STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 5 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

Version

V1R1

Release Date

Apr 1, 2026

SCAP Benchmark ID

TOSS_5_STIG

Total Checks

391

Tags

other
CAT I: 23CAT II: 356CAT III: 12

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (391)

V-282352MEDIUMTOSS 5 must automatically expire temporary accounts within 72 hours.V-282353MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.V-282354MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory.V-282355MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.V-282356MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.V-282357MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.V-282358MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.V-282359MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.V-282360MEDIUMTOSS 5 must automatically lock an account when three unsuccessful login attempts occur.V-282361MEDIUMTOSS 5 must automatically lock an account when three unsuccessful login attempts occur during a 15-minute time period.V-282362MEDIUMTOSS 5 must ensure account lockouts persist.V-282363MEDIUMTOSS 5 must log username information when unsuccessful login attempts occur.V-282364MEDIUMTOSS 5 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.V-282365MEDIUMTOSS 5 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.V-282366MEDIUMTOSS 5 must display the Standard Mandatory DOD or other applicable U.S. Government Notice and Consent Banner before granting local or remote access to the system via a command line user login.V-282367MEDIUMTOSS 5 must display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting local or remote access to the system via a SSH login.V-282368MEDIUMTOSS 5 must display the Standard Mandatory DOD or other applicable U.S. Government agency Notice and Consent Banner before granting local or remote access to the system via a graphical user login.V-282369MEDIUMTOSS 5 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.V-282371LOWTOSS 5 must limit the number of concurrent sessions to 256 for all accounts and/or account types.V-282372MEDIUMTOSS 5 must directly initiate a session lock for all connection types when the smart card is removed.V-282373MEDIUMTOSS 5 must prevent a user from overriding the disabling of the graphical user smart card removal action.V-282374MEDIUMTOSS 5 must enable a user session lock until that user reestablishes access using established identification and authentication procedures for graphical user sessions.V-282375MEDIUMTOSS 5 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.V-282376MEDIUMTOSS 5 must have the tmux package installed.V-282377MEDIUMTOSS 5 must automatically lock graphical user sessions after 10 minutes of inactivity.V-282378MEDIUMTOSS 5 must prevent a user from overriding the session idle-delay setting for the graphical user interface.V-282379MEDIUMTOSS 5 must initiate a session lock for graphical user interfaces when the screensaver is activated.V-282380MEDIUMTOSS 5 must prevent a user from overriding the session lock-delay setting for the graphical user interface.V-282381MEDIUMTOSS 5 must automatically exit interactive command shell user sessions after 15 minutes of inactivity.V-282382MEDIUMTOSS 5 must conceal via the session lock information previously visible on the display with a publicly viewable image.V-282383MEDIUMTOSS 5 must log SSH connection attempts and failures to the server.V-282384MEDIUMAll TOSS 5 remote access methods must be monitored.V-282385MEDIUMTOSS 5 must force a frequent session key renegotiation for SSH connections to the server.V-282386HIGHTOSS 5 IP tunnels must use FIPS 140-3-approved cryptographic algorithms.V-282387LOWTOSS 5 must enable auditing of processes that start prior to the audit daemon.V-282388MEDIUMTOSS 5 must audit all uses of the chmod, fchmod, and fchmodat system calls.V-282389MEDIUMTOSS 5 must audit all uses of the chown, fchown, fchownat, and lchown system calls.V-282390MEDIUMTOSS 5 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.V-282391MEDIUMTOSS 5 must audit all uses of umount system calls.V-282392MEDIUMTOSS 5 must audit all uses of the chacl command.V-282393MEDIUMTOSS 5 must audit all uses of the setfacl command.V-282394MEDIUMTOSS 5 must audit all uses of the chcon command.V-282395MEDIUMTOSS 5 must audit all uses of the semanage command.V-282396MEDIUMTOSS 5 must audit all uses of the setfiles command.V-282397MEDIUMTOSS 5 must audit all uses of the setsebool command.V-282398MEDIUMTOSS 5 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.V-282399MEDIUMTOSS 5 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.V-282400MEDIUMTOSS 5 must audit all uses of the delete_module system call.V-282401MEDIUMTOSS 5 must audit all uses of the init_module and finit_module system calls.V-282402MEDIUMTOSS 5 must audit all uses of the chage command.V-282403MEDIUMTOSS 5 must audit all uses of the chsh command.V-282404MEDIUMTOSS 5 must audit all uses of the crontab command.V-282405MEDIUMTOSS 5 must audit all uses of the gpasswd command.V-282406MEDIUMTOSS 5 must audit all uses of the kmod command.V-282407MEDIUMTOSS 5 must audit all uses of the newgrp command.V-282408MEDIUMTOSS 5 must audit all uses of the pam_timestamp_check command.V-282409MEDIUMTOSS 5 must audit all uses of the passwd command.V-282410MEDIUMTOSS 5 must audit all uses of the postdrop command.V-282411MEDIUMTOSS 5 must audit all uses of the postqueue command.V-282412MEDIUMTOSS 5 must audit all uses of the ssh-agent command.V-282413MEDIUMTOSS 5 must audit all uses of the ssh-keysign command.V-282414MEDIUMTOSS 5 must audit all uses of the su command.V-282415MEDIUMTOSS 5 must audit all uses of the sudo command.V-282416MEDIUMTOSS 5 must audit all uses of the sudoedit command.V-282417MEDIUMTOSS 5 must audit all uses of the unix_chkpwd command.V-282418MEDIUMTOSS 5 must audit all uses of the unix_update command.V-282419MEDIUMTOSS 5 must audit all uses of the userhelper command.V-282420MEDIUMTOSS 5 must audit all uses of the usermod command.V-282421MEDIUMTOSS 5 must audit all uses of the mount command.V-282422MEDIUMSuccessful/unsuccessful uses of the umount system call in TOSS 5 must generate an audit record.V-282423MEDIUMSuccessful/unsuccessful uses of the umount2 system call in TOSS 5 must generate an audit record.V-282424MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.V-282425MEDIUMTOSS 5 must label all offloaded audit logs before sending them to the central log server.V-282426MEDIUMTOSS 5 must forward mail from postmaster to the root account using a postfix alias.V-282427MEDIUMTOSS 5 system administrators (SAs) and/or information system security officer (ISSOs) (at a minimum) must be alerted of an audit processing failure event.V-282428MEDIUMTOSS 5 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.V-282429MEDIUMTOSS 5 must take appropriate action when a critical audit processing failure occurs.V-282430MEDIUMTOSS 5 must periodically flush audit records to disk to prevent the loss of audit records.V-282431MEDIUMTOSS 5 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.V-282432MEDIUMTOSS 5 audit log directory must be owned by root to prevent unauthorized read access.V-282433MEDIUMTOSS 5 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.V-282434MEDIUMTOSS 5 audit system must protect login user identifiers (UIDs) from unauthorized change.V-282435MEDIUMTOSS 5 audit system must protect auditing rules from unauthorized change.V-282436LOWTOSS 5 must enable Linux audit logging for the USBGuard daemon.V-282437MEDIUMTOSS 5 audit package must be installed.V-282438MEDIUMTOSS 5 audit service must be enabled.V-282439MEDIUMThe TOSS 5 audit system must audit local events.V-282440MEDIUMTOSS 5 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.V-282441MEDIUMTOSS 5 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized access.V-282442MEDIUMTOSS 5, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-282443MEDIUMTOSS 5, for public key infrastructure (PKI)-based authentication, must enforce authorized access to the corresponding private key.V-282444MEDIUMTOSS 5 must map the authenticated identity to the user or group account for PKI-based authentication.V-282445MEDIUMTOSS 5 must ensure the password complexity module in the system-auth file is configured for three retries or less.V-282446HIGHTOSS 5 must ensure the password complexity module is enabled in the password-auth file.V-282447MEDIUMTOSS 5 must enforce password complexity by requiring at least one uppercase character.V-282448MEDIUMTOSS 5 must enforce password complexity by requiring that at least one lowercase character be used.V-282449MEDIUMTOSS 5 must enforce password complexity by requiring that at least one numeric character be used.V-282450MEDIUMTOSS 5 must enforce password complexity rules for the root account.V-282451MEDIUMTOSS 5 must require users to change at least eight characters when changing passwords.V-282452MEDIUMTOSS 5 must limit the maximum number of repeating characters of the same character class to four when passwords are changed.V-282453MEDIUMTOSS 5 must limit the maximum number of repeating characters to three when passwords are changed.V-282454MEDIUMTOSS 5 must require the change of at least four character classes when passwords are changed.V-282455MEDIUMTOSS 5 password-auth must be configured to use a sufficient number of hashing rounds.V-282456MEDIUMTOSS 5 system-auth must be configured to use a sufficient number of hashing rounds.V-282457MEDIUMTOSS 5 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.V-282458MEDIUMTOSS 5 must be configured to use the shadow file to store only encrypted representations of passwords.V-282459MEDIUMTOSS 5 shadow password suite must be configured to use a sufficient number of hashing rounds.V-282460MEDIUMTOSS 5 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.V-282461MEDIUMThe TOSS 5 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.V-282462MEDIUMTOSS 5 must not have the rsh-server package installed.V-282463MEDIUMTOSS 5 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.V-282464MEDIUMTOSS 5 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.V-282465MEDIUMTOSS 5 user account passwords for new users or password changes must have a 60-day maximum password lifetime restriction in /etc/login.defs.V-282466MEDIUMTOSS 5 user account passwords must have a 60-day maximum password lifetime restriction.V-282467MEDIUMTOSS 5 passwords must be created with a minimum of 15 characters.V-282468MEDIUMTOSS 5 passwords, for new users, must have a minimum of 15 characters.V-282470HIGHTOSS 5 must require a unique superuser name upon booting into single-user and maintenance modes.V-282471MEDIUMTOSS 5 must require authentication to access emergency mode.V-282472MEDIUMTOSS 5 must require authentication to access single-user mode.V-282473LOWTOSS 5 must enable mitigations against processor-based vulnerabilities.V-282474MEDIUMTOSS 5 must be configured to disable the Asynchronous Transfer Mode (ATM) kernel module.V-282475MEDIUMTOSS 5 must be configured to disable the Controller Area Network (CAN) kernel module.V-282476MEDIUMTOSS 5 must be configured to disable the FireWire kernel module.V-282477MEDIUMTOSS 5 must disable the Stream Control Transmission Protocol (SCTP) kernel module.V-282478MEDIUMTOSS 5 must disable the Transparent Inter Process Communication (TIPC) kernel module.V-282479MEDIUMTOSS 5 must not have the ypserv package installed.V-282480MEDIUMTOSS 5 must not have the rsh-server package installed.V-282481MEDIUMTOSS 5 must not have the telnet-server package installed.V-282482MEDIUMTOSS 5 must not have the iprutils package installed.V-282483LOWTOSS 5 must disable mounting of cramfs.V-282484LOWTOSS 5 must disable network management of the chrony daemon.V-282485MEDIUMTOSS 5 must have the firewalld package installed.V-282486MEDIUMThe firewalld service on TOSS 5 must be active.V-282487MEDIUMTOSS 5 must control remote access methods.V-282488MEDIUMTOSS 5 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.V-282489MEDIUMTOSS 5 duplicate User IDs (UIDs) must not exist for interactive users.V-282490MEDIUMAll TOSS 5 interactive users must have a primary group that exists.V-282491MEDIUMTOSS 5 groups must have unique Group ID (GID).V-282492MEDIUMTOSS 5 must have the openssl-pkcs11 package installed.V-282493HIGHTOSS 5 SSHD must not allow blank or null passwords.V-282494MEDIUMTOSS 5 must not permit direct logins to the root account using remote access via SSH.V-282497MEDIUMTOSS 5 file system automount function must be disabled unless required.V-282498MEDIUMTOSS 5 must disable the graphical user interface automount function unless required.V-282499MEDIUMTOSS 5 must prevent a user from overriding the disabling of the graphical user interface automount function.V-282500MEDIUMTOSS 5 must prevent a user from overriding the disabling of the graphical user interface autorun function.V-282501MEDIUMTOSS 5 must be configured to disable USB mass storage.V-282502MEDIUMTOSS 5 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.V-282503MEDIUMTOSS 5 must use mechanisms meeting the requirements of applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.V-282504HIGHTOSS 5 must enable the Pluggable Authentication Module (PAM) interface for SSHD.V-282505MEDIUMTOSS 5 must restrict access to the kernel message buffer.V-282506MEDIUMTOSS 5 must prevent kernel profiling by nonprivileged users.V-282507MEDIUMTOSS 5 must restrict exposed kernel pointer addresses access.V-282508MEDIUMTOSS 5 must disable access to network bpf system call from nonprivileged processes.V-282509MEDIUMTOSS 5 must restrict usage of ptrace to descendant processes.V-282510MEDIUMTOSS 5 must use a Linux Security Module configured to enforce limits on system services.V-282511MEDIUMA sticky bit must be set on all TOSS 5 public directories.V-282512MEDIUMTOSS 5 must be configured to use TCP syncookies.V-282514HIGHTOSS 5 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.V-282516MEDIUMTOSS 5 /var/log directory must have mode 0755 or less permissive.V-282517MEDIUMTOSS 5 /var/log/messages file must have mode 0640 or less permissive.V-282518MEDIUMTOSS 5 /var/log directory must be owned by root.V-282519MEDIUMTOSS 5 /var/log directory must be group-owned by root.V-282520MEDIUMTOSS 5 /var/log/messages file must be owned by root.V-282521MEDIUMTOSS 5 /var/log/messages file must be group-owned by root.V-282522MEDIUMTOSS 5 SSH daemon must be configured to use systemwide crypto policies.V-282523MEDIUMTOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption ciphers to protect the confidentiality of SSH client connections.V-282524MEDIUMTOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption ciphers to protect the confidentiality of SSH server connections.V-282525MEDIUMThe TOSS 5 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms.V-282526HIGHTOSS 5 must implement DOD or other applicable U.S. Government agency-approved TLS encryption in the GnuTLS package.V-282527MEDIUMTOSS 5 must implement DOD or other applicable U.S. Government agency -approved encryption in the OpenSSL package.V-282528MEDIUMTOSS 5 must implement DOD or other applicable U.S. Government agency-approved TLS encryption in the OpenSSL package.V-282529LOWTOSS 5 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.V-282530MEDIUMTOSS 5 must produce audit records containing information to establish the identity of any individual or process associated with the event.V-282531MEDIUMTOSS 5 audit tools must have a mode of 0755 or less permissive.V-282532MEDIUMTOSS 5 audit tools must be owned by root.V-282533MEDIUMTOSS 5 audit tools must be group-owned by root.V-282534MEDIUMTOSS 5 must use cryptographic mechanisms to protect the integrity of audit tools.V-282535MEDIUMTOSS 5 system commands must have mode 755 or less permissive.V-282536MEDIUMTOSS 5 library directories must have mode 755 or less permissive.V-282537MEDIUMTOSS 5 library files must have mode 755 or less permissive.V-282538MEDIUMTOSS 5 system commands must be owned by root.V-282539MEDIUMTOSS 5 system commands must be group-owned by root or a system account.V-282540MEDIUMTOSS 5 library files must be owned by root.V-282541MEDIUMTOSS 5 library files must be group-owned by root or a system account.V-282542MEDIUMTOSS 5 library directories must be owned by root.V-282543MEDIUMTOSS 5 library directories must be group-owned by root or a system account.V-282544MEDIUMTOSS 5 must enforce password complexity by requiring at least one special character.V-282545MEDIUMThe TOSS 5 systemd-journald service must be enabled.V-282549MEDIUMTOSS 5 must securely compare internal information system clocks at least every 24 hours.V-282553MEDIUMTOSS 5 must enable kernel parameters to enforce discretionary access control on hardlinks.V-282554MEDIUMTOSS 5 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.V-282557HIGHThe systemd Ctrl-Alt-Delete burst key sequence in TOSS 5 must be disabled.V-282558HIGHThe x86 Ctrl-Alt-Delete key sequence must be disabled on TOSS 5.V-282559MEDIUMThe TOSS 5 debug-shell systemd service must be disabled.V-282560MEDIUMTOSS 5 must have the sudo package installed.V-282561MEDIUMTOSS 5 must audit uses of the execve system call.V-282562MEDIUMTOSS 5 must allocate audit record storage capacity to store at least one week's worth of audit records.V-282563MEDIUMTOSS 5 must be configured to off-load audit records onto a different system from the system being audited via syslog.V-282564MEDIUMTOSS 5 must authenticate the remote logging server for off-loading audit logs via rsyslog.V-282565MEDIUMTOSS 5 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.V-282566MEDIUMTOSS 5 must encrypt, via the gtls driver, the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.V-282567MEDIUMTOSS 5 must take appropriate action when the internal event queue is full.V-282568MEDIUMTOSS 5 audispd-plugins package must be installed.V-282569MEDIUMTOSS 5 must act when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.V-282570MEDIUMTOSS 5 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.V-282571MEDIUMTOSS 5 must act when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.V-282572MEDIUMTOSS 5 must act when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.V-282574MEDIUMTOSS 5 must have the chrony package installed.V-282575MEDIUMTOSS 5 chronyd service must be enabled.V-282578MEDIUMTOSS 5 must have the s-nail package installed.V-282579MEDIUMTOSS 5 must have the Advanced Intrusion Detection Environment (AIDE) package installed.V-282580MEDIUMTOSS 5 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.V-282581MEDIUMTOSS 5 SSH daemon must not allow Kerberos authentication.V-282582HIGHTOSS 5 must ensure cryptographic verification of vendor software packages.V-282583HIGHTOSS 5 must check the GPG signature of software packages originating from external software repositories before installation.V-282584HIGHTOSS 5 must check the GPG signature of locally installed software packages before installation.V-282585HIGHTOSS 5 must have GPG signature verification enabled for all software repositories.V-282586MEDIUMTOSS 5 subscription-manager package must be installed.V-282587MEDIUMTOSS 5 must mount /var/tmp with the nosuid option.V-282588MEDIUMTOSS 5 must disable the graphical user interface autorun function unless required.V-282589MEDIUMTOSS 5 fapolicy module must be installed.V-282590MEDIUMTOSS 5 must use the invoking user's password for privilege escalation when using sudo.V-282591MEDIUMTOSS 5 must have the pcsc-lite package installed.V-282592MEDIUMTOSS 5 must have the opensc package installed.V-282593MEDIUMTOSS 5 must have the USBGuard package installed.V-282594MEDIUMTOSS 5 must have the USBGuard package enabled.V-282595MEDIUMTOSS 5 must block unauthorized peripherals before establishing a connection.V-282597MEDIUMTOSS 5 must prohibit the use of cached authenticators after one day.V-282598MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.V-282599MEDIUMTOSS 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog.V-282601HIGHTOSS 5 must have the crypto-policies package installed.V-282602MEDIUMTOSS 5 crypto policy must not be overridden.V-282603MEDIUMTOSS 5 must implement a systemwide encryption policy.V-282605MEDIUMTOSS 5 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.V-282606MEDIUMAll TOSS 5 networked systems must have SSH installed.V-282607MEDIUMAll TOSS 5 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.V-282608MEDIUMTOSS 5 must implement DOD or other applicable U.S. Government agency-approved encryption in the bind package.V-282610MEDIUMTOSS 5 must implement nonexecutable data to protect its memory from unauthorized code execution.V-282611LOWTOSS 5 must remove all software components after updated versions have been installed.V-282613MEDIUMTOSS 5 must enable the "SELinux" targeted policy.V-282615HIGHTOSS 5 crypto policy files must match files shipped with the operating system.V-282616MEDIUMTOSS 5 must have the rsyslog package installed.V-282617MEDIUMTOSS 5 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.V-282618MEDIUMTOSS 5 must prevent the use of dictionary words for passwords.V-282619MEDIUMTOSS 5 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.V-282620MEDIUMTOSS 5 must disable virtual system calls.V-282621MEDIUMTOSS 5 must clear the page allocator to prevent use-after-free attacks.V-282622MEDIUMTOSS 5 must disable the kernel.core_pattern.V-282623HIGHTOSS 5 must be a vendor-supported release.V-282624MEDIUMTOSS 5 vendor packaged system security patches and updates must be installed and up to date.V-282625MEDIUMThe graphical display manager must not be the default target on TOSS 5 unless approved.V-282626LOWTOSS 5 must enable the hardware random number generator entropy gatherer service.V-282627MEDIUMTOSS 5 must disable the ability of systemd to spawn an interactive boot process.V-282628MEDIUMThe TOSS 5 /boot/grub2/grub.cfg file must be group owned by root.V-282629MEDIUMThe TOSS 5 /boot/grub2/grub.cfg file must be owned by root.V-282630MEDIUMTOSS 5 must prevent loading a new kernel for later execution.V-282631MEDIUMTOSS 5 must disable core dump backtraces.V-282632MEDIUMTOSS 5 must disable storing core dumps.V-282633MEDIUMTOSS 5 must disable acquiring, saving, and processing core dumps.V-282634MEDIUMTOSS 5 must not have the sendmail package installed.V-282635MEDIUMTOSS 5 must not have the quagga package installed.V-282636MEDIUMTOSS 5 must have the gnutls-utils package installed.V-282637MEDIUMTOSS 5 must have the nss-tools package installed.V-282638MEDIUMTOSS 5 must have the rng-tools package installed.V-282639MEDIUMTOSS 5 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.V-282640MEDIUMTOSS 5 must prevent special devices on file systems that are imported via Network File System (NFS).V-282641MEDIUMTOSS 5 cron configuration directories must have a mode of 0700 or less permissive.V-282642MEDIUMAll TOSS 5 local initialization files must have mode 0740 or less permissive.V-282643MEDIUMAll TOSS 5 local interactive user home directories must have mode 0770 or less permissive.V-282644MEDIUMThe TOSS 5 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.V-282645MEDIUMThe TOSS 5 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.V-282646MEDIUMThe TOSS 5 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access.V-282647MEDIUMThe TOSS 5 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access.V-282648MEDIUMThe TOSS 5 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.V-282649MEDIUMThe TOSS 5 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access.V-282650MEDIUMThe TOSS 5 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access.V-282651MEDIUMThe TOSS 5 /etc/group file must be owned by root.V-282652MEDIUMThe TOSS 5 /etc/group file must be group-owned by root.V-282653MEDIUMThe TOSS 5 /etc/group- file must be owned by root.V-282654MEDIUMThe TOSS 5 /etc/group- file must be group-owned by root.V-282655MEDIUMThe TOSS 5 /etc/gshadow file must be owned by root.V-282656MEDIUMThe TOSS 5 /etc/gshadow file must be group-owned by root.V-282657MEDIUMThe TOSS 5 /etc/gshadow- file must be owned by root.V-282658MEDIUMThe TOSS 5 /etc/gshadow- file must be group-owned by root.V-282659MEDIUMThe TOSS 5 /etc/passwd file must be owned by root.V-282660MEDIUMThe TOSS 5 /etc/passwd file must be group-owned by root.V-282661MEDIUMThe TOSS 5 /etc/passwd- file must be owned by root.V-282662MEDIUMThe TOSS 5 /etc/passwd- file must be group-owned by root.V-282663MEDIUMThe TOSS 5 /etc/shadow file must be owned by root.V-282664MEDIUMThe TOSS 5 /etc/shadow file must be group-owned by root.V-282665MEDIUMThe TOSS 5 /etc/shadow- file must be owned by root.V-282666MEDIUMThe TOSS 5 /etc/shadow- file must be group-owned by root.V-282667MEDIUMThe TOSS 5 cron configuration files directory must be owned by root.V-282668MEDIUMThe TOSS 5 cron configuration files directory must be group-owned by root.V-282669MEDIUMAll TOSS 5 world-writable directories must be owned by root, sys, bin, or an application user.V-282670MEDIUMAll TOSS 5 local files and directories must have a valid group owner.V-282671MEDIUMAll TOSS 5 local files and directories must have a valid owner.V-282672MEDIUMTOSS 5 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.V-282673MEDIUMTOSS 5 /etc/crontab file must have mode 0600.V-282674MEDIUMThe TOSS 5 /etc/shadow file must have mode 0000 to prevent unauthorized access.V-282675MEDIUMA TOSS 5 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.V-282676MEDIUMTOSS 5 network interfaces must not be in promiscuous mode.V-282677MEDIUMTOSS 5 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time (JIT) compiler.V-282678MEDIUMTOSS 5 systems using DNS resolution must have at least two name servers configured.V-282679MEDIUMTOSS 5 must configure a DNS processing mode set in Network Manager.V-282680MEDIUMTOSS 5 must not have unauthorized IP tunnels configured.V-282681MEDIUMTOSS 5 must be configured to prevent unrestricted mail relaying.V-282682HIGHIf the Trivial File Transfer Protocol (TFTP) server is required, TOSS 5 TFTP daemon must be configured to operate in secure mode.V-282683MEDIUMThe TOSS 5 libreswan package must be installed.V-282684HIGHThere must be no .shosts files on TOSS 5.V-282685MEDIUMTOSS 5 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.V-282686MEDIUMTOSS 5 must not forward Internet Protocol version 4 (IPv4) source-routed packets.V-282687MEDIUMTOSS 5 must log IPv4 packets with impossible addresses.V-282688MEDIUMTOSS 5 must log IPv4 packets with impossible addresses by default.V-282689MEDIUMTOSS 5 must use reverse path filtering on all IPv4 interfaces.V-282690MEDIUMTOSS 5 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted.V-282691MEDIUMTOSS 5 must not forward IPv4 source-routed packets by default.V-282692MEDIUMTOSS 5 must use a reverse-path filter for IPv4 network traffic when possible by default.V-282693MEDIUMTOSS 5 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.V-282694MEDIUMTOSS 5 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.V-282695MEDIUMTOSS 5 must not send Internet Control Message Protocol (ICMP) redirects.V-282696MEDIUMTOSS 5 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.V-282697MEDIUMTOSS 5 must not enable Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router.V-282698MEDIUMTOSS 5 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces.V-282699MEDIUMTOSS 5 must ignore Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages.V-282700MEDIUMTOSS 5 must not forward Internet Protocol version 6 (IPv6) source-routed packets.V-282701MEDIUMTOSS 5 must not enable Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router.V-282702MEDIUMTOSS 5 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces by default.V-282703MEDIUMTOSS 5 must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted.V-282704MEDIUMTOSS 5 must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.V-282705MEDIUMTOSS 5 must have the openssh-clients package installed.V-282706MEDIUMThe TOSS 5 SSH server configuration file must be group-owned by root.V-282707MEDIUMThe TOSS 5 SSH server configuration file must be owned by root.V-282708MEDIUMThe TOSS 5 SSH server configuration file must have mode 0600 or less permissive.V-282709MEDIUMTOSS 5 SSH private host key files must have mode 0640 or less permissive.V-282710MEDIUMTOSS 5 SSH public host key files must have mode 0644 or less permissive.V-282711MEDIUMThe TOSS 5 SSH daemon must not allow rhosts authentication.V-282712MEDIUMThe TOSS 5 SSH daemon must not allow known hosts authentication.V-282713MEDIUMThe TOSS 5 SSH daemon must perform strict mode checking of home directory configuration files.V-282714MEDIUMThe TOSS 5 SSH daemon must display the date and time of the last successful account logon upon an SSH logon.V-282715MEDIUMThe TOSS 5 effective dconf policy must match the policy keyfiles.V-282716MEDIUMTOSS 5 must disable the ability of a user to restart the system from the login screen.V-282717MEDIUMTOSS 5 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.V-282718MEDIUMTOSS 5 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.V-282719MEDIUMTOSS 5 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.V-282720MEDIUMTOSS 5 must disable the user list at logon for graphical user interfaces.V-282721MEDIUMAll TOSS 5 local interactive user accounts must be assigned a home directory upon creation.V-282722MEDIUMTOSS 5 must set the umask value to 077 for all local interactive user accounts.V-282723MEDIUMTOSS 5 system accounts must not have an interactive login shell.V-282724MEDIUMExecutable search paths within the initialization files of all local interactive TOSS 5 users must only contain paths that resolve to the system default or the users home directory.V-282725MEDIUMAll TOSS 5 local interactive users must have a home directory assigned in the /etc/passwd file.V-282726MEDIUMAll TOSS 5 local interactive user home directories defined in the /etc/passwd file must exist.V-282727MEDIUMAll TOSS 5 local interactive user home directories must be group-owned by the home directory owner's primary group.V-282728MEDIUMTOSS 5 must not have unauthorized accounts.V-282729HIGHThe root account must be the only account with unrestricted access to TOSS 5 system.V-282730MEDIUMLocal TOSS 5 initialization files must not execute world-writable programs.V-282731LOWTOSS 5 must display the date and time of the last successful account logon upon user logon.V-282732MEDIUMTOSS 5 must have policycoreutils package installed.V-282733MEDIUMTOSS 5 policycoreutils-python-utils package must be installed.V-282734MEDIUMTOSS 5 must require reauthentication when using the sudo command.V-282735MEDIUMTOSS 5 must require users to reauthenticate for privilege escalation.V-282736MEDIUMTOSS 5 must restrict privilege elevation to authorized personnel.V-282737HIGHTOSS 5 must not allow blank or null passwords.V-282738HIGHTOSS 5 must ensure the password complexity module is enabled in the system-auth file.V-282739MEDIUMTOSS 5 must require users to provide a password for privilege escalation.V-282740MEDIUMTOSS 5 must not be configured to bypass password requirements for privilege escalation.V-282741MEDIUMTOSS 5 must not have accounts configured with blank or null passwords.V-282742MEDIUMTOSS 5 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories.V-282743LOWTOSS 5 must be configured so that the file integrity tool verifies Access Control Lists (ACLs).V-282744LOWTOSS 5 must be configured so the file integrity tool verifies extended attributes.V-282745MEDIUMTOSS 5 must have the packages required for encrypting off-loaded audit logs installed.V-282746MEDIUMThe rsyslog service on TOSS 5 must be active.V-282747MEDIUMTOSS 5 must be configured so the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.V-282748MEDIUMTOSS 5 must use cron logging.V-282749MEDIUMThe TOSS 5 audit system must take appropriate action when an error writing to the audit storage volume occurs.V-282750MEDIUMThe TOSS 5 audit system must take appropriate action when the audit storage volume is full.V-282751MEDIUMThe TOSS 5 audit system must take appropriate action when the audit files have reached maximum size.V-282752MEDIUMTOSS 5 must write audit records to disk.V-282753MEDIUMTOSS 5 must define default permissions for the bash shell.V-282754MEDIUMTOSS 5 must define default permissions for the c shell.V-282755MEDIUMTOSS 5 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.V-282756MEDIUMTOSS 5 must define default permissions for the system default profile.V-282757HIGHTOSS 5 must not allow an unattended or automatic logon to the system.V-282758MEDIUMTOSS 5 must not allow users to override SSH environment variables.V-282759HIGHTOSS 5 must not allow unattended or automatic logon via the graphical user interface.V-282760MEDIUMAll TOSS local interactive user home directories must have mode 0770 or less permissive.V-282764MEDIUMTOSS 5 must, for password-based authentication, verify when users create or update passwords the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).V-282768MEDIUMTOSS 5 must accept only external credentials that are NIST compliant.V-282770MEDIUMTOSS 5 must include only approved trust anchors in trust stores or certificate stores managed by the organization.V-282771MEDIUMTOSS 5 must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.V-282772MEDIUMTOSS 5 must securely compare internal information system clocks at least every 24 hours.