Table 9-1 lists the vulnerabilities fixed by running the STIGfix script.
Table 9-1 List of Vulnerabilities Fixed by STIGfix Script
Vulnerability ID | Description |
---|---|
GEN000000_LNX00380 |
An Xserver must have none of the following options enabled: -ac, -core (except for debugging purposes), or -nolock. |
GEN000000-LNX00440 |
The /etc/security/access.conf file must have mode 0640 or less permissive. |
GEN000000-LNX00520 |
The /etc/sysctl.conf file must have mode 0600 or less permissive. |
GEN000000-LNX00580 |
The x86 CTRL-ALT-DELETE key sequence must be disabled. |
GEN000020 |
The system must require authentication upon booting into single-user and maintenance modes. (CCE-4241-6) |
GEN000252 |
The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive. |
GEN000290-2 |
The system must not have the unnecessary (news) account. |
GEN000290-3 |
The system must not have the unnecessary (gopher) account. |
GEN000290-4 |
The system must not have the unnecessary (ftp) account. |
GEN000460 |
The system must disable accounts after three consecutive unsuccessful login attempts. |
GEN000500_2 |
The graphical desktop environment must set the idle timeout to no more than 15 minutes. Note: You can ignore the Fail status on the Linux 6 operating system. |
GEN000500_3 |
Graphical desktop environments provided by the system must have automatic lock enabled. |
GEN000540 |
Users must not be able to change passwords more than once every 24 hours. |
GEN000560 |
The system must not have accounts configured with blank or null passwords. |
GEN000580 |
The system must require passwords contain a minimum of 14 characters. |
GEN000590 |
The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. |
GEN000600 |
The system must require passwords contain at least one uppercase alphabetic character. |
GEN000610 |
The system must require passwords contain at least one lowercase alphabetic character. |
GEN000620 |
The system must require passwords contain at least one numeric character. |
GEN000640 |
The system must require passwords contain at least one special character. |
GEN000680 |
The system must require passwords contain no more than three consecutive repeating characters. |
GEN000700 |
User passwords must be changed at least every 60 days. |
GEN000750 |
The system must require at least four characters be changed between the old and new passwords during a password change. |
GEN000800 |
The system must prohibit the reuse of passwords within five iterations. |
GEN000920 |
The root account's home directory (other than /) must have mode 0700. |
GEN000940 |
The root account's executable search path must be the vendor default and must contain only absolute paths. |
GEN000980 |
The system must prevent the root account from directly logging in except from the system console. |
GEN001120 |
The system must not permit root logins using remote access programs such as ssh. |
GEN001720 |
All global initialization files must have mode 0644 or less permissive. |
GEN002100 |
The rhosts file must not be supported in PAM. |
GEN002560 |
The system and user default umask must be 077. |
GEN003060 |
Default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file if the cron.allow file does not exist. |
GEN003080 |
Crontab files must have mode 0600 or less permissive and files in cron script directories must have mode 0700 or less. |
GEN003080-2 |
Files in cron script directories must have mode 0700 or less permissive. |
GEN003200 |
The cron.deny file must have mode 0600 or less permissive. |
GEN003320 |
Default system accounts (with the exception of root) must not be listed in the at.allow file or must be included in the at.deny file if the at.allow file does not exist. |
GEN003609 |
The system must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages. |
GEN003610 |
The system must not send IPv4 Internet Control Message Protocol (ICMP) redirects. |
GEN003740 |
The xinetd configuration files must have mode 0640 or less permissive. |
GEN003810 |
The portmap or rpcbind service must not be running unless needed. Note: You can ignore the Fail status on the Linux 6 operating system. |
GEN004000 |
The traceroute file must have mode 0700 or less permissive. |
GEN004540 |
The SMTP service HELP command must not be enabled. |
GEN004580 |
The system must not use forward files. |
GEN005040 |
All FTP users must have a default umask of 077. Note: You can ignore the Fail status on the Linux 6 operating system. |
GEN005320 |
The snmpd.conf file must have mode 0600 or less permissive. |
GEN005390 |
The /etc/syslog.conf file must have mode 0640 or less permissive. Note: You can ignore the Fail status on the Linux 6 operating system. |
GEN005501 |
The SSH client must be configured to only use the SSHv2 protocol. |
GEN005505 |
The SSH daemon must be configured to only use FIPS 140-2 approved ciphers. |
GEN005507 |
The SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms. |
GEN005550 |
The SSH daemon must be configured with the Department of Defense (DoD) logon banner. This file contains the banner message which will be displayed to any user accessing the hardened system. Users should modify this file to add their company policy or banner message before applying STIGfix. |
GEN007020 |
The Stream Control Transmission Protocol (SCTP) must be disabled unless required. |
GEN007080 |
The Datagram Congestion Control Protocol (DCCP) must be disabled unless required. |
GEN007480 |
The Reliable Datagram Sockets (RDS) protocol must be disabled or not installed unless required. |
GEN007540 |
The Transparent Inter-Process Communication (TIPC) protocol must be disabled or uninstalled. |
GEN007660 |
The Bluetooth protocol handler must be disabled or not installed. |
GEN008040 |
If the system is using LDAP for authentication or account information, the system must verify that the LDAP server's certificate has not been revoked. |
GEN008700 |
The system boot loader must require authentication. |
Parent topic: Hardening an Exalytics Machine