STIGhub
STIGs
RMF Controls
Compare
← MA-4 — Nonlocal Maintenance
CCI-000877
Definition
Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
Parent Control
MA-4
Nonlocal Maintenance
Maintenance
Linked STIG Checks (99)
V-274052
CAT I
Amazon Linux 2023 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Amazon Linux 2023 Security Technical Implementation Guide
V-274057
CAT I
Amazon Linux 2023 must enable FIPS mode.
Amazon Linux 2023 Security Technical Implementation Guide
V-268176
CAT I
NixOS must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
Anduril NixOS Security Technical Implementation Guide
V-257773
CAT I
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257774
CAT I
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257775
CAT I
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257165
CAT I
The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257166
CAT I
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH server configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257167
CAT I
The macOS system must implement approved Key Exchange Algorithms within the SSH server configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257293
CAT I
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257294
CAT I
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257295
CAT I
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268477
CAT I
The macOS system must disable password authentication for SSH.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277084
CAT I
The macOS system must disable password authentication for SSH.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-222565
CAT II
The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.
Application Security and Development Security Technical Implementation Guide
V-272627
CAT III
CylanceON-PREM must be configured to use a third-party identity provider.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-219309
CAT II
The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238211
CAT II
The Ubuntu operating system must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260534
CAT II
Ubuntu 22.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270741
CAT II
Ubuntu 24.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-269125
CAT I
AlmaLinux OS 9 must use the TuxCare ESU repository.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269126
CAT I
AlmaLinux OS 9 must use the TuxCare FIPS packages and not the default encryption packages.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269127
CAT I
AlmaLinux OS 9 must enable FIPS mode.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269420
CAT I
AlmaLinux OS 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233106
CAT II
The container platform must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.
Container Platform Security Requirements Guide
V-205175
CAT II
The DNS server implementation must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
Domain Name System (DNS) Security Requirements Guide
V-203653
CAT I
The operating system must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
General Purpose Operating System Security Requirements Guide
V-255239
CAT II
SSMC must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
HPE 3PAR SSMC Operating System Security Technical Implementation Guide
V-237826
CAT I
User credentials which would allow remote access to the system by the Service Processor must be removed from the storage system.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-215213
CAT I
AIX must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
IBM AIX 7.x Security Technical Implementation Guide
V-223497
CAT II
CA-ACF2 defined user accounts must uniquely identify system users.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223722
CAT II
IBM RACF user accounts must uniquely identify system users.
IBM z/OS RACF Security Technical Implementation Guide
V-223952
CAT II
CA-TSS user accounts must uniquely identify system users.
IBM z/OS TSS Security Technical Implementation Guide
V-214167
CAT II
The Infoblox system must be configured to employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
Infoblox 7.x DNS Security Technical Implementation Guide
V-233905
CAT II
The Infoblox system must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.
Infoblox 8.x DNS Security Technical Implementation Guide
V-220862
CAT I
The Windows Remote Management (WinRM) client must not use Basic authentication.
Microsoft Windows 10 Security Technical Implementation Guide
V-220865
CAT I
The Windows Remote Management (WinRM) service must not use Basic authentication.
Microsoft Windows 10 Security Technical Implementation Guide
V-220868
CAT II
The Windows Remote Management (WinRM) client must not use Digest authentication.
Microsoft Windows 10 Security Technical Implementation Guide
V-253416
CAT I
The Windows Remote Management (WinRM) client must not use Basic authentication.
Microsoft Windows 11 Security Technical Implementation Guide
V-253418
CAT I
The Windows Remote Management (WinRM) service must not use Basic authentication.
Microsoft Windows 11 Security Technical Implementation Guide
V-253421
CAT II
The Windows Remote Management (WinRM) client must not use Digest authentication.
Microsoft Windows 11 Security Technical Implementation Guide
V-224958
CAT I
The Windows Remote Management (WinRM) client must not use Basic authentication.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224960
CAT II
The Windows Remote Management (WinRM) client must not use Digest authentication.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224961
CAT I
The Windows Remote Management (WinRM) service must not use Basic authentication.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205711
CAT I
Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205712
CAT II
Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205713
CAT I
Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254378
CAT I
Windows Server 2022 Windows Remote Management (WinRM) client must not use Basic authentication.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254380
CAT II
Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254381
CAT I
Windows Server 2022 Windows Remote Management (WinRM) service must not use Basic authentication.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278125
CAT I
Windows Server 2025 Windows Remote Management (WinRM) client must not use Basic authentication.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278127
CAT II
Windows Server 2025 Windows Remote Management (WinRM) client must not use Digest authentication.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278128
CAT I
Windows Server 2025 Windows Remote Management (WinRM) service must not use Basic authentication.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-259411
CAT II
The DNS server implementation must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-254125
CAT I
Nutanix AOS must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279534
CAT I
Nutanix OS must implement cryptography to protect the integrity of remote access sessions by using only HMACs employing FIPS 140-3-approved algorithms.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279620
CAT I
Nutanix OS must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-221840
CAT II
The Oracle Linux 7 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.
Oracle Linux 7 Security Technical Implementation Guide
V-248524
CAT I
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Oracle Linux 8 Security Technical Implementation Guide
V-283446
CAT I
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Oracle Linux 8 Security Technical Implementation Guide
V-283457
CAT I
The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Oracle Linux 8 Security Technical Implementation Guide
V-283458
CAT I
The OL 8 SSH server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Oracle Linux 8 Security Technical Implementation Guide
V-271454
CAT I
OL 9 must enable FIPS mode.
Oracle Linux 9 Security Technical Implementation Guide
V-271707
CAT I
OL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Oracle Linux 9 Security Technical Implementation Guide
V-235978
CAT II
Oracle WebLogic must employ strong identification and authentication techniques when establishing nonlocal maintenance and diagnostic sessions.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-253522
CAT I
Prisma Cloud Compute Console must use TLS 1.2 for user interface and API access. Communication TCP ports must adhere to the Ports, Protocols, and Services Management Category Assurance Levels (PSSM CAL).
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-281009
CAT I
RHEL 10 must enable FIPS mode.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281010
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281011
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281012
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281013
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281216
CAT I
RHEL 10 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-257986
CAT I
RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258230
CAT I
RHEL 9 must enable FIPS mode.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257583
CAT I
Red Hat Enterprise Linux CoreOS (RHCOS) must disable SSHD service.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-275627
CAT I
Ubuntu OS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.
Riverbed NetIM OS Security Technical Implementation Guide
V-261334
CAT I
SLEM 5 must implement DOD-approved encryption to protect the confidentiality of SSH remote connections.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-261335
CAT I
SLEM 5 SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2/140-3 approved cryptographic hash algorithms.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217271
CAT II
The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-216387
CAT II
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
Solaris 11 SPARC Security Technical Implementation Guide
V-216150
CAT II
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
Solaris 11 X86 Security Technical Implementation Guide
V-241005
CAT II
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
Tanium 7.0 Security Technical Implementation Guide
V-234066
CAT II
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
Tanium 7.3 Security Technical Implementation Guide
V-252919
CAT I
The TOSS operating system must implement DOD-approved encryption in the OpenSSL package.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282504
CAT I
TOSS 5 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-240467
CAT II
The SLES for vRealize must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
VMware vRealize Automation 7.x SLES Security Technical Implementation Guide
V-239560
CAT II
The SLES for vRealize must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide
V-256503
CAT II
The Photon operating system must use an OpenSSH server version that does not support protocol 1.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-207399
CAT II
The VMM must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
Virtual Machine Manager Security Requirements Guide
V-73593
CAT I
The Windows Remote Management (WinRM) client must not use Basic authentication.
Windows Server 2016 Security Technical Implementation Guide
V-73593
CAT I
The Windows Remote Management (WinRM) client must not use Basic authentication.
Windows Server 2016 Security Technical Implementation Guide
V-73597
CAT II
The Windows Remote Management (WinRM) client must not use Digest authentication.
Windows Server 2016 Security Technical Implementation Guide
V-73597
CAT II
The Windows Remote Management (WinRM) client must not use Digest authentication.
Windows Server 2016 Security Technical Implementation Guide
V-73599
CAT I
The Windows Remote Management (WinRM) service must not use Basic authentication.
Windows Server 2016 Security Technical Implementation Guide
V-73599
CAT I
The Windows Remote Management (WinRM) service must not use Basic authentication.
Windows Server 2016 Security Technical Implementation Guide
V-93503
CAT I
Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication.
Windows Server 2019 Security Technical Implementation Guide
V-93505
CAT II
Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication.
Windows Server 2019 Security Technical Implementation Guide
V-93507
CAT I
Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication.
Windows Server 2019 Security Technical Implementation Guide
V-269574
CAT I
Xylok Security Suite must use a centralized user management solution.
Xylok Security Suite 20.x Security Technical Implementation Guide