STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 5 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

SUSE Linux Enterprise Server 15 Security Technical Implementation Guide

Archived

Version

V2R7

Release Date

Feb 19, 2026

SCAP Benchmark ID

SLES_15_STIG

Total Checks

214

Tags

linux
CAT I: 20CAT II: 172CAT III: 22

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (214)

V-234800HIGHThe SUSE operating system must be a vendor-supported release.V-234802MEDIUMVendor-packaged SUSE operating system security patches and updates must be installed and up to date.V-234803MEDIUMThe SUSE operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting access via local console.V-234804HIGHThe SUSE operating system must not have the vsftpd package installed if not required for operational support.V-234805MEDIUMThe SUSE operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting access via SSH.V-234806MEDIUMThe SUSE operating system must display the Standard Mandatory DoD Notice and Consent Banner until users acknowledge the usage conditions and take explicit actions to log on for further access to the local graphical user interface (GUI).V-234807MEDIUMThe SUSE operating system file /etc/gdm/banner must contain the Standard Mandatory DoD Notice and Consent banner text.V-234808MEDIUMThe SUSE operating system must display a banner before granting local or remote access to the system via a graphical user logon.V-234809MEDIUMThe SUSE operating system must display the approved Standard Mandatory DoD Notice before granting local or remote access to the system via a graphical user logon.V-234810MEDIUMThe SUSE operating system must be able to lock the graphical user interface (GUI).V-234811LOWThe SUSE operating system must utilize vlock to allow for session locking.V-234812MEDIUMThe SUSE operating system must initiate a session lock after a 15-minute period of inactivity for the graphical user interface (GUI).V-234813MEDIUMThe SUSE operating system must initiate a session lock after a 10-minute period of inactivity.V-234814LOWThe SUSE operating system must conceal, via the session lock, information previously visible on the display with a publicly viewable image in the graphical user interface (GUI).V-234815MEDIUMThe SUSE operating system must log SSH connection attempts and failures to the server.V-234816MEDIUMThe SUSE operating system must implement DOD-approved encryption to protect the confidentiality of SSH remote connections.V-234817MEDIUMThe SUSE operating system, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-234818HIGHThe SUSE operating system must not have the telnet-server package installed.V-234819HIGHSUSE operating systems with a basic input/output system (BIOS) must require authentication upon booting into single-user and maintenance modes.V-234820HIGHSUSE operating systems with Unified Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.V-234821MEDIUMThe SUSE operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.V-234822MEDIUMThe SUSE operating system must not have duplicate User IDs (UIDs) for interactive users.V-234823MEDIUMThe SUSE operating system must disable the file system automounter.V-234825MEDIUMThe SUSE operating system must employ FIPS 140-2 approved cryptographic hashing algorithm for system authentication (login.defs).V-234826MEDIUMThe SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.V-234827MEDIUMThe SUSE operating system SSH daemon must be configured with a timeout interval.V-234828MEDIUMThe sticky bit must be set on all SUSE operating system world-writable directories.V-234829MEDIUMThe SUSE operating system must be configured to use TCP syncookies.V-234830MEDIUMThe SUSE operating system, for all network connections associated with SSH traffic, must immediately terminate at the end of the session or after 10 minutes of inactivity.V-234831HIGHAll SUSE operating system persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.V-234832MEDIUMThe SUSE operating system must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.V-234833MEDIUMThe SUSE operating system must prevent unauthorized users from accessing system error messages.V-234834MEDIUMThe SUSE operating system library files must have mode 0755 or less permissive.V-234835MEDIUMThe SUSE operating system library directories must have mode 0755 or less permissive.V-234836MEDIUMThe SUSE operating system library files must be owned by root.V-234837MEDIUMThe SUSE operating system library directories must be owned by root.V-234838MEDIUMThe SUSE operating system library files must be group-owned by root.V-234839MEDIUMThe SUSE operating system library directories must be group-owned by root.V-234840MEDIUMThe SUSE operating system must have system commands set to a mode of 0755 or less permissive.V-234841MEDIUMThe SUSE operating system must have directories that contain system commands set to a mode of 0755 or less permissive.V-234842MEDIUMThe SUSE operating system must have system commands owned by root.V-234843MEDIUMThe SUSE operating system must have directories that contain system commands owned by root.V-234844MEDIUMThe SUSE operating system must have system commands group-owned by root or a system account.V-234845MEDIUMThe SUSE operating system must have directories that contain system commands group-owned by root.V-234846MEDIUMThe SUSE operating system must have a firewall system installed to immediately disconnect or disable remote access to the whole operating system.V-234847MEDIUMThe SUSE operating system wireless network adapters must be disabled unless approved and documented.V-234848MEDIUMSUSE operating system AppArmor tool must be configured to control whitelisted applications and user home directory access control.V-234849MEDIUMThe SUSE operating system clock must, for networked systems, be synchronized to an authoritative DOD time source at least every 24 hours.V-234850LOWThe SUSE operating system must be configured to use Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).V-234851MEDIUMAdvanced Intrusion Detection Environment (AIDE) must verify the baseline SUSE operating system configuration at least weekly.V-234852HIGHThe SUSE operating system tool zypper must have gpgcheck enabled.V-234853HIGHThe SUSE operating system must reauthenticate users when changing authenticators, roles, or escalating privileges.V-234854MEDIUMThe SUSE operating system must have the packages required for multifactor authentication to be installed.V-234855MEDIUMThe SUSE operating system must implement certificate status checking for multifactor authentication.V-234856MEDIUMThe SUSE operating system must disable the USB mass storage kernel module.V-234857MEDIUMIf Network Security Services (NSS) is being used by the SUSE operating system it must prohibit the use of cached authentications after one day.V-234858MEDIUMThe SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to prohibit the use of cached offline authentications after one day.V-234859HIGHFIPS 140-2 mode must be enabled on the SUSE operating system.V-234860HIGHAll networked SUSE operating systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.V-234861MEDIUMThe SUSE operating system must implement kptr-restrict to prevent the leaking of internal kernel addresses.V-234862MEDIUMAddress space layout randomization (ASLR) must be implemented by the SUSE operating system to protect memory from unauthorized code execution.V-234863MEDIUMThe SUSE operating system must remove all outdated software components after updated versions have been installed.V-234864MEDIUMThe SUSE operating system must notify the System Administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions.V-234865MEDIUMThe SUSE operating system must off-load rsyslog messages for networked systems in real time and off-load standalone systems at least weekly.V-234866MEDIUMThe SUSE operating system must provision temporary accounts with an expiration date for 72 hours.V-234867MEDIUMThe SUSE operating system must lock an account after three consecutive invalid access attempts.V-234868LOWThe SUSE operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.V-234869MEDIUMThe SUSE operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).V-234870MEDIUMThe SUSE operating system must deny direct logons to the root account using remote access via SSH.V-234871MEDIUMThe SUSE operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.V-234872MEDIUMThe SUSE operating system must never automatically remove or disable emergency administrator accounts.V-234874MEDIUMThe SUSE operating system must not have unnecessary accounts.V-234875MEDIUMThe SUSE operating system must not have unnecessary account capabilities.V-234876HIGHThe SUSE operating system root account must be the only account with unrestricted access to the system.V-234877MEDIUMThe SUSE operating system must restrict privilege elevation to authorized personnel.V-234878MEDIUMThe SUSE operating system must require reauthentication when using the "sudo" command.V-234879MEDIUMThe SUSE operating system must use the invoking user's password for privilege escalation when using "sudo".V-234880MEDIUMAll SUSE operating system local interactive user accounts, upon creation, must be assigned a home directory.V-234881MEDIUMThe SUSE operating system must display the date and time of the last successful account logon upon an SSH logon.V-234882MEDIUMThe SUSE operating system must enforce passwords that contain at least one uppercase character.V-234883MEDIUMThe SUSE operating system must enforce passwords that contain at least one lowercase character.V-234884MEDIUMThe SUSE operating system must enforce passwords that contain at least one numeric character.V-234885MEDIUMThe SUSE operating system must require the change of at least eight of the total number of characters when passwords are changed.V-234886MEDIUMThe SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to only store encrypted representations of passwords.V-234887MEDIUMThe SUSE operating system must employ FIPS 140-2-approved cryptographic hashing algorithms for all stored passwords.V-234888MEDIUMThe SUSE operating system must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.V-234889MEDIUMThe SUSE operating system must be configured to create or update passwords with a minimum lifetime of 24 hours (one day).V-234890MEDIUMThe SUSE operating system must employ user passwords with a minimum lifetime of 24 hours (one day).V-234891MEDIUMThe SUSE operating system must be configured to create or update passwords with a maximum lifetime of 60 days.V-234892MEDIUMThe SUSE operating system must employ user passwords with a maximum lifetime of 60 days.V-234895MEDIUMThe SUSE operating system must employ passwords with a minimum of 15 characters.V-234896MEDIUMThe SUSE operating system must enforce passwords that contain at least one special character.V-234897MEDIUMThe SUSE operating system must prevent the use of dictionary words for passwords.V-234898HIGHThe SUSE operating system must not be configured to allow blank or null passwords.V-234899MEDIUMThe SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.V-234900MEDIUMThe SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.V-234901MEDIUMThe SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.V-234902MEDIUMThe SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.V-234903MEDIUMThe SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.V-234904MEDIUMSUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.V-234905LOWThe SUSE operating system must generate audit records for all uses of the ssh-keysign command.V-234906MEDIUMThe SUSE operating system must generate audit records for all uses of the passwd command.V-234907LOWThe SUSE operating system must generate audit records for all uses of the gpasswd command.V-234908LOWThe SUSE operating system must generate audit records for all uses of the newgrp command.V-234909LOWThe SUSE operating system must generate audit records for a uses of the chsh command.V-234910MEDIUMThe SUSE operating system must generate audit records for all uses of the unix_chkpwd or unix2_chkpwd commands.V-234911MEDIUMThe SUSE operating system must generate audit records for all uses of the chage command.V-234912MEDIUMThe SUSE operating system must generate audit records for all uses of the crontab command.V-234913MEDIUMThe SUSE operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.V-234914MEDIUMThe SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.V-234918MEDIUMThe SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.V-234924MEDIUMThe SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown system calls.V-234928MEDIUMThe SUSE operating system must generate audit records for all uses of the chmod, fchmod, and fchmodat system calls.V-234932MEDIUMThe SUSE operating system must generate audit records for all uses of the sudoedit command.V-234933LOWThe SUSE operating system must generate audit records for all uses of the chfn command.V-234934LOWThe SUSE operating system must generate audit records for all uses of the mount system call.V-234935LOWThe SUSE operating system must generate audit records for all uses of the umount system call.V-234936LOWThe SUSE operating system must generate audit records for all uses of the ssh-agent command.V-234937MEDIUMThe SUSE operating system must generate audit records for all uses of the insmod command.V-234938MEDIUMThe SUSE operating system must generate audit records for all uses of the rmmod command.V-234939MEDIUMThe SUSE operating system must generate audit records for all uses of the modprobe command.V-234940MEDIUMThe SUSE operating system must generate audit records for all uses of the kmod command.V-234941MEDIUMThe SUSE operating system must generate audit records for all uses of the chmod command.V-234942MEDIUMThe SUSE operating system must generate audit records for all uses of the setfacl command.V-234943MEDIUMThe SUSE operating system must generate audit records for all uses of the chacl command.V-234944MEDIUMThe SUSE operating system must generate audit records for all uses of the chcon command.V-234945MEDIUMThe SUSE operating system must generate audit records for all uses of the rm command.V-234946MEDIUMThe SUSE operating system must generate audit records for all modifications to the tallylog file must generate an audit record.V-234947MEDIUMThe SUSE operating system must generate audit records for all modifications to the lastlog file.V-234948MEDIUMThe SUSE operating system must generate audit records for all uses of the passmass command.V-234949MEDIUMThe SUSE operating system must generate audit records for all uses of the usermod command.V-234950MEDIUMThe SUSE operating system must generate audit records for all uses of the pam_timestamp_check command.V-234951MEDIUMThe SUSE operating system must generate audit records for all uses of the delete_module system call.V-234952MEDIUMThe SUSE operating system must generate audit records for all uses of the init_module and finit_module system calls.V-234954MEDIUMThe SUSE operating system must generate audit records for all uses of the su command.V-234955LOWThe SUSE operating system must generate audit records for all uses of the sudo command.V-234956MEDIUMThe Information System Security Officer (ISSO) and System Administrator (SA), at a minimum, must be alerted of a SUSE operating system audit processing failure event.V-234957MEDIUMThe Information System Security Officer (ISSO) and System Administrator (SA), at a minimum, must have mail aliases to be notified of a SUSE operating system audit processing failure.V-234958MEDIUMThe SUSE operating system audit system must take appropriate action when the audit storage volume is full.V-234959MEDIUMThe SUSE operating system must protect audit rules from unauthorized modification.V-234961MEDIUMThe SUSE operating system audit tools must have the proper permissions configured to protect against unauthorized access.V-234962MEDIUMThe SUSE operating system file integrity tool must be configured to protect the integrity of the audit tools.V-234963LOWThe SUSE operating system must generate audit records for all uses of the privileged functions.V-234964MEDIUMThe SUSE operating system must have the auditing package installed.V-234965MEDIUMThe SUSE operating system must allocate audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility.V-234966MEDIUMThe audit-audispd-plugins must be installed on the SUSE operating system.V-234967LOWThe SUSE operating system audit event multiplexor must be configured to use Kerberos.V-234968LOWAudispd must off-load audit records onto a different system or media from the SUSE operating system being audited.V-234969MEDIUMThe SUSE operating system auditd service must notify the System Administrator (SA) and Information System Security Officer (ISSO) immediately when audit storage capacity is 75 percent full.V-234973MEDIUMThe SUSE operating system must generate audit records for all uses of the unlink, unlinkat, rename, renameat, and rmdir system calls.V-234975MEDIUMThe SUSE operating system must generate audit records for the /run/utmp file.V-234976MEDIUMThe SUSE operating system must generate audit records for the /var/log/wtmp file.V-234977MEDIUMThe SUSE operating system must generate audit records for the /var/log/btmp file.V-234978MEDIUMThe SUSE operating system must off-load audit records onto a different system or media from the system being audited.V-234979MEDIUMAudispd must take appropriate action when the SUSE operating system audit storage is full.V-234980LOWThe SUSE operating system must use a separate file system for the system audit data path.V-234981MEDIUMThe SUSE operating system must not disable syscall auditing.V-234982MEDIUMThe SUSE operating system must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.V-234983MEDIUMThe SUSE operating system must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.V-234984HIGHThere must be no .shosts files on the SUSE operating system.V-234985HIGHThere must be no shosts.equiv files on the SUSE operating system.V-234986LOWThe SUSE operating system file integrity tool must be configured to verify Access Control Lists (ACLs).V-234987LOWThe SUSE operating system file integrity tool must be configured to verify extended attributes.V-234988HIGHThe SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence.V-234989HIGHThe SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence for Graphical User Interfaces.V-234990HIGHThe SUSE operating system must disable the systemd Ctrl-Alt-Delete burst key sequence.V-234991MEDIUMAll SUSE operating system local interactive users must have a home directory assigned in the /etc/passwd file.V-234992MEDIUMAll SUSE operating system local interactive user home directories defined in the /etc/passwd file must exist.V-234993MEDIUMAll SUSE operating system local interactive user home directories must have mode 0750 or less permissive.V-234994MEDIUMAll SUSE operating system local interactive user home directories must be group-owned by the home directory owner's primary group.V-234995MEDIUMAll SUSE operating system local initialization files must have mode 0740 or less permissive.V-234996MEDIUMAll SUSE operating system local interactive user initialization files executable search paths must contain only paths that resolve to the users home directory.V-234997MEDIUMAll SUSE operating system local initialization files must not execute world-writable programs.V-234998MEDIUMSUSE operating system file systems that contain user home directories must be mounted to prevent files with the setuid and setgid bit set from being executed.V-234999MEDIUMSUSE operating system file systems that are used with removable media must be mounted to prevent files with the setuid and setgid bit set from being executed.V-235000MEDIUMSUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent files with the setuid and setgid bit set from being executed.V-235001MEDIUMSUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent binary files from being executed.V-235002MEDIUMAll SUSE operating system world-writable directories must be group-owned by root, sys, bin, or an application group.V-235003MEDIUMSUSE operating system kernel core dumps must be disabled unless needed.V-235004LOWA separate file system must be used for SUSE operating system user home directories (such as /home or an equivalent).V-235005LOWThe SUSE operating system must use a separate file system for /var.V-235006MEDIUMThe SUSE operating system must be configured to not overwrite Pluggable Authentication Modules (PAM) configuration on package changes.V-235007MEDIUMThe SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication.V-235008MEDIUMThe SUSE operating system SSH daemon public host key files must have mode 0644 or less permissive.V-235009MEDIUMThe SUSE operating system SSH daemon private host key files must have mode 0640 or less permissive.V-235010MEDIUMThe SUSE operating system SSH daemon must perform strict mode checking of home directory configuration files.V-235013MEDIUMThe SUSE operating system SSH daemon must disable forwarded remote X connections for interactive users, unless to fulfill documented and validated mission requirements.V-235014MEDIUMThe SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.V-235015MEDIUMThe SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets.V-235016MEDIUMThe SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.V-235017MEDIUMThe SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.V-235018MEDIUMThe SUSE operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.V-235019MEDIUMThe SUSE operating system must not allow interfaces to accept Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default.V-235020MEDIUMThe SUSE operating system must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted.V-235021MEDIUMThe SUSE operating system must not allow interfaces to accept Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages by default.V-235022MEDIUMThe SUSE operating system must not allow interfaces to send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default.V-235023MEDIUMThe SUSE operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.V-235024MEDIUMThe SUSE operating system must not be performing Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router.V-235025MEDIUMThe SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router.V-235026MEDIUMThe SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding by default unless the system is a router.V-235027MEDIUMThe SUSE operating system must not have network interfaces in promiscuous mode unless approved and documented.V-235028MEDIUMAll SUSE operating system files and directories must have a valid owner.V-235029MEDIUMAll SUSE operating system files and directories must have a valid group owner.V-235030MEDIUMThe SUSE operating system default permissions must be defined in such a way that all authenticated users can only read and modify their own files.V-235031HIGHThe SUSE operating system must not allow unattended or automatic logon via the graphical user interface (GUI).V-235032HIGHThe SUSE operating system must not allow unattended or automatic logon via SSH.V-251723MEDIUMThe SUSE operating system must specify the default "include" directory for the /etc/sudoers file.V-251724MEDIUMThe SUSE operating system must not be configured to bypass password requirements for privilege escalation.V-251725HIGHThe SUSE operating system must not have accounts configured with blank or null passwords.V-255920MEDIUMThe SUSE operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.V-255921LOWThe SUSE operating system must restrict access to the kernel message buffer.V-255922MEDIUMThe SUSE operating system must use a file integrity tool to verify correct operation of all security functions.V-256983MEDIUMThe SUSE operating system must be configured to allow sending email notifications of unauthorized configuration changes to designated personnel.V-274879MEDIUMThe SUSE operating system must audit any script or executable called by cron as root or by any privileged user.