_writable_programs
        status: automated
    -   id: RHEL-08-010670
        levels:
            - medium
        title: RHEL 8 must disable kernel dumps unless needed.
        rules:
            - service_kdump_disabled
        status: automated
    -   id: RHEL-08-010671
        levels:
            - medium
        title: RHEL 8 must disable the kernel.core_pattern.
        rules:
            - sysctl_kernel_core_pattern
        status: automated
    -   id: RHEL-08-010672
        levels:
            - medium
        title: RHEL 8 must disable acquiring, saving, and processing core dumps.
        rules:
            - service_systemd-coredump_disabled
        status: automated
    -   id: RHEL-08-010673
        levels:
            - medium
        title: RHEL 8 must disable core dumps for all users.
        rules:
            - disable_users_coredumps
        status: automated
    -   id: RHEL-08-010674
        levels:
            - medium
        title: RHEL 8 must disable storing core dumps.
        rules:
            - coredump_disable_storage
        status: automated
    -   id: RHEL-08-010675
        levels:
            - medium
        title: RHEL 8 must disable core dump backtraces.
        rules:
            - coredump_disable_backtraces
        status: automated
    -   id: RHEL-08-010680
        levels:
            - medium
        title: For RHEL 8 systems using Domain Name Servers (DNS) resolution, at least two
            name servers must be configured.
        rules:
            - network_configure_name_resolution
        status: automated
    -   id: RHEL-08-010690
        levels:
            - medium
        title: Executable search paths within the initialization files of all local interactive
            RHEL 8 users must only contain paths that resolve to the system default or the
            users home directory.
        rules:
            - accounts_user_home_paths_only
        status: automated
    -   id: RHEL-08-010700
        levels:
            - medium
        title: All RHEL 8 world-writable directories must be owned by root, sys, bin, or
            an application user.
        rules:
            - dir_perms_world_writable_root_owned
        status: automated
    -   id: RHEL-08-010710
        levels:
            - medium
        title: All RHEL 8 world-writable directories must be group-owned by root, sys, bin,
            or an application group.
        status: pending
    -   id: RHEL-08-010720
        levels:
            - medium
        title: All RHEL 8 local interactive users must have a home directory assigned in
            the /etc/passwd file.
        rules:
            - accounts_user_interactive_home_directory_defined
        status: automated
    -   id: RHEL-08-010730
        levels:
            - medium
        title: All RHEL 8 local interactive user home directories must have mode 0750 or
            less permissive.
        rules:
            - file_permissions_home_directories
        status: automated
    -   id: RHEL-08-010740
        levels:
            - medium
        title: "All RHEL 8 local interactive user home directories must be group-owned by\
    \ the home directory owner\u2019s primary group."
        rules:
            - file_groupownership_home_directories
        status: automated
    -   id: RHEL-08-010750
        levels:
            - medium
        title: All RHEL 8 local interactive user home directories defined in the /etc/passwd
            file must exist.
        rules:
            - accounts_user_interactive_home_directory_exists
        status: automated
    -   id: RHEL-08-010760
        levels:
            - medium
        title: All RHEL 8 local interactive user accounts must be assigned a home directory
            upon creation.
        rules:
            - accounts_have_homedir_login_defs
        status: automated
    -   id: RHEL-08-010770
        levels:
            - medium
        title: All RHEL 8 local initialization files must have mode 0740 or less permissive.
        rules:
            - file_permission_user_init_files
        status: automated
    -   id: RHEL-08-010780
        levels:
            - medium
        title: All RHEL 8 local files and directories must have a valid owner.
        rules:
            - no_files_unowned_by_user
        status: automated
    -   id: RHEL-08-010790
        levels:
            - medium
        title: All RHEL 8 local files and directories must have a valid group owner.
        rules:
            - file_permissions_ungroupowned
        status: automated
    -   id: RHEL-08-010800
        levels:
            - medium
        title: A separate RHEL 8 filesystem must be used for user home directories (such
            as /home or an equivalent).
        rules:
            - partition_for_home
        status: automated
    -   id: RHEL-08-010820
        levels:
            - high
        title: Unattended or automatic logon via the RHEL 8 graphical user interface must
            not be allowed.
        rules:
            - gnome_gdm_disable_automatic_login
        status: automated
    -   id: RHEL-08-010830
        levels:
            - medium
        title: RHEL 8 must not allow users to override SSH environment variables.
        rules:
            - sshd_do_not_permit_user_env
        status: automated
    -   id: RHEL-08-020000
        levels:
            - medium
        title: RHEL 8 temporary user accounts must be provisioned with an expiration time
            of 72 hours or less.
        rules:
            - account_temp_expire_date
        status: automated
    -   id: RHEL-08-020010
        levels:
            - medium
        title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts
            occur.
        rules:
            - accounts_passwords_pam_faillock_deny
        status: automated
    -   id: RHEL-08-020011
        levels:
            - medium
        title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts
            occur.
        rules:
            - accounts_passwords_pam_faillock_deny
        status: automated
    -   id: RHEL-08-020012
        levels:
            - medium
        title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts
            occur during a 15-minute time period.
        rules:
            - accounts_passwords_pam_faillock_interval
        status: automated
    -   id: RHEL-08-020013
        levels:
            - medium
        title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts
            occur during a 15-minute time period.
        rules:
            - accounts_passwords_pam_faillock_interval
        status: automated
    -   id: RHEL-08-020014
        levels:
            - medium
        title: RHEL 8 must automatically lock an account until the locked account is released
            by an administrator when three unsuccessful logon attempts occur during a 15-minute
            time period.
        rules:
            - accounts_passwords_pam_faillock_unlock_time
        status: automated
    -   id: RHEL-08-020015
        levels:
            - medium
        title: RHEL 8 must automatically lock an account until the locked account is released
            by an administrator when three unsuccessful logon attempts occur during a 15-minute
            time period.
        status: pending
    -   id: RHEL-08-020016
        levels:
            - medium
        title: RHEL 8 must ensure account lockouts persist.
        rules:
            - accounts_passwords_pam_faillock_unlock_time
        status: automated
    -   id: RHEL-08-020017
        levels:
            - medium
        title: RHEL 8 must ensure account lockouts persist.
        rules:
            - accounts_passwords_pam_faillock_unlock_time
        status: automated
    -   id: RHEL-08-020018
        levels:
            - medium
        title: RHEL 8 must prevent system messages from being presented when three unsuccessful
            logon attempts occur.
        rules:
            - accounts_passwords_pam_faillock_deny
        status: automated
    -   id: RHEL-08-020019
        levels:
            - medium
        title: RHEL 8 must prevent system messages from being presented when three unsuccessful
            logon attempts occur.
        rules:
            - accounts_passwords_pam_faillock_deny
        status: automated
    -   id: RHEL-08-020020
        levels:
            - medium
        title: RHEL 8 must log user name information when unsuccessful logon attempts occur.
        status: pending
    -   id: RHEL-08-020021
        levels:
            - medium
        title: RHEL 8 must log user name information when unsuccessful logon attempts occur.
        status: pending
    -   id: RHEL-08-020022
        levels:
            - medium
        title: RHEL 8 must include root when automatically locking an account until the
            locked account is released by an administrator when three unsuccessful logon attempts
            occur during a 15-minute time period.
        rules:
            - accounts_passwords_pam_faillock_deny_root
        status: automated
    -   id: RHEL-08-020023
        levels:
            - medium
        title: RHEL 8 must include root when automatically locking an account until the
            locked account is released by an administrator when three unsuccessful logon attempts
            occur during a 15-minute time period.
        rules:
            - accounts_passwords_pam_faillock_deny_root
        status: automated
    -   id: RHEL-08-020024
        levels:
            - low
        title: RHEL 8 must limit the number of concurrent sessions to ten for all accounts
            and/or account types.
        rules:
            - accounts_max_concurrent_login_sessions
        status: automated
    -   id: RHEL-08-020030
        levels:
            - medium
        title: RHEL 8 must enable a user session lock until that user re-establishes access
            using established identification and authentication procedures for graphical user
            sessions.
        rules:
            - dconf_gnome_screensaver_lock_enabled
        status: automated
    -   id: RHEL-08-020040
        levels:
            - medium
        title: RHEL 8 must enable a user session lock until that user re-establishes access
            using established identification and authentication procedures for command line
            sessions.
        rules:
            - configure_tmux_lock_command
        status: automated
    -   id: RHEL-08-020041
        levels:
            - medium
        title: RHEL 8 must ensure session control is automatically started at shell initialization.
        rules:
            - configure_bashrc_exec_tmux
        status: automated
    -   id: RHEL-08-020042
        levels:
            - low
        title: RHEL 8 must prevent users from disabling session control mechanisms.
        rules:
            - no_tmux_in_shells
        status: automated
    -   id: RHEL-08-020050
        levels:
            - medium
        title: RHEL 8 must be able to initiate directly a session lock for all connection
            types using smartcard when the smartcard is removed.
        rules:
            - dconf_gnome_lock_screen_on_smartcard_removal
        status: automated
    -   id: RHEL-08-020060
        levels:
            - medium
        title: RHEL 8 must automatically lock graphical user sessions after 15 minutes of
            inactivity.
        rules:
            - dconf_gnome_screensaver_idle_delay
        status: automated
    -   id: RHEL-08-020070
        levels:
            - medium
        title: RHEL 8 must automatically lock command line user sessions after 15 minutes
            of inactivity.
        rules:
            - configure_tmux_lock_after_time
        status: automated
    -   id: RHEL-08-020080
        levels:
            - medium
        title: RHEL 8 must prevent a user from overriding the session lock-delay setting
            for the graphical user interface.
        status: pending
    -   id: RHEL-08-020090
        levels:
            - medium
        title: RHEL 8 must map the authenticated identity to the user or group account for
            PKI-based authentication.
        rules:
            - sssd_enable_certmap
        status: automated
    -   id: RHEL-08-020100
        levels:
            - medium
        title: RHEL 8 must ensure a password complexity module is enabled.
        rules:
            - accounts_password_pam_retry
        status: automated
    -   id: RHEL-08-020110
        levels:
            - medium
        title: RHEL 8 must enforce password complexity by requiring that at least one uppercase
            character be used.
        rules:
            - accounts_password_pam_ucredit
        status: automated
    -   id: RHEL-08-020120
        levels:
            - medium
        title: RHEL 8 must enforce password complexity by requiring that at least one lower-case
            character be used.
        rules:
            - accounts_password_pam_lcredit
        status: automated
    -   id: RHEL-08-020130
        levels:
            - medium
        title: RHEL 8 must enforce password complexity by requiring that at least one numeric
            character be used.
        rules:
            - accounts_password_pam_dcredit
        status: automated
    -   id: RHEL-08-020140
        levels:
            - medium
        title: RHEL 8 must require the maximum number of repeating characters of the same
            character class be limited to four when passwords are changed.
        rules:
            - accounts_password_pam_maxclassrepeat
        status: automated
    -   id: RHEL-08-020150
        levels:
            - medium
        title: RHEL 8 must require the maximum number of repeating characters be limited
            to three when passwords are changed.
        rules:
            - accounts_password_pam_maxrepeat
        status: automated
    -   id: RHEL-08-020160
        levels:
            - medium
        title: RHEL 8 must require the change of at least four character classes when passwords
            are changed.
        rules:
            - accounts_password_pam_minclass
        status: automated
    -   id: RHEL-08-020170
        levels:
            - medium
        title: RHEL 8 must require the change of at least 8 characters when passwords are
            changed.
        rules:
            - accounts_password_pam_difok
        status: automated
    -   id: RHEL-08-020180
        levels:
            - medium
        title: RHEL 8 passwords must have a 24 hours/1 day minimum password lifetime restriction
            in /etc/shadow.
        rules:
            - accounts_password_set_min_life_existing
        status: automated
    -   id: RHEL-08-020190
        levels:
            - medium
        title: RHEL 8 passwords for new users or password changes must have a 24 hours/1
            day minimum password lifetime restriction in /etc/logins.def.
        rules:
            - accounts_minimum_age_login_defs
        status: automated
    -   id: RHEL-08-020200
        levels:
            - medium
        title: RHEL 8 user account passwords must have a 60-day maximum password lifetime
            restriction.
        rules:
            - accounts_maximum_age_login_defs
        status: automated
    -   id: RHEL-08-020210
        levels:
            - medium
        title: RHEL 8 user account passwords must be configured so that existing passwords
            are restricted to a 60-day maximum lifetime.
        rules:
            - accounts_password_set_max_life_existing
        status: automated
    -   id: RHEL-08-020220
        levels:
            - medium
        title: RHEL 8 passwords must be prohibited from reuse for a minimum of five generations.
        rules:
            - accounts_password_pam_pwhistory_remember_password_auth
            - accounts_password_pam_pwhistory_remember_system_auth
        status: automated
    -   id: RHEL-08-020230
        levels:
            - medium
        title: RHEL 8 passwords must have a minimum of 15 characters.
        rules:
            - accounts_password_pam_minlen
        status: automated
    -   id: RHEL-08-020231
        levels:
            - medium
        title: RHEL 8 passwords for new users must have a minimum of 15 characters.
        rules:
            - accounts_password_minlen_login_defs
        status: automated
    -   id: RHEL-08-020240
        levels:
            - medium
        title: RHEL 8 duplicate User IDs (UIDs) must not exist for interactive users.
        rules:
            - account_unique_id
        status: automated
    -   id: RHEL-08-020250
        levels:
            - medium
        title: RHEL 8 must implement smart card logon for multifactor authentication for
            access to interactive accounts.
        rules:
            - sssd_enable_smartcards
        status: automated
    -   id: RHEL-08-020260
        levels:
            - medium
        title: RHEL 8 account identifiers (individuals, groups, roles, and devices) must
            be disabled after 35 days of inactivity.
        rules:
            - account_disable_post_pw_expiration
        status: automated
    -   id: RHEL-08-020270
        levels:
            - medium
        title: RHEL 8 emergency accounts must be automatically removed or disabled after
            the crisis is resolved or within 72 hours.
        rules:
            - account_emergency_expire_date
        status: automated
    -   id: RHEL-08-020280
        levels:
            - medium
        title: All RHEL 8 passwords must contain at least one special character.
        rules:
            - accounts_password_pam_ocredit
        status: automated
    -   id: RHEL-08-020290
        levels:
            - medium
        title: RHEL 8 must prohibit the use of cached authentications after one day.
        rules:
            - sssd_offline_cred_expiration
        status: automated
    -   id: RHEL-08-020300
        levels:
            - medium
        title: RHEL 8 must prevent the use of dictionary words for passwords.
        rules:
            - accounts_password_pam_dictcheck
        status: automated
    -   id: RHEL-08-020310
        levels:
            - medium
        title: RHEL 8 must enforce a delay of at least four seconds between logon prompts
            following a failed logon attempt.
        rules:
            - accounts_logon_fail_delay
        status: automated
    -   id: RHEL-08-020320
        levels:
            - medium
        title: RHEL 8 must not have unnecessary accounts.
        rules:
            - accounts_authorized_local_users
        status: automated
    -   id: RHEL-08-020330
        levels:
            - high
        title: RHEL 8 must not allow accounts configured with blank or null passwords.
        rules:
            - sshd_disable_empty_passwords
        status: automated
    -   id: RHEL-08-020340
        levels:
            - low
        title: RHEL 8 must display the date and time of the last successful account logon
            upon logon.
        rules:
            - display_login_attempts
        status: automated
    -   id: RHEL-08-020350
        levels:
            - medium
        title: RHEL 8 must display the date and time of the last successful account logon
            upon an SSH logon.
        rules:
            - sshd_print_last_log
        status: automated
    -   id: RHEL-08-020351
        levels:
            - medium
        title: RHEL 8 must define default permissions for all authenticated users in such
            a way that the user can only read and modify their own files.
        rules:
            - accounts_umask_etc_login_defs
        status: automated
    -   id: RHEL-08-020352
        levels:
            - medium
        title: RHEL 8 must set the umask value to 077 for all local interactive user accounts.
        rules:
            - accounts_umask_interactive_users
        status: automated
    -   id: RHEL-08-020353
        levels:
            - medium
        title: RHEL 8 must define default permissions for logon and non-logon shells.
        rules:
            - accounts_umask_etc_bashrc
        status: automated
    -   id: RHEL-08-030000
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit the execution of privileged
            functions and prevent all software from executing at higher privilege levels than
            users executing the software.
        rules:
            - audit_rules_suid_privilege_function
        status: automated
    -   id: RHEL-08-030010
        levels:
            - medium
        title: Cron logging must be implemented in RHEL 8.
        rules:
            - rsyslog_cron_logging
        status: automated
    -   id: RHEL-08-030020
        levels:
            - medium
        title: The RHEL 8 System Administrator (SA) and Information System Security Officer
            (ISSO) (at a minimum) must be alerted of an audit processing failure event.
        rules:
            - auditd_data_retention_action_mail_acct
        status: automated
    -   id: RHEL-08-030030
        levels:
            - medium
        title: The RHEL 8 Information System Security Officer (ISSO) and System Administrator
            (SA) (at a minimum) must have mail aliases to be notified of an audit processing
            failure.
        rules:
            - postfix_client_configure_mail_alias
        status: automated
    -   id: RHEL-08-030040
        levels:
            - medium
        title: The RHEL 8 System must take appropriate action when an audit processing failure
            occurs.
        rules:
            - auditd_data_disk_error_action
        status: automated
    -   id: RHEL-08-030050
        levels:
            - medium
        title: The RHEL 8 System Administrator (SA) and Information System Security Officer
            (ISSO) (at a minimum) must be alerted when the audit storage volume is full.
        rules:
            - auditd_data_retention_max_log_file_action
        status: automated
    -   id: RHEL-08-030060
        levels:
            - medium
        title: The RHEL 8 audit system must take appropriate action when the audit storage
            volume is full.
        rules:
            - auditd_data_disk_full_action
        status: automated
    -   id: RHEL-08-030061
        levels:
            - medium
        title: The RHEL 8 audit system must audit local events.
        rules:
            - auditd_local_events
        status: automated
    -   id: RHEL-08-030062
        levels:
            - medium
        title: RHEL 8 must label all off-loaded audit logs before sending them to the central
            log server.
        rules:
            - auditd_name_format
        status: automated
    -   id: RHEL-08-030063
        levels:
            - low
        title: RHEL 8 must resolve audit information before writing to disk.
        rules:
            - auditd_log_format
        status: automated
    -   id: RHEL-08-030070
        levels:
            - medium
        title: RHEL 8 audit logs must have a mode of 0600 or less permissive to prevent
            unauthorized read access.
        rules:
            - file_permissions_var_log_audit
        status: automated
    -   id: RHEL-08-030080
        levels:
            - medium
        title: RHEL 8 audit logs must be owned by root to prevent unauthorized read access.
        rules:
            - file_ownership_var_log_audit_stig
        status: automated
    -   id: RHEL-08-030090
        levels:
            - medium
        title: RHEL 8 audit logs must be group-owned by root to prevent unauthorized read
            access.
        rules:
            - file_group_ownership_var_log_audit
        status: automated
    -   id: RHEL-08-030100
        levels:
            - medium
        title: RHEL 8 audit log directory must be owned by root to prevent unauthorized
            read access.
        rules:
            - directory_ownership_var_log_audit
        status: automated
    -   id: RHEL-08-030110
        levels:
            - medium
        title: RHEL 8 audit log directory must be group-owned by root to prevent unauthorized
            read access.
        rules:
            - directory_group_ownership_var_log_audit
        status: automated
    -   id: RHEL-08-030120
        levels:
            - medium
        title: RHEL 8 audit log directory must have a mode of 0700 or less permissive to
            prevent unauthorized read access.
        rules:
            - directory_permissions_var_log_audit
        status: automated
    -   id: RHEL-08-030121
        levels:
            - medium
        title: RHEL 8 audit system must protect auditing rules from unauthorized change.
        rules:
            - audit_rules_immutable
        status: automated
    -   id: RHEL-08-030122
        levels:
            - medium
        title: RHEL 8 audit system must protect logon UIDs from unauthorized change.
        rules:
            - audit_immutable_login_uids
        status: automated
    -   id: RHEL-08-030130
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/shadow.
        rules:
            - audit_rules_usergroup_modification_shadow
        status: automated
    -   id: RHEL-08-030140
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/security/opasswd.
        rules:
            - audit_rules_usergroup_modification_opasswd
        status: automated
    -   id: RHEL-08-030150
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/passwd.
        rules:
            - audit_rules_usergroup_modification_passwd
        status: automated
    -   id: RHEL-08-030160
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/gshadow.
        rules:
            - audit_rules_usergroup_modification_gshadow
        status: automated
    -   id: RHEL-08-030170
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/group.
        rules:
            - audit_rules_usergroup_modification_group
        status: automated
    -   id: RHEL-08-030171
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/sudoers.
        rules:
            - audit_rules_sudoers
        status: automated
    -   id: RHEL-08-030172
        levels:
            - medium
        title: RHEL 8 must generate audit records for all account creations, modifications,
            disabling, and termination events that affect /etc/sudoers.d/.
        rules:
            - audit_rules_sudoers_d
        status: automated
    -   id: RHEL-08-030180
        levels:
            - medium
        title: The RHEL 8 audit package must be installed.
        rules:
            - package_audit_installed
        status: automated
    -   id: RHEL-08-030190
        levels:
            - medium
        title: Successful/unsuccessful uses of the su command in RHEL 8 must generate an
            audit record.
        rules:
            - audit_rules_privileged_commands_su
        status: automated
    -   id: RHEL-08-030200
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit any usage of the lremovexattr
            system call.
        rules:
            - audit_rules_dac_modification_lremovexattr
        status: automated
    -   id: RHEL-08-030210
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit any usage of the removexattr
            system call.
        rules:
            - audit_rules_dac_modification_removexattr
        status: automated
    -   id: RHEL-08-030220
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit any usage of the lsetxattr
            system call.
        rules:
            - audit_rules_dac_modification_lsetxattr
        status: automated
    -   id: RHEL-08-030230
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit any usage of the fsetxattr
            system call.
        rules:
            - audit_rules_dac_modification_fsetxattr
        status: automated
    -   id: RHEL-08-030240
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit any usage of the fremovexattr
            system call.
        rules:
            - audit_rules_dac_modification_fremovexattr
        status: automated
    -   id: RHEL-08-030250
        levels:
            - medium
        title: Successful/unsuccessful uses of the chage command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_chage
        status: automated
    -   id: RHEL-08-030260
        levels:
            - medium
        title: Successful/unsuccessful uses of the chcon command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_execution_chcon
        status: automated
    -   id: RHEL-08-030270
        levels:
            - medium
        title: The RHEL 8 audit system must be configured to audit any usage of the setxattr
            system call.
        rules:
            - audit_rules_dac_modification_setxattr
        status: automated
    -   id: RHEL-08-030280
        levels:
            - medium
        title: Successful/unsuccessful uses of the ssh-agent in RHEL 8 must generate an
            audit record.
        rules:
            - audit_rules_privileged_commands_ssh_agent
        status: automated
    -   id: RHEL-08-030290
        levels:
            - medium
        title: Successful/unsuccessful uses of the passwd command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_passwd
        status: automated
    -   id: RHEL-08-030300
        levels:
            - medium
        title: Successful/unsuccessful uses of the mount command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_mount
        status: automated
    -   id: RHEL-08-030301
        levels:
            - medium
        title: Successful/unsuccessful uses of the umount command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_umount
        status: automated
    -   id: RHEL-08-030302
        levels:
            - medium
        title: Successful/unsuccessful uses of the mount syscall in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_media_export
        status: automated
    -   id: RHEL-08-030310
        levels:
            - medium
        title: Successful/unsuccessful uses of the unix_update in RHEL 8 must generate an
            audit record.
        rules:
            - audit_rules_privileged_commands_unix_update
        status: automated
    -   id: RHEL-08-030311
        levels:
            - medium
        title: Successful/unsuccessful uses of postdrop in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_privileged_commands_postdrop
        status: automated
    -   id: RHEL-08-030312
        levels:
            - medium
        title: Successful/unsuccessful uses of postqueue in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_privileged_commands_postqueue
        status: automated
    -   id: RHEL-08-030313
        levels:
            - medium
        title: Successful/unsuccessful uses of semanage in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_execution_semanage
        status: automated
    -   id: RHEL-08-030314
        levels:
            - medium
        title: Successful/unsuccessful uses of setfiles in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_execution_setfiles
        status: automated
    -   id: RHEL-08-030315
        levels:
            - medium
        title: Successful/unsuccessful uses of userhelper in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_privileged_commands_userhelper
        status: automated
    -   id: RHEL-08-030316
        levels:
            - medium
        title: Successful/unsuccessful uses of setsebool in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_execution_setsebool
        status: automated
    -   id: RHEL-08-030317
        levels:
            - medium
        title: Successful/unsuccessful uses of unix_chkpwd in RHEL 8 must generate an audit
            record.
        rules:
            - audit_rules_privileged_commands_unix_chkpwd
        status: automated
    -   id: RHEL-08-030320
        levels:
            - medium
        title: Successful/unsuccessful uses of the ssh-keysign in RHEL 8 must generate an
            audit record.
        rules:
            - audit_rules_privileged_commands_ssh_keysign
        status: automated
    -   id: RHEL-08-030330
        levels:
            - medium
        title: Successful/unsuccessful uses of the setfacl command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_execution_setfacl
        status: automated
    -   id: RHEL-08-030340
        levels:
            - medium
        title: Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8
            must generate an audit record.
        rules:
            - audit_rules_privileged_commands_pam_timestamp_check
        status: automated
    -   id: RHEL-08-030350
        levels:
            - medium
        title: Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_newgrp
        status: automated
    -   id: RHEL-08-030360
        levels:
            - medium
        title: Successful/unsuccessful uses of the init_module command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_kernel_module_loading_init
        status: automated
    -   id: RHEL-08-030361
        levels:
            - medium
        title: Successful/unsuccessful uses of the rename command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_file_deletion_events_rename
        status: automated
    -   id: RHEL-08-030362
        levels:
            - medium
        title: Successful/unsuccessful uses of the renameat command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_file_deletion_events_renameat
        status: automated
    -   id: RHEL-08-030363
        levels:
            - medium
        title: Successful/unsuccessful uses of the rmdir command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_file_deletion_events_rmdir
        status: automated
    -   id: RHEL-08-030364
        levels:
            - medium
        title: Successful/unsuccessful uses of the unlink command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_file_deletion_events_unlink
        status: automated
    -   id: RHEL-08-030365
        levels:
            - medium
        title: Successful/unsuccessful uses of the unlinkat command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_file_deletion_events_unlinkat
        status: automated
    -   id: RHEL-08-030370
        levels:
            - medium
        title: Successful/unsuccessful uses of the gpasswd command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_gpasswd
        status: automated
    -   id: RHEL-08-030380
        levels:
            - medium
        title: Successful/unsuccessful uses of the finit_module command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_kernel_module_loading_finit
        status: automated
    -   id: RHEL-08-030390
        levels:
            - medium
        title: Successful/unsuccessful uses of the delete_module command in RHEL 8 must
            generate an audit record.
        rules:
            - audit_rules_kernel_module_loading_delete
        status: automated
    -   id: RHEL-08-030400
        levels:
            - medium
        title: Successful/unsuccessful uses of the crontab command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_crontab
        status: automated
    -   id: RHEL-08-030410
        levels:
            - medium
        title: Successful/unsuccessful uses of the chsh command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_chsh
        status: automated
    -   id: RHEL-08-030420
        levels:
            - medium
        title: Successful/unsuccessful uses of the truncate command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_unsuccessful_file_modification_truncate
        status: automated
    -   id: RHEL-08-030430
        levels:
            - medium
        title: Successful/unsuccessful uses of the openat system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_unsuccessful_file_modification_openat
        status: automated
    -   id: RHEL-08-030440
        levels:
            - medium
        title: Successful/unsuccessful uses of the open system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_unsuccessful_file_modification_open
        status: automated
    -   id: RHEL-08-030450
        levels:
            - medium
        title: Successful/unsuccessful uses of the open_by_handle_at system call in RHEL
            8 must generate an audit record.
        rules:
            - audit_rules_unsuccessful_file_modification_open_by_handle_at
        status: automated
    -   id: RHEL-08-030460
        levels:
            - medium
        title: Successful/unsuccessful uses of the ftruncate command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_unsuccessful_file_modification_ftruncate
        status: automated
    -   id: RHEL-08-030470
        levels:
            - medium
        title: Successful/unsuccessful uses of the creat system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_unsuccessful_file_modification_creat
        status: automated
    -   id: RHEL-08-030480
        levels:
            - medium
        title: Successful/unsuccessful uses of the chown command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_chown
        status: automated
    -   id: RHEL-08-030490
        levels:
            - medium
        title: Successful/unsuccessful uses of the chmod command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_chmod
        status: automated
    -   id: RHEL-08-030500
        levels:
            - medium
        title: Successful/unsuccessful uses of the lchown system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_lchown
        status: automated
    -   id: RHEL-08-030510
        levels:
            - medium
        title: Successful/unsuccessful uses of the fchownat system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_fchownat
        status: automated
    -   id: RHEL-08-030520
        levels:
            - medium
        title: Successful/unsuccessful uses of the fchown system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_fchown
        status: automated
    -   id: RHEL-08-030530
        levels:
            - medium
        title: Successful/unsuccessful uses of the fchmodat system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_fchmodat
        status: automated
    -   id: RHEL-08-030540
        levels:
            - medium
        title: Successful/unsuccessful uses of the fchmod system call in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_dac_modification_fchmod
        status: automated
    -   id: RHEL-08-030550
        levels:
            - medium
        title: Successful/unsuccessful uses of the sudo command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_sudo
        status: automated
    -   id: RHEL-08-030560
        levels:
            - medium
        title: Successful/unsuccessful uses of the usermod command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_usermod
        status: automated
    -   id: RHEL-08-030570
        levels:
            - medium
        title: Successful/unsuccessful uses of the chacl command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_execution_chacl
        status: automated
    -   id: RHEL-08-030580
        levels:
            - medium
        title: Successful/unsuccessful uses of the kmod command in RHEL 8 must generate
            an audit record.
        rules:
            - audit_rules_privileged_commands_kmod
        status: automated
    -   id: RHEL-08-030590
        levels:
            - medium
        title: Successful/unsuccessful modifications to the faillock log file in RHEL 8
            must generate an audit record.
        status: pending
    -   id: RHEL-08-030600
        levels:
            - medium
        title: Successful/unsuccessful modifications to the lastlog file in RHEL 8 must
            generate an audit record.
        rules:
            - audit_rules_login_events_lastlog
        status: automated
    -   id: RHEL-08-030601
        levels:
            - low
        title: RHEL 8 must enable auditing of processes that start prior to the audit daemon.
        rules:
            - grub2_audit_argument
        status: automated
    -   id: RHEL-08-030602
        levels:
            - low
        title: RHEL 8 must allocate an audit_backlog_limit of sufficient size to capture
            processes that start prior to the audit daemon.
        rules:
            - grub2_audit_backlog_limit_argument
        status: automated
    -   id: RHEL-08-030603
        levels:
            - low
        title: RHEL 8 must enable Linux audit logging for the USBGuard daemon.
        rules:
            - configure_usbguard_auditbackend
        status: automated
    -   id: RHEL-08-030610
        levels:
            - medium
        title: RHEL 8 must allow only the Information System Security Manager (ISSM) (or
            individuals or roles appointed by the ISSM) to select which auditable events are
            to be audited.
        rules:
            - file_permissions_etc_audit_auditd
            - file_permissions_etc_audit_rulesd
        status: automated
    -   id: RHEL-08-030620
        levels:
            - medium
        title: RHEL 8 audit tools must have a mode of 0755 or less permissive.
        status: pending
    -   id: RHEL-08-030630
        levels:
            - medium
        title: RHEL 8 audit tools must be owned by root.
        status: pending
    -   id: RHEL-08-030640
        levels:
            - medium
        title: RHEL 8 audit tools must be group-owned by root.
        status: pending
    -   id: RHEL-08-030650
        levels:
            - medium
        title: RHEL 8 must use cryptographic mechanisms to protect the integrity of audit
            tools.
        rules:
            - aide_check_audit_tools
        status: automated
    -   id: RHEL-08-030660
        levels:
            - medium
        title: RHEL 8 must allocate audit record storage capacity to store at least one
            week of audit records, when audit records are not immediately sent to a central
            audit record storage facility.
        rules:
            - auditd_audispd_configure_sufficiently_large_partition
        status: automated
    -   id: RHEL-08-030670
        levels:
            - medium
        title: RHEL 8 must have the packages required for offloading audit logs installed.
        rules:
            - package_rsyslog_installed
        status: automated
    -   id: RHEL-08-030680
        levels:
            - medium
        title: RHEL 8 must have the packages required for encrypting offloaded audit logs
            installed.
        rules:
            - package_rsyslog-gnutls_installed
        status: automated
    -   id: RHEL-08-030690
        levels:
            - medium
        title: The RHEL 8 audit records must be off-loaded onto a different system or storage
            media from the system being audited.
        rules:
            - rsyslog_remote_loghost
        status: automated
    -   id: RHEL-08-030700
        levels:
            - medium
        title: RHEL 8 must take appropriate action when the internal event queue is full.
        rules:
            - auditd_overflow_action
        status: automated
    -   id: RHEL-08-030710
        levels:
            - medium
        title: RHEL 8 must encrypt the transfer of audit records off-loaded onto a different
            system or media from the system being audited.
        rules:
            - rsyslog_encrypt_offload_actionsendstreamdrivermode
            - rsyslog_encrypt_offload_defaultnetstreamdriver
        status: automated
    -   id: RHEL-08-030720
        levels:
            - medium
        title: RHEL 8 must authenticate the remote logging server for off-loading audit
            logs.
        rules:
            - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
        status: automated
    -   id: RHEL-08-030730
        levels:
            - medium
        title: RHEL 8 must take action when allocated audit record storage volume reaches
            75 percent of the repository maximum audit record storage capacity.
        rules:
            - auditd_data_retention_space_left_percentage
        status: automated
    -   id: RHEL-08-030740
        levels:
            - medium
        title: RHEL 8 must securely compare internal information system clocks at least
            every 24 hours with a server synchronized to an authoritative time source, such
            as the United States Naval Observatory (USNO) time servers, or a time server designated
            for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning
            System (GPS).
        rules:
            - chronyd_or_ntpd_set_maxpoll
        status: automated
    -   id: RHEL-08-030741
        levels:
            - low
        title: RHEL 8 must disable the chrony daemon from acting as a server.
        rules:
            - chronyd_client_only
        status: automated
    -   id: RHEL-08-030742
        levels:
            - low
        title: RHEL 8 must disable network management of the chrony daemon.
        rules:
            - chronyd_no_chronyc_network
        status: automated
    -   id: RHEL-08-040000
        levels:
            - high
        title: RHEL 8 must not have the telnet-server package installed.
        rules:
            - package_telnet-server_removed
        status: automated
    -   id: RHEL-08-040001
        levels:
            - medium
        title: RHEL 8 must not have any automated bug reporting tools installed.
        rules:
            - package_abrt_removed
            - package_abrt-addon-ccpp_removed
            - package_abrt-addon-kerneloops_removed
            - package_abrt-addon-python_removed
            - package_abrt-cli_removed
            - package_abrt-plugin-logger_removed
            - package_abrt-plugin-rhtsupport_removed
            - package_abrt-plugin-sosreport_removed
        status: automated
    -   id: RHEL-08-040002
        levels:
            - medium
        title: RHEL 8 must not have the sendmail package installed.
        rules:
            - package_sendmail_removed
        status: automated
    -   id: RHEL-08-040004
        levels:
            - low
        title: RHEL 8 must enable mitigations against processor-based vulnerabilities.
        rules:
            - grub2_pti_argument
        status: automated
    -   id: RHEL-08-040010
        levels:
            - high
        title: RHEL 8 must not have the rsh-server package installed.
        rules:
            - package_rsh-server_removed
        status: automated
    -   id: RHEL-08-040020
        levels:
            - medium
        title: RHEL 8 must cover or disable the built-in or attached camera when not in
            use.
        status: pending
    -   id: RHEL-08-040021
        levels:
            - low
        title: RHEL 8 must disable the asynchronous transfer mode (ATM) protocol.
        rules:
            - kernel_module_atm_disabled
        status: automated
    -   id: RHEL-08-040022
        levels:
            - low
        title: RHEL 8 must disable the controller area network (CAN) protocol.
        rules:
            - kernel_module_can_disabled
        status: automated
    -   id: RHEL-08-040023
        levels:
            - low
        title: RHEL 8 must disable the stream control transmission protocol (SCTP).
        rules:
            - kernel_module_sctp_disabled
        status: automated
    -   id: RHEL-08-040024
        levels:
            - low
        title: RHEL 8 must disable the transparent inter-process communication (TIPC) protocol.
        rules:
            - kernel_module_tipc_disabled
        status: automated
    -   id: RHEL-08-040025
        levels:
            - low
        title: RHEL 8 must disable mounting of cramfs.
        rules:
            - kernel_module_cramfs_disabled
        status: automated
    -   id: RHEL-08-040026
        levels:
            - low
        title: RHEL 8 must disable IEEE 1394 (FireWire) Support.
        rules:
            - kernel_module_firewire-core_disabled
        status: automated
    -   id: RHEL-08-040030
        levels:
            - medium
        title: RHEL 8 must be configured to prohibit or restrict the use of functions, ports,
            protocols, and/or services, as defined in the Ports, Protocols, and Services Management
            (PPSM) Category Assignments List (CAL) and vulnerability assessments.
        rules:
            - configure_firewalld_ports
        status: automated
    -   id: RHEL-08-040070
        levels:
            - medium
        title: The RHEL 8 file system automounter must be disabled unless required.
        rules:
            - service_autofs_disabled
        status: automated
    -   id: RHEL-08-040080
        levels:
            - medium
        title: RHEL 8 must be configured to disable USB mass storage.
        rules:
            - kernel_module_usb-storage_disabled
        status: automated
    -   id: RHEL-08-040090
        levels:
            - medium
        title: A RHEL 8 firewall must employ a deny-all, allow-by-exception policy for allowing
            connections to other systems.
        status: pending
    -   id: RHEL-08-040100
        levels:
            - medium
        title: A firewall must be installed on RHEL 8.
        rules:
            - package_firewalld_installed
        status: automated
    -   id: RHEL-08-040110
        levels:
            - medium
        title: RHEL 8 wireless network adapters must be disabled.
        rules:
            - wireless_disable_interfaces
        status: automated
    -   id: RHEL-08-040111
        levels:
            - medium
        title: RHEL 8 Bluetooth must be disabled.
        rules:
            - kernel_module_bluetooth_disabled
        status: automated
    -   id: RHEL-08-040120
        levels:
            - medium
        title: RHEL 8 must mount /dev/shm with the nodev option.
        rules:
            - mount_option_dev_shm_nodev
        status: automated
    -   id: RHEL-08-040121
        levels:
            - medium
        title: RHEL 8 must mount /dev/shm with the nosuid option.
        rules:
            - mount_option_dev_shm_nosuid
        status: automated
    -   id: RHEL-08-040122
        levels:
            - medium
        title: RHEL 8 must mount /dev/shm with the noexec option.
        rules:
            - mount_option_dev_shm_noexec
        status: automated
    -   id: RHEL-08-040123
        levels:
            - medium
        title: RHEL 8 must mount /tmp with the nodev option.
        rules:
            - mount_option_tmp_nodev
        status: automated
    -   id: RHEL-08-040124
        levels:
            - medium
        title: RHEL 8 must mount /tmp with the nosuid option.
        rules:
            - mount_option_tmp_nosuid
        status: automated
    -   id: RHEL-08-040125
        levels:
            - medium
        title: RHEL 8 must mount /tmp with the noexec option.
        rules:
            - mount_option_tmp_noexec
        status: automated
    -   id: RHEL-08-040126
        levels:
            - medium
        title: RHEL 8 must mount /var/log with the nodev option.
        rules:
            - mount_option_var_log_nodev
        status: automated
    -   id: RHEL-08-040127
        levels:
            - medium
        title: RHEL 8 must mount /var/log with the nosuid option.
        rules:
            - mount_option_var_log_nosuid
        status: automated
    -   id: RHEL-08-040128
        levels:
            - medium
        title: RHEL 8 must mount /var/log with the noexec option.
        rules:
            - mount_option_var_log_noexec
        status: automated
    -   id: RHEL-08-040129
        levels:
            - medium
        title: RHEL 8 must mount /var/log/audit with the nodev option.
        rules:
            - mount_option_var_log_audit_nodev
        status: automated
    -   id: RHEL-08-040130
        levels:
            - medium
        title: RHEL 8 must mount /var/log/audit with the nosuid option.
        rules:
            - mount_option_var_log_audit_nosuid
        status: automated
    -   id: RHEL-08-040131
        levels:
            - medium
        title: RHEL 8 must mount /var/log/audit with the noexec option.
        rules:
            - mount_option_var_log_audit_noexec
        status: automated
    -   id: RHEL-08-040132
        levels:
            - medium
        title: RHEL 8 must mount /var/tmp with the nodev option.
        rules:
            - mount_option_var_tmp_nodev
        status: automated
    -   id: RHEL-08-040133
        levels:
            - medium
        title: RHEL 8 must mount /var/tmp with the nosuid option.
        rules:
            - mount_option_var_tmp_nosuid
        status: automated
    -   id: RHEL-08-040134
        levels:
            - medium
        title: RHEL 8 must mount /var/tmp with the noexec option.
        rules:
            - mount_option_var_tmp_noexec
        status: automated
    -   id: RHEL-08-040135
        levels:
            - medium
        title: The RHEL 8 fapolicy module must be installed.
        rules:
            - package_fapolicyd_installed
        status: automated
    -   id: RHEL-08-040140
        levels:
            - medium
        title: RHEL 8 must block unauthorized peripherals before establishing a connection.
        rules:
            - usbguard_generate_policy
        status: automated
    -   id: RHEL-08-040150
        levels:
            - medium
        title: A firewall must be able to protect against or limit the effects of Denial
            of Service (DoS) attacks by ensuring RHEL 8 can implement rate-limiting measures
            on impacted network interfaces.
        status: pending
    -   id: RHEL-08-040160
        levels:
            - medium
        title: All RHEL 8 networked systems must have and implement SSH to protect the confidentiality
            and integrity of transmitted and received information, as well as information
            during preparation for transmission.
        rules:
            - service_sshd_enabled
        status: automated
    -   id: RHEL-08-040161
        levels:
            - medium
        title: RHEL 8 must force a frequent session key renegotiation for SSH connections
            to the server.
        rules:
            - sshd_rekey_limit
        status: automated
    -   id: RHEL-08-040170
        levels:
            - high
        title: The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 8.
        rules:
            - disable_ctrlaltdel_reboot
        status: automated
    -   id: RHEL-08-040171
        levels:
            - high
        title: The x86 Ctrl-Alt-Delete key sequence in RHEL 8 must be disabled if a graphical
            user interface is installed.
        rules:
            - dconf_gnome_disable_ctrlaltdel_reboot
        status: automated
    -   id: RHEL-08-040172
        levels:
            - high
        title: The systemd Ctrl-Alt-Delete burst key sequence in RHEL 8 must be disabled.
        rules:
            - disable_ctrlaltdel_burstaction
        status: automated
    -   id: RHEL-08-040180
        levels:
            - medium
        title: The debug-shell systemd service must be disabled on RHEL 8.
        rules:
            - service_debug-shell_disabled
        status: automated
    -   id: RHEL-08-040190
        levels:
            - high
        title: The Trivial File Transfer Protocol (TFTP) server package must not be installed
            if not required for RHEL 8 operational support.
        rules:
            - package_tftp-server_removed
        status: automated
    -   id: RHEL-08-040200
        levels:
            - high
        title: The root account must be the only account having unrestricted access to the
            RHEL 8 system.
        rules:
            - accounts_no_uid_except_zero
        status: automated
    -   id: RHEL-08-040210
        levels:
            - medium
        title: RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect
            messages from being accepted.
        rules:
            - sysctl_net_ipv6_conf_default_accept_redirects
        status: automated
    -   id: RHEL-08-040220
        levels:
            - medium
        title: RHEL 8 must not send Internet Control Message Protocol (ICMP) redirects.
        rules:
            - sysctl_net_ipv4_conf_all_send_redirects
        status: automated
    -   id: RHEL-08-040230
        levels:
            - medium
        title: RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes
            sent to a broadcast address.
        rules:
            - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
        status: automated
    -   id: RHEL-08-040240
        levels:
            - medium
        title: RHEL 8 must not forward IPv6 source-routed packets.
        rules:
            - sysctl_net_ipv6_conf_all_accept_source_route
        status: automated
    -   id: RHEL-08-040250
        levels:
            - medium
        title: RHEL 8 must not forward IPv6 source-routed packets by default.
        rules:
            - sysctl_net_ipv6_conf_default_accept_source_route
        status: automated
    -   id: RHEL-08-040260
        levels:
            - medium
        title: RHEL 8 must not be performing packet forwarding unless the system is a router.
        rules:
            - sysctl_net_ipv4_ip_forward
        status: automated
    -   id: RHEL-08-040261
        levels:
            - medium
        title: RHEL 8 must not accept router advertisements on all IPv6 interfaces.
        rules:
            - sysctl_net_ipv6_conf_all_accept_ra
        status: automated
    -   id: RHEL-08-040262
        levels:
            - medium
        title: RHEL 8 must not accept router advertisements on all IPv6 interfaces by default.
        rules:
            - sysctl_net_ipv6_conf_default_accept_ra
        status: automated
    -   id: RHEL-08-040270
        levels:
            - medium
        title: RHEL 8 must not allow interfaces to perform Internet Control Message Protocol
            (ICMP) redirects by default.
        rules:
            - sysctl_net_ipv4_conf_default_send_redirects
        status: automated
    -   id: RHEL-08-040280
        levels:
            - medium
        title: RHEL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect
            messages.
        rules:
            - sysctl_net_ipv6_conf_all_accept_redirects
        status: automated
    -   id: RHEL-08-040281
        levels:
            - medium
        title: RHEL 8 must disable access to network bpf syscall from unprivileged processes.
        rules:
            - sysctl_kernel_unprivileged_bpf_disabled
        status: automated
    -   id: RHEL-08-040282
        levels:
            - medium
        title: RHEL 8 must restrict usage of ptrace to descendant  processes.
        rules:
            - sysctl_kernel_yama_ptrace_scope
        status: automated
    -   id: RHEL-08-040283
        levels:
            - medium
        title: RHEL 8 must restrict exposed kernel pointer addresses access.
        rules:
            - sysctl_kernel_kptr_restrict
        status: automated
    -   id: RHEL-08-040284
        levels:
            - medium
        title: RHEL 8 must disable the use of user namespaces.
        rules:
            - sysctl_user_max_user_namespaces
        status: automated
    -   id: RHEL-08-040285
        levels:
            - medium
        title: RHEL 8 must use reverse path filtering on all IPv4 interfaces.
        rules:
            - sysctl_net_ipv4_conf_all_rp_filter
        status: automated
    -   id: RHEL-08-040290
        levels:
            - medium
        title: RHEL 8 must be configured to prevent unrestricted mail relaying.
        rules:
            - postfix_prevent_unrestricted_relay
        status: automated
    -   id: RHEL-08-040300
        levels:
            - low
        title: The RHEL 8 file integrity tool must be configured to verify extended attributes.
        rules:
            - aide_verify_ext_attributes
        status: automated
    -   id: RHEL-08-040310
        levels:
            - low
        title: The RHEL 8 file integrity tool must be configured to verify Access Control
            Lists (ACLs).
        rules:
            - aide_verify_acls
        status: automated
    -   id: RHEL-08-040320
        levels:
            - medium
        title: The graphical display manager must not be installed on RHEL 8 unless approved.
        rules:
            - xwindows_remove_packages
        status: automated
    -   id: RHEL-08-040330
        levels:
            - medium
        title: RHEL 8 network interfaces must not be in promiscuous mode.
        rules:
            - network_sniffer_disabled
        status: automated
    -   id: RHEL-08-040340
        levels:
            - medium
        title: RHEL 8 remote X connections for interactive users must be disabled unless
            to fulfill documented and validated mission requirements.
        rules:
            - sshd_disable_x11_forwarding
        status: automated
    -   id: RHEL-08-040341
        levels:
            - medium
        title: The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy
            display.
        rules:
            - sshd_x11_use_localhost
        status: automated
    -   id: RHEL-08-040350
        levels:
            - medium
        title: If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL
            8 TFTP daemon must be configured to operate in secure mode.
        rules:
            - tftpd_uses_secure_mode
        status: automated
    -   id: RHEL-08-040360
        levels:
            - high
        title: A File Transfer Protocol (FTP) server package must not be installed unless
            mission essential on RHEL 8.
        rules:
            - package_vsftpd_removed
        status: automated
    -   id: RHEL-08-040370
        levels:
            - medium
        title: The gssproxy package must not be installed unless mission essential on RHEL
            8.
        rules:
            - package_gssproxy_removed
        status: automated
    -   id: RHEL-08-040380
        levels:
            - medium
        title: The iprutils package must not be installed unless mission essential on RHEL
            8.
        rules:
            - package_iprutils_removed
        status: automated
    -   id: RHEL-08-040390
        levels:
            - medium
        title: The tuned package must not be installed unless mission essential on RHEL
            8.
        rules:
            - package_tuned_removed
        status: automated
    -   id: RHEL-08-010163
        levels:
            - medium
        title: The krb5-server package must not be installed on RHEL 8.
        status: pending
    -   id: RHEL-08-010382
        levels:
            - medium
        title: RHEL 8 must restrict privilege elevation to authorized personnel.
        rules:
            - sudo_restrict_privilege_elevation_to_authorized
        status: automated
    -   id: RHEL-08-010383
        levels:
            - medium
        title: RHEL 8 must use the invoking user's password for privilege escalation when
            using "sudo".
        rules:
            - sudoers_validate_passwd
        status: automated
    -   id: RHEL-08-010384
        levels:
            - medium
        title: RHEL 8 must require re-authentication when using the "sudo" command.
        rules:
            - sudo_require_reauthentication
        status: automated
    -   id: RHEL-08-010049
        levels:
            - medium
        title: RHEL 8 must display a banner before granting local or remote access to the
            system via a graphical user logon.
        rules:
            - dconf_gnome_banner_enabled
        status: automated
    -   id: RHEL-08-010131
        levels:
            - medium
        title: The RHEL 8 system-auth file must be configured to use a sufficient number
            of hashing rounds.
        rules:
            - accounts_password_pam_unix_rounds_system_auth
        status: automated
    -   id: RHEL-08-010141
        levels:
            - medium
        title: RHEL 8 operating systems booted with United Extensible Firmware Interface
            (UEFI) must require a unique superusers name upon booting into single-user mode
            and maintenance.
        rules:
            - grub2_uefi_admin_username
        status: automated
    -   id: RHEL-08-010149
        levels:
            - medium
        title: RHEL 8 operating systems booted with a BIOS must require  a unique superusers
            name upon booting into single-user and maintenance modes.
        rules:
            - grub2_admin_username
        status: automated
    -   id: RHEL-08-010152
        levels:
            - medium
        title: RHEL 8 operating systems must require authentication upon booting into emergency
            mode.
        rules:
            - require_emergency_target_auth
        status: automated
    -   id: RHEL-08-010159
        levels:
            - medium
        title: The RHEL 8 pam_unix.so module must be configured in the system-auth file
            to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
        status: pending
    -   id: RHEL-08-010201
        levels:
            - medium
        title: The RHEL 8 SSH daemon must be configured with a timeout interval.
        rules:
            - sshd_set_idle_timeout
        status: automated
    -   id: RHEL-08-010287
        levels:
            - medium
        title: The RHEL 8 SSH daemon must be configured to use system-wide crypto policies.
        status: pending
    -   id: RHEL-08-010472
        levels:
            - low
        title: RHEL 8 must have the packages required to use the hardware random number
            generator entropy gatherer service.
        rules:
            - package_rng-tools_installed
        status: automated
    -   id: RHEL-08-010522
        levels:
            - medium
        title: The RHEL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill
            documented and validated mission requirements.
        rules:
            - sshd_disable_gssapi_auth
        status: automated
    -   id: RHEL-08-010544
        levels:
            - medium
        title: RHEL 8 must use a separate file system for /var/tmp.
        rules:
            - partition_for_var_tmp
        status: automated
    -   id: RHEL-08-010572
        levels:
            - medium
        title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed
            on the /boot/efi directory.
        status: pending
    -   id: RHEL-08-010731
        levels:
            - medium
        title: All RHEL 8 local interactive user home directory files must have mode 0750
            or less permissive.
        status: pending
    -   id: RHEL-08-010741
        levels:
            - medium
        title: RHEL 8 must be configured so that all files and directories contained in
            local interactive user home directories are group-owned by a group of which the
            home directory owner is a member.
        status: pending
    -   id: RHEL-08-020025
        levels:
            - medium
        title: RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth
            file.
        rules:
            - accounts_passwords_pam_faillock_deny
        status: automated
    -   id: RHEL-08-020026
        levels:
            - medium
        title: RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth
            file.
        rules:
            - accounts_passwords_pam_faillock_deny
        status: automated
    -   id: RHEL-08-020031
        levels:
            - medium
        title: RHEL 8 must initiate a session lock for graphical user interfaces when the
            screensaver is activated.
        status: pending
    -   id: RHEL-08-020032
        levels:
            - medium
        title: RHEL 8 must disable the user list at logon for graphical user interfaces.
        status: automated
        rules:
            - dconf_gnome_disable_user_list
    -   id: RHEL-08-020039
        levels:
            - medium
        title: RHEL 8 must have the tmux package installed.
        rules:
            - package_tmux_installed
        status: automated
    -   id: RHEL-08-020081
        levels:
            - medium
        title: RHEL 8 must prevent a user from overriding the session idle-delay setting
            for the graphical user interface.
        status: pending
    -   id: RHEL-08-020082
        levels:
            - medium
        title: RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting
            for the graphical user interface.
        status: pending
    -   id: RHEL-08-020331
        levels:
            - high
        title: RHEL 8 must not allow blank or null passwords in the system-auth file.
        rules:
            - no_empty_passwords
        status: automated
    -   id: RHEL-08-020332
        levels:
            - high
        title: RHEL 8 must not allow blank or null passwords in the password-auth file.
        status: pending
    -   id: RHEL-08-030181
        levels:
            - medium
        title: RHEL 8 audit records must contain information to establish what type of events
            occurred, the source of events, where events occurred, and the outcome of events.
        rules:
            - service_auditd_enabled
        status: automated
    -   id: RHEL-08-030731
        levels:
            - medium
        title: RHEL 8 must notify the System Administrator (SA) and Information System Security
            Officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent
            utilization.
        rules:
            - auditd_data_retention_space_left_action
        status: automated
    -   id: RHEL-08-040101
        levels:
            - medium
        title: A firewall must be active on RHEL 8.
        rules:
            - service_firewalld_enabled
        status: automated
    -   id: RHEL-08-040136
        levels:
            - medium
        title: The RHEL 8 fapolicy module must be enabled.
        rules:
            - service_fapolicyd_enabled
        status: automated
    -   id: RHEL-08-040137
        levels:
            - medium
        title: The RHEL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception
            policy to allow the execution of authorized software programs.
        status: pending
    -   id: RHEL-08-040139
        levels:
            - medium
        title: RHEL 8 must have the USBGuard installed.
        rules:
            - package_usbguard_installed
        status: automated
    -   id: RHEL-08-040141
        levels:
            - medium
        title: RHEL 8 must enable the USBGuard.
        rules:
            - service_usbguard_enabled
        status: automated
    -   id: RHEL-08-040159
        levels:
            - medium
        title: All RHEL 8 networked systems must have SSH installed.
        rules:
            - package_openssh-server_installed
        status: automated
    -   id: RHEL-08-040209
        levels:
            - medium
        title: RHEL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect
            messages from being accepted.
        rules:
            - sysctl_net_ipv4_conf_default_accept_redirects
        status: automated
    -   id: RHEL-08-040239
        levels:
            - medium
        title: RHEL 8 must not forward IPv4 source-routed packets.
        rules:
            - sysctl_net_ipv4_conf_all_accept_source_route
        status: automated
    -   id: RHEL-08-040249
        levels:
            - medium
        title: RHEL 8 must not forward IPv4 source-routed packets by default.
        rules:
            - sysctl_net_ipv4_conf_default_accept_source_route
        status: automated
    -   id: RHEL-08-040279
        levels:
            - medium
        title: RHEL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect
            messages.
        rules:
            - sysctl_net_ipv4_conf_all_accept_redirects
        status: automated
    -   id: RHEL-08-040286
        levels:
            - medium
        title: RHEL 8 must enable hardening for the Berkeley Packet Filter Just-in-time
            compiler.
        rules:
            - sysctl_net_core_bpf_jit_harden
        status: automated
    -   id: RHEL-08-010001
        levels:
            - medium
        title: The RHEL 8 operating system must implement the Endpoint Security for Linux
            Threat Prevention tool.
        rules:
            - agent_mfetpd_running
            - package_mcafeetp_installed
        status: automated