xccdf_org.open-scap_testresult_xccdf_hardpipe_profile_slmicro62_hardened

Guide to the Secure Configuration of SUSE Linux Enterprise Micro 6

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide

This guide presents a catalog of security-relevant configuration settings for SUSE Linux Enterprise Micro 6. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Evaluation Characteristics

Evaluation target	localhost
Benchmark URL	#scap_org.open-scap_comp_ssg-slmicro6-xccdf.xml
Benchmark ID	xccdf_org.ssgproject.content_benchmark_SLMICRO6
Benchmark version	0.1.81
Profile ID	xccdf_hardpipe_profile_slmicro62_hardened
Started at	2026-08-27T10:02:21+00:00
Finished at	2026-08-27T10:03:25+00:00
Performed by	root
Test system	cpe:/a:redhat:openscap:1.3.6

CPE Platforms

cpe:/o:suse:sl-micro:6.0
cpe:/o:suse:sl-micro:6.1

Addresses

IPv4 127.0.0.1
IPv4 192.168.77.27
IPv4 10.52.0.0
IPv4 192.168.77.78
MAC 00:00:00:00:00:00
MAC 52:54:00:16:75:F5
MAC EA:71:D6:BC:51:02
MAC EE:EE:EE:EE:EE:EE
MAC 76:90:D1:15:27:77

Compliance and Scoring

The target system did not satisfy the conditions of 6 rules! Furthermore, the results of 1 rules were inconclusive. Please review rule results and consider applying remediation.

Rule results

150 passed

6 failed

11 other

Severity of failed rules

0 other

1 low

4 medium

1 high

Score

Scoring system	Score	Maximum	Percent
urn:xccdf:scoring:default	97.237038	100.000000	97.24%

Rule Overview

Title	Severity	Result
Guide to the Secure Configuration of SUSE Linux Enterprise Micro 6 6x fail 1x error 10x notchecked
System Settings 6x fail 1x error 8x notchecked
Installing and Maintaining Software 4x fail 2x notchecked
System and Software Integrity 4x fail
Software Integrity Checking 4x fail
Verify Integrity with AIDE 4x fail
Install AIDE	medium	pass
Configure AIDE to Verify the Audit Tools	medium	fail
Configure Systemd Timer Execution of AIDE	medium	fail
Configure Notification of Post-AIDE Scan Details	medium	fail
Configure AIDE to Verify Access Control Lists (ACLs)	low	pass
Configure AIDE to Verify Extended Attributes	low	fail
Operating System Vendor Support and Certification
The Installed Operating System Is Vendor Supported	high	pass
Disk Partitioning 1x notchecked
Encrypt Partitions	high	notchecked
Sudo
Require Re-Authentication When Using the sudo Command	medium	pass
The operating system must restrict privilege elevation to authorized personnel	medium	pass
Ensure sudo only includes the default configuration directory	medium	pass
Updating Software 1x notchecked
Ensure gpgcheck Enabled In Main zypper Configuration	high	pass
Ensure Software Patches Installed ()	medium	notchecked
Account and Access Control 1x fail 1x error 3x notchecked
Warning Banners for System Accesses
Modify the System Login Banner	medium	pass
Protect Accounts by Configuring PAM 1x fail
Set Lockouts for Failed Password Attempts
Limit Password Reuse	medium	pass
Enforce Delay After Failed Logon Attempts	medium	pass
Set Password Hashing Algorithm 1x fail
Set Password Hashing Algorithm in /etc/login.defs	medium	pass
Set PAM Password Hashing Algorithm - system-auth	medium	pass
Set Password Hashing Rounds in /etc/login.defs	medium	fail
Protect Physical Console Access
Configure Screen Locking
Configure Console Screen Locking
Check that vlock is installed to allow session locking	medium	pass
Hardware Tokens for Authentication
Enable Smart Card Logins in PAM	medium	pass
Disable Ctrl-Alt-Del Reboot Activation	high	pass
Protect Accounts by Restricting Password-Based Login 1x error 2x notchecked
Set Account Expiration Parameters 2x notchecked
Set Account Expiration Following Inactivity	medium	pass
Never Automatically Remove or Disable Emergency Administrator Accounts	medium	notchecked
Assign Expiration Date to Temporary Accounts	medium	notchecked
Set Password Expiration Parameters
Set Password Maximum Age	medium	pass
Set Password Minimum Age	medium	pass
Set Existing Passwords Maximum Age	medium	pass
Set Existing Passwords Minimum Age	medium	pass
Verify Proper Storage and Existence of Password Hashes
Verify All Account Password Hashes are Shadowed with SHA512	medium	pass
Prevent Login to Accounts With Empty Password	high	pass
Ensure There Are No Accounts With Blank or Null Passwords	high	pass
Restrict Root Logins 1x error
Verify Only Root Has UID 0	high	pass
Ensure that System Accounts Do Not Run a Shell Upon Login	medium	error
Ensure All Accounts on the System Have Unique User IDs	medium	pass
Secure Session Configuration Files for Login Accounts 1x notchecked
Ensure that Users Have Sensible Umask Values
Ensure the Default Umask is Set Correctly in login.defs	medium	pass
Ensure Home Directories are Created for New Users	medium	pass
Ensure the Logon Failure Delay is Set Correctly in login.defs	medium	pass
Limit the Number of Concurrent Login Sessions Allowed Per User	low	pass
Set Interactive Session Timeout	medium	pass
User Initialization Files Must Not Run World-Writable Programs	medium	pass
Ensure that Users Path Contains Only Local Directories	medium	notchecked
All Interactive Users Must Have A Home Directory Defined	medium	pass
All Interactive Users Home Directories Must Exist	medium	pass
All Interactive User Home Directories Must Be Group-Owned By The Primary Group	medium	pass
Ensure All User Initialization Files Have Mode 0740 Or Less Permissive	medium	pass
All Interactive User Home Directories Must Have mode 0750 Or Less Permissive	medium	pass
Configure Syslog
systemd-journald
Enable systemd-journal-upload Service	medium	notapplicable
Network Configuration and Firewalls
firewalld
Inspect and Activate Default firewalld Rules
Verify firewalld Enabled	medium	notapplicable
IPv6
Configure IPv6 Settings if Necessary
Disable Accepting ICMP Redirects for All IPv6 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces	medium	pass
Disable Kernel Parameter for IPv6 Forwarding	medium	pass
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default	medium	pass
Disable Kernel Parameter for IPv6 Forwarding by default	medium	pass
Kernel Parameters Which Affect Networking
Network Related Kernel Runtime Parameters for Hosts and Routers
Disable Accepting ICMP Redirects for All IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default	medium	pass
Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces	medium	pass
Network Parameters for Hosts Only
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default	medium	pass
Wireless Networking
Disable Wireless Through Software Configuration
Deactivate Wireless Network Interfaces	medium	pass
Ensure System is Not Acting as a Network Sniffer	medium	pass
File Permissions and Masks 2x notchecked
Verify Permissions on Important Files and Directories
Verify Permissions on Files with Local Account Information and Credentials
Verify Permissions and Ownership of Old Passwords File	medium	pass
Verify File Permissions Within Some Important Directories
Verify that Shared Library Directories Have Root Group Ownership	medium	pass
Verify that Shared Library Directories Have Root Ownership	medium	pass
Verify that System Executable Directories Have Restrictive Permissions	medium	pass
Verify that Shared Library Directories Have Restrictive Permissions	medium	pass
Verify that system commands files are group owned by root or a system account	medium	pass
Verify that System Executables Have Root Ownership	medium	pass
Verify that Shared Library Files Have Root Ownership	medium	pass
Verify that System Executables Have Restrictive Permissions	medium	pass
Verify that Shared Library Files Have Restrictive Permissions	medium	pass
Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.	medium	pass
Ensure All World-Writable Directories Are Group Owned by a System Account	medium	pass
Verify that system commands directories have root as a group owner	medium	pass
Verify that system commands directories have root ownership	medium	pass
Restrict Dynamic Mounting and Unmounting of Filesystems
Disable Modprobe Loading of USB Storage Driver	medium	pass
Restrict Partition Mount Options
Add nosuid Option to Removable Media Partitions	medium	pass
Verify Permissions on Important Files and Directories Are Configured in /etc/permissions.local 2x notchecked
Verify that local /var/log/messages is not world-readable	medium	pass
Verify Permissions of Local Logs of audit Tools	medium	notchecked
Verify that Local Logs of the audit Daemon are not World-Readable	medium	notchecked
Restrict Programs from Dangerous Execution Patterns
Enable ExecShield
Enable Randomized Layout of Virtual Address Space	medium	pass
Restrict Access to Kernel Message Buffer	low	pass
SELinux 1x fail 1x notchecked
Install policycoreutils-python-utils package	medium	pass
Install policycoreutils Package	low	pass
Configure SELinux Policy	medium	pass
Ensure SELinux State is Enforcing	high	fail
Map System Users To The Appropriate SELinux Role	medium	notchecked
Services 1x notchecked
Base Services
Disable KDump Kernel Crash Analyzer (kdump)	medium	pass
Network Time Protocol
A remote time server for Chrony is configured	medium	notapplicable
Configure Time Service Maxpoll Interval	medium	notapplicable
Obsolete Services
Rlogin, Rsh, and Rexec
Remove Host-Based Authentication Files	high	pass
Remove User Host-Based Authentication Files	high	pass
Telnet
Uninstall telnet-server Package	high	pass
SSH Server 1x notchecked
Configure OpenSSH Server if Necessary
Set SSH Client Alive Count Max	medium	pass
Set SSH Client Alive Interval	medium	pass
Disable SSH Access via Empty Passwords	high	pass
Disable SSH Root Login	medium	pass
Disable SSH Support for User Known Hosts	medium	pass
Disable X11 Forwarding	medium	pass
Do Not Allow SSH Environment Options	medium	pass
Enable Use of Strict Mode Checking	medium	pass
Enable SSH Warning Banner	medium	pass
Enable SSH Print Last Log	medium	pass
Set SSH Daemon LogLevel to VERBOSE	medium	pass
Use Only FIPS 140-2 Validated Ciphers	medium	pass
Use Only FIPS 140-2 Validated Ciphers	medium	pass
Use Only FIPS 140-2 Validated Key Exchange Algorithms	medium	pass
Use Only FIPS 140-2 Validated MACs	medium	pass
Use Only FIPS 140-2 Validated MACs	medium	pass
Install the OpenSSH Server Package	medium	pass
Enable the OpenSSH Service	medium	pass
Verify Permissions on SSH Server Private *_key Key Files	medium	pass
Verify Permissions on SSH Server Public *.pub Key Files	medium	pass
OpenSSH Service Must Use Passcode for Their Private Keys	medium	notchecked
System Security Services Daemon
Configure SSSD's Memory Cache to Expire	medium	notapplicable
Configure SSSD to Expire Offline Credentials	medium	notapplicable
System Accounting with auditd 1x notchecked
Configure auditd Rules for Comprehensive Auditing
Record Events that Modify the System's Discretionary Access Controls
Record Events that Modify the System's Discretionary Access Controls - fchmod	medium	pass
Record Events that Modify the System's Discretionary Access Controls - fremovexattr	medium	pass
Record Events that Modify the System's Discretionary Access Controls - lchown	medium	pass
Record Events that Modify the System's Discretionary Access Controls - umount2	medium	pass
Record Execution Attempts to Run ACL Privileged Commands
Record Any Attempts to Run chacl	medium	pass
Record Any Attempts to Run chmod	medium	pass
Record Any Attempts to Run setfacl	medium	pass
Record Execution Attempts to Run SELinux Privileged Commands
Record Any Attempts to Run chcon	medium	pass
Record Any Attempts to Run rm	medium	pass
Record Any Attempts to Run semanage	medium	pass
Record Any Attempts to Run setfiles	medium	pass
Record Any Attempts to Run setsebool	medium	pass
Record Unauthorized Access Attempts Events to Files (unsuccessful)
Record Unsuccessful Access Attempts to Files - open	medium	pass
Record Unsuccessful Delete Attempts to Files - rename	medium	pass
Record Information on Kernel Modules Loading and Unloading
Ensure auditd Collects Information on Kernel Module Unloading - delete_module	medium	pass
Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module	medium	pass
Record Attempts to Alter Logon and Logout Events
Record Attempts to Alter Logon and Logout Events - lastlog	medium	pass
Record Attempts to Alter Logon and Logout Events - tallylog	medium	pass
Record Information on the Use of Privileged Commands
Ensure auditd Collects Information on the Use of Privileged Commands - chage	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - chfn	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - chsh	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - crontab	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - insmod	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - kmod	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - modprobe	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - passwd	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - rmmod	medium	pass
Record Any Attempts to Run ssh-agent	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - su	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - sudo	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd	medium	pass
Ensure auditd Collects Information on the Use of Privileged Commands - usermod	medium	pass
Ensure auditd Collects Information on Exporting to Media (successful)	medium	pass
Record Attempts to Alter Process and Session Initiation Information btmp	medium	pass
Record Attempts to Alter Process and Session Initiation Information utmp	medium	pass
Record Attempts to Alter Process and Session Initiation Information wtmp	medium	pass
Record Events When Privileged Executables Are Run	medium	pass
Ensure auditd Collects System Administrator Actions	medium	pass
Record Events that Modify User/Group Information - /etc/group	medium	pass
Record Events that Modify User/Group Information - /etc/security/opasswd	medium	pass
Record Events that Modify User/Group Information - /etc/passwd	medium	pass
Record Events that Modify User/Group Information - /etc/shadow	medium	pass
Configure auditd Data Retention 1x notchecked
Configure a Sufficiently Large Partition for Audit Logs	medium	notchecked
Configure auditd Disk Full Action when Disk Space Is Full	medium	pass
Configure auditd mail_acct Action on Low Disk Space	medium	pass
Configure auditd space_left Action on Low Disk Space	medium	pass
Configure auditd space_left on Low Disk Space	medium	pass
Ensure the audit Subsystem is Installed	medium	pass
Enable auditd Service	medium	pass

Result Details

Install AIDE

Rule ID	xccdf_org.ssgproject.content_rule_package_aide_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_aide_installed:def:1
Time	2026-08-27T10:02:21+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94712-7 References: 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000445-GPOS-00199, R76, R79, 1034, 1288, 1341, 1417, 11.5.2
Description	The `aide` package can be installed with the following command: $ sudo zypper install aide
Rationale	The AIDE package must be installed if it is to be available for integrity checking.

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
aide	x86_64	(none)	24.1	0.16	0:0.16-24.1	70af9e8139db7c82	aide-0:0.16-24.1.x86_64

Configure AIDE to Verify the Audit Tools

Rule ID xccdf_org.ssgproject.content_rule_aide_check_audit_tools

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-aide_check_audit_tools:def:1

Time 2026-08-27T10:02:21+00:00

Severity medium

Identifiers and References

Identifiers: CCE-94702-8

References: AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108

Description

The operating system file integrity tool must be configured to protect the integrity of the audit tools.

Rationale

Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit tools include but are not limited to vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	restrict

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base; then

zypper install -y "aide"










if grep -i -E '^.*(/usr)?/sbin/auditctl.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/auditd.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/ausearch.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/aureport.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/autrace.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/augenrules.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/audispd.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> /etc/aide.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Gather List of Packages
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  ansible.builtin.package_facts:
    manager: auto
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)

- name: Configure AIDE to Verify the Audit Tools - Ensure AIDE is Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Gather the Package Facts
  ansible.builtin.package_facts:
    manager: auto
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set "Configure AIDE to Verify the Audit Tools - audit_tools fact"
  ansible.builtin.set_fact:
    audit_tools:
    - /usr/sbin/audispd
    - /usr/sbin/auditctl
    - /usr/sbin/auditd
    - /usr/sbin/augenrules
    - /usr/sbin/aureport
    - /usr/sbin/ausearch
    - /usr/sbin/autrace
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Ensure Existing AIDE Configuration
    for Audit Tools are Correct
  ansible.builtin.lineinfile:
    path: /etc/aide.conf
    regexp: ^{{ item }}\s
    line: '{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512'
    create: true
  with_items: '{{ audit_tools }}'
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - '"aide" in ansible_facts.packages'
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Configure AIDE to Properly Protect
    Audit Tools
  ansible.builtin.lineinfile:
    path: /etc/aide.conf
    line: '{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512'
    create: true
  with_items: '{{ audit_tools }}'
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - '"aide" in ansible_facts.packages'
  tags:
  - CCE-94702-8
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
aide	x86_64	(none)	24.1	0.16	0:0.16-24.1	70af9e8139db7c82	aide-0:0.16-24.1.x86_64

auditctl is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

auditd is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditd:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

ausearch is checked in /etc/aide.conf oval:ssg-test_aide_verify_ausearch:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

aureport is checked in /etc/aide.conf oval:ssg-test_aide_verify_aureport:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

autrace is checked in /etc/aide.conf oval:ssg-test_aide_verify_autrace:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

audispd is checked in /etc/aide.conf oval:ssg-test_aide_verify_audispd:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_audispd:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/aide.conf	^(?:/usr)?/sbin/audispd\s+([^\n]+)$	1

augenrules is checked in /etc/aide.conf oval:ssg-test_aide_verify_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

Configure Systemd Timer Execution of AIDE

Rule ID xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-aide_periodic_checking_systemd_timer:def:1

Time 2026-08-27T10:02:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-94714-3

References: 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, R76, 11.5.2

Description

At a minimum, AIDE should be configured to run a weekly scan. To implement a systemd service and a timer unit to run the service periodically: For example, if a systemd timer is expected to be started every day at 5AM

OnCalendar=*-*-* 05:00:0

[Timer]

section in the timer unit and a Unit section starting the AIDE check service unit should be referred.

Rationale

AIDE provides a means to check if unauthorized changes are made to the system. AIDE itself does not setup a periodic execution, so in order to detect unauthorized changes a systemd service to run the check and a systemd timer to take care of periodical execution of that systemd service should be defined.

Remediation Shell script ⇲

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base && { ( ( rpm --quiet -q aide && rpm --quiet -q systemd ) ); }; then

zypper install -y "aide"

# create unit file for periodic aide database check
cat > /etc/systemd/system/aidecheck.service <<EOF
[Unit]
Description=Aide Check
[Service]
Type=simple
ExecStart=/usr/bin/aide --check
[Install]
WantedBy=multi-user.target
EOF

# create unit file for the aide check timer
cat > /etc/systemd/system/aidecheck.timer <<EOF
[Unit]
Description=Aide check every day at 5AM
[Timer]
OnCalendar=*-*-* 05:00:00
Unit=aidecheck.service
[Install]
WantedBy=multi-user.target
EOF

#  setup service unit files attributes
chown root:root /etc/systemd/system/aidecheck.*
chmod 0644 /etc/systemd/system/aidecheck.*

# enable the aide related services
systemctl daemon-reload
systemctl enable aidecheck.service
systemctl enable aidecheck.timer

if [[ $(systemctl is-system-running) != "offline" ]]; then
  systemctl start aidecheck.timer
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	configure

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-94714-3
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_checking_systemd_timer
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Systemd Timer Execution of AIDE - Define AIDE Periodic Check Service
  ansible.builtin.blockinfile:
    create: true
    dest: /etc/systemd/system/aidecheck.service
    owner: root
    group: root
    mode: '0644'
    block: |
      [Unit]
      Description=Aide Check
      [Service]
      Type=simple
      ExecStart=/usr/bin/aide --check
      [Install]
      WantedBy=multi-user.target
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - ( "aide" in ansible_facts.packages and "systemd" in ansible_facts.packages )
  tags:
  - CCE-94714-3
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_checking_systemd_timer
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Systemd Timer Execution of AIDE - Define AIDE Periodic Check Service
    Timer
  ansible.builtin.blockinfile:
    create: true
    dest: /etc/systemd/system/aidecheck.timer
    owner: root
    group: root
    mode: '0644'
    block: |
      [Unit]
      Description=Aide check every day at 5AM
      [Timer]
      OnCalendar=*-*-* 05:00:00
      Unit=aidecheck.service
      [Install]
      WantedBy=multi-user.target
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - ( "aide" in ansible_facts.packages and "systemd" in ansible_facts.packages )
  tags:
  - CCE-94714-3
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_checking_systemd_timer
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Systemd Timer Execution of AIDE - Ensure AIDE Service is Enabled
  ansible.builtin.systemd:
    name: aidecheck.service
    enabled: true
    daemon_reload: true
    masked: false
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - ( "aide" in ansible_facts.packages and "systemd" in ansible_facts.packages )
  - not ansible_check_mode
  tags:
  - CCE-94714-3
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_checking_systemd_timer
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Systemd Timer Execution of AIDE - Ensure AIDE Service Timer is Enabled
  ansible.builtin.systemd:
    name: aidecheck.timer
    state: started
    enabled: true
    daemon_reload: true
    masked: false
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - ( "aide" in ansible_facts.packages and "systemd" in ansible_facts.packages )
  - not ansible_check_mode
  tags:
  - CCE-94714-3
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_checking_systemd_timer
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
aide	x86_64	(none)	24.1	0.16	0:0.16-24.1	70af9e8139db7c82	aide-0:0.16-24.1.x86_64

systemd aidecheck.service enabled oval:ssg-tst_aidecheck-service_enabled:tst:1 false

Following items have been found on the system:

Unit	Property	Value
aidecheck.service	UnitFileState	static

systemd aidecheck.timer enabled oval:ssg-tst_aidecheck-timer_enabled:tst:1 true

Following items have been found on the system:

Unit	Property	Value
aidecheck.timer	UnitFileState	enabled

systemd aidecheck.timer active oval:ssg-tst_aidecheck-timer_active:tst:1 true

Following items have been found on the system:

Unit	Property	Value
aidecheck.timer	ActiveState	active

Configure Notification of Post-AIDE Scan Details

Rule ID xccdf_org.ssgproject.content_rule_aide_scan_notification

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-aide_scan_notification:def:1

Time 2026-08-27T10:02:22+00:00

Severity medium

Identifiers and References

Identifiers: CCE-94730-9

References: 1, 11, 12, 13, 15, 16, 2, 3, 5, 7, 8, 9, BAI01.06, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, 4.3.4.3.2, 4.3.4.3.3, SR 6.2, SR 7.6, A.12.1.2, A.12.4.1, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, CM-6(a), CM-3(5), DE.CM-1, DE.CM-7, PR.IP-1, PR.IP-3, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, R76

Description

AIDE should notify appropriate personnel of the details of a scan after the scan has been run. If AIDE has already been configured for periodic execution in /etc/crontab, append the following line to the existing AIDE line:

 | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost

Otherwise, add the following line to /etc/crontab:

05 4 * * * root /usr/bin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost

AIDE can be executed periodically through other means; this is merely one example.

Rationale

Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.

Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.

Remediation Shell script ⇲

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base; then

zypper install -y "aide"
var_aide_scan_notification_email='root@localhost'



# create unit file for periodic aide database check
cat > /etc/systemd/system/aidecheck.service <<CHECKEOF
[Unit]
        Description=Aide Check
        Before=aidecheck-notify.service
        Wants=aidecheck-notify.service
        [Service]
        Type=forking
        ExecStart=/usr/bin/aide --check -r file:/tmp/aide-report.log
        [Install]
        WantedBy=multi-user.target
CHECKEOF
cat > /etc/systemd/system/aidecheck-notify.service <<NOTIFYEOF
[Unit]
        Description=Status email for AIDE check result
        After=aidecheck.service
        [Service]
        Type=forking
        ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  $var_aide_scan_notification_email'
NOTIFYEOF

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-94730-9
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_aide_scan_notification_email # promote to variable
  set_fact:
    var_aide_scan_notification_email: !!str root@localhost
  tags:
    - always

- name: Configure Notification of Post-AIDE Scan Details - Ensure AIDE is installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94730-9
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Notification of Post-AIDE Scan Details - Check Service
  ansible.builtin.blockinfile:
    create: true
    dest: /etc/systemd/system/aidecheck.service
    owner: root
    group: root
    mode: '0644'
    block: |
      [Unit]
      Description=Aide Check
      Before=aidecheck-notify.service
      Wants=aidecheck-notify.service
      [Service]
      Type=forking
      ExecStart=/usr/bin/aide --check -r file:/tmp/aide-report.log
      [Install]
      WantedBy=multi-user.target
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94730-9
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Notification of Post-AIDE Scan Details - Notify Service
  ansible.builtin.blockinfile:
    create: true
    dest: /etc/systemd/system/aidecheck-notify.service
    owner: root
    group: root
    mode: '0644'
    block: |
      [Unit]
      Description=Status email for AIDE check result
      After=aidecheck.service
      [Service]
      Type=forking
      ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check"  {{ var_aide_scan_notification_email }}'
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94730-9
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
aide	x86_64	(none)	24.1	0.16	0:0.16-24.1	70af9e8139db7c82	aide-0:0.16-24.1.x86_64

notify personnel when aide completes oval:ssg-test_aide_scan_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_test_aide_scan_notification:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/crontab	^./usr/bin/aide[\s]\-\-check.\\|./bin/mail[\s]-s[\s]"."[\s].+@.+$	1

notify personnel when aide completes oval:ssg-test_aide_var_cron_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_var_cron_notification:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/var/spool/cron/root	^./usr/bin/aide[\s]\-\-check.\\|./bin/mail[\s]-s[\s]"."[\s].+@.+$	1

notify personnel when aide completes in cron.(daily|weekly|monthly) oval:ssg-test_aide_crontabs_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_crontabs_notification:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
^/etc/cron.(d\|daily\|weekly\|monthly)$	^.*$	^./usr/bin/aide[\s]\-\-check.\\|./bin/mail[\s]-s[\s]"."[\s].+@.+$	1

aide check is run before notification service oval:ssg-test_aidecheck_systemd_scan_before_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_aidecheck_systemd_before_notification:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/systemd/system/aidecheck.service	^.Before\=.aidecheck-notify.service.*$	1

aide check systemd unit wants notification service oval:ssg-test_aidecheck_systemd_scan_wants_notification:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_aidecheck_for_notification_enabled:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/systemd/system/aidecheck.service	^.Wants\=.aidecheck-notify.service.*$	1

report results of aide check, when started by systemd oval:ssg-test_aidecheck_systemd_scan_report:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_aidecheck_systemd_report:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/systemd/system/aidecheck.service	^.ExecStart\=./usr/bin/aide[\s]\-\-check.\-r\sfile:\/w.*$	1

Configure AIDE to Verify Access Control Lists (ACLs)

Rule ID	xccdf_org.ssgproject.content_rule_aide_verify_acls
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-aide_verify_acls:def:1
Time	2026-08-27T10:02:22+00:00
Severity	low
Identifiers and References	Identifiers: CCE-95052-7 References: 2, 3, APO01.06, BAI03.05, BAI06.01, DSS06.02, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, A.11.2.4, A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, A.14.2.4, SI-7, SI-7(1), CM-6(a), PR.DS-6, PR.DS-8, SRG-OS-000480-GPOS-00227, R76
Description	By default, the `acl` option is added to the `FIPSR` ruleset in AIDE. If using a custom ruleset or the `acl` option is missing, add `acl` to the appropriate ruleset. For example, add `acl` to the following line in `/etc/aide.conf`: FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256 AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds `acl` to all rule sets available in `/etc/aide.conf`
Rationale	ACLs can provide permissions beyond those permitted through the file mode and must be verified by the file integrity tools.

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
aide	x86_64	(none)	24.1	0.16	0:0.16-24.1	70af9e8139db7c82	aide-0:0.16-24.1.x86_64

acl is set in /etc/aide.conf oval:ssg-test_aide_verify_acls:tst:1 true

Following items have been found on the system:

Path	Content
/etc/aide.conf	FIPSR = p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/etc/aide.conf	NORMAL = p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/etc/aide.conf	DIR = p+i+n+u+g+acl+selinux+xattrs
/etc/aide.conf	PERMS = p+u+g+acl+selinux

Configure AIDE to Verify Extended Attributes

Rule ID xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-aide_verify_ext_attributes:def:1

Time 2026-08-27T10:02:22+00:00

Severity low

Identifiers and References

Identifiers: CCE-95053-5

References: 2, 3, APO01.06, BAI03.05, BAI06.01, DSS06.02, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, A.11.2.4, A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, A.14.2.4, SI-7, SI-7(1), CM-6(a), PR.DS-6, PR.DS-8, SRG-OS-000480-GPOS-00227, R76

Description

By default, the xattrs option is added to the FIPSR ruleset in AIDE. If using a custom ruleset or the xattrs option is missing, add xattrs to the appropriate ruleset. For example, add xattrs to the following line in /etc/aide.conf:

FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256

AIDE rules can be configured in multiple ways; this is merely one example that is already configured by default. The remediation provided with this rule adds xattrs to all rule sets available in /etc/aide.conf

Rationale

Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.

Remediation Shell script ⇲

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base; then

zypper install -y "aide"

aide_conf="/etc/aide.conf"


groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u)


for group in $groups
do
	config=$(grep "^$group\s*=" $aide_conf | cut -f2 -d '=' | tr -d ' ')

	if ! [[ $config = *xattrs* ]]
	then
		if [[ -z $config ]]
		then
			config="xattrs"
		else
			config=$config"+xattrs"
		fi
	fi
	sed -i "s/^$group\s*=.*/$group = $config/g" $aide_conf
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-95053-5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Gather list of packages
  ansible.builtin.package_facts:
    manager: auto
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-95053-5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get rules groups
  ansible.builtin.shell: |
    set -o pipefail
    LC_ALL=C grep "^[A-Z][A-Za-z_]*" /etc/aide.conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u || true
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - '''aide'' in ansible_facts.packages'
  register: find_rules_groups_results
  changed_when: false
  check_mode: false
  tags:
  - CCE-95053-5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the xattrs rule is present when aide is installed.
  ansible.builtin.replace:
    path: /etc/aide.conf
    regexp: (^\s*{{ item }}\s*=\s*)(?!.*xattrs)([^\s]*)
    replace: \g<1>\g<2>+xattrs
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"
  with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list }}'
  tags:
  - CCE-95053-5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

OVAL test results details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
aide	x86_64	(none)	24.1	0.16	0:0.16-24.1	70af9e8139db7c82	aide-0:0.16-24.1.x86_64

xattrs is set in /etc/aide.conf oval:ssg-test_aide_verify_ext_attributes:tst:1 false

Following items have been found on the system:

Path	Content
/etc/aide.conf	FIPSR = p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/etc/aide.conf	NORMAL = p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/etc/aide.conf	DIR = p+i+n+u+g+acl+selinux+xattrs
/etc/aide.conf	PERMS = p+u+g+acl+selinux

The Installed Operating System Is Vendor Supported

Rule ID	xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-installed_OS_is_vendor_supported:def:1
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95035-2 References: 18, 20, 4, APO12.01, APO12.02, APO12.03, APO12.04, BAI03.10, DSS05.01, DSS05.02, 4.2.3, 4.2.3.12, 4.2.3.7, 4.2.3.9, A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.3, CM-6(a), MA-6, SA-13(a), ID.RA-1, PR.IP-12, SRG-OS-000480-GPOS-00227
Description	The installed operating system must be maintained by a vendor. SUSE Linux Enterprise is supported by SUSE. As the SUSE Linux Enterprise vendor, SUSE is responsible for providing security patches.
Rationale	An operating system is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve any security issue discovered in the system software.
Warnings	warning There is no remediation besides switching to a different operating system.

OVAL test results details

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

/etc/almalinux-release exists oval:ssg-test_almalinux:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_almalinux:obj:1 of type file_object

Filepath
/etc/almalinux-release

Check Custom OS version oval:ssg-test_almalinux9:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_almalinux9:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/almalinux-release	^AlmaLinux release 9.[0-9]+ .*$	1

installed OS part of unix family oval:ssg-test_rhel8_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 8 oval:ssg-test_rhel8:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel8:obj:1 of type rpminfo_object

Name
redhat-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 8 oval:ssg-test_ol8_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol8_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 8 oval:ssg-test_rhevh_rhel8_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel8_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

installed OS part of unix family oval:ssg-test_rhel9_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 9 oval:ssg-test_rhel9:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel9:obj:1 of type rpminfo_object

Name
redhat-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 9 oval:ssg-test_ol9_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol9_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 9 oval:ssg-test_rhevh_rhel9_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel9_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

installed OS part of unix family oval:ssg-test_rhel10_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

redhat-release is version 10 oval:ssg-test_rhel10:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel10:obj:1 of type rpminfo_object

Name
redhat-release

redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object

Name
redhat-release-virtualization-host

RHEVH base RHEL is version 10 oval:ssg-test_rhevh_rhel10_version:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhevh_rhel10_version:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/redhat-release	^Red Hat Enterprise Linux release (\d)\.\d+$	1

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

hummingbird-release RPM packages are installed oval:ssg-test_hummingbird_release_rpm:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_hummingbird_release_rpm:obj:1 of type rpminfo_object

Name
hummingbird-release.*

CPE vendor is 'redhat' and 'product' is hummingbird oval:ssg-test_hummingbird_vendor_product:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_hummingbird_vendor_product:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/system-release-cpe	^cpe:\/a:redhat:hummingbird:[\d]+$	1

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 7 oval:ssg-test_ol7_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol7_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 8 oval:ssg-test_ol8_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol8_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

oraclelinux-release is version 9 oval:ssg-test_ol9_system:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ol9_system:obj:1 of type rpminfo_object

Name
oraclelinux-release

installed OS part of unix family oval:ssg-test_sle12_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sled-release is version 6 oval:ssg-test_sle12_desktop:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_desktop:obj:1 of type rpminfo_object

Name
sled-release

sles-release is version 6 oval:ssg-test_sle12_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle12_server:obj:1 of type rpminfo_object

Name
sles-release

SLES_SAP-release is version 12 oval:ssg-test_sles_12_for_sap:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sles_12_for_sap:obj:1 of type rpminfo_object

Name
SLES_SAP-release

installed OS part of unix family oval:ssg-test_sle15_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sled-release is version 15 oval:ssg-test_sle15_desktop:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_desktop:obj:1 of type rpminfo_object

Name
sled-release

sles-release is version 15 oval:ssg-test_sle15_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle15_server:obj:1 of type rpminfo_object

Name
sles-release

SLES_SAP-release is version 15 oval:ssg-test_sles_15_for_sap:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sles_15_for_sap:obj:1 of type rpminfo_object

Name
SLES_SAP-release

SUMA is version 4 oval:ssg-test_suma_4:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_suma_4:obj:1 of type rpminfo_object

Name
SUSE-Manager-Server-release

SLE HPC release is version 15 oval:ssg-test_sle_hpc:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle_hpc:obj:1 of type rpminfo_object

Name
SLE_HPC-release

installed OS part of unix family oval:ssg-test_sle16_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

SLES-release is version 16 oval:ssg-test_sle16_server:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sle16_server:obj:1 of type rpminfo_object

Name
SLES-release

SLES_SAP-release is version 16 oval:ssg-test_sles_16_for_sap:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sles_16_for_sap:obj:1 of type rpminfo_object

Name
SLES_SAP-release

sle-ha-release is version 16 oval:ssg-test_sles_16_for_ha:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_sles_16_for_ha:obj:1 of type rpminfo_object

Name
sle-ha-release

installed OS part of unix family oval:ssg-test_slmicro5_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sle-micro-release is version 5 oval:ssg-test_slmicroos5:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_slmicroos5:obj:1 of type rpminfo_object

Name
SUSE-MicroOS-release

sle-micro-release is version 5 oval:ssg-test_slmicro5:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_slmicro5:obj:1 of type rpminfo_object

Name
SLE-Micro-release

installed OS part of unix family oval:ssg-test_slmicro6_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

installed OS part of unix family oval:ssg-test_slmicro6_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sle-micro-release is version 6 oval:ssg-test_slmicro6:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
SL-Micro-release	x86_64	(none)	160000.18.1	6.2	0:6.2-160000.18.1	fec28eaf09d9ea69	SL-Micro-release-0:6.2-160000.18.1.x86_64

sle-micro-release is version 6 oval:ssg-test_slmicro6:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
SL-Micro-release	x86_64	(none)	160000.18.1	6.2	0:6.2-160000.18.1	fec28eaf09d9ea69	SL-Micro-release-0:6.2-160000.18.1.x86_64

installed OS part of unix family oval:ssg-test_slmicro6_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

installed OS part of unix family oval:ssg-test_slmicro6_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

sle-micro-release is version 6 oval:ssg-test_slmicro6:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
SL-Micro-release	x86_64	(none)	160000.18.1	6.2	0:6.2-160000.18.1	fec28eaf09d9ea69	SL-Micro-release-0:6.2-160000.18.1.x86_64

sle-micro-release is version 6 oval:ssg-test_slmicro6:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
SL-Micro-release	x86_64	(none)	160000.18.1	6.2	0:6.2-160000.18.1	fec28eaf09d9ea69	SL-Micro-release-0:6.2-160000.18.1.x86_64

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_lsb:obj:1 of type file_object

Filepath
/etc/lsb-release

Check Ubuntu oval:ssg-test_ubuntu:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/lsb-release	^DISTRIB_ID=Ubuntu$	1

Check Ubuntu version oval:ssg-test_ubuntu_jammy:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ubuntu_jammy:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/lsb-release	^DISTRIB_CODENAME=jammy$	1

Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true

Following items have been found on the system:

Family
unix

/etc/lsb-release exists oval:ssg-test_lsb:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_lsb:obj:1 of type file_object

Filepath
/etc/lsb-release

Check Ubuntu oval:ssg-test_ubuntu:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ubuntu:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/lsb-release	^DISTRIB_ID=Ubuntu$	1

Check Ubuntu version oval:ssg-test_ubuntu_noble:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_ubuntu_noble:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/lsb-release	^DISTRIB_CODENAME=noble$	1

Encrypt Partitions

Rule ID	xccdf_org.ssgproject.content_rule_encrypt_partitions
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-94686-3 References: 13, 14, APO01.06, BAI02.01, BAI06.01, DSS04.07, DSS05.03, DSS05.04, DSS05.07, DSS06.02, DSS06.06, 3.13.16, 164.308(a)(1)(ii)(D), 164.308(b)(1), 164.310(d), 164.312(a)(1), 164.312(a)(2)(iii), 164.312(a)(2)(iv), 164.312(b), 164.312(c), 164.314(b)(2)(i), 164.312(d), SR 3.4, SR 4.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4.2, CIP-007-3 R5.1, CM-6(a), SC-28, SC-28(1), SC-13, AU-9(3), PR.DS-1, PR.DS-5, SRG-OS-000405-GPOS-00184, SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183
Description	SUSE Linux Enterprise Micro 6 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time. For manual installations, select the `Encrypt` checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots. Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on the SUSE Linux Enterprise Micro 6 Documentation web site: https://documentation.suse.com/sle-micro/6.0/html/Micro-deployment-raw-images/index.html#deployment-jeos-firstboot .
Rationale	The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost.
Evaluation messages info No candidate or applicable check found.

Require Re-Authentication When Using the sudo Command

Rule ID	xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sudo_require_reauthentication:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94719-2 References: IA-11, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, 2.2.6, 2.2
Description	The sudo `timestamp_timeout` tag sets the amount of time sudo password prompt waits. The default `timestamp_timeout` value is 5 minutes. The timestamp_timeout should be configured by making sure that the `timestamp_timeout` tag exists in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`. If the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.
Rationale	Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.

OVAL test results details

check correct configuration in /etc/sudoers oval:ssg-test_sudo_timestamp_timeout:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sudoers.d/90-hardpipe-cis	Defaults timestamp_timeout=5

check correct configuration in /etc/sudoers oval:ssg-test_sudo_timestamp_timeout_no_signs:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_sudo_timestamp_timeout_no_signs:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^\/etc\/(sudoers\|sudoers\.d\/.*)$	^[\s]Defaults[\s]+timestamp_timeout[\s]=\s[\-](\d\.\d+\|\d+\.\d*\|\d+)$	1

The operating system must restrict privilege elevation to authorized personnel

Rule ID	xccdf_org.ssgproject.content_rule_sudo_restrict_privilege_elevation_to_authorized
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sudo_restrict_privilege_elevation_to_authorized:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95042-8 References: CM-6(b), CM-6(iv), SRG-OS-000480-GPOS-00227
Description	The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. Restrict privileged actions by removing the following entries from the sudoers file: `ALL ALL=(ALL) ALL` `ALL ALL=(ALL:ALL) ALL`
Rationale	If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.
Warnings	warning This rule doesn't come with a remediation, as the exact requirement allows exceptions, and removing lines from the sudoers file can make the system non-administrable.

OVAL test results details

Make sure that sudoers has restrictions on which users can run sudo oval:ssg-test_not_all_users_can_sudo_to_users:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sudoers_cfg_spec_all_users:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/sudoers(\.d/.*)?$	^\sALL\s+ALL\=$ALL$\s+ALL\s$	1

Make sure that sudoers has restrictions on which users can run sudo oval:ssg-test_not_all_users_can_sudo_to_group:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sudoers_cfg_spec_all_group:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/sudoers(\.d/.*)?$	^\sALL\s+ALL\=$ALL\:ALL$\s+ALL\s	1

Ensure sudo only includes the default configuration directory

Rule ID	xccdf_org.ssgproject.content_rule_sudoers_default_includedir
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sudoers_default_includedir:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95040-2 References: SRG-OS-000480-GPOS-00227
Description	Administrators can configure authorized `sudo` users via drop-in files, and it is possible to include other directories and configuration files from the file currently being parsed. Make sure that `/etc/sudoers` only includes drop-in configuration files from `/etc/sudoers.d`, or that no drop-in file is included. Either the `/etc/sudoers` should contain only one `#includedir` directive pointing to `/etc/sudoers.d`, and no file in `/etc/sudoers.d/` should include other files or directories; Or the `/etc/sudoers` should not contain any `#include`, `@include`, `#includedir` or `@includedir` directives. Note that the '#' character doesn't denote a comment in the configuration file.
Rationale	Some `sudo` configuration options allow users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.

OVAL test results details

test none sudoers #include or @include oval:ssg-test_sudoers_without_include:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sudoers_without_include:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/sudoers	^[#@]include[\s]+.*$	1

test none sudoers #includedir or @includdir oval:ssg-test_sudoers_without_includedir:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sudoers	#includedir /etc/sudoers.d

test only one sudoers #includedir oval:ssg-test_sudoers_default_includedir:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sudoers	#includedir /etc/sudoers.d

test none sudoers #include or @include oval:ssg-test_sudoers_without_include:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sudoers_without_include:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/sudoers	^[#@]include[\s]+.*$	1

test none sudoers @includedir oval:ssg-test_sudoers_without_includedir_new:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sudoers_without_include_new:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/sudoers	^@includedir[\s]+.*$	1

test none sudoers.d #include, @include, #includedir or @includedir oval:ssg-test_sudoersd_without_includes:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sudoersd_without_includes:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/sudoers.d/	.*	^[#@]include(?:dir)?[\s]+.*$	1

Ensure gpgcheck Enabled In Main zypper Configuration

Rule ID	xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-ensure_gpgcheck_globally_activated:def:1
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-94715-0 References: 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, R59, 1493, 6.3.3, 6.3
Description	The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure zypper to check package signatures before installing them, ensure the following line appears in `/etc/zypp/zypp.conf` in the `[main]` section: gpgcheck=1
Rationale	Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).

OVAL test results details

check value of gpgcheck in /etc/zypp/zypp.conf oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1 true

Following items have been found on the system:

Path	Content
/etc/zypp/zypp.conf	gpgcheck = 1

no value 0 set in /etc/zypp/zypp.conf oval:ssg-test_ensure_gpgcheck_globally_no_deactivated:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_test_ensure_gpgcheck_globally_no_deactivated:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/zypp/zypp.conf	^\sgpgcheck\s=\s(0\|off\|no\|false)\s$	0

Ensure Software Patches Installed

Rule ID	xccdf_org.ssgproject.content_rule_security_patches_up_to_date
Result	notchecked
Multi-check rule	yes
OVAL Definition ID
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95036-0 References: 18, 20, 4, 5.10.4.1, APO12.01, APO12.02, APO12.03, APO12.04, BAI03.10, DSS05.01, DSS05.02, 4.2.3, 4.2.3.12, 4.2.3.7, 4.2.3.9, A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.3, SI-2(5), SI-2(c), CM-6(a), ID.RA-1, PR.IP-12, FMT_MOF_EXT.1, Req-6.2, SRG-OS-000480-GPOS-00227, R61, 1409, 6.3.3, 6.3
Description	If the system is configured for online updates, invoking the following command will list available security updates: $ sudo zypper refresh && sudo zypper list-patches -g security NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy dictates.
Rationale	Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.
Warnings	warning The OVAL feed of SUSE Linux Enterprise Micro 6 is not a XML file, which may not be understood by all scanners.
Evaluation messages info None of the check-content-ref elements was resolvable.

Modify the System Login Banner

Rule ID	xccdf_org.ssgproject.content_rule_banner_etc_issue
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-banner_etc_issue:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94665-7 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.9, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-8(a), AC-8(c), PR.AC-7, SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088
Description	To configure the system login banner edit `/etc/issue`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. OR: `I've read & consent to terms in IS user agreem't.`
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.

OVAL test results details

correct banner in /etc/issue oval:ssg-test_banner_etc_issue:tst:1 true

Following items have been found on the system:

Path	Content
/etc/issue	Authorized users only. All activity may be monitored and reported.

Limit Password Reuse

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_password_pam_pwhistory_remember:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94641-8 References: SRG-OS-000077-GPOS-00045
Description	Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM modules. In the file `/etc/pam.d/common-password`, make sure the parameters `remember` and `use_authtok` are present, and that the value for the `remember` parameter is 5 or greater. For example: password requisite pam_pwhistory.so ...existing_options... remember=5 use_authtok The profile requirement is 5 passwords.
Rationale	Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user.

OVAL test results details

Verify remember configuation of pam_pwhistory.so oval:ssg-test_pam_password_pam_pwhistory_remember:tst:1 true

Following items have been found on the system:

Path	Content
/etc/pam.d/common-password	password requisite pam_pwhistory.so remember=5 use_authtok enforce_for_root

Verify use_authtok configuation of pam_pwhistory.so oval:ssg-test_pam_password_pam_pwhistory_use_authtok:tst:1 true

Following items have been found on the system:

Path	Content
/etc/pam.d/common-password	password requisite pam_pwhistory.so remember=5 use_authtok enforce_for_root # Final password module password required pam_unix.so use_authtok sha512 shadow

Enforce Delay After Failed Logon Attempts

Rule ID	xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faildelay_delay
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_passwords_pam_faildelay_delay:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94742-4 References: SRG-OS-000480-GPOS-00226
Description	To configure the system to introduce a delay after failed logon attempts, add or correct the `pam_faildelay` settings in `/etc/pam.d/common-auth` to make sure its `delay` parameter is at least 4000000 or greater. For example: auth required pam_faildelay.so delay=4000000
Rationale	Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain access to an account.

OVAL test results details

Verify delay configuation of pam_faildelay.so oval:ssg-test_pam_auth_pam_faildelay_delay:tst:1 true

Following items have been found on the system:

Path	Content
/etc/pam.d/common-auth	auth required pam_faildelay.so delay=4000000 #

Set Password Hashing Algorithm in /etc/login.defs

Rule ID	xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-set_password_hashing_algorithm_logindefs:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	References: 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(c), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041, 0418, 1055, 1402, 8.3.2, 8.3
Description	In `/etc/login.defs`, add or update the following line to ensure the system will use SHA512 as the hashing algorithm: ENCRYPT_METHOD SHA512
Rationale	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. Using a stronger hashing algorithm makes password cracking attacks more difficult.

OVAL test results details

Check ENCRYPT_METHOD in /etc/login.defs.d/oscap.login.defs is not set oval:ssg-test_password_hashing_algorithm_drop_in_path_not_set:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_password_hashing_algorithm_drop_in_path_not_set:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/login.defs.d	.*\.defs$	^\sENCRYPT_METHOD\s	1

The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs oval:ssg-test_password_hashing_algorithm_logindefs:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-local_variable_test_password_hashing_algorithm_logindefs:var:1	SHA512

The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs.d oval:ssg-test_password_hashing_algorithm_logindefs_drop_in_path:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-variable_object_test_password_hashing_algorithm_logindefs_drop_in_path:obj:1 of type variable_object

Var ref
oval:ssg-local_variable_test_password_hashing_algorithm_logindefs_drop_in_path:var:1

Set PAM Password Hashing Algorithm - system-auth

Rule ID	xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-set_password_hashing_algorithm_systemauth:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94659-0 References: 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(c), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061, R68, 0418, 1055, 1402, 8.3.2, 8.3
Description	The PAM system service can be configured to only store encrypted representations of passwords. In "/etc/pam.d/common-password", the `password` section of the file controls which PAM modules to execute during a password change. Set the `pam_unix.so` module in the `password` section to include the option `sha512` and no other hashing algorithms as shown below: password required pam_unix.so sha512 other arguments... This will help ensure that new passwords for local users will be stored using the sha512 algorithm.
Rationale	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option in `/etc/libuser.conf` ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Warnings	warning The hashing algorithms to be used with pam_unix.so are defined with independent module options. There are at least 7 possible algorithms and likely more algorithms will be introduced along the time. Due the the number of options and its possible combinations, the use of multiple hashing algorithm options may bring unexpected behaviors to the system. For this reason the check will pass only when one hashing algorithm option is defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The remediation will ensure the correct option and remove any other extra hashing algorithm option.

OVAL test results details

check if pam_unix.so hashing algorithm option is correct and specified only once in /etc/pam.d/common-password oval:ssg-test_pam_unix_hashing_algorithm_systemauth:tst:1 true

Following items have been found on the system:

Path	Content
/etc/pam.d/common-password	password required pam_unix.so use_authtok sha512 shadow

Set Password Hashing Rounds in /etc/login.defs

Rule ID xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-set_password_hashing_min_rounds_logindefs:def:1

Time 2026-08-27T10:02:23+00:00

Severity medium

Identifiers and References

Identifiers: CCE-94660-8

References: SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061

Description

In /etc/login.defs, ensure SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS has the minimum value of 100000. For example:

SHA_CRYPT_MIN_ROUNDS 100000
SHA_CRYPT_MAX_ROUNDS 100000

Notice that if neither are set, they already have the default value of 5000. If either is set, they must have the minimum value of 100000.

Rationale

Passwords need to be protected at all times, and hashing is the standard method for protecting passwords. If passwords are not hashed, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are hashed with a weak algorithm are no more protected than if they are kept in plain text.

Using more hashing rounds makes password cracking attacks more difficult.

Remediation Shell script ⇲

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base; then

var_password_hashing_min_rounds_login_defs='100000'




config_file=/etc/login.defs
current_min_rounds=$(grep -Po '^\s*SHA_CRYPT_MIN_ROUNDS\s+\K\d+' "$config_file")
current_max_rounds=$(grep -Po '^\s*SHA_CRYPT_MAX_ROUNDS\s+\K\d+' "$config_file")

if [[ -z "$current_min_rounds" || "$current_min_rounds" -le "$var_password_hashing_min_rounds_login_defs" ]]; then
    if [ -e "/etc/login.defs" ] ; then
        
        LC_ALL=C sed -i "/^\s*SHA_CRYPT_MIN_ROUNDS\s*/Id" "/etc/login.defs"
    else
        printf '%s\n' "Path '/etc/login.defs' wasn't found on this system. Refusing to continue." >&2
        return 1
    fi
    # make sure file has newline at the end
    sed -i -e '$a\' "/etc/login.defs"

    cp "/etc/login.defs" "/etc/login.defs.bak"
    # Insert at the end of the file
    printf '%s\n' "SHA_CRYPT_MIN_ROUNDS $var_password_hashing_min_rounds_login_defs" >> "/etc/login.defs"
    # Clean up after ourselves.
    rm "/etc/login.defs.bak"
fi

if [[ -n "$current_max_rounds" && "$current_max_rounds" -le "$var_password_hashing_min_rounds_login_defs" ]]; then
    if [ -e "/etc/login.defs" ] ; then
        
        LC_ALL=C sed -i "/^\s*SHA_CRYPT_MAX_ROUNDS\s*/Id" "/etc/login.defs"
    else
        printf '%s\n' "Path '/etc/login.defs' wasn't found on this system. Refusing to continue." >&2
        return 1
    fi
    # make sure file has newline at the end
    sed -i -e '$a\' "/etc/login.defs"

    cp "/etc/login.defs" "/etc/login.defs.bak"
    # Insert at the end of the file
    printf '%s\n' "SHA_CRYPT_MAX_ROUNDS $var_password_hashing_min_rounds_login_defs" >> "/etc/login.defs"
    # Clean up after ourselves.
    rm "/etc/login.defs.bak"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs
- name: XCCDF Value var_password_hashing_min_rounds_login_defs # promote to variable
  set_fact:
    var_password_hashing_min_rounds_login_defs: !!str 100000
  tags:
    - always

- name: Set Password Hashing Rounds in /etc/login.defs - Copy distro defaults /usr/etc/login.defs
    to /etc/login.defs
  ansible.builtin.copy:
    src: /usr/etc/login.defs
    dest: /etc/login.defs
    force: false
    mode: preserve
    remote_src: true
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Check if the parameter SHA_CRYPT_MIN_ROUNDS
    is configured in login.defs configuration(s)
  ansible.builtin.find:
    paths:
    - /etc
    - /etc/login.defs.d
    contains: (?i)^\s*{{ "SHA_CRYPT_MIN_ROUNDS"| regex_escape }}\s+
    patterns:
    - '*.defs'
  register: SHA_CRYPT_MIN_ROUNDS_login_defs_has_parameter
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Check if the parameter SHA_CRYPT_MIN_ROUNDS
    is configured correctly in login.defs configuration(s)
  ansible.builtin.find:
    paths:
    - /etc
    - /etc/login.defs.d
    contains: (?i)^\s*{{ "SHA_CRYPT_MIN_ROUNDS"| regex_escape }}\s+{{ var_password_hashing_min_rounds_login_defs
      }}$
    patterns:
    - '*.defs'
  register: SHA_CRYPT_MIN_ROUNDS_login_defs_correctly
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs
  block:

  - name: Set Password Hashing Rounds in /etc/login.defs - Deduplicate values from
      /etc/login.defs
    ansible.builtin.lineinfile:
      path: /etc/login.defs
      create: false
      regexp: (?i)(?i)^\s*{{ "SHA_CRYPT_MIN_ROUNDS"| regex_escape }}\s+
      state: absent

  - name: Set Password Hashing Rounds in /etc/login.defs - Check if the parameter
      SHA_CRYPT_MIN_ROUNDS is present in /etc/login.defs.d
    ansible.builtin.find:
      paths: /etc/login.defs.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "SHA_CRYPT_MIN_ROUNDS"| regex_escape }}\s+
      patterns:
      - '*.defs'
    register: login_defs_d_has_parameter

  - name: Set Password Hashing Rounds in /etc/login.defs - Remove parameter from files
      in /etc/login.defs.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "SHA_CRYPT_MIN_ROUNDS"| regex_escape }}\s+
      state: absent
    with_items: '{{ login_defs_d_has_parameter.files }}'

  - name: Set Password Hashing Rounds in /etc/login.defs - Insert correct line to
      /etc/login.defs.d/oscap.login.defs
    ansible.builtin.lineinfile:
      path: /etc/login.defs.d/oscap.login.defs
      create: true
      regexp: (?i)(?i)^\s*{{ "SHA_CRYPT_MIN_ROUNDS"| regex_escape }}\s+
      line: SHA_CRYPT_MIN_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
      state: present
      insertbefore: BOF

  - name: Set Password Hashing Rounds in /etc/login.defs - Add comment in /etc/login.defs.d/oscap.login.defs
    ansible.builtin.lineinfile:
      path: /etc/login.defs.d/oscap.login.defs
      line: '# Per CCE-94660-8 Set SHA_CRYPT_MIN_ROUNDS {{ var_password_hashing_min_rounds_login_defs
        }} in /etc/login.defs.d/oscap.login.defs'
      state: present
      insertbefore: SHA_CRYPT_MIN_ROUNDS {{ var_password_hashing_min_rounds_login_defs
        }}
    when: not ansible_check_mode
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - SHA_CRYPT_MIN_ROUNDS_login_defs_correctly.matched == 0 or SHA_CRYPT_MIN_ROUNDS_login_defs_has_parameter.matched
    != 1
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Copy distro defaults /usr/etc/login.defs
    to /etc/login.defs
  ansible.builtin.copy:
    src: /usr/etc/login.defs
    dest: /etc/login.defs
    force: false
    mode: preserve
    remote_src: true
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Check if the parameter SHA_CRYPT_MAX_ROUNDS
    is configured in login.defs configuration(s)
  ansible.builtin.find:
    paths:
    - /etc
    - /etc/login.defs.d
    contains: (?i)^\s*{{ "SHA_CRYPT_MAX_ROUNDS"| regex_escape }}\s+
    patterns:
    - '*.defs'
  register: SHA_CRYPT_MAX_ROUNDS_login_defs_has_parameter
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Check if the parameter SHA_CRYPT_MAX_ROUNDS
    is configured correctly in login.defs configuration(s)
  ansible.builtin.find:
    paths:
    - /etc
    - /etc/login.defs.d
    contains: (?i)^\s*{{ "SHA_CRYPT_MAX_ROUNDS"| regex_escape }}\s+{{ var_password_hashing_min_rounds_login_defs
      }}$
    patterns:
    - '*.defs'
  register: SHA_CRYPT_MAX_ROUNDS_login_defs_correctly
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs
  block:

  - name: Set Password Hashing Rounds in /etc/login.defs - Deduplicate values from
      /etc/login.defs
    ansible.builtin.lineinfile:
      path: /etc/login.defs
      create: false
      regexp: (?i)(?i)^\s*{{ "SHA_CRYPT_MAX_ROUNDS"| regex_escape }}\s+
      state: absent

  - name: Set Password Hashing Rounds in /etc/login.defs - Check if the parameter
      SHA_CRYPT_MAX_ROUNDS is present in /etc/login.defs.d
    ansible.builtin.find:
      paths: /etc/login.defs.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "SHA_CRYPT_MAX_ROUNDS"| regex_escape }}\s+
      patterns:
      - '*.defs'
    register: login_defs_d_has_parameter

  - name: Set Password Hashing Rounds in /etc/login.defs - Remove parameter from files
      in /etc/login.defs.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "SHA_CRYPT_MAX_ROUNDS"| regex_escape }}\s+
      state: absent
    with_items: '{{ login_defs_d_has_parameter.files }}'

  - name: Set Password Hashing Rounds in /etc/login.defs - Insert correct line to
      /etc/login.defs.d/oscap.login.defs
    ansible.builtin.lineinfile:
      path: /etc/login.defs.d/oscap.login.defs
      create: true
      regexp: (?i)(?i)^\s*{{ "SHA_CRYPT_MAX_ROUNDS"| regex_escape }}\s+
      line: SHA_CRYPT_MAX_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
      state: present
      insertbefore: BOF

  - name: Set Password Hashing Rounds in /etc/login.defs - Add comment in /etc/login.defs.d/oscap.login.defs
    ansible.builtin.lineinfile:
      path: /etc/login.defs.d/oscap.login.defs
      line: '# Per CCE-94660-8 Set SHA_CRYPT_MAX_ROUNDS {{ var_password_hashing_min_rounds_login_defs
        }} in /etc/login.defs.d/oscap.login.defs'
      state: present
      insertbefore: SHA_CRYPT_MAX_ROUNDS {{ var_password_hashing_min_rounds_login_defs
        }}
    when: not ansible_check_mode
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - SHA_CRYPT_MAX_ROUNDS_login_defs_correctly.matched == 0 or SHA_CRYPT_MAX_ROUNDS_login_defs_has_parameter.matched
    != 1
  tags:
  - CCE-94660-8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

OVAL test results details

Check SHA_CRYPT_MIN_ROUNDS in /etc/login.defs.d/oscap.login.defs is not set oval:ssg-test_sha_crypt_min_rounds_logindefs_drop_in_path_not_set:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sha_crypt_min_rounds_logindefs_drop_in_path_not_set:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/login.defs.d	.*\.defs$	^\sSHA_CRYPT_MIN_ROUNDS\s	1

The value of SHA_CRYPT_MIN_ROUNDS should be set appropriately in /etc/login.defs oval:ssg-test_sha_crypt_min_rounds_logindefs:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-variable_object_test_sha_crypt_min_rounds_logindefs:obj:1 of type variable_object

Var ref
oval:ssg-local_variable_test_sha_crypt_min_rounds_logindefs:var:1

Check SHA_CRYPT_MAX_ROUNDS in /etc/login.defs.d/oscap.login.defs is not set oval:ssg-test_sha_crypt_max_rounds_logindefs_drop_in_path_not_set:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_sha_crypt_max_rounds_logindefs_drop_in_path_not_set:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/login.defs.d	.*\.defs$	^\sSHA_CRYPT_MAX_ROUNDS\s	1

The value of SHA_CRYPT_MAX_ROUNDS should be set appropriately in /etc/login.defs oval:ssg-test_sha_crypt_max_rounds_logindefs:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-variable_object_test_sha_crypt_max_rounds_logindefs:obj:1 of type variable_object

Var ref
oval:ssg-local_variable_test_sha_crypt_max_rounds_logindefs:var:1

The value of SHA_CRYPT_MIN_ROUNDS should be set appropriately in /etc/login.defs.d oval:ssg-test_sha_crypt_min_rounds_logindefs_drop_in_path:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-variable_object_test_sha_crypt_min_rounds_logindefs_drop_in_path:obj:1 of type variable_object

Var ref
oval:ssg-local_variable_test_sha_crypt_min_rounds_logindefs_drop_in_path:var:1

The value of SHA_CRYPT_MAX_ROUNDS should be set appropriately in /etc/login.defs.d oval:ssg-test_sha_crypt_max_rounds_logindefs_drop_in_path:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-variable_object_test_sha_crypt_max_rounds_logindefs_drop_in_path:obj:1 of type variable_object

Var ref
oval:ssg-local_variable_test_sha_crypt_max_rounds_logindefs_drop_in_path:var:1

Check that vlock is installed to allow session locking

Rule ID	xccdf_org.ssgproject.content_rule_vlock_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-vlock_installed:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94630-1 References: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011
Description	The SUSE Linux Enterprise Micro 6 operating system must have vlock installed to allow for session locking. The `kbd` package can be installed with the following command: $ sudo zypper install kbd
Rationale	A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.

OVAL test results details

package kbd is installed oval:ssg-test_package_kbd_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
kbd	x86_64	(none)	160000.2.2	2.7.1	0:2.7.1-160000.2.2	fec28eaf09d9ea69	kbd-0:2.7.1-160000.2.2.x86_64

Enable Smart Card Logins in PAM

Rule ID	xccdf_org.ssgproject.content_rule_smartcard_pam_enabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-smartcard_pam_enabled:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94658-2 References: SRG-OS-000068-GPOS-00036, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162
Description	This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). Check that the `pam_pkcs11.so` option is configured in the `etc/pam.d/common-auth` file with the following command: # grep pam_pkcs11.so /etc/pam.d/common-auth auth sufficient pam_pkcs11.so For general information about enabling smart card authentication, consult the documentation at: https://www.suse.com/c/configuring-smart-card-authentication-suse-linux-enterprise/
Rationale	Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards or similar secure authentication devices issued by an organization or identity provider.

OVAL test results details

package pam_pkcs11 is installed oval:ssg-test_package_pam_pkcs11_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_pam_pkcs11_installed:obj:1 of type rpminfo_object

Name
pam_pkcs11

package mozilla-nss is installed oval:ssg-test_package_mozilla-nss_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
mozilla-nss	x86_64	(none)	160000.1.1	3.112.5	0:3.112.5-160000.1.1	fec28eaf09d9ea69	mozilla-nss-0:3.112.5-160000.1.1.x86_64

package mozilla-nss-tools is installed oval:ssg-test_package_mozilla-nss-tools_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_mozilla-nss-tools_installed:obj:1 of type rpminfo_object

Name
mozilla-nss-tools

package pcsc-ccid is installed oval:ssg-test_package_pcsc-ccid_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_pcsc-ccid_installed:obj:1 of type rpminfo_object

Name
pcsc-ccid

package pcsc-lite is installed oval:ssg-test_package_pcsc-lite_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_pcsc-lite_installed:obj:1 of type rpminfo_object

Name
pcsc-lite

package pcsc-tools is installed oval:ssg-test_package_pcsc-tools_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_pcsc-tools_installed:obj:1 of type rpminfo_object

Name
pcsc-tools

package opensc is installed oval:ssg-test_package_opensc_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_opensc_installed:obj:1 of type rpminfo_object

Name
opensc

package coolkey is installed oval:ssg-test_package_coolkey_installed:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_coolkey_installed:obj:1 of type rpminfo_object

Name
coolkey

Test smartcard authentication is required in /etc/pam.d/common-auth file oval:ssg-test_smart_card_common_auth:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_smart_card_common_auth:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/pam.d/common-auth	^\s*auth\s+(?:sufficient\|required)\s+pam_pkcs11.so(?:\s\|$)	1

Disable Ctrl-Alt-Del Reboot Activation

Rule ID	xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-disable_ctrlaltdel_reboot:def:1
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95054-3 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227
Description	By default, `SystemD` will reboot the system if the `Ctrl-Alt-Del` key sequence is pressed. To configure the system to ignore the `Ctrl-Alt-Del` key sequence from the command line instead of rebooting the system, do either of the following: ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target or systemctl mask ctrl-alt-del.target Do not simply delete the `/usr/lib/systemd/system/ctrl-alt-del.service` file, as this file may be restored during future system updates.
Rationale	A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.

OVAL test results details

Disable Ctrl-Alt-Del key sequence override exists oval:ssg-test_disable_ctrlaltdel_exists:tst:1 true

Following items have been found on the system:

Filepath	Canonical path
/etc/systemd/system/ctrl-alt-del.target	/dev/null

Set Account Expiration Following Inactivity

Rule ID	xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-account_disable_post_pw_expiration:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94675-6 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.6.2.1.1, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.6, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, IA-4(e), AC-2(3), CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, Req-8.1.4, SRG-OS-000118-GPOS-00060, 8.2.6, 8.2
Description	To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in `/etc/default/useradd`: INACTIVE=35 If a password is currently on the verge of expiration, then `35` day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus `35` day(s) could elapse until the account would be automatically disabled. See the `useradd` man page for more information.
Rationale	Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.

OVAL test results details

the value INACTIVE parameter should be set appropriately in /etc/default/useradd oval:ssg-test_etc_default_useradd_inactive:tst:1 true

Following items have been found on the system:

Path	Content
/etc/default/useradd	INACTIVE=35

Never Automatically Remove or Disable Emergency Administrator Accounts

Rule ID	xccdf_org.ssgproject.content_rule_account_emergency_admin
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94677-2 References: SRG-OS-000123-GPOS-00064
Description	Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. Check to see if an emergency administrator account password or account expires with the following command: # sudo chage -l [Emergency_Administrator] Password expires:never If `Password expires` or `Account expires` is set to anything other than `never`, this is a finding.
Rationale	Emergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. To address access requirements the SUSE operating system can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.
Evaluation messages info No candidate or applicable check found.

Assign Expiration Date to Temporary Accounts

Rule ID	xccdf_org.ssgproject.content_rule_account_temp_expire_date
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94678-0 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS06.03, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-2(2), AC-2(3), CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, SRG-OS-000123-GPOS-00064, SRG-OS-000002-GPOS-00002
Description	Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts. In the event temporary accounts are required, configure the system to terminate them after a documented time period. For every temporary account, run the following command to set an expiration date on it, substituting `USER` and `YYYY-MM-DD` appropriately: $ sudo chage -E YYYY-MM-DD USER `YYYY-MM-DD` indicates the documented expiration date for the account. For U.S. Government systems, the operating system must be configured to automatically terminate these types of accounts after a period of 72 hours.
Rationale	If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.
Evaluation messages info No candidate or applicable check found.

Set Password Maximum Age

Rule ID	xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_maximum_age_login_defs:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94670-7 References: 1, 12, 15, 16, 5, 5.6.2.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.6, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(d), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.4, SRG-OS-000076-GPOS-00044, 0418, 1055, 1402, 8.3.9, 8.3
Description	To specify password maximum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line: PASS_MAX_DAYS 60 The profile requirement is `60`.
Rationale	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

OVAL test results details

The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs oval:ssg-test_pass_max_days:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-variable_last_pass_max_days_instance_value:var:1	60

Set Password Minimum Age

Rule ID	xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_minimum_age_login_defs:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94669-9 References: 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(d), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000075-GPOS-00043, 0418, 1055, 1402
Description	To specify password minimum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line: PASS_MIN_DAYS 1 A value of 1 day is considered sufficient for many environments. The profile requirement is `1`.
Rationale	Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse. Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.

OVAL test results details

The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs oval:ssg-test_pass_min_days:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-variable_last_pass_min_days_instance_value:var:1	1

Set Existing Passwords Maximum Age

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_password_set_max_life_existing:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94662-4 References: IA-5(f), IA-5(1)(d), CM-6(a), SRG-OS-000076-GPOS-00044, 8.3.9, 8.3
Description	Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction by running the following command: $ sudo passwd -x 60 USER
Rationale	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

OVAL test results details

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing:tst:1 true

Following items have been found on the system:

Path	Content
/etc/shadow	rancher:$6$xhp6ngbkzwnVUkRO$764TUlcT6/ljHtJBp9DJAFgkvEsXMcbJqvM1NbOTPmC8M32sz48khkyM54v.Stsi5WkwOiBgf79TRtFFDX/tX.:20692:1:60:7:::

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:tst:1 true

Following items have been found on the system:

Path	Content
/etc/shadow	rancher:$6$xhp6ngbkzwnVUkRO$764TUlcT6/ljHtJBp9DJAFgkvEsXMcbJqvM1NbOTPmC8M32sz48khkyM54v.Stsi5WkwOiBgf79TRtFFDX/tX.:20692:1:60:7:::

Passwords must have the maximum password age set non-empty in /etc/shadow. oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_not_empty:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_set_max_life_existing_shadow_password_users_max_life_not_existing:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]+:)(?:[^:]:){2}():(?:[^:]:){3}(?:[^:]*)$	1

Set Existing Passwords Minimum Age

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_password_set_min_life_existing:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94661-6 References: IA-5(f), IA-5(1)(d), CM-6(a), SRG-OS-000075-GPOS-00043
Description	Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime by running the following command: $ sudo chage -m 1 USER
Rationale	Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

OVAL test results details

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_existing:tst:1 true

Following items have been found on the system:

Path	Content
/etc/shadow	rancher:$6$xhp6ngbkzwnVUkRO$764TUlcT6/ljHtJBp9DJAFgkvEsXMcbJqvM1NbOTPmC8M32sz48khkyM54v.Stsi5WkwOiBgf79TRtFFDX/tX.:20692:1:60:7:::

Compares a specific field in /etc/shadow with a specific variable value oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:tst:1 true

Following items have been found on the system:

Path	Content
/etc/shadow	rancher:$6$xhp6ngbkzwnVUkRO$764TUlcT6/ljHtJBp9DJAFgkvEsXMcbJqvM1NbOTPmC8M32sz48khkyM54v.Stsi5WkwOiBgf79TRtFFDX/tX.:20692:1:60:7:::

Passwords must have the maximum password age set non-empty in /etc/shadow. oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_not_empty:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_set_min_life_existing_shadow_password_users_max_life_not_existing:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^(?:[^:]:)(?:[^\!\:]+:)(?:[^:]:)():(?:[^:]:){4}(?:[^:]*)$	1

Verify All Account Password Hashes are Shadowed with SHA512

Rule ID	xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_password_all_shadowed_sha512:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94676-4 References: IA-5(1)(c), IA-5(1).1(v), IA-7, IA-7.1, SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061
Description	Verify the operating system requires the shadow password suite configuration be set to encrypt interactive user passwords using a strong cryptographic hash. Check that the interactive user account passwords are using a strong password hash with the following command: $ sudo cut -d: -f2 /etc/shadow $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/ Password hashes `!` or `*` indicate inactive accounts not available for logon and are not evaluated. If any interactive user password hash does not begin with `$6`, this is a finding.
Rationale	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.

OVAL test results details

password hashes are shadowed using sha512 oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1 of type shadow_object

Username	Filter	Filter	Filter
.*	oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1	oval:ssg-state_accounts_password_all_shadowed_has_locked_password:ste:1	oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1

Prevent Login to Accounts With Empty Password

Rule ID	xccdf_org.ssgproject.content_rule_no_empty_passwords
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-no_empty_passwords:def:1
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95047-7 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, 1546, 8.3.1, 8.3
Description	If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the `nullok` in password authentication configurations in `/etc/pam.d/` to prevent logins with empty passwords.
Rationale	If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Warnings	warning If the system relies on `authselect` tool to manage PAM settings, the remediation will also use `authselect` tool. However, if any manual modification was made in PAM files, the `authselect` integrity check will fail and the remediation will be aborted in order to preserve intentional changes. In this case, an informative message will be shown in the remediation report. Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.

OVAL test results details

make sure nullok is not used in /etc/pam.d/system-auth oval:ssg-test_no_empty_passwords:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_empty_passwords:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
^/etc/pam.d/.*$	^[^#]\bnullok\b.$	1

Ensure There Are No Accounts With Blank or Null Passwords

Rule ID	xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-no_empty_passwords_etc_shadow:def:1
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95046-9 References: CM-6(b), CM-6.1(iv), SRG-OS-000480-GPOS-00227, 2.2.2, 2.2
Description	Check the "/etc/shadow" file for blank passwords with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding. Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] Lock an account: $ sudo passwd -l [username]
Rationale	If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Warnings	warning Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.

OVAL test results details

make sure there aren't blank or null passwords in /etc/shadow oval:ssg-test_no_empty_passwords_etc_shadow:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/shadow	^[^:]+::.*$	1

Verify Only Root Has UID 0

Rule ID	xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_no_uid_except_zero:def:1
Time	2026-08-27T10:02:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95041-0 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, AC-6(5), IA-4(b), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, Req-8.5, SRG-OS-000480-GPOS-00227, 1546, 8.2.1, 8.2
Description	If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed, locked or have their UID changed. If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned.
Rationale	An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

OVAL test results details

test that there are no accounts with UID 0 except root in the /etc/passwd file oval:ssg-test_accounts_no_uid_except_root:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_no_uid_except_root:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/passwd	^(?!root:)([^:]+):[^:]+:0:.*$	1

Ensure that System Accounts Do Not Run a Shell Upon Login

Rule ID xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts

Result

error

Multi-check rule no

OVAL Definition ID oval:ssg-no_shelllogin_for_systemaccounts:def:1

Time 2026-08-27T10:02:23+00:00

Severity medium

Identifiers and References

Identifiers: CCE-95039-4

References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS06.03, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-6, CM-6(a), CM-6(b), CM-6.1(iv), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, SRG-OS-000480-GPOS-00227, 1491, 8.2.2, 8.2

Description

Some accounts are not associated with a human user of the system, and exist to perform some administrative functions. Should an attacker be able to log into these accounts, they should not be granted access to a shell.

The login shell for each local account is stored in the last field of each line in /etc/passwd. System accounts are those user accounts with a user ID less than 1000. The user ID is stored in the third field. If any system account other than root has a login shell, disable it with the command:

$ sudo usermod -s /sbin/nologin account

Rationale

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

Warnings

warning Do not perform the steps in this section on the root account. Doing so might cause the system to become inaccessible.

Remediation Shell script ⇲

Complexity:	low
Disruption:	medium
Reboot:	false
Strategy:	restrict

# Remediation is applicable only in certain platforms
if ( rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base ); then

readarray -t systemaccounts < <(awk -F: '($3 < 1000 && $1 != "root" \
  && $7 != "\/sbin\/shutdown" && $7 != "\/sbin\/halt" && $7 != "\/bin\/sync") \
  { print $1 }' /etc/passwd)

for systemaccount in "${systemaccounts[@]}"; do
    usermod -s /sbin/nologin "$systemaccount"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	medium
Reboot:	false
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-95039-4
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login - Get All Local
    Users From /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-95039-4
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login - Create local_users
    Variable From getent_passwd Facts
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd | dict2items }}'
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-95039-4
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login -  Disable Login
    Shell for System Accounts
  ansible.builtin.user:
    name: '{{ item.key }}'
    shell: /sbin/nologin
  loop: '{{ local_users }}'
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - item.key not in ['root']
  - item.value[1]|int < 1000
  - item.value[5] not in ['/sbin/shutdown', '/sbin/halt', '/bin/sync']
  tags:
  - CCE-95039-4
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

OVAL test results details

SYS_UID_MIN not defined in /etc/login.defs oval:ssg-test_sys_uid_min_not_defined:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1 of type textfilecontent54_object

Behaviors	Filepath	Pattern	Instance
no value	/etc/login.defs	.(?:^\|\n)\s(SYS_UID_MIN[\s]+[\d]+)\s*(?:$\|\n)	1

SYS_UID_MAX not defined in /etc/login.defs oval:ssg-test_sys_uid_max_not_defined:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1 of type textfilecontent54_object

Behaviors	Filepath	Pattern	Instance
no value	/etc/login.defs	.(?:^\|\n)\s(SYS_UID_MAX[\s]+[\d]+)\s*(?:$\|\n)	1

<0, UID_MIN - 1> system UIDs having shell set oval:ssg-test_shell_defined_default_uid_range:tst:1 error

Following items have been found on the system:

Path	Content
/etc/passwd	rancher:x:65535:1000:Created by entities:/home/rancher:/bin/bash

SYS_UID_MIN not defined in /etc/login.defs oval:ssg-test_sys_uid_min_not_defined:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1 of type textfilecontent54_object

Behaviors	Filepath	Pattern	Instance
no value	/etc/login.defs	.(?:^\|\n)\s(SYS_UID_MIN[\s]+[\d]+)\s*(?:$\|\n)	1

SYS_UID_MAX not defined in /etc/login.defs oval:ssg-test_sys_uid_max_not_defined:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1 of type textfilecontent54_object

Behaviors	Filepath	Pattern	Instance
no value	/etc/login.defs	.(?:^\|\n)\s(SYS_UID_MAX[\s]+[\d]+)\s*(?:$\|\n)	1

<0, SYS_UID_MIN> system UIDs having shell set oval:ssg-test_shell_defined_reserved_uid_range:tst:1 error

Following items have been found on the system:

Path	Content
/etc/passwd	rancher:x:65535:1000:Created by entities:/home/rancher:/bin/bash

<SYS_UID_MIN, SYS_UID_MAX> system UIDS having shell set oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1 error

Following items have been found on the system:

Path	Content
/etc/passwd	rancher:x:65535:1000:Created by entities:/home/rancher:/bin/bash

Ensure All Accounts on the System Have Unique User IDs

Rule ID	xccdf_org.ssgproject.content_rule_account_unique_id
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-account_unique_id:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94673-1 References: Req-8.1.1, SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062, 8.2.1, 8.2
Description	Change user IDs (UIDs), or delete accounts, so each has a unique name.
Rationale	To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.
Warnings	warning Automatic remediation of this control is not available due to unique requirements of each system.

OVAL test results details

There should not exist duplicate user ids in /etc/passwd oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-variable_count_of_all_uids:var:1	14

Ensure the Default Umask is Set Correctly in login.defs

Rule ID	xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_umask_etc_login_defs:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95089-9 References: 11, 18, 3, 9, APO13.01, BAI03.01, BAI03.02, BAI03.03, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.1.1, A.14.2.1, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.5, A.6.1.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-1, PR.IP-2, SRG-OS-000480-GPOS-00228, R36
Description	To ensure the default umask controlled by `/etc/login.defs` is set properly, add or correct the `UMASK` setting in `/etc/login.defs` to read as follows: UMASK 027
Rationale	The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and written to by unauthorized users.

OVAL test results details

Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_accounts_user_umask_umask_as_number:var:1	23

Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_login_defs:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_etc_login_defs_umask_as_number:var:1	63

Ensure Home Directories are Created for New Users

Rule ID	xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_have_homedir_login_defs:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95044-4 References: SRG-OS-000480-GPOS-00227
Description	All local interactive user accounts, upon creation, should be assigned a home directory. Configure the operating system to assign home directories to all new local interactive users by setting the `CREATE_HOME` parameter in `/etc/login.defs` to `yes` as follows: CREATE_HOME yes
Rationale	If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.

OVAL test results details

Check value of CREATE_HOME in /etc/login.defs oval:ssg-test_accounts_have_homedir_login_defs:tst:1 true

Following items have been found on the system:

Path	Content
/etc/login.defs	CREATE_HOME yes

Ensure the Logon Failure Delay is Set Correctly in login.defs

Rule ID	xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_logon_fail_delay:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95034-5 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, AC-7(b), CM-6(a), PR.IP-1, SRG-OS-000480-GPOS-00226
Description	To ensure the logon failure delay controlled by `/etc/login.defs` is set properly, add or correct the `FAIL_DELAY` setting in `/etc/login.defs` to read as follows: FAIL_DELAY 5
Rationale	Increasing the time between a failed authentication attempt and re-prompting to enter credentials helps to slow a single-threaded brute force attack.

OVAL test results details

check FAIL_DELAY in /etc/login.defs oval:ssg-test_accounts_logon_fail_delay:tst:1 true

Following items have been found on the system:

Path	Content
/etc/login.defs	FAIL_DELAY 5

Limit the Number of Concurrent Login Sessions Allowed Per User

Rule ID	xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_max_concurrent_login_sessions:def:1
Time	2026-08-27T10:02:23+00:00
Severity	low
Identifiers and References	Identifiers: CCE-94644-2 References: 14, 15, 18, 9, 5.5.2.2, DSS01.05, DSS05.02, 4.3.3.4, SR 3.1, SR 3.8, A.13.1.1, A.13.1.3, A.13.2.1, A.14.1.2, A.14.1.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, AC-10, CM-6(a), PR.AC-5, SRG-OS-000027-GPOS-00008
Description	Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. To set the number of concurrent sessions per user add the following line in `/etc/security/limits.conf` or a file under `/etc/security/limits.d/`: * hard maxlogins 10
Rationale	Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

OVAL test results details

the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf oval:ssg-test_limitsd_maxlogins:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/security/limits.d	^.*\.conf$	^[\s]\[\s]+(?:(?:hard)\|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$	1

the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf oval:ssg-test_limitsd_maxlogins_exists:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/etc/security/limits.d	^.*\.conf$	^[\s]\[\s]+(?:(?:hard)\|(?:-))[\s]+maxlogins	1

the value maxlogins should be set appropriately in /etc/security/limits.conf oval:ssg-test_maxlogins:tst:1 true

Following items have been found on the system:

Path	Content
/etc/security/limits.conf	* hard maxlogins 10

Set Interactive Session Timeout

Rule ID	xccdf_org.ssgproject.content_rule_accounts_tmout
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_tmout:def:1
Time	2026-08-27T10:02:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94645-9 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.11, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, AC-12, SC-10, AC-2(5), CM-6(a), PR.AC-7, SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010, R32, 8.6.1, 8.6
Description	Setting the `TMOUT` option in `/etc/profile` ensures that all user sessions will terminate based on inactivity. A value of `0` (zero) disables the automatic logout feature and is therefore not a compliant setting. The value of TMOUT should be a positive integer, exported, and read only. The `TMOUT` setting in `/etc/profile.d/autologout.sh` should read as follows: TMOUT=900 readonly TMOUT export TMOUT
Rationale	Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.

OVAL test results details

TMOUT in /etc/profile oval:ssg-test_etc_profile_tmout:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_etc_profile_tmout:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/profile	^[\s]TMOUT=([\w$]+)[\s]readonly TMOUT[\s]*export TMOUT$	1

TMOUT in /etc/profile.d/*.sh oval:ssg-test_etc_profiled_tmout:tst:1 true

Following items have been found on the system:

Path	Content
/etc/profile.d/90-hardpipe-cis.sh	TMOUT=600 readonly TMOUT export TMOUT

Check that at least one TMOUT is defined oval:ssg-test_accounts_tmout_defined:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-variable_count_of_tmout_instances:var:1	1

All TMOUT values must be greater than or equal to 1 oval:ssg-test_accounts_tmout_lower_bound:tst:1 true

Following items have been found on the system:

Path	Content
/etc/profile.d/90-hardpipe-cis.sh	TMOUT=600 readonly TMOUT export TMOUT

User Initialization Files Must Not Run World-Writable Programs

Rule ID	xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_user_dot_no_world_writable_programs:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95061-8 References: SRG-OS-000480-GPOS-00227
Description	Set the mode on files being executed by the user initialization files with the following command: $ sudo chmod o-w FILE
Rationale	If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.

OVAL test results details

Init files do not execute world-writable programs oval:ssg-test_accounts_user_dot_no_world_writable_programs:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_accounts_user_dot_no_world_writable_programs_init_files:obj:1 of type textfilecontent54_object

Path

Filename

Pattern

Instance

^\.[\w\- ]+$

/home/rancher

Referenced variable has no values (oval:ssg-var_world_writable_programs_regex:var:1).

Ensure that Users Path Contains Only Local Directories

Rule ID	xccdf_org.ssgproject.content_rule_accounts_user_home_paths_only
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95060-0 References: SRG-OS-000480-GPOS-00227
Description	Ensure that all interactive user initialization files executable search path statements do not contain statements that will reference a working directory other than the users home directory.
Rationale	The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the users home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).
Evaluation messages info No candidate or applicable check found.

All Interactive Users Must Have A Home Directory Defined

Rule ID	xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_user_interactive_home_directory_defined:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95055-0 References: SRG-OS-000480-GPOS-00227
Description	Assign home directories to all interactive users that currently do not have a home directory assigned. This rule checks if the home directory is properly defined in a folder which has at least one parent folder, like "user" in "/home/user" or "/remote/users/user". Therefore, this rule will report a finding for home directories like `/users`, `/tmp` or `/`.
Rationale	If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.

OVAL test results details

All Interactive Users Have A Home Directory Defined oval:ssg-test_accounts_user_interactive_home_directory_defined:tst:1 true

Following items have been found on the system:

Username	Password	User id	Group id	Gcos	Home dir	Login shell	Last login
rancher	x	65535	1000	Created by entities	/home/rancher	/bin/bash	-1

All Interactive Users Home Directories Must Exist

Rule ID	xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-accounts_user_interactive_home_directory_exists:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95056-8 References: SRG-OS-000480-GPOS-00227
Description	Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in `/etc/passwd`: $ sudo mkdir /home/USER
Rationale	If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.

OVAL test results details

Check the existence of interactive users. oval:ssg-test_accounts_user_interactive_home_directory_exists:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count_fs:var:1	1

Check the existence of interactive users. oval:ssg-test_accounts_user_interactive_home_directory_exists_users:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1	1

All Interactive User Home Directories Must Be Group-Owned By The Primary Group

Rule ID	xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_groupownership_home_directories:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95058-4 References: SRG-OS-000480-GPOS-00227
Description	Change the group owner of interactive users home directory to the group found in `/etc/passwd`. To change the group owner of interactive users home directory, use the following command: $ sudo chgrp USER_GROUP /home/USER This rule ensures every home directory related to an interactive user is group-owned by an interactive user. It also ensures that interactive users are group-owners of one and only one home directory.
Rationale	If the Group Identifier (GID) of a local interactive users home directory is not the same as the primary GID of the user, this would allow unauthorized access to the users files, and users that share the same group may not be able to access files that they legitimately should.
Warnings	warning Due to OVAL limitation, this rule can report a false negative in a specific situation where two interactive users swap the group-ownership of their respective home directories.

OVAL test results details

All home directories are group-owned by a local interactive group oval:ssg-test_file_groupownership_home_directories:tst:1 true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/home/rancher/	directory	65535	1000	4096	`rwxr-x---`

Ensure All User Initialization Files Have Mode 0740 Or Less Permissive

Rule ID	xccdf_org.ssgproject.content_rule_file_permission_user_init_files
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permission_user_init_files:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95059-2 References: SRG-OS-000480-GPOS-00227, R50
Description	Set the mode of the user initialization files to `0740` or less permissisive with the following command: $ sudo chmod u-s,g-wxs,o= /home/USER/.INIT_FILE
Rationale	Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.

OVAL test results details

Init files have mode 0740 or less permissive oval:ssg-test_file_permission_user_init_files:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permission_user_init_files:obj:1 of type file_object

Path

Filename

^\.[\w\- ]+$

/home/rancher

All Interactive User Home Directories Must Have mode 0750 Or Less Permissive

Rule ID	xccdf_org.ssgproject.content_rule_file_permissions_home_directories
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permissions_home_directories:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95057-6 References: SRG-OS-000480-GPOS-00227
Description	Change the mode of interactive users home directories to `0750`. To change the mode of interactive users home directory, use the following command: $ sudo chmod 0750 /home/USER
Rationale	Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.

OVAL test results details

All home directories have proper permissions oval:ssg-test_file_permissions_home_directories:tst:1 true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/home/rancher/	directory	65535	1000	4096	`rwxr-x---`

Enable systemd-journal-upload Service

Rule ID	xccdf_org.ssgproject.content_rule_service_systemd-journal-upload_enabled
Result	notapplicable
Multi-check rule	no
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94735-8 References: SRG-OS-000479-GPOS-00224
Description	The `systemd-journal-upload` service is part of the `systemd-journal-remote` package and enables centralized logging by uploading local systemd journal entries to a remote log server via HTTPS. This service acts as a client that pushes journal data to a remote host running the `systemd-journal-remote` receiver service. The `systemd-journal-upload` service can be enabled with the following command: $ sudo systemctl enable systemd-journal-upload.service
Rationale	Centralized logging through `systemd-journal-upload` is essential for security monitoring, incident response, and compliance requirements. Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data stored locally to hide their activities. Remote logging ensures that audit trails remain intact even if the local system is compromised. Additionally, centralized logs facilitate correlation of events across multiple systems, enabling better detection of distributed attacks and security incidents.
Warnings	warning The `systemd-journal-upload` service will fail to start if the remote server URL is not configured. Edit `/etc/systemd/journal-upload.conf` to configure the remote server URL.

Verify firewalld Enabled

Rule ID	xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Result	notapplicable
Multi-check rule	no
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94672-3 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SYS.1.6.A5, SYS.1.6.A21, 1409, 1.2.1, 1.2
Description	The `firewalld` service can be enabled with the following command: $ sudo systemctl enable firewalld.service
Rationale	Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.

Disable Accepting ICMP Redirects for All IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95079-0 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, R13
Description	To set the runtime status of the `net.ipv6.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_redirects = 0
Rationale	An illicit ICMP redirect message could result in a man-in-the-middle attack.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.disable_ipv6	1

net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/51-network.conf	net.ipv6.conf.all.accept_redirects = 0
/lib/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.all.accept_redirects=0
/etc/sysctl.conf	net.ipv6.conf.all.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv6.conf.all.accept_redirects = 0

net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/51-network.conf	net.ipv6.conf.all.accept_redirects = 0
/lib/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.all.accept_redirects=0
/etc/sysctl.conf	net.ipv6.conf.all.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv6.conf.all.accept_redirects = 0

net.ipv6.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/51-network.conf	net.ipv6.conf.all.accept_redirects = 0
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_redirects = 0

kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95074-1 References: 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, R13
Description	To set the runtime status of the `net.ipv6.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.disable_ipv6	1

net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.all.accept_source_route=0

net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.all.accept_source_route=0

net.ipv6.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.accept_source_route[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.accept_source_route	0

Disable Kernel Parameter for IPv6 Forwarding

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95084-0 References: 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv6.conf.all.forwarding` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.forwarding=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.all.forwarding = 0
Rationale	IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.disable_ipv6	1

net.ipv6.conf.all.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.all.forwarding=1

net.ipv6.conf.all.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.all.forwarding=1

net.ipv6.conf.all.forwarding static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.forwarding[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_runtime:tst:1 false

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.forwarding	1

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1
Time	2026-08-27T10:02:26+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95080-8 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, R13
Description	To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_redirects = 0
Rationale	An illicit ICMP redirect message could result in a man-in-the-middle attack.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.disable_ipv6	1

net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
/lib/sysctl.d/51-network.conf	net.ipv6.conf.default.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.default.accept_redirects=0
/etc/sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv6.conf.default.accept_redirects = 0

net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
/lib/sysctl.d/51-network.conf	net.ipv6.conf.default.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.default.accept_redirects=0
/etc/sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv6.conf.default.accept_redirects = 0

net.ipv6.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_redirects = 0
/usr/lib/sysctl.d/51-network.conf	net.ipv6.conf.default.accept_redirects = 0

kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.default.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1
Time	2026-08-27T10:02:26+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95076-6 References: 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, R13, 1.4.2, 1.4
Description	To set the runtime status of the `net.ipv6.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.disable_ipv6	1

net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.default.accept_source_route=0

net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv6.conf.default.accept_source_route=0

net.ipv6.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.default.accept_source_route[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.default.accept_source_route	0

Disable Kernel Parameter for IPv6 Forwarding by default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_forwarding
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv6_conf_default_forwarding:def:1
Time	2026-08-27T10:02:26+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95085-7 References: CM-6(b), CM-6.1(iv), SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv6.conf.default.forwarding` kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.forwarding=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv6.conf.default.forwarding = 0
Rationale	IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.

OVAL test results details

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/ipv6.conf	net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.all.disable_ipv6[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv6.conf.all.disable_ipv6	1

net.ipv6.conf.default.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_static_user:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_forwarding:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_forwarding:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_forwarding:obj:1

net.ipv6.conf.default.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_static_user_missing:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_forwarding:obj:1 of type textfilecontent54_object

Set
oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_forwarding:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_forwarding:obj:1

net.ipv6.conf.default.forwarding static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_static_pkg_correct:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_forwarding:obj:1 of type textfilecontent54_object

Path	Filename	Pattern	Instance
/usr/lib/sysctl.d	^.*\.conf$	^[\s]net.ipv6.conf.default.forwarding[\s]=[\s](.\S)[\s]*$	1

kernel runtime parameter net.ipv6.conf.default.forwarding set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_forwarding_runtime:tst:1 false

Following items have been found on the system:

Name	Value
net.ipv6.conf.default.forwarding	1

Disable Accepting ICMP Redirects for All IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1
Time	2026-08-27T10:02:26+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95077-4 References: 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, 5.10.1.1, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, R12
Description	To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required."

OVAL test results details

net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.all.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.all.accept_redirects=0
/etc/sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.all.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.all.accept_redirects=0
/etc/sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_redirects = 0
/usr/lib/sysctl.d/51-network.conf	net.ipv4.conf.all.accept_redirects = 0

kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.conf.all.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1
Time	2026-08-27T10:02:26+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95073-3 References: 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, R12
Description	To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

OVAL test results details

net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.all.accept_source_route = 0
/etc/sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.all.accept_source_route=0

net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.all.accept_source_route = 0
/etc/sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.all.accept_source_route=0

net.ipv4.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_source_route = 0
/usr/lib/sysctl.d/51-network.conf	net.ipv4.conf.all.accept_source_route = 0

kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.conf.all.accept_source_route	0

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1
Time	2026-08-27T10:02:26+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95078-2 References: 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, R12, 1.4.3, 1.4
Description	To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.

OVAL test results details

net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.default.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.default.accept_redirects=0
/etc/sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.default.accept_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.default.accept_redirects=0
/etc/sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_redirects = 0
/usr/lib/sysctl.d/51-network.conf	net.ipv4.conf.default.accept_redirects = 0

kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.conf.default.accept_redirects	0

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1
Time	2026-08-27T10:02:27+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95075-8 References: 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, R12
Description	To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.

OVAL test results details

net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_source_route = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.default.accept_source_route = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.default.accept_source_route=0
/etc/sysctl.conf	net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_source_route = 0
/lib/sysctl.d/51-network.conf	net.ipv4.conf.default.accept_source_route = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.default.accept_source_route=0
/etc/sysctl.conf	net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_source_route = 0
/usr/lib/sysctl.d/51-network.conf	net.ipv4.conf.default.accept_source_route = 0

kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.conf.default.accept_source_route	0

Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1
Time	2026-08-27T10:02:27+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94684-8 References: 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), SC-5(1), SC-5(2), SC-5(3)(a), CM-6(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, Req-1.4.1, SRG-OS-000480-GPOS-00227, SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00071, R12, 1.4.3, 1.4
Description	To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.tcp_syncookies = 1
Rationale	A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.

OVAL test results details

net.ipv4.tcp_syncookies static configuration oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.tcp_syncookies = 1
/etc/sysctl.conf	net.ipv4.tcp_syncookies = 1
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.tcp_syncookies=1
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_syncookies static configuration oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.tcp_syncookies = 1
/etc/sysctl.conf	net.ipv4.tcp_syncookies = 1
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.tcp_syncookies=1
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_syncookies static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.tcp_syncookies = 1

kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.tcp_syncookies	1

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1
Time	2026-08-27T10:02:27+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95082-4 References: 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, R12, 1.4.5, 1.4
Description	To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.send_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.

OVAL test results details

net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.send_redirects = 0
/etc/sysctl.conf	net.ipv4.conf.all.send_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.all.send_redirects=0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.send_redirects = 0
/etc/sysctl.conf	net.ipv4.conf.all.send_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.all.send_redirects=0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.all.send_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.send_redirects = 0

kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0 oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.conf.all.send_redirects	0

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1
Time	2026-08-27T10:02:27+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95081-6 References: 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, R12, 1.4.5, 1.4
Description	To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.send_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.

OVAL test results details

net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.send_redirects = 0
/etc/sysctl.conf	net.ipv4.conf.default.send_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.default.send_redirects=0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.send_redirects = 0
/etc/sysctl.conf	net.ipv4.conf.default.send_redirects = 0
/etc/sysctl.d/90-cis-os-hardening.conf	net.ipv4.conf.default.send_redirects=0
/etc/sysctl.d/91-stig-hardening.conf	net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.default.send_redirects static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.send_redirects = 0

kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0 oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_runtime:tst:1 true

Following items have been found on the system:

Name	Value
net.ipv4.conf.default.send_redirects	0

Deactivate Wireless Network Interfaces

Rule ID	xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-wireless_disable_interfaces:def:1
Time	2026-08-27T10:02:27+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94703-6 References: 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 3.1.16, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.3.3, SRG-OS-000299-GPOS-00117, SRG-OS-000300-GPOS-00118, SRG-OS-000424-GPOS-00188, SRG-OS-000481-GPOS-00481, 1315, 1319, 1.3.3, 1.3
Description	Deactivating wireless network interfaces should prevent normal usage of the wireless capability. Configure the system to disable all wireless network interfaces with the following command: $ sudo nmcli radio all off
Rationale	The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.

OVAL test results details

check if UP flag is present on wifi interfaces oval:ssg-test_wireless_disable_interfaces:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_active_wifi_interfaces:obj:1 of type interface_object

Name
^wl.*$

Ensure System is Not Acting as a Network Sniffer

Rule ID	xccdf_org.ssgproject.content_rule_network_sniffer_disabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-network_sniffer_disabled:def:1
Time	2026-08-27T10:02:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95086-5 References: 1, 11, 14, 3, 9, APO11.06, APO12.06, BAI03.10, BAI09.01, BAI09.02, BAI09.03, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS04.05, DSS05.02, DSS05.05, DSS06.06, 4.2.3.4, 4.3.3.3.7, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, SR 7.8, A.11.1.2, A.11.2.4, A.11.2.5, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.16.1.6, A.8.1.1, A.8.1.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), CM-7(2), MA-3, DE.DP-5, ID.AM-1, PR.IP-1, PR.MA-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 1409, 1.4.5, 1.4
Description	The system should not be acting as a network sniffer, which can capture all traffic on the network to which it is connected. Run the following to determine if any interface is running in promiscuous mode: $ ip link \| grep PROMISC Promiscuous mode of an interface can be disabled with the following command: $ sudo ip link set dev `device_name` multicast off promisc off
Rationale	Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect information such as logon IDs, passwords, and key exchanges between systems. If the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information Systems Security Manager (ISSM) and restricted to only authorized personnel.

OVAL test results details

check all network interfaces for PROMISC flag oval:ssg-test_promisc_interfaces:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_promisc_interfaces:obj:1 of type interface_object

Name	Filter
^.*$	oval:ssg-state_promisc:ste:1

Verify Permissions and Ownership of Old Passwords File

Rule ID	xccdf_org.ssgproject.content_rule_file_etc_security_opasswd
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_etc_security_opasswd:def:1
Time	2026-08-27T10:02:50+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94663-2 References: SRG-OS-000077-GPOS-00045
Description	To properly set the owner of `/etc/security/opasswd`, run the command: $ sudo chown root /etc/security/opasswd To properly set the group owner of `/etc/security/opasswd`, run the command: $ sudo chgrp root /etc/security/opasswd To properly set the permissions of `/etc/security/opasswd`, run the command: $ sudo chmod 0600 /etc/security/opasswd
Rationale	The `/etc/security/opasswd` file stores old passwords to prevent password reuse. Protection of this file is critical for system security.

OVAL test results details

/etc/security/opasswd is owned by root:root / 0600 oval:ssg-test_file_etc_security_opasswd:tst:1 true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/etc/security/opasswd	regular	0	0	0	`rw-------`

Verify that Shared Library Directories Have Root Group Ownership

Rule ID	xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_group_ownership_library_dirs:def:1
Time	2026-08-27T10:02:50+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94695-4 References: CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100
Description	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be group-owned by the `root` group. If the directories are found to be owned by a group other than root correct its ownership with the following command: $ sudo chgrp root DIR
Rationale	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.

OVAL test results details

Testing group ownership of /lib/ oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib	no value	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1

Testing group ownership of /lib64/ oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib64	no value	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1

Testing group ownership of /usr/lib/ oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib	no value	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1

Testing group ownership of /usr/lib64/ oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib64	no value	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1

Verify that Shared Library Directories Have Root Ownership

Rule ID	xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_ownership_library_dirs:def:1
Time	2026-08-27T10:02:51+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94693-9 References: CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100
Description	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directories are found to be owned by a user other than root correct its ownership with the following command: $ sudo chown root DIR
Rationale	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership of library directories is necessary to protect the integrity of the system.

OVAL test results details

Testing user ownership of /lib/ oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib	no value	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1

Testing user ownership of /lib64/ oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib64	no value	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1

Testing user ownership of /usr/lib/ oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib	no value	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1

Testing user ownership of /usr/lib64/ oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib64	no value	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1

Verify that System Executable Directories Have Restrictive Permissions

Rule ID	xccdf_org.ssgproject.content_rule_dir_permissions_binary_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_permissions_binary_dirs:def:1
Time	2026-08-27T10:02:51+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95100-4 References: SRG-OS-000258-GPOS-00099
Description	System executables are stored in the following directories by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin These directories should not be group-writable or world-writable. If any directory DIR in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w DIR
Rationale	System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

OVAL test results details

Testing mode of /bin/ oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/bin	no value	oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1

Testing mode of /sbin/ oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/sbin	no value	oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1

Testing mode of /usr/bin/ oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/bin	no value	oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1

Testing mode of /usr/sbin/ oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/sbin	no value	oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1

Testing mode of /usr/local/bin/ oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/local/bin	no value	oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1

Testing mode of /usr/local/sbin/ oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/local/sbin	no value	oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1

Verify that Shared Library Directories Have Restrictive Permissions

Rule ID	xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_permissions_library_dirs:def:1
Time	2026-08-27T10:02:51+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94691-3 References: CIP-003-8 R6, CM-5, CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100
Description	System-wide shared library directories, which contain are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All sub-directories in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w DIR
Rationale	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

OVAL test results details

Testing mode of /lib/ oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib	no value	oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_7755or_stricter_:ste:1

Testing mode of /lib64/ oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib64	no value	oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_7755or_stricter_:ste:1

Testing mode of /usr/lib/ oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib	no value	oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_7755or_stricter_:ste:1

Testing mode of /usr/lib64/ oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib64	no value	oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1	oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_7755or_stricter_:ste:1

Verify that system commands files are group owned by root or a system account

Rule ID	xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_groupownership_system_commands_dirs:def:1
Time	2026-08-27T10:02:52+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94699-6 References: CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100, R50
Description	System commands files are stored in the following directories by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin All files in these directories should be owned by the `root` group, or a system account. If the directory, or any file in these directories, is found to be owned by a group other than root or a a system account correct its ownership with the following command: $ sudo chgrp root FILE
Rationale	If the operating system allows any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

OVAL test results details

system commands are owned by root or a system account oval:ssg-test_groupownership_system_commands_dirs:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_groupownership_system_commands_dirs:obj:1 of type file_object

Path	Filename	Filter	Filter
^\/s?bin\|^\/usr\/s?bin\|^\/usr\/local\/s?bin	/	oval:ssg-state_groupowner_system_commands_dirs_not_root_or_system_account:ste:1	oval:ssg-state_groupowner_system_commands_dirs_symlink:ste:1

Verify that System Executables Have Root Ownership

Rule ID	xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_ownership_binary_dirs:def:1
Time	2026-08-27T10:02:52+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94697-0 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-5(6), CM-5(6).1, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000259-GPOS-00100, R50, 1409
Description	System executables are stored in the following directories by default: /bin /sbin /usr/bin /usr/libexec /usr/local/bin /usr/local/sbin /usr/sbin All files in these directories should be owned by the `root` user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command: $ sudo chown root FILE
Rationale	System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted.

OVAL test results details

binary directories uid root oval:ssg-test_ownership_binary_directories:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_binary_directories:obj:1 of type file_object

Path	Filename	Filter
^\/(\|s)bin\|^\/usr\/(\|local\/)(\|s)bin\|^\/usr\/libexec	no value	oval:ssg-state_owner_binaries_not_root:ste:1

binary files uid root oval:ssg-test_ownership_binary_files:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_binary_files:obj:1 of type file_object

Path	Filename	Filter
^\/(\|s)bin\|^\/usr\/(\|local\/)(\|s)bin\|^\/usr\/libexec	/	oval:ssg-state_owner_binaries_not_root:ste:1

Verify that Shared Library Files Have Root Ownership

Rule ID	xccdf_org.ssgproject.content_rule_file_ownership_library_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_ownership_library_dirs:def:1
Time	2026-08-27T10:02:55+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94692-1 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-5(6), CM-5(6).1, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000259-GPOS-00100, 1409
Description	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are also stored in `/lib/modules`. All files in these directories should be owned by the `root` user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command: $ sudo chown root FILE
Rationale	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership is necessary to protect the integrity of the system.

OVAL test results details

Testing user ownership of /lib/ oval:ssg-test_file_ownership_library_dirs_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_library_dirs_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib	^.*$	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownership_library_dirs_0_0:ste:1

Testing user ownership of /lib64/ oval:ssg-test_file_ownership_library_dirs_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_library_dirs_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib64	^.*$	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownership_library_dirs_0_0:ste:1

Testing user ownership of /usr/lib/ oval:ssg-test_file_ownership_library_dirs_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_library_dirs_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib	^.*$	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownership_library_dirs_0_0:ste:1

Testing user ownership of /usr/lib64/ oval:ssg-test_file_ownership_library_dirs_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_ownership_library_dirs_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib64	^.*$	oval:ssg-symlink_file_owner:ste:1	oval:ssg-state_file_ownership_library_dirs_0_0:ste:1

Verify that System Executables Have Restrictive Permissions

Rule ID	xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permissions_binary_dirs:def:1
Time	2026-08-27T10:02:55+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94696-2 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-5(6), CM-5(6).1, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000259-GPOS-00100, R50, 1409
Description	System executables are stored in the following directories by default: /bin /sbin /usr/bin /usr/libexec /usr/local/bin /usr/local/sbin /usr/sbin All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w FILE
Rationale	System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

OVAL test results details

binary files go-w oval:ssg-test_perms_binary_files:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_binary_files:obj:1 of type file_object

Path	Filename	Filter	Filter
^\/(\|s)bin\|^\/usr\/(\|local\/)(\|s)bin\|^\/usr\/libexec	/	oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1	oval:ssg-state_perms_binary_files_symlink:ste:1

Verify that Shared Library Files Have Restrictive Permissions

Rule ID	xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permissions_library_dirs:def:1
Time	2026-08-27T10:02:58+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94690-5 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), CM-5(6), CM-5(6).1, AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000259-GPOS-00100, 1409
Description	System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 Kernel modules, which can be added to the kernel during runtime, are stored in `/lib/modules`. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w FILE
Rationale	Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system.

OVAL test results details

Testing mode of /lib/ oval:ssg-test_file_permissions_library_dirs_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_library_dirs_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib	^.*$	oval:ssg-exclude_symlinks__library_dirs:ste:1	oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1

Testing mode of /lib64/ oval:ssg-test_file_permissions_library_dirs_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_library_dirs_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib64	^.*$	oval:ssg-exclude_symlinks__library_dirs:ste:1	oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1

Testing mode of /usr/lib/ oval:ssg-test_file_permissions_library_dirs_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_library_dirs_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib	^.*$	oval:ssg-exclude_symlinks__library_dirs:ste:1	oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1

Testing mode of /usr/lib64/ oval:ssg-test_file_permissions_library_dirs_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_library_dirs_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib64	^.*$	oval:ssg-exclude_symlinks__library_dirs:ste:1	oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1

Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.

Rule ID	xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-root_permissions_syslibrary_files:def:1
Time	2026-08-27T10:03:01+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94694-7 References: CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100
Description	System-wide library files are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64 All system-wide shared library files should be protected from unauthorised access. If any of these files is not group-owned by root, correct its group-owner with the following command: $ sudo chgrp root FILE
Rationale	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

OVAL test results details

Testing group ownership of /lib/ oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib	^.*$	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1

Testing group ownership of /lib64/ oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/lib64	^.*$	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1

Testing group ownership of /usr/lib/ oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib	^.*$	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1

Testing group ownership of /usr/lib64/ oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1 of type file_object

Behaviors	Path	Filename	Filter	Filter
no value	/usr/lib64	^.*$	oval:ssg-symlink_file_groupowner:ste:1	oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1

Ensure All World-Writable Directories Are Group Owned by a System Account

Rule ID	xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned_group
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_perms_world_writable_system_owned_group:def:1
Time	2026-08-27T10:02:50+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95064-2 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227
Description	All directories in local partitions which are world-writable should be group owned by root or another system account. If any world-writable directories are not group owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.
Rationale	Allowing a user account to group own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users.

OVAL test results details

check for local directories that are world writable and have gid greater than or equal to 1000 oval:ssg-test_dir_world_writable_gid_gt_value:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-all_local_directories_gid:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/	no value	oval:ssg-state_gid_is_user_and_world_writable:ste:1

Verify that system commands directories have root as a group owner

Rule ID	xccdf_org.ssgproject.content_rule_dir_system_commands_group_root_owned
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_system_commands_group_root_owned:def:1
Time	2026-08-27T10:02:50+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94700-2 References: CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100, R50
Description	System commands are stored in the following directories: by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin All these directories should have `root` user as a group owner. If any system command directory is not group owned by a user other than root correct its ownership with the following command: $ sudo chgrp root DIR
Rationale	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

OVAL test results details

system commands directories uid root oval:ssg-test_group_ownership_system_commands_dirs:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_system_commands_dirs_group_ownership:obj:1 of type file_object

Path	Filename	Filter
^\/s?bin\|^\/usr\/s?bin\|^\/usr\/local\/s?bin	no value	oval:ssg-state_system_commands_dirs_group_owner_not_root:ste:1

Verify that system commands directories have root ownership

Rule ID	xccdf_org.ssgproject.content_rule_dir_system_commands_root_owned
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-dir_system_commands_root_owned:def:1
Time	2026-08-27T10:02:50+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94698-8 References: CM-5(6), CM-5(6).1, SRG-OS-000259-GPOS-00100, R50
Description	System commands are stored in the following directories by default: /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin All these directories should be owned by the `root` user. If any system command directory is not owned by a user other than root correct its ownership with the following command: $ sudo chown root DIR
Rationale	If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

OVAL test results details

system commands directories uid root oval:ssg-test_ownership_system_commands_directory_bin:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_ownership_system_commands_directory_bin_ownership:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/bin	no value	oval:ssg-state_system_commands_directory_bin_owner_not_root:ste:1

system commands directories uid root oval:ssg-test_ownership_system_commands_directory_sbin:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_ownership_system_commands_directory_sbin_ownership:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/sbin	no value	oval:ssg-state_system_commands_directory_sbin_owner_not_root:ste:1

system commands directories uid root oval:ssg-test_ownership_system_commands_directory_usr_bin:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_ownership_system_commands_directory_usr_bin_ownership:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/usr/bin	no value	oval:ssg-state_system_commands_directory_usr_bin_owner_not_root:ste:1

system commands directories uid root oval:ssg-test_ownership_system_commands_directory_usr_sbin:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_ownership_system_commands_directory_usr_sbin_ownership:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/usr/sbin	no value	oval:ssg-state_system_commands_directory_usr_sbin_owner_not_root:ste:1

system commands directories uid root oval:ssg-test_ownership_system_commands_directory_usr_local_bin:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_ownership_system_commands_directory_usr_local_bin_ownership:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/usr/local/bin	no value	oval:ssg-state_system_commands_directory_usr_local_bin_owner_not_root:ste:1

system commands directories uid root oval:ssg-test_ownership_system_commands_directory_usr_local_sbin:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_ownership_system_commands_directory_usr_local_sbin_ownership:obj:1 of type file_object

Behaviors	Path	Filename	Filter
no value	/usr/local/sbin	no value	oval:ssg-state_system_commands_directory_usr_local_sbin_owner_not_root:ste:1

Disable Modprobe Loading of USB Storage Driver

Rule ID	xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-kernel_module_usb-storage_disabled:def:1
Time	2026-08-27T10:03:01+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94722-6 References: 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.21, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, SRG-APP-000141-CTR-000315, 3.4.2, 3.4
Description	To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the `usb-storage` kernel module from being loaded, add the following line to the file `/etc/modprobe.d/usb-storage.conf`: install usb-storage /bin/false This entry will cause a non-zero return value during a `usb-storage` module installation and additionally convey the meaning of the entry to the user in form of an error message. If you would like to omit a non-zero return value and an error message, you may want to add a different line instead (both `/bin/true` and `/bin/false` are allowed by OVAL and will be accepted by the scan): install usb-storage /bin/true This will prevent the `modprobe` program from loading the `usb-storage` module, but will not prevent an administrator (or another program) from using the `insmod` program to load the module manually.
Rationale	USB storage devices such as thumb drives can be used to introduce malicious software.

OVAL test results details

kernel module usb-storage blacklisted oval:ssg-test_kernmod_usb-storage_blacklisted:tst:1 true

Following items have been found on the system:

Path	Content
/etc/modprobe.d/hardpipe-cis.conf	blacklist usb-storage
/etc/modprobe.d/usb-storage.conf	blacklist usb-storage

kernel module usb-storage disabled oval:ssg-test_kernmod_usb-storage_disabled:tst:1 true

Following items have been found on the system:

Path	Content
/etc/modprobe.d/usb-storage.conf	install usb-storage /bin/true
/etc/modprobe.d/hardpipe-cis.conf	install usb-storage /bin/true

kernel module usb-storage disabled in /etc/modprobe.conf oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/etc/modprobe.conf	^\s*install\s+usb-storage\s+(/bin/false\|/bin/true)$	1

Add nosuid Option to Removable Media Partitions

Rule ID	xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-mount_option_nosuid_removable_partitions:def:1
Time	2026-08-27T10:03:01+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95063-4 References: 11, 12, 13, 14, 15, 16, 18, 3, 5, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.06, DSS05.07, DSS06.02, DSS06.03, DSS06.06, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.11.2.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.AC-3, PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000480-GPOS-00227
Description	The `nosuid` mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removable media. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Allowing users to introduce SUID or SGID binaries from partitions mounted off of removable media would allow them to introduce their own highly-privileged programs.

OVAL test results details

Check if expected removable partitions truly exist on the system oval:ssg-test_removable_partition_doesnt_exist:tst:1 false

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/dev/cdrom	symbolic link	0	0	3	`rwxrwxrwx`

Check if removable partition variable value represents CD/DVD drive oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-var_removable_partition:var:1	/dev/cdrom

'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^[\s]*/dev/cdrom[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$

^[\s]*/dev/dvd[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$

^[\s]*/dev/scd0[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$

^[\s]*/dev/sr0[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$

/dev/cdrom

/dev/dvd

/dev/scd0

/dev/sr0

/etc/fstab

'CD/DVD drive is not listed in /etc/fstab oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

/dev/cdrom

/dev/dvd

/dev/scd0

/dev/sr0

/etc/fstab

Check if removable partition is configured with 'nosuid' mount option in /etc/fstab oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1 of type textfilecontent54_object

Filepath

Pattern

Instance

^[\s]*/dev/cdrom[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$

/dev/cdrom

/etc/fstab

Verify that local /var/log/messages is not world-readable

Rule ID	xccdf_org.ssgproject.content_rule_file_permissions_local_var_log_messages
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permissions_local_var_log_messages:def:1
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	References: SRG-OS-000206-GPOS-00084
Description	Files containing sensitive information should be protected by restrictive permissions. Most of the time, there is no need that these files need to be read by any non-root user To properly set the permissions of `/var/log/messages`, run the command: $ sudo chmod 0640 /var/log/messages Check that "permissions.local" file contains the correct permissions rules with the following command: # grep -i messages /etc/permissions.local /var/log/messages root:root 640
Rationale	The `/var/log/messages` file contains system error messages. Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the SUSE operating system or platform. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives.

OVAL test results details

package rsyslog is removed oval:ssg-service_syslog_disabled_test_service_syslog_package_rsyslog_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_syslog_disabled_test_service_syslog_package_rsyslog_removed:obj:1 of type rpminfo_object

Name
rsyslog

Test that the syslog service is not running oval:ssg-test_service_not_running_service_syslog_disabled_syslog:tst:1 true

Following items have been found on the system:

Unit	Property	Value
syslog.socket	ActiveState	inactive
syslog.service	ActiveState	inactive

Test that the property LoadState from the service syslog is masked oval:ssg-test_service_loadstate_is_masked_service_syslog_disabled_syslog:tst:1 false

Following items have been found on the system:

Unit	Property	Value
syslog.socket	LoadState	loaded
syslog.service	LoadState	not-found

Test that the service syslog is not found oval:ssg-test_service_not_found_service_syslog_disabled_syslog:tst:1 false

Following items have been found on the system:

Unit	Property	Value
syslog.socket	LoadState	loaded
syslog.service	LoadState	not-found

system.map files readable only by root oval:ssg-test_permissions_var_log_messages_files:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_local_var_log_messages_files:obj:1 of type file_object

Filepath
/var/log/messages

Verify Permissions of Local Logs of audit Tools

Rule ID	xccdf_org.ssgproject.content_rule_permissions_local_audit_binaries
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94689-7 References: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099
Description	The SUSE operating system audit tools must have the proper permissions configured to protect against unauthorized access. Check that "permissions.local" file contains the correct permissions rules with the following command: grep "^/usr/sbin/au" /etc/permissions.local /usr/sbin/audispd root:root 0750 /usr/sbin/auditctl root:root 0750 /usr/sbin/auditd root:root 0750 /usr/sbin/ausearch root:root 0755 /usr/sbin/aureport root:root 0755 /usr/sbin/autrace root:root 0750 /usr/sbin/augenrules root:root 0750 Audit tools include but are not limited to vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Rationale	Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. SUSE operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools.
Evaluation messages info No candidate or applicable check found.

Verify that Local Logs of the audit Daemon are not World-Readable

Rule ID	xccdf_org.ssgproject.content_rule_permissions_local_var_log_audit
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94666-5 References: AU-9, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029
Description	Files containing sensitive information should be protected by restrictive permissions. Most of the time, there is no need that these files need to be read by any non-root user. Check that "permissions.local" file contains the correct permissions rules with the following command: # grep -i audit /etc/permissions.local /var/log/audit/ root:root 600 /var/log/audit/audit.log root:root 600 /etc/audit/audit.rules root:root 640 /etc/audit/rules.d/audit.rules root:root 640
Rationale	Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Evaluation messages info No candidate or applicable check found.

Enable Randomized Layout of Virtual Address Space

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_kernel_randomize_va_space:def:1
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94728-3 References: 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), CIP-002-5 R1.1, CIP-002-5 R1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 4.1, CIP-004-6 4.2, CIP-004-6 R2.2.3, CIP-004-6 R2.2.4, CIP-004-6 R2.3, CIP-004-6 R4, CIP-005-6 R1, CIP-005-6 R1.1, CIP-005-6 R1.2, CIP-007-3 R3, CIP-007-3 R3.1, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R8.4, CIP-009-6 R.1.1, CIP-009-6 R4, SC-30, SC-30(2), CM-6(a), Req-2.2.1, SRG-OS-000433-GPOS-00193, SRG-OS-000480-GPOS-00227, SRG-APP-000450-CTR-001105, R9, 1409, 3.3.1.1, 3.3.1, 3.3
Description	To set the runtime status of the `kernel.randomize_va_space` kernel parameter, run the following command: $ sudo sysctl -w kernel.randomize_va_space=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.randomize_va_space = 2
Rationale	Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.

OVAL test results details

kernel.randomize_va_space static configuration oval:ssg-test_sysctl_kernel_randomize_va_space_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/91-stig-hardening.conf	kernel.randomize_va_space = 2
/etc/sysctl.conf	kernel.randomize_va_space = 2
/etc/sysctl.d/90-cis-os-hardening.conf	kernel.randomize_va_space=2
/etc/sysctl.d/99-hardpipe-kptr.conf	kernel.randomize_va_space = 2
/lib/sysctl.d/99-sysctl.conf	kernel.randomize_va_space = 2

kernel.randomize_va_space static configuration oval:ssg-test_sysctl_kernel_randomize_va_space_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/91-stig-hardening.conf	kernel.randomize_va_space = 2
/etc/sysctl.conf	kernel.randomize_va_space = 2
/etc/sysctl.d/90-cis-os-hardening.conf	kernel.randomize_va_space=2
/etc/sysctl.d/99-hardpipe-kptr.conf	kernel.randomize_va_space = 2
/lib/sysctl.d/99-sysctl.conf	kernel.randomize_va_space = 2

kernel.randomize_va_space static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_randomize_va_space_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	kernel.randomize_va_space = 2

kernel runtime parameter kernel.randomize_va_space set to 2 oval:ssg-test_sysctl_kernel_randomize_va_space_runtime:tst:1 true

Following items have been found on the system:

Name	Value
kernel.randomize_va_space	2

Restrict Access to Kernel Message Buffer

Rule ID	xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sysctl_kernel_dmesg_restrict:def:1
Time	2026-08-27T10:03:02+00:00
Severity	low
Identifiers and References	Identifiers: CCE-94683-0 References: 3.1.5, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), SI-11(a), SI-11(b), FMT_SMF_EXT.1, SRG-OS-000132-GPOS-00067, SRG-OS-000138-GPOS-00069, SRG-APP-000243-CTR-000600, R9, 1546
Description	To set the runtime status of the `kernel.dmesg_restrict` kernel parameter, run the following command: $ sudo sysctl -w kernel.dmesg_restrict=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.dmesg_restrict = 1
Rationale	Unprivileged access to the kernel syslog can expose sensitive kernel address information.

OVAL test results details

kernel.dmesg_restrict static configuration oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user:tst:1 true

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	kernel.dmesg_restrict=1
/etc/sysctl.conf	kernel.dmesg_restrict = 1
/etc/sysctl.d/91-stig-hardening.conf	kernel.dmesg_restrict = 1
/etc/sysctl.d/99-hardpipe-kptr.conf	kernel.dmesg_restrict = 1
/lib/sysctl.d/50-default.conf	kernel.dmesg_restrict = 1
/lib/sysctl.d/99-sysctl.conf	kernel.dmesg_restrict = 1

kernel.dmesg_restrict static configuration oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user_missing:tst:1 false

Following items have been found on the system:

Path	Content
/etc/sysctl.d/90-cis-os-hardening.conf	kernel.dmesg_restrict=1
/etc/sysctl.conf	kernel.dmesg_restrict = 1
/etc/sysctl.d/91-stig-hardening.conf	kernel.dmesg_restrict = 1
/etc/sysctl.d/99-hardpipe-kptr.conf	kernel.dmesg_restrict = 1
/lib/sysctl.d/50-default.conf	kernel.dmesg_restrict = 1
/lib/sysctl.d/99-sysctl.conf	kernel.dmesg_restrict = 1

kernel.dmesg_restrict static configuration in /usr/lib/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_dmesg_restrict_static_pkg_correct:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/sysctl.d/99-sysctl.conf	kernel.dmesg_restrict = 1
/usr/lib/sysctl.d/50-default.conf	kernel.dmesg_restrict = 1

kernel runtime parameter kernel.dmesg_restrict set to 1 oval:ssg-test_sysctl_kernel_dmesg_restrict_runtime:tst:1 true

Following items have been found on the system:

Name	Value
kernel.dmesg_restrict	1

Install policycoreutils-python-utils package

Rule ID	xccdf_org.ssgproject.content_rule_package_policycoreutils-python-utils_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_policycoreutils-python-utils_installed:def:1
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95096-4 References: SRG-OS-000480-GPOS-00227
Description	The `policycoreutils-python-utils` package can be installed with the following command: $ sudo zypper install policycoreutils-python-utils
Rationale	This package is required to operate and manage an SELinux environment and its policies. It provides utilities such as semanage, audit2allow, audit2why, chcat and sandbox.

OVAL test results details

package policycoreutils-python-utils is installed oval:ssg-test_package_policycoreutils-python-utils_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
policycoreutils-python-utils	noarch	(none)	160000.5.1	3.8.1	0:3.8.1-160000.5.1	fec28eaf09d9ea69	policycoreutils-python-utils-0:3.8.1-160000.5.1.noarch

Install policycoreutils Package

Rule ID	xccdf_org.ssgproject.content_rule_package_policycoreutils_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_policycoreutils_installed:def:1
Time	2026-08-27T10:03:02+00:00
Severity	low
Identifiers and References	Identifiers: CCE-95093-1 References: SRG-OS-000480-GPOS-00227, SRG-OS-000134-GPOS-00068
Description	The `policycoreutils` package can be installed with the following command: $ sudo zypper install policycoreutils
Rationale	Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve security of the Flask operating system. These architectural components provide general support for the enforcement of many kinds of mandatory access control policies, including those based on the concepts of Type Enforcement, Role-based Access Control, and Multi-level Security. `policycoreutils` contains the policy core utilities that are required for basic operation of an SELinux-enabled system. These utilities include `load_policy` to load SELinux policies, `setfiles` to label filesystems, `newrole` to switch roles, and so on.

OVAL test results details

package policycoreutils is installed oval:ssg-test_package_policycoreutils_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
policycoreutils	x86_64	(none)	160000.5.1	3.8.1	0:3.8.1-160000.5.1	fec28eaf09d9ea69	policycoreutils-0:3.8.1-160000.5.1.x86_64

Configure SELinux Policy

Rule ID	xccdf_org.ssgproject.content_rule_selinux_policytype
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-selinux_policytype:def:1
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95094-9 References: 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9, APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01, 3.1.2, 3.7.2, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.2, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-004-6 R3.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CIP-007-3 R6.5, AC-3, AC-3(3)(a), AU-9, SC-7(21), DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4, FMT_MOF_EXT.1, SRG-OS-000445-GPOS-00199, SRG-APP-000233-CTR-000585, R46, R64, APP.4.4.A4, SYS.1.6.A3, SYS.1.6.A18, SYS.1.6.A21, 1409, 1.2.6, 1.2
Description	The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`: SELINUXTYPE=targeted Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.
Rationale	Setting the SELinux policy to `targeted` or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in `permissive` mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to `targeted`.

OVAL test results details

tests the value of SELINUXTYPE setting in the /etc/selinux/config file oval:ssg-test_selinux_policytype:tst:1 true

Following items have been found on the system:

Path	Content
/etc/selinux/config	SELINUXTYPE=targeted

The configuration file /etc/selinux/config exists for selinux_policytype oval:ssg-test_selinux_policytype_config_file_exists:tst:1 true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/etc/selinux/config	regular	0	0	679	`rw-r--r--`

Ensure SELinux State is Enforcing

Rule ID xccdf_org.ssgproject.content_rule_selinux_state

Result

fail

Multi-check rule no

OVAL Definition ID oval:ssg-selinux_state:def:1

Time 2026-08-27T10:03:02+00:00

Severity high

Identifiers and References

Identifiers: CCE-95092-3

References: 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9, APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01, 3.1.2, 3.7.2, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.2, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-004-6 R3.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CIP-007-3 R6.5, AC-3, AC-3(3)(a), AU-9, SC-7(21), DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4, FMT_MOF_EXT.1, SRG-OS-000445-GPOS-00199, SRG-OS-000134-GPOS-00068, R37, R79, APP.4.4.A4, SYS.1.6.A3, SYS.1.6.A18, SYS.1.6.A21, 1409, 1.2.6, 1.2

Description

The SELinux state should be set to enforcing at system boot time. In the file /etc/selinux/config, add or correct the following line to configure the system to boot into enforcing mode:

SELINUX=enforcing

Ensure that all files have correct SELinux labels by running:

fixfiles onboot

Then reboot the system.

Rationale

Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges.

Remediation Shell script ⇲

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default || rpm --quiet -q kernel-default-base; then

var_selinux_state='enforcing'


if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=$var_selinux_state" >> "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet ⇲

Complexity:	low
Disruption:	low
Reboot:	false
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-95092-3
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state
- name: XCCDF Value var_selinux_state # promote to variable
  set_fact:
    var_selinux_state: !!str enforcing
  tags:
    - always

- name: Ensure SELinux State is Enforcing - Check current SELinux state
  ansible.builtin.command:
    cmd: getenforce
  register: current_selinux_state
  check_mode: false
  changed_when: false
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-95092-3
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state

- name: Ensure SELinux State is Enforcing
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    when: dupes.found is defined and dupes.found > 1

  - name: Insert correct line to /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      line: SELINUX={{ var_selinux_state }}
      state: present
  when: ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  tags:
  - CCE-95092-3
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state

- name: Ensure SELinux State is Enforcing - Mark system to relabel SELinux on next
    boot
  ansible.builtin.file:
    path: /.autorelabel
    state: touch
    access_time: preserve
    modification_time: preserve
  when:
  - ("kernel-default" in ansible_facts.packages or "kernel-default-base" in ansible_facts.packages)
  - current_selinux_state.stdout | lower != var_selinux_state
  tags:
  - CCE-95092-3
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state

OVAL test results details

/selinux/enforce is 1 oval:ssg-test_etc_selinux_config:tst:1 false

Following items have been found on the system:

Path	Content
/etc/selinux/config	SELINUX=permissive

Map System Users To The Appropriate SELinux Role

Rule ID	xccdf_org.ssgproject.content_rule_selinux_user_login_roles
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:03:02+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95099-8 References: SRG-OS-000324-GPOS-00125
Description	Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. All administrators must be mapped to the `sysadm_u` or `staff_u` users with the appropriate domains (`sysadm_t` and `staff_t`). $ sudo semanage login -m -s sysadm_u USER or $ sudo semanage login -m -s staff_u USER All authorized non-administrative users must be mapped to the `user_u` role or the appropriate domain (user_t). $ sudo semanage login -m -s user_u USER
Rationale	Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
Evaluation messages info No candidate or applicable check found.

Disable KDump Kernel Crash Analyzer (kdump)

Rule ID	xccdf_org.ssgproject.content_rule_service_kdump_disabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-service_kdump_disabled:def:1
Time	2026-08-27T10:03:03+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95065-9 References: 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, FMT_SMF_EXT.1.1, SRG-OS-000269-GPOS-00103, SRG-OS-000480-GPOS-00227, 1409
Description	The `kdump` service provides a kernel crash dump analyzer. It uses the `kexec` system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The `kdump` service can be disabled with the following command: $ sudo systemctl mask --now kdump.service
Rationale	Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. Unless the system is used for kernel development or testing, there is little need to run the kdump service.

OVAL test results details

package kexec-tools is removed oval:ssg-service_kdump_disabled_test_service_kdump_package_kexec-tools_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
kexec-tools	x86_64	(none)	160000.3.2	2.0.30	0:2.0.30-160000.3.2	fec28eaf09d9ea69	kexec-tools-0:2.0.30-160000.3.2.x86_64

Test that the kdump service is not running oval:ssg-test_service_not_running_service_kdump_disabled_kdump:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_not_running_service_kdump_disabled_kdump:obj:1 of type systemdunitproperty_object

Unit	Property
^kdump\.(service\|socket)$	ActiveState

Test that the property LoadState from the service kdump is masked oval:ssg-test_service_loadstate_is_masked_service_kdump_disabled_kdump:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_loadstate_is_masked_service_kdump_disabled_kdump:obj:1 of type systemdunitproperty_object

Unit	Property
^kdump\.(service\|socket)$	LoadState

Test that the service kdump is not found oval:ssg-test_service_not_found_service_kdump_disabled_kdump:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_service_loadstate_is_masked_service_kdump_disabled_kdump:obj:1 of type systemdunitproperty_object

Unit	Property
^kdump\.(service\|socket)$	LoadState

A remote time server for Chrony is configured

Rule ID	xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server
Result	notapplicable
Multi-check rule	no
Time	2026-08-27T10:03:03+00:00
Severity	medium
Identifiers and References	References: CM-6(a), AU-8(1)(a), Req-10.4.3, SRG-OS-000355-GPOS-00143, R71, 0988, 1405, 10.6.2, 10.6
Description	`Chrony` is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on `chrony` can be found at https://chrony-project.org/. `Chrony` can be configured to be a client and/or a server. Add or edit server or pool lines to `/etc/chrony.conf` as appropriate: server <remote-server> Alternatively, server or pool directives can be specified in files included via `sourcedir` or `confdir` directives in `/etc/chrony.conf`. When using `sourcedir`, create `.sources` files in the specified directory: # In /etc/chrony.conf: sourcedir /etc/chrony/sources.d # In /etc/chrony/sources.d/ntp.sources: server 0.pool.ntp.org When using `confdir`, create `.conf` files in the specified directory: # In /etc/chrony.conf: confdir /etc/chrony/conf.d # In /etc/chrony/conf.d/ntp-servers.conf: pool 1.pool.ntp.org Multiple servers may be configured.
Rationale	If `chrony` is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

Configure Time Service Maxpoll Interval

Rule ID	xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll
Result	notapplicable
Multi-check rule	no
Time	2026-08-27T10:03:03+00:00
Severity	medium
Identifiers and References	References: 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), AU-8(1)(b), AU-12(1), PR.PT-1, SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144, SRG-OS-000359-GPOS-00146
Description	The `maxpoll` should be configured to 16 in `/etc/ntp.conf` or `/etc/chrony.conf` (or `/etc/chrony.d/`) to continuously poll time servers. To configure `maxpoll` in `/etc/ntp.conf` or `/etc/chrony.conf` (or `/etc/chrony.d/`) add the following after each `server`, `pool` or `peer` entry: maxpoll 16 to `server` directives. If using chrony, any `pool` directives should be configured too.
Rationale	Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).

Remove Host-Based Authentication Files

Rule ID	xccdf_org.ssgproject.content_rule_no_host_based_files
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-no_host_based_files:def:1
Time	2026-08-27T10:03:13+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95051-9 References: SRG-OS-000480-GPOS-00227
Description	The `shosts.equiv` file lists remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location: $ sudo rm /[path]/[to]/[file]/shosts.equiv
Rationale	The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.

OVAL test results details

look for shosts.equiv in / oval:ssg-test_no_shosts_equiv:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_shosts_equiv_files_root:obj:1 of type file_object

Behaviors	Path	Filename
no value	/	shosts.equiv

Remove User Host-Based Authentication Files

Rule ID	xccdf_org.ssgproject.content_rule_no_user_host_based_files
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-no_user_host_based_files:def:1
Time	2026-08-27T10:03:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95049-3 References: SRG-OS-000480-GPOS-00227
Description	The `~/.shosts` (in each user's home directory) files list remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location: $ sudo find / -name '.shosts' -type f -delete
Rationale	The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.

OVAL test results details

look for .shosts in / oval:ssg-test_no_shosts:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_no_shosts_files_root:obj:1 of type file_object

Behaviors	Path	Filename
no value	/	.shosts

Uninstall telnet-server Package

Rule ID	xccdf_org.ssgproject.content_rule_package_telnet-server_removed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_telnet-server_removed:def:1
Time	2026-08-27T10:03:22+00:00
Severity	high
Identifiers and References	Identifiers: CCE-94643-4 References: 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, Req-2.2.2, SRG-OS-000095-GPOS-00049, R62, 1409, 2.2.4, 2.2
Description	The `telnet-server` package can be removed with the following command: $ sudo zypper remove telnet-server
Rationale	It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities are often overlooked and therefore may remain insecure. They increase the risk to the platform by providing additional attack vectors. The telnet service provides an unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised. Removing the `telnet-server` package decreases the risk of the telnet service's accidental (or intentional) activation.

OVAL test results details

package telnet-server is removed oval:ssg-test_package_telnet-server_removed:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-obj_test_package_telnet-server_removed:obj:1 of type rpminfo_object

Name
telnet-server

Set SSH Client Alive Count Max

Rule ID	xccdf_org.ssgproject.content_rule_sshd_set_keepalive
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_set_keepalive:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94685-5 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.5.6, APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.11, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2, Req-8.1.8, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, 8.2.8, 8.2
Description	The SSH server sends at most `ClientAliveCountMax` messages during a SSH session and waits for a response from the SSH client. The option `ClientAliveInterval` configures timeout after each `ClientAliveCountMax` message. If the SSH server does not receive a response from the client, then the connection is considered unresponsive and terminated. For SSH earlier than v8.2, a `ClientAliveCountMax` value of `0` causes a timeout precisely when the `ClientAliveInterval` is set. Starting with v8.2, a value of `0` disables the timeout functionality completely. If the option is set to a number greater than `0`, then the session will be disconnected after `ClientAliveInterval * ClientAliveCountMax` seconds without receiving a keep alive message.
Rationale	This ensures a user login will be terminated as soon as the `ClientAliveInterval` is reached.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_keepalive:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	ClientAliveCountMax 0

Verify that the value of ClientAliveCountMax is present oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	ClientAliveCountMax 0

Set SSH Client Alive Interval

Rule ID	xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_set_idle_timeout:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94681-4 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.5.6, APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.11, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CM-6(a), AC-17(a), AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2, Req-8.1.8, SRG-OS-000126-GPOS-00066, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000395-GPOS-00175, 8.2.8, 8.2
Description	SSH allows administrators to set a network responsiveness timeout interval. After this interval has passed, the unresponsive client will be automatically logged out. To set this timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows: ClientAliveInterval 600 The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in `/etc/ssh/sshd_config`. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.
Rationale	Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.
Warnings	warning SSH disconnecting unresponsive clients will not have desired effect without also configuring ClientAliveCountMax in the SSH service configuration. warning Following conditions may prevent the SSH session to time out: Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens. Any `scp` or `sftp` activity by the same user to the host resets the timeout.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

timeout is configured oval:ssg-test_sshd_idle_timeout:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	ClientAliveInterval 600

Verify that the value of ClientAliveInterval is present oval:ssg-test_clientaliveinterval_present:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	ClientAliveInterval 600

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_keepalive:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	ClientAliveCountMax 0

Verify that the value of ClientAliveCountMax is present oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	ClientAliveCountMax 0

Disable SSH Access via Empty Passwords

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_disable_empty_passwords:def:1
Time	2026-08-27T10:03:23+00:00
Severity	high
Identifiers and References	Identifiers: CCE-95091-5 References: 11, 12, 13, 14, 15, 16, 18, 3, 5, 9, 5.5.6, APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, 3.1.1, 3.1.5, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3, FIA_UAU.1, Req-2.2.4, SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00227, 1546, 2.2.6, 2.2
Description	Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for `PermitEmptyPasswords`. To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config`: PermitEmptyPasswords no Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.
Rationale	Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_empty_passwords:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PermitEmptyPasswords no

Verify that the value of PermitEmptyPasswords is present oval:ssg-test_PermitEmptyPasswords_present_sshd_disable_empty_passwords:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PermitEmptyPasswords no

Disable SSH Root Login

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_root_login
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_disable_root_login:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94674-9 References: 1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.6, APO01.06, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.06, DSS06.10, 3.1.1, 3.1.5, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, AC-6(2), AC-17(a), IA-2, IA-2(5), CM-7(a), CM-7(b), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, PR.PT-3, FAU_GEN.1, Req-2.2.4, SRG-OS-000109-GPOS-00056, SRG-OS-000480-GPOS-00227, SRG-APP-000148-CTR-000335, SRG-APP-000190-CTR-000500, R33, 1546, 2.2.6, 2.2
Description	The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config`: PermitRootLogin no
Rationale	Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_root_login:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PermitRootLogin no

Verify that the value of PermitRootLogin is present oval:ssg-test_PermitRootLogin_present_sshd_disable_root_login:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PermitRootLogin no

Disable SSH Support for User Known Hosts

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_disable_user_known_hosts:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95068-3 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.12, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.IP-1, SRG-OS-000480-GPOS-00227, 1546
Description	SSH can allow system users to connect to systems if a cache of the remote systems public keys is available. This should be disabled. To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config`: IgnoreUserKnownHosts yes
Rationale	Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_user_known_hosts:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	IgnoreUserKnownHosts yes

Verify that the value of IgnoreUserKnownHosts is present oval:ssg-test_IgnoreUserKnownHosts_present_sshd_disable_user_known_hosts:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	IgnoreUserKnownHosts yes

Disable X11 Forwarding

Rule ID	xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_disable_x11_forwarding:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95072-5 References: CM-6(b), SRG-OS-000480-GPOS-00227, 0484, 2.2.6, 2.2
Description	The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. SSH has the capability to encrypt remote X11 connections when SSH's `X11Forwarding` option is enabled. The default SSH configuration disables X11Forwarding. The appropriate configuration is used if no value is set for `X11Forwarding`. To explicitly disable X11 Forwarding, add or correct the following line in `/etc/ssh/sshd_config`: X11Forwarding no
Rationale	Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_x11_forwarding:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	X11Forwarding no

Verify that the value of X11Forwarding is present oval:ssg-test_X11Forwarding_present_sshd_disable_x11_forwarding:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	X11Forwarding no

Do Not Allow SSH Environment Options

Rule ID	xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_do_not_permit_user_env:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95090-7 References: 11, 3, 9, 5.5.6, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.12, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.IP-1, Req-2.2.4, SRG-OS-000480-GPOS-00229, 1546, 2.2.6, 2.2
Description	Ensure that users are not able to override environment variables of the SSH daemon. The default SSH configuration disables environment processing. The appropriate configuration is used if no value is set for `PermitUserEnvironment`. To explicitly disable Environment options, add or correct the following `/etc/ssh/sshd_config`: PermitUserEnvironment no
Rationale	SSH environment options potentially allow users to bypass access restriction in some configurations.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_do_not_permit_user_env:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PermitUserEnvironment no

Verify that the value of PermitUserEnvironment is present oval:ssg-test_PermitUserEnvironment_present_sshd_do_not_permit_user_env:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PermitUserEnvironment no

Enable Use of Strict Mode Checking

Rule ID	xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_enable_strictmodes:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95071-7 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.1.12, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6, AC-17(a), CM-6(a), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 1409
Description	SSHs `StrictModes` option checks file and ownership permissions in the user's home directory `.ssh` folder before accepting login. If world- writable permissions are found, logon is rejected. The default SSH configuration has `StrictModes` enabled. The appropriate configuration is used if no value is set for `StrictModes`. To explicitly enable `StrictModes` in SSH, add or correct the following line in `/etc/ssh/sshd_config`: StrictModes yes
Rationale	If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of StrictModes setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_strictmodes:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	StrictModes yes

Verify that the value of StrictModes is present oval:ssg-test_StrictModes_present_sshd_enable_strictmodes:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	StrictModes yes

Enable SSH Warning Banner

Rule ID	xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_enable_warning_banner:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94626-9 References: 1, 12, 15, 16, 5.5.6, DSS05.04, DSS05.10, DSS06.10, 3.1.9, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-8(a), AC-8(c), AC-17(a), CM-6(a), PR.AC-7, FTA_TAB.1, Req-2.2.4, SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088, 0484
Description	To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config`: Banner /etc/issue Another section contains information on how to create an appropriate system-wide warning banner.
Rationale	The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of Banner setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_warning_banner:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	Banner /etc/issue

Verify that the value of Banner is present oval:ssg-test_Banner_present_sshd_enable_warning_banner:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	Banner /etc/issue

Enable SSH Print Last Log

Rule ID	xccdf_org.ssgproject.content_rule_sshd_print_last_log
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_print_last_log:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95045-1 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-9, AC-9(1), PR.AC-7, SRG-OS-000480-GPOS-00227, 0582, 0846
Description	Ensure that SSH will display the date and time of the last successful account logon. The default SSH configuration enables print of the date and time of the last login. The appropriate configuration is used if no value is set for `PrintLastLog`. To explicitly enable LastLog in SSH, add or correct the following line in `/etc/ssh/sshd_config`: PrintLastLog yes
Rationale	Providing users feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_print_last_log:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PrintLastLog yes

Verify that the value of PrintLastLog is present oval:ssg-test_PrintLastLog_present_sshd_print_last_log:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	PrintLastLog yes

Set SSH Daemon LogLevel to VERBOSE

Rule ID	xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_set_loglevel_verbose:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94627-7 References: CIP-007-3 R7.1, AC-17(a), AC-17(1), CM-6(a), Req-2.2.4, SRG-OS-000032-GPOS-00013, 2.2.6, 2.2
Description	The `VERBOSE` parameter configures the SSH daemon to record login and logout activity. To specify the log level in SSH, add or correct the following line in `/etc/ssh/sshd_config`: LogLevel VERBOSE
Rationale	SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` or `VERBOSE` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of LogLevel setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_loglevel_verbose:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	LogLevel VERBOSE

Verify that the value of LogLevel is present oval:ssg-test_LogLevel_present_sshd_set_loglevel_verbose:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	LogLevel VERBOSE

Use Only FIPS 140-2 Validated Ciphers

Rule ID	xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_use_approved_ciphers:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94647-5 References: 1, 11, 12, 14, 15, 16, 18, 3, 5, 6, 8, 9, 5.5.6, APO11.04, APO13.01, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, MEA02.01, 3.1.13, 3.13.11, 3.13.8, 164.308(b)(1), 164.308(b)(2), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii), 164.314(b)(2)(i), 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.18.1.4, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CM-6(a), AC-17(a), AC-17(2), SC-13, MA-4(6), IA-5(1)(c), SC-12(2), SC-12(3), PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-1, PR.PT-1, PR.PT-3, PR.PT-4, SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 2.2.7, 2.2
Description	Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved ciphers: Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc The man page `sshd_config(5)` contains a list of supported ciphers. The rule is parametrized to use the following ciphers: `aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se`.
Rationale	Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on SUSE Linux Enterprise Micro 6.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of Ciphers setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_approved_ciphers:tst:1 true

Following items have been found on the system:

Var ref	Value	Value	Value
oval:ssg-var_sshd_config_ciphers:var:1	aes256-ctr	aes192-ctr	aes128-ctr

Use Only FIPS 140-2 Validated Ciphers

Rule ID	xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers_ordered_stig
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_use_approved_ciphers_ordered_stig:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94646-7 References: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174
Description	Limit the ciphers to those algorithms which are FIPS-approved. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved ciphers: Ciphers aes256-ctr,aes192-ctr,aes128-ctr This rule ensures that there are configured ciphers mentioned above (or their subset), keeping the given order of algorithms.
Rationale	Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on SUSE Linux Enterprise Micro 6.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of Ciphers setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_approved_ciphers_ordered_stig:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	Ciphers aes256-ctr,aes192-ctr,aes128-ctr

Use Only FIPS 140-2 Validated Key Exchange Algorithms

Rule ID	xccdf_org.ssgproject.content_rule_sshd_use_approved_kex_ordered_stig
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_use_approved_kex_ordered_stig:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94688-9 References: AC-17(2), SRG-OS-000250-GPOS-00093
Description	Limit the key exchange algorithms to those which are FIPS-approved. Add or modify the following line in `/etc/ssh/sshd_config` KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256 This rule ensures that only the key exchange algorithms mentioned above (or their subset) are configured for use, keeping the given order of algorithms.
Rationale	FIPS-approved key exchange algorithms are required to be used. The system will attempt to use the first algorithm presented by the client that matches the server list. Listing the values "strongest to weakest" is a method to ensure the use of the strongest algorithm available to secure the SSH connection.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System crypto modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this requirements, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of Kex algorithms setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_approved_kex_ordered_stig:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256

Use Only FIPS 140-2 Validated MACs

Rule ID	xccdf_org.ssgproject.content_rule_sshd_use_approved_macs
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_use_approved_macs:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94680-6 References: 1, 12, 13, 15, 16, 5, 8, APO01.06, APO13.01, DSS01.04, DSS05.02, DSS05.03, DSS05.04, DSS05.07, DSS06.02, DSS06.03, 3.1.13, 3.13.11, 3.13.8, 164.308(b)(1), 164.308(b)(2), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii), 164.314(b)(2)(i), 4.3.3.5.1, 4.3.3.6.6, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.6, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.11.2.6, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CM-6(a), AC-17(a), AC-17(2), SC-13, MA-4(6), SC-12(2), SC-12(3), PR.AC-1, PR.AC-3, PR.DS-5, PR.PT-4, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000394-GPOS-00174, 2.2.7, 2.2
Description	Limit the MACs to those hash algorithms which are FIPS-approved. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved MACs: MACs hmac-sha2-512,hmac-sha2-256 The man page `sshd_config(5)` contains a list of supported MACs. The rule is parametrized to use the following MACs: `hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com`.
Rationale	FIPS-approved cryptographic hash functions are required to be used. The only SSHv2 hash algorithms meeting this requirement is SHA2.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of MACs setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_approved_macs:tst:1 true

Following items have been found on the system:

Var ref	Value	Value
oval:ssg-var_sshd_config_macs:var:1	hmac-sha2-512	hmac-sha2-256

Use Only FIPS 140-2 Validated MACs

Rule ID	xccdf_org.ssgproject.content_rule_sshd_use_approved_macs_ordered_stig
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-sshd_use_approved_macs_ordered_stig:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94679-8 References: SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000394-GPOS-00174
Description	Limit the MACs to those hash algorithms which are FIPS-approved. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved MACs: MACs hmac-sha2-512,hmac-sha2-256 This rule ensures that there are configured MACs mentioned above (or their subset), keeping the given order of algorithms.
Rationale	FIPS-approved cryptographic hash functions are required to be used. The only SSHv2 hash algorithms meeting this requirement is SHA2.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

OVAL test results details

Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true

Following items have been found on the system:

Var ref	Value
oval:ssg-sshd_required:var:1	0

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

tests the value of MACs setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_use_approved_macs_ordered_stig:tst:1 true

Following items have been found on the system:

Path	Content
/etc/ssh/sshd_config	MACs hmac-sha2-512,hmac-sha2-256

Install the OpenSSH Server Package

Rule ID	xccdf_org.ssgproject.content_rule_package_openssh-server_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_openssh-server_installed:def:1
Time	2026-08-27T10:03:22+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94725-9 References: 13, 14, APO01.06, DSS05.02, DSS05.04, DSS05.07, DSS06.02, DSS06.06, SR 3.1, SR 3.8, SR 4.1, SR 4.2, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), PR.DS-2, PR.DS-5, FIA_UAU.5, FTP_ITC_EXT.1, FCS_SSH_EXT.1, FCS_SSHS_EXT.1, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Description	The `openssh-server` package should be installed. The `openssh-server` package can be installed with the following command: $ sudo zypper install openssh-server
Rationale	Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered.

OVAL test results details

package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Enable the OpenSSH Service

Rule ID	xccdf_org.ssgproject.content_rule_service_sshd_enabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-service_sshd_enabled:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94726-7 References: 13, 14, APO01.06, DSS05.02, DSS05.04, DSS05.07, DSS06.02, DSS06.06, 3.1.13, 3.5.4, 3.13.8, SR 3.1, SR 3.8, SR 4.1, SR 4.2, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), SC-8, SC-8(1), SC-8(2), SC-8(3), SC-8(4), PR.DS-2, PR.DS-5, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190
Description	The SSH server service, sshd, is commonly needed. The `sshd` service can be enabled with the following command: $ sudo systemctl enable sshd.service
Rationale	Without protection of the transmitted information, confidentiality, and integrity may be compromised because unprotected communications can be intercepted and either read or altered. This checklist item applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, etc). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.

OVAL test results details

package openssh-server is installed oval:ssg-test_service_sshd_package_openssh-server_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
openssh-server	x86_64	(none)	160000.7.1	10.0p2	0:10.0p2-160000.7.1	fec28eaf09d9ea69	openssh-server-0:10.0p2-160000.7.1.x86_64

Test that the sshd service is running oval:ssg-test_service_running_sshd:tst:1 true

Following items have been found on the system:

Unit	Property	Value
sshd.service	ActiveState	active

systemd test oval:ssg-test_multi_user_wants_sshd:tst:1 true

Following items have been found on the system:

Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
multi-user.target	basic.target	sysinit.target	systemd-firstboot.service	sys-kernel-config.mount	systemd-hibernate-clear.service	systemd-modules-load.service	systemd-timesyncd.service	systemd-binfmt.service	dev-hugepages.mount	integritysetup.target	dracut-shutdown.service	lvm2-lvmpolld.socket	systemd-random-seed.service	cryptsetup.target	systemd-pstore.service	systemd-sysctl.service	sys-kernel-debug.mount	kmod-static-nodes.service	systemd-repart.service	dev-mqueue.mount	systemd-tmpfiles-setup.service	systemd-time-wait-sync.service	systemd-udevd.service	systemd-udev-trigger.service	systemd-tmpfiles-setup-dev.service	systemd-journald.service	systemd-sysusers.service	systemd-machine-id-commit.service	systemd-hwdb-update.service	systemd-update-done.service	sys-kernel-tracing.mount	sys-fs-fuse-connections.mount	local-fs.target	var-lib-cni.mount	boot.mount	usr-lib-firmware.mount	var-lib-harvester-defaultdisk.mount	var-lib-third\x2dparty.mount	srv.mount	etc-pki-trust-anchors.mount	root.mount	etc.mount	-.mount	var-log.mount	var-crash.mount	var.mount	etc-nvme.mount	etc-systemd.mount	var-lib-longhorn.mount	var-lib-wicked.mount	home.mount	var-lib-NetworkManager.mount	var-lib-rancher.mount	etc-ssh.mount	var-lib-kubelet.mount	etc-rancher.mount	opt.mount	etc-NetworkManager.mount	usr-local.mount	usr-libexec.mount	etc-iscsi.mount	oem.mount	run-overlay.mount	etc-cni.mount	systemd-remount-fs.service	tmp.mount	systemd-journal-flush.service	systemd-ask-password-console.path	systemd-journal-catalog-update.service	veritysetup.target	systemd-tmpfiles-setup-dev-early.service	swap.target	elemental-setup-fs.service	proc-sys-fs-binfmt_misc.automount	paths.target	slices.target	-.slice	system.slice	sockets.target	systemd-coredump.socket	dm-event.socket	systemd-pcrlock.socket	systemd-udevd-kernel.socket	systemd-bootctl.socket	systemd-creds.socket	dbus.socket	iscsid.socket	systemd-sysext.socket	systemd-journald.socket	systemd-udevd-control.socket	systemd-journald-dev-log.socket	systemd-hostnamed.socket	timers.target	btrfs-defrag.timer	aidecheck.timer	snapper-cleanup.timer	systemd-tmpfiles-clean.timer	logrotate.timer	btrfs-trim.timer	fstrim.timer	snapper-timeline.timer	btrfs-scrub.timer	btrfs-balance.timer	audit-rules.service	hardpipe-file-perms.service	sshd.service	remote-fs.target	iscsi.service	systemd-logind.service	NetworkManager.service	hardpipe-login-defs-mount.service	btrfsmaintenance-refresh.path	rke2-server.service	lvm2-monitor.service	elemental-setup-boot.service	auditd.service	getty.target	getty@tty1.service	smartd.service	hardpipe-selinux-relabel.service	elemental-setup-reconcile.service	hardpipe-post-boot-hardening.service	vmtoolsd.service	hardpipe-etcd-user.service	hardpipe-relabel-activeimg.service	kbdsettings.service	elemental-setup-reconcile.timer	rancherd.service	systemd-user-sessions.service	rancher-system-agent.service	elemental-setup-network.service

systemd test oval:ssg-test_multi_user_wants_sshd_socket:tst:1 false

Following items have been found on the system:

Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
multi-user.target	basic.target	sysinit.target	systemd-firstboot.service	sys-kernel-config.mount	systemd-hibernate-clear.service	systemd-modules-load.service	systemd-timesyncd.service	systemd-binfmt.service	dev-hugepages.mount	integritysetup.target	dracut-shutdown.service	lvm2-lvmpolld.socket	systemd-random-seed.service	cryptsetup.target	systemd-pstore.service	systemd-sysctl.service	sys-kernel-debug.mount	kmod-static-nodes.service	systemd-repart.service	dev-mqueue.mount	systemd-tmpfiles-setup.service	systemd-time-wait-sync.service	systemd-udevd.service	systemd-udev-trigger.service	systemd-tmpfiles-setup-dev.service	systemd-journald.service	systemd-sysusers.service	systemd-machine-id-commit.service	systemd-hwdb-update.service	systemd-update-done.service	sys-kernel-tracing.mount	sys-fs-fuse-connections.mount	local-fs.target	var-lib-cni.mount	boot.mount	usr-lib-firmware.mount	var-lib-harvester-defaultdisk.mount	var-lib-third\x2dparty.mount	srv.mount	etc-pki-trust-anchors.mount	root.mount	etc.mount	-.mount	var-log.mount	var-crash.mount	var.mount	etc-nvme.mount	etc-systemd.mount	var-lib-longhorn.mount	var-lib-wicked.mount	home.mount	var-lib-NetworkManager.mount	var-lib-rancher.mount	etc-ssh.mount	var-lib-kubelet.mount	etc-rancher.mount	opt.mount	etc-NetworkManager.mount	usr-local.mount	usr-libexec.mount	etc-iscsi.mount	oem.mount	run-overlay.mount	etc-cni.mount	systemd-remount-fs.service	tmp.mount	systemd-journal-flush.service	systemd-ask-password-console.path	systemd-journal-catalog-update.service	veritysetup.target	systemd-tmpfiles-setup-dev-early.service	swap.target	elemental-setup-fs.service	proc-sys-fs-binfmt_misc.automount	paths.target	slices.target	-.slice	system.slice	sockets.target	systemd-coredump.socket	dm-event.socket	systemd-pcrlock.socket	systemd-udevd-kernel.socket	systemd-bootctl.socket	systemd-creds.socket	dbus.socket	iscsid.socket	systemd-sysext.socket	systemd-journald.socket	systemd-udevd-control.socket	systemd-journald-dev-log.socket	systemd-hostnamed.socket	timers.target	btrfs-defrag.timer	aidecheck.timer	snapper-cleanup.timer	systemd-tmpfiles-clean.timer	logrotate.timer	btrfs-trim.timer	fstrim.timer	snapper-timeline.timer	btrfs-scrub.timer	btrfs-balance.timer	audit-rules.service	hardpipe-file-perms.service	sshd.service	remote-fs.target	iscsi.service	systemd-logind.service	NetworkManager.service	hardpipe-login-defs-mount.service	btrfsmaintenance-refresh.path	rke2-server.service	lvm2-monitor.service	elemental-setup-boot.service	auditd.service	getty.target	getty@tty1.service	smartd.service	hardpipe-selinux-relabel.service	elemental-setup-reconcile.service	hardpipe-post-boot-hardening.service	vmtoolsd.service	hardpipe-etcd-user.service	hardpipe-relabel-activeimg.service	kbdsettings.service	elemental-setup-reconcile.timer	rancherd.service	systemd-user-sessions.service	rancher-system-agent.service	elemental-setup-network.service

Verify Permissions on SSH Server Private *_key Key Files

Rule ID	xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permissions_sshd_private_key:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95070-9 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.1.13, 3.13.10, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-17(a), CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-2.2.4, SRG-OS-000480-GPOS-00227, R50, 1449, 2.2.6, 2.2
Description	SSH server private keys - files that match the `/etc/ssh/*_key` glob, have to have restricted permissions. If those files are owned by the `root` user and the `root` group, they have to have the `0640` permission or stricter.
Rationale	If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
Warnings	warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

No keys that have unsafe ownership/permissions combination exist oval:ssg-test_no_offending_keys:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_offending_keys:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	.*_key$	oval:ssg-exclude_symlinks__sshd_private_key:ste:1	oval:ssg-filter_ssh_key_owner_root:ste:1

Verify Permissions on SSH Server Public *.pub Key Files

Rule ID	xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-file_permissions_sshd_pub_key:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95069-1 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.1.13, 3.13.10, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-17(a), CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-2.2.4, SRG-OS-000480-GPOS-00227, R50, 2.2.6, 2.2
Description	To properly set the permissions of `/etc/ssh/.pub`, run the command: $ sudo chmod 0644 /etc/ssh/.pub
Rationale	If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
Warnings	warning Remediation is not possible at bootable container build time because SSH host keys are generated post-deployment.

OVAL test results details

Testing mode of /etc/ssh/ oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1 true

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1 of type file_object

Path	Filename	Filter	Filter
/etc/ssh	^.*\.pub$	oval:ssg-exclude_symlinks__sshd_pub_key:ste:1	oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1

OpenSSH Service Must Use Passcode for Their Private Keys

Rule ID	xccdf_org.ssgproject.content_rule_ssh_private_keys_have_passcode
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94668-1 References: IA-5(2), IA-5(2).1, SRG-OS-000067-GPOS-00035
Description	Verify the SSH private key files have a passcode. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, without asking a passphrase this is a finding.
Rationale	If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed.
Evaluation messages info No candidate or applicable check found.

Configure SSSD's Memory Cache to Expire

Rule ID	xccdf_org.ssgproject.content_rule_sssd_memcache_timeout
Result	notapplicable
Multi-check rule	no
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94723-4 References: 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), IA-5(13), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000383-GPOS-00166
Description	SSSD's memory cache should be configured to set to expire records after `86400` seconds. To configure SSSD to expire memory cache, set `memcache_timeout` to `86400` under the `[nss]` section in `/etc/sssd/sssd.conf`. For example: [nss] memcache_timeout = 86400
Rationale	If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

Configure SSSD to Expire Offline Credentials

Rule ID	xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
Result	notapplicable
Multi-check rule	no
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94724-2 References: 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), IA-5(13), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000383-GPOS-00166
Description	SSSD should be configured to expire offline credentials after 1 day. To configure SSSD to expire offline credentials, set `offline_credentials_expiration` to `1` under the `[pam]` section in `/etc/sssd/sssd.conf`. For example: [pam] offline_credentials_expiration = 1
Rationale	If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

Record Events that Modify the System's Discretionary Access Controls - fchmod

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_dac_modification_fchmod:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94634-3 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.5.5, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203, SRG-APP-000091-CTR-000160, SRG-APP-000492-CTR-001220, SRG-APP-000493-CTR-001225, SRG-APP-000494-CTR-001230, SRG-APP-000500-CTR-001260, SRG-APP-000507-CTR-001295, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, R73, 10.3.4, 10.3
Description	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
Rationale	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit fchmod oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit fchmod oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit fchmod oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit fchmod oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

Record Events that Modify the System's Discretionary Access Controls - fremovexattr

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_dac_modification_fremovexattr:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94632-7 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.5.5, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000471-GPOS-00215, SRG-OS-000474-GPOS-00219, SRG-OS-000466-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000064-GPOS-00033, SRG-APP-000091-CTR-000160, SRG-APP-000492-CTR-001220, SRG-APP-000493-CTR-001225, SRG-APP-000494-CTR-001230, SRG-APP-000500-CTR-001260, SRG-APP-000507-CTR-001295, SRG-APP-000495-CTR-001235, SRG-APP-000496-CTR-001240, SRG-APP-000497-CTR-001245, SRG-APP-000498-CTR-001250, SRG-APP-000499-CTR-001255, R73, 10.3.4, 10.3
Description	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
Rationale	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit fremovexattr oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit fremovexattr oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit fremovexattr oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit fremovexattr oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Record Events that Modify the System's Discretionary Access Controls - lchown

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_dac_modification_lchown:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94633-5 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.5.5, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-APP-000091-CTR-000160, SRG-APP-000492-CTR-001220, SRG-APP-000493-CTR-001225, SRG-APP-000494-CTR-001230, SRG-APP-000500-CTR-001260, SRG-APP-000507-CTR-001295, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, R73, 10.3.4, 10.3
Description	At a minimum, the audit system should collect file permission changes for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
Rationale	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit lchown oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit lchown oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit lchown oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit lchown oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

Record Events that Modify the System's Discretionary Access Controls - umount2

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_dac_modification_umount2:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94636-8 References: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235, R73
Description	At a minimum, the audit system should collect file system umount2 changes. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod If the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
Rationale	The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit umount2 oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit umount2 oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit umount2 oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit umount2 oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod

Record Any Attempts to Run chacl

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_chacl:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94619-4 References: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules chacl oval:ssg-test_audit_rules_execution_chacl_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_chg

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl chacl oval:ssg-test_audit_rules_execution_chacl_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_chg

Record Any Attempts to Run chmod

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_chmod
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_chmod:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94617-8 References: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules chmod oval:ssg-test_audit_rules_execution_chmod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/chmod -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_chg

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl chmod oval:ssg-test_audit_rules_execution_chmod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/chmod -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_chg

Record Any Attempts to Run setfacl

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_setfacl:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94618-6 References: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules setfacl oval:ssg-test_audit_rules_execution_setfacl_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_chg

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl setfacl oval:ssg-test_audit_rules_execution_setfacl_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_chg

Record Any Attempts to Run chcon

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_chcon:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94620-2 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-APP-000495-CTR-001235, SRG-APP-000496-CTR-001240, SRG-APP-000497-CTR-001245, SRG-APP-000498-CTR-001250, SRG-APP-000501-CTR-001265, SRG-APP-000502-CTR-001270, 0582
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules chcon oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl chcon oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

Record Any Attempts to Run rm

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_rm
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_rm:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94621-0 References: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/rm -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/rm -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules rm oval:ssg-test_audit_rules_execution_rm_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/rm -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_mod

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl rm oval:ssg-test_audit_rules_execution_rm_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/rm -F perm=x -F auid>=1000 -F auid!=unset -F key=perm_mod

Record Any Attempts to Run semanage

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_semanage:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95095-6 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-APP-000495-CTR-001235, SRG-APP-000496-CTR-001240, SRG-APP-000497-CTR-001245, SRG-APP-000498-CTR-001250, 0582
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules semanage oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl semanage oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

Record Any Attempts to Run setfiles

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_setfiles:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95097-2 References: AU-2(d), AU-12(c), AC-6(9), CM-6(a), SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-APP-000495-CTR-001235, SRG-APP-000496-CTR-001240, SRG-APP-000497-CTR-001245, SRG-APP-000498-CTR-001250, 0582
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules setfiles oval:ssg-test_audit_rules_execution_setfiles_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl setfiles oval:ssg-test_audit_rules_execution_setfiles_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

Record Any Attempts to Run setsebool

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_execution_setsebool:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-95098-0 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-APP-000495-CTR-001235, SRG-APP-000496-CTR-001240, SRG-APP-000497-CTR-001245, SRG-APP-000498-CTR-001250, 0582
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules setsebool oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl setsebool oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-selinux

Record Unsuccessful Access Attempts to Files - open

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94649-1 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.4, Req-10.2.1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-APP-000495-CTR-001235, R73, 0582, 0846
Description	At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Rationale	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit file eacces oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

audit augenrules 32-bit file eperm oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit file eacces oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

audit augenrules 64-bit file eperm oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit file eacces oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

audit auditctl 32-bit file eperm oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit file eacces oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

audit auditctl 64-bit file eperm oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access

Record Unsuccessful Delete Attempts to Files - rename

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94731-7 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.4, Req-10.2.1, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000468-GPOS-00212, SRG-APP-000501-CTR-001265, SRG-APP-000502-CTR-001270
Description	The audit system should collect unsuccessful file deletion attempts for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file. -a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete -a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete
Rationale	Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping system calls related to the same event is more efficient. See the following example: -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-delete

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit file eacces oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

audit augenrules 32-bit file eperm oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit file eacces oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

audit augenrules 64-bit file eperm oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit file eacces oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

audit auditctl 32-bit file eperm oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit file eacces oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

audit auditctl 64-bit file eperm oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-delete

Ensure auditd Collects Information on Kernel Module Unloading - delete_module

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_kernel_module_loading_delete:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94653-3 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-APP-000495-CTR-001235, SRG-APP-000504-CTR-001280, R73
Description	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S delete_module -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.
Rationale	The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit delete_module oval:ssg-test_32bit_arkml_delete_module_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S delete_module -F key=modules

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit delete_module oval:ssg-test_64bit_arkml_delete_module_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S delete_module -F key=modules

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit delete_module oval:ssg-test_32bit_arkml_delete_module_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S delete_module -F key=modules

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit delete_module oval:ssg-test_64bit_arkml_delete_module_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S delete_module -F key=modules

Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_kernel_module_loading_finit:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94654-1 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-APP-000495-CTR-001235, SRG-APP-000504-CTR-001280, R73
Description	To capture kernel module loading and unloading events, use the following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S finit_module -F key=modules Place to add the line depends on a way `auditd` daemon is configured. If it is configured to use the `augenrules` program (the default), add the line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`. If the `auditd` daemon is configured to use the `auditctl` utility, add the line to file `/etc/audit/audit.rules`.
Rationale	The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit finit_module oval:ssg-test_32bit_arkml_finit_module_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S finit_module -F key=modules

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit finit_module oval:ssg-test_64bit_arkml_finit_module_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S finit_module -F key=modules

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit finit_module oval:ssg-test_32bit_arkml_finit_module_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S finit_module -F key=modules

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit finit_module oval:ssg-test_64bit_arkml_finit_module_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S finit_module -F key=modules

Record Attempts to Alter Logon and Logout Events - lastlog

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_login_events_lastlog:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94629-3 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.3, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000473-GPOS-00218, SRG-OS-000470-GPOS-00214, SRG-APP-000495-CTR-001235, SRG-APP-000503-CTR-001275, SRG-APP-000506-CTR-001290, R73, 0582, 10.2.1.3, 10.2.1, 10.2
Description	The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/lastlog -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/lastlog -p wa -k logins
Rationale	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules lastlog oval:ssg-test_audit_rules_login_events_lastlog_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /var/log/lastlog -p wa -k logins

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl lastlog oval:ssg-test_audit_rules_login_events_lastlog_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /var/log/lastlog -p wa -k logins

Record Attempts to Alter Logon and Logout Events - tallylog

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_login_events_tallylog:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94628-5 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.3, SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218, SRG-APP-000503-CTR-001275, 0582, 10.2.1.3, 10.2.1, 10.2
Description	The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/tallylog -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/tallylog -p wa -k logins
Rationale	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules tallylog oval:ssg-test_audit_rules_login_events_tallylog_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /var/log/tallylog -p wa -k logins

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl tallylog oval:ssg-test_audit_rules_login_events_tallylog_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /var/log/tallylog -p wa -k logins

Ensure auditd Collects Information on the Use of Privileged Commands - chage

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_chage:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94611-1 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235, SRG-APP-000501-CTR-001265, SRG-APP-000502-CTR-001270
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules chage oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-passwd

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl chage oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-passwd

Ensure auditd Collects Information on the Use of Privileged Commands - chfn

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chfn
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_chfn:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94614-5 References: AU-3, AU-12(a), AU-12(c), MA-4(1)(a)
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules chfn oval:ssg-test_audit_rules_privileged_commands_chfn_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl chfn oval:ssg-test_audit_rules_privileged_commands_chfn_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on the Use of Privileged Commands - chsh

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_chsh:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94609-5 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules chsh oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl chsh oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on the Use of Privileged Commands - crontab

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_crontab:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94612-9 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules crontab oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-cron

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl crontab oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-cron

Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_gpasswd:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94607-9 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules gpasswd oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-passwd

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl gpasswd oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-passwd

Ensure auditd Collects Information on the Use of Privileged Commands - insmod

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_insmod
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_insmod:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94650-9 References: AU-12(c), AU-12.1(iv), AU-3, AU-3.1, AU-12(a), AU-12.1(ii), MA-4(1)(a), SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, R73
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /sbin/insmod -p x -k modules
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules insmod oval:ssg-test_insmod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /sbin/insmod -p x -k modules

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl insmod oval:ssg-test_insmod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /sbin/insmod -p x -k modules

Ensure auditd Collects Information on the Use of Privileged Commands - kmod

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_kmod:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94616-0 References: AU-3, AU-3.1, AU-12(a), AU-12.1(ii), AU-12.1(iv)AU-12(c), MA-4(1)(a), SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-APP-000495-CTR-001235, SRG-APP-000504-CTR-001280, R73
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules kmod oval:ssg-test_audit_rules_privileged_commands_kmod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-modules

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl kmod oval:ssg-test_audit_rules_privileged_commands_kmod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-modules

Ensure auditd Collects Information on the Use of Privileged Commands - modprobe

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_modprobe
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_modprobe:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94652-5 References: AU-12(a), AU-12.1(ii), AU-3, AU-3.1, AU-12(c), AU-12.1(iv), MA-4(1)(a), SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, R73
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /sbin/modprobe -p x -k modules If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -w /sbin/modprobe -p x -k modules
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules modprobe oval:ssg-test_modprobe_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /sbin/modprobe -p x -k modules

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl modprobe oval:ssg-test_modprobe_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /sbin/modprobe -p x -k modules

Ensure auditd Collects Information on the Use of Privileged Commands - newgrp

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_newgrp:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94608-7 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules newgrp oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl newgrp oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_pam_timestamp_check:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94623-6 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules pam_timestamp_check oval:ssg-test_audit_rules_privileged_commands_pam_timestamp_check_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-pam

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl pam_timestamp_check oval:ssg-test_audit_rules_privileged_commands_pam_timestamp_check_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-pam

Ensure auditd Collects Information on the Use of Privileged Commands - passwd

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_passwd:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94606-1 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules passwd oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-passwd

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl passwd oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-passwd

Ensure auditd Collects Information on the Use of Privileged Commands - rmmod

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_rmmod
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_rmmod:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94651-7 References: SRG-OS-000037-GPOS-00015, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, R73
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /sbin/rmmod -p x -k modules
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules rmmod oval:ssg-test_rmmod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /sbin/rmmod -p x -k modules

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl rmmod oval:ssg-test_rmmod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /sbin/rmmod -p x -k modules

Record Any Attempts to Run ssh-agent

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_agent
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_ssh_agent:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94615-2 References: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules ssh_agent oval:ssg-test_audit_rules_privileged_commands_ssh_agent_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-ssh

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl ssh_agent oval:ssg-test_audit_rules_privileged_commands_ssh_agent_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-ssh

Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94605-3 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/libexec/ssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/libexec/ssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules ssh_keysign oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/libexec/ssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-ssh

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl ssh_keysign oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/libexec/ssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-ssh

Ensure auditd Collects Information on the Use of Privileged Commands - su

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_su:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94624-4 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, SRG-OS-000755-GPOS-00220
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules su oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl su oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on the Use of Privileged Commands - sudo

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_sudo:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94625-1 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, SRG-OS-000755-GPOS-00220, R33
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules sudo oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl sudo oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_sudoedit:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94613-7 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235, SRG-OS-000755-GPOS-00220
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules sudoedit oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl sudoedit oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94610-3 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R6.5, AC-2(4), AU-2(d), AU-3, AU-3.1, AU-12(a), AU-12(c), AU-12.1(ii), AU-12.1(iv), AC-6(9), CM-6(a), MA-4(1)(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000029-CTR-000085, SRG-APP-000495-CTR-001235
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules unix_chkpwd oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-pam

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl unix_chkpwd oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-pam

Ensure auditd Collects Information on the Use of Privileged Commands - usermod

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_privileged_commands_usermod:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94622-8 References: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255
Description	At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add a line of the following form to `/etc/audit/audit.rules`: -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats. Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules usermod oval:ssg-test_audit_rules_privileged_commands_usermod_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl usermod oval:ssg-test_audit_rules_privileged_commands_usermod_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged-priv_change

Ensure auditd Collects Information on Exporting to Media (successful)

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_media_export
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_media_export:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94635-0 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-APP-000495-CTR-001235, R73, 10.2.1.7, 10.2.1, 10.2
Description	At a minimum, the audit system should collect media exportation events for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: -a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export
Rationale	The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit mount oval:ssg-test_32bit_ardm_mount_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -F key=media_export

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit augenrules 64-bit mount oval:ssg-test_64bit_ardm_mount_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -F key=media_export

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit mount oval:ssg-test_32bit_ardm_mount_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -F key=media_export

64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false

Following items have been found on the system:

Machine class	Node name	Os name	Os release	Os version	Processor type
x86_64	hardpipe-node0	Linux	6.12.0-160000.36-default	#1 SMP PREEMPT_DYNAMIC Tue Jul 14 08:31:14 UTC 2026 (352acd0)	x86_64

audit auditctl 64-bit mount oval:ssg-test_64bit_ardm_mount_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -F key=media_export

Record Attempts to Alter Process and Session Initiation Information btmp

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_session_events_btmp
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_session_events_btmp:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94734-1 References: 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), AU-12(c), AU-12.1(iv), SRG-OS-000472-GPOS-00217, R73, 0582, 0846, 10.2.1.3, 10.2.1, 10.2
Description	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/btmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/btmp -p wa -k session
Rationale	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules btmp oval:ssg-test_audit_rules_session_events_btmp_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /var/log/btmp -p wa -k logins

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl btmp oval:ssg-test_audit_rules_session_events_btmp_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /var/log/btmp -p wa -k logins

Record Attempts to Alter Process and Session Initiation Information utmp

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_session_events_utmp
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_session_events_utmp:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94732-5 References: 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), AU-12(c), AU-12.1(iv), SRG-OS-000472-GPOS-00217, R73, 0582, 0846, 10.2.1.3, 10.2.1, 10.2
Description	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/run/utmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/run/utmp -p wa -k session
Rationale	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules utmp oval:ssg-test_audit_rules_session_events_utmp_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /var/run/utmp -p wa -k session

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl utmp oval:ssg-test_audit_rules_session_events_utmp_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /var/run/utmp -p wa -k session

Record Attempts to Alter Process and Session Initiation Information wtmp

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_session_events_wtmp
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_session_events_wtmp:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94733-3 References: 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), AU-12(c), AU-12.1(iv), SRG-OS-000472-GPOS-00217, R73, 0582, 0846, 10.2.1.3, 10.2.1, 10.2
Description	The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /var/log/wtmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /var/log/wtmp -p wa -k session
Rationale	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules wtmp oval:ssg-test_audit_rules_session_events_wtmp_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /var/log/wtmp -p wa -k logins

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl wtmp oval:ssg-test_audit_rules_session_events_wtmp_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /var/log/wtmp -p wa -k logins

Record Events When Privileged Executables Are Run

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_suid_privilege_function:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94704-4 References: CM-5(1), AU-7(a), AU-7(b), AU-8(b), AU-12(3), AC-6(9), SRG-OS-000326-GPOS-00126, SRG-OS-000327-GPOS-00127, SRG-APP-000343-CTR-000780, SRG-APP-000381-CTR-000905, SRG-OS-000755-GPOS-00220, 10.2.1.2, 10.2.1, 10.2
Description	Verify the system generates an audit record when privileged functions are executed. If audit is using the "auditctl" tool to load the rules, run the following command: $ sudo grep execve /etc/audit/audit.rules If audit is using the "augenrules" tool to load the rules, run the following command: $ sudo grep -r execve /etc/audit/rules.d -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding. If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.
Rationale	Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.
Warnings	warning Note that these rules can be configured in a number of ways while still achieving the desired effect.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules 32-bit uid privileged function oval:ssg-test_32bit_uid_privileged_function_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=setuid

audit augenrules 64-bit uid privileged function oval:ssg-test_64bit_uid_privileged_function_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=setuid

audit augenrules 32-bit gid privileged function oval:ssg-test_32bit_gid_privileged_function_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=setgid

audit augenrules 64-bit gid privileged function oval:ssg-test_64bit_gid_privileged_function_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=setgid

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl 32-bit uid privileged function oval:ssg-test_32bit_uid_privileged_function_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=setuid

audit auditctl 64-bit uid privileged_function oval:ssg-test_64bit_uid_privileged_function_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=setuid

audit auditctl 32-bit gid privileged function oval:ssg-test_32bit_gid_privileged_function_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=setgid

audit auditctl 64-bit gid privileged_function oval:ssg-test_64bit_gid_privileged_function_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=setgid

Ensure auditd Collects System Administrator Actions

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_sysadmin_actions:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94648-3 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-2(7)(b), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.2, Req-10.2.5.b, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-APP-000026-CTR-000070, SRG-APP-000027-CTR-000075, SRG-APP-000028-CTR-000080, SRG-APP-000291-CTR-000675, SRG-APP-000292-CTR-000680, SRG-APP-000293-CTR-000685, SRG-APP-000294-CTR-000690, SRG-APP-000319-CTR-000745, SRG-APP-000320-CTR-000750, SRG-APP-000509-CTR-001305, R73, 0582, 10.2.1.5, 10.2.1, 10.2
Description	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sudoers -p wa -k actions If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers.d/ -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/sudoers.d/ -p wa -k actions
Rationale	The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules sudoers oval:ssg-test_audit_rules_sudoers_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /etc/sudoers -p wa -k actions

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl sudoers oval:ssg-test_audit_rules_sudoers_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /etc/sudoers -p wa -k actions

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules sudoers_d oval:ssg-test_audit_rules_sudoers_d_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /etc/sudoers.d/ -p wa -k actions

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl sudoers_d oval:ssg-test_audit_rules_sudoers_d_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /etc/sudoers.d/ -p wa -k actions

Record Events that Modify User/Group Information - /etc/group

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_usergroup_modification_group:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94602-0 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.5, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, SRG-APP-000503-CTR-001275, R73, 0582, 10.2.1.5, 10.2.1, 10.2
Description	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/group -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/group -p wa -k audit_rules_usergroup_modification
Rationale	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules group oval:ssg-test_audit_rules_usergroup_modification_group_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /etc/group -p wa -k identity

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl group oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /etc/group -p wa -k identity

Record Events that Modify User/Group Information - /etc/security/opasswd

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_usergroup_modification_opasswd:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94604-6 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.5, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-APP-000495-CTR-001235, SRG-APP-000496-CTR-001240, SRG-APP-000497-CTR-001245, SRG-APP-000498-CTR-001250, SRG-APP-000503-CTR-001275, R73, 0582, 10.2.1.5, 10.2.1, 10.2
Description	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
Rationale	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules opasswd oval:ssg-test_audit_rules_usergroup_modification_opasswd_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /etc/security/opasswd -p wa -k identity

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl opasswd oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /etc/security/opasswd -p wa -k identity

Record Events that Modify User/Group Information - /etc/passwd

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_usergroup_modification_passwd:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94601-2 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.5, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-OS-000274-GPOS-00104, SRG-OS-000275-GPOS-00105, SRG-OS-000276-GPOS-00106, SRG-OS-000277-GPOS-00107, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, SRG-APP-000503-CTR-001275, R73, 0582, 10.2.1.5, 10.2.1, 10.2
Description	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/passwd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
Rationale	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules passwd oval:ssg-test_audit_rules_usergroup_modification_passwd_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /etc/passwd -p wa -k identity

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl passwd oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /etc/passwd -p wa -k identity

Record Events that Modify User/Group Information - /etc/shadow

Rule ID	xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-audit_rules_usergroup_modification_shadow:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94603-8 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, AC-2(4), AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.5, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221, SRG-APP-000495-CTR-001235, SRG-APP-000499-CTR-001255, SRG-APP-000503-CTR-001275, R73, 0582, 10.2.1.5, 10.2.1, 10.2
Description	If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/shadow -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules`: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
Rationale	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

OVAL test results details

audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/usr/lib/systemd/system/auditd.service	ExecStartPost=-/sbin/augenrules --load

audit augenrules shadow oval:ssg-test_audit_rules_usergroup_modification_shadow_augenrules:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/rules.d/90-hardpipe-cis.rules	-w /etc/shadow -p wa -k identity

audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object

Filepath	Pattern	Instance
/usr/lib/systemd/system/auditd.service	^ExecStartPost=\-\/sbin\/auditctl.*$	1

audit auditctl shadow oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/audit.rules	-w /etc/shadow -p wa -k identity

Configure a Sufficiently Large Partition for Audit Logs

Rule ID	xccdf_org.ssgproject.content_rule_auditd_audispd_configure_sufficiently_large_partition
Result	notchecked
Multi-check rule	no
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94706-9 References: SRG-OS-000341-GPOS-00132, SRG-OS-000342-GPOS-00133
Description	The SUSE Linux Enterprise Micro 6 operating system must allocate audit record storage capacity to store at least one weeks worth of audit records when audit records are not immediately sent to a central audit record storage facility. The partition size needed to capture a week's worth of audit records is based on the activity level of the system and the total storage capacity available. In normal circumstances, 10.0 GB of storage space for audit records will be sufficient. Determine which partition the audit records are being written to with the following command: $ sudo grep log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log Check the size of the partition that audit records are written to with the following command: $ sudo df -h /var/log/audit/ /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit
Rationale	Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Evaluation messages info No candidate or applicable check found.

Configure auditd Disk Full Action when Disk Space Is Full

Rule ID	xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-auditd_data_disk_full_action:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94657-4 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, SRG-OS-000047-GPOS-00023
Description	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately: disk_full_action = ACTION Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `syslog`, `exec`, `single`, and `halt` For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.
Rationale	Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.

OVAL test results details

disk error action oval:ssg-test_auditd_data_disk_full_action:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/auditd.conf	disk_full_action = halt

Configure auditd mail_acct Action on Low Disk Space

Rule ID	xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-auditd_data_retention_action_mail_acct:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94655-8 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, 3.3.1, 164.312(a)(2)(ii), 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, CIP-003-8 R1.3, CIP-003-8 R3, CIP-003-8 R3.1, CIP-003-8 R3.2, CIP-003-8 R3.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-5(1), AU-5(a), AU-5(2), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.7.a, SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134
Description	The `auditd` service can be configured to send email to a designated account in certain situations. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that administrators are notified via email for those situations: action_mail_acct = root
Rationale	Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.

OVAL test results details

email account for actions oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/auditd.conf	action_mail_acct = root

Configure auditd space_left Action on Low Disk Space

Rule ID	xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-auditd_data_retention_space_left_action:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94711-9 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, 3.3.1, 164.312(a)(2)(ii), 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.7, SRG-OS-000343-GPOS-00134, 10.5.1, 10.5
Description	The `auditd` service can be configured to take an action when disk space starts to run low. Edit the file `/etc/audit/auditd.conf`. Modify the following line, substituting ACTION appropriately: space_left_action = ACTION Possible values for ACTION are described in the `auditd.conf` man page. These include: `syslog` `email` `exec` `suspend` `single` `halt` Set this to `email` (instead of the default, which is `suspend`) as it is more likely to get prompt attention. Acceptable values also include `suspend`, `single`, and `halt`.
Rationale	Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

OVAL test results details

space left action oval:ssg-test_auditd_data_retention_space_left_action:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/auditd.conf	space_left_action = email

Configure auditd space_left on Low Disk Space

Rule ID	xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-auditd_data_retention_space_left_percentage:def:1
Time	2026-08-27T10:03:25+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94710-1 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.7, SRG-OS-000343-GPOS-00134
Description	The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting PERCENTAGE appropriately: space_left = PERCENTAGE% Set this value to at least 25 to cause the system to notify the user of an issue.
Rationale	Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

OVAL test results details

admin space left action oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1 true

Following items have been found on the system:

Path	Content
/etc/audit/auditd.conf	space_left = 25%

Ensure the audit Subsystem is Installed

Rule ID	xccdf_org.ssgproject.content_rule_package_audit_installed
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-package_audit_installed:def:1
Time	2026-08-27T10:03:23+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94705-1 References: 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, R33, R73, 0582, 0846, 10.2.1, 10.2
Description	The audit package should be installed.
Rationale	The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.

OVAL test results details

package audit is installed oval:ssg-test_package_audit_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
audit	x86_64	(none)	160000.2.2	4.0	0:4.0-160000.2.2	fec28eaf09d9ea69	audit-0:4.0-160000.2.2.x86_64

Enable auditd Service

Rule ID	xccdf_org.ssgproject.content_rule_service_auditd_enabled
Result	pass
Multi-check rule	no
OVAL Definition ID	oval:ssg-service_auditd_enabled:def:1
Time	2026-08-27T10:03:24+00:00
Severity	medium
Identifiers and References	Identifiers: CCE-94631-9 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-APP-000095-CTR-000170, SRG-APP-000409-CTR-000990, SRG-APP-000508-CTR-001300, SRG-APP-000510-CTR-001310, R33, R73, 1409, 10.2.1, 10.2
Description	The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command: $ sudo systemctl enable auditd.service
Rationale	Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the `auditd` service is active ensures audit records generated by the kernel are appropriately recorded. Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

OVAL test results details

package audit is installed oval:ssg-test_service_auditd_package_audit_installed:tst:1 true

Following items have been found on the system:

Name	Arch	Epoch	Release	Version	Evr	Signature keyid	Extended name
audit	x86_64	(none)	160000.2.2	4.0	0:4.0-160000.2.2	fec28eaf09d9ea69	audit-0:4.0-160000.2.2.x86_64

Test that the auditd service is running oval:ssg-test_service_running_auditd:tst:1 true

Following items have been found on the system:

Unit	Property	Value
auditd.service	ActiveState	active

systemd test oval:ssg-test_multi_user_wants_auditd:tst:1 true

Following items have been found on the system:

Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
multi-user.target	basic.target	sysinit.target	systemd-firstboot.service	sys-kernel-config.mount	systemd-hibernate-clear.service	systemd-modules-load.service	systemd-timesyncd.service	systemd-binfmt.service	dev-hugepages.mount	integritysetup.target	dracut-shutdown.service	lvm2-lvmpolld.socket	systemd-random-seed.service	cryptsetup.target	systemd-pstore.service	systemd-sysctl.service	sys-kernel-debug.mount	kmod-static-nodes.service	systemd-repart.service	dev-mqueue.mount	systemd-tmpfiles-setup.service	systemd-time-wait-sync.service	systemd-udevd.service	systemd-udev-trigger.service	systemd-tmpfiles-setup-dev.service	systemd-journald.service	systemd-sysusers.service	systemd-machine-id-commit.service	systemd-hwdb-update.service	systemd-update-done.service	sys-kernel-tracing.mount	sys-fs-fuse-connections.mount	local-fs.target	var-lib-cni.mount	boot.mount	usr-lib-firmware.mount	var-lib-harvester-defaultdisk.mount	var-lib-third\x2dparty.mount	srv.mount	etc-pki-trust-anchors.mount	root.mount	etc.mount	-.mount	var-log.mount	var-crash.mount	var.mount	etc-nvme.mount	etc-systemd.mount	var-lib-longhorn.mount	var-lib-wicked.mount	home.mount	var-lib-NetworkManager.mount	var-lib-rancher.mount	etc-ssh.mount	var-lib-kubelet.mount	etc-rancher.mount	opt.mount	etc-NetworkManager.mount	usr-local.mount	usr-libexec.mount	etc-iscsi.mount	oem.mount	run-overlay.mount	etc-cni.mount	systemd-remount-fs.service	tmp.mount	systemd-journal-flush.service	systemd-ask-password-console.path	systemd-journal-catalog-update.service	veritysetup.target	systemd-tmpfiles-setup-dev-early.service	swap.target	elemental-setup-fs.service	proc-sys-fs-binfmt_misc.automount	paths.target	slices.target	-.slice	system.slice	sockets.target	systemd-coredump.socket	dm-event.socket	systemd-pcrlock.socket	systemd-udevd-kernel.socket	systemd-bootctl.socket	systemd-creds.socket	dbus.socket	iscsid.socket	systemd-sysext.socket	systemd-journald.socket	systemd-udevd-control.socket	systemd-journald-dev-log.socket	systemd-hostnamed.socket	timers.target	btrfs-defrag.timer	aidecheck.timer	snapper-cleanup.timer	systemd-tmpfiles-clean.timer	logrotate.timer	btrfs-trim.timer	fstrim.timer	snapper-timeline.timer	btrfs-scrub.timer	btrfs-balance.timer	audit-rules.service	hardpipe-file-perms.service	sshd.service	remote-fs.target	iscsi.service	systemd-logind.service	NetworkManager.service	hardpipe-login-defs-mount.service	btrfsmaintenance-refresh.path	rke2-server.service	lvm2-monitor.service	elemental-setup-boot.service	auditd.service	getty.target	getty@tty1.service	smartd.service	hardpipe-selinux-relabel.service	elemental-setup-reconcile.service	hardpipe-post-boot-hardening.service	vmtoolsd.service	hardpipe-etcd-user.service	hardpipe-relabel-activeimg.service	kbdsettings.service	elemental-setup-reconcile.timer	rancherd.service	systemd-user-sessions.service	rancher-system-agent.service	elemental-setup-network.service

systemd test oval:ssg-test_multi_user_wants_auditd_socket:tst:1 false

Following items have been found on the system:

Unit	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency	Dependency
multi-user.target	basic.target	sysinit.target	systemd-firstboot.service	sys-kernel-config.mount	systemd-hibernate-clear.service	systemd-modules-load.service	systemd-timesyncd.service	systemd-binfmt.service	dev-hugepages.mount	integritysetup.target	dracut-shutdown.service	lvm2-lvmpolld.socket	systemd-random-seed.service	cryptsetup.target	systemd-pstore.service	systemd-sysctl.service	sys-kernel-debug.mount	kmod-static-nodes.service	systemd-repart.service	dev-mqueue.mount	systemd-tmpfiles-setup.service	systemd-time-wait-sync.service	systemd-udevd.service	systemd-udev-trigger.service	systemd-tmpfiles-setup-dev.service	systemd-journald.service	systemd-sysusers.service	systemd-machine-id-commit.service	systemd-hwdb-update.service	systemd-update-done.service	sys-kernel-tracing.mount	sys-fs-fuse-connections.mount	local-fs.target	var-lib-cni.mount	boot.mount	usr-lib-firmware.mount	var-lib-harvester-defaultdisk.mount	var-lib-third\x2dparty.mount	srv.mount	etc-pki-trust-anchors.mount	root.mount	etc.mount	-.mount	var-log.mount	var-crash.mount	var.mount	etc-nvme.mount	etc-systemd.mount	var-lib-longhorn.mount	var-lib-wicked.mount	home.mount	var-lib-NetworkManager.mount	var-lib-rancher.mount	etc-ssh.mount	var-lib-kubelet.mount	etc-rancher.mount	opt.mount	etc-NetworkManager.mount	usr-local.mount	usr-libexec.mount	etc-iscsi.mount	oem.mount	run-overlay.mount	etc-cni.mount	systemd-remount-fs.service	tmp.mount	systemd-journal-flush.service	systemd-ask-password-console.path	systemd-journal-catalog-update.service	veritysetup.target	systemd-tmpfiles-setup-dev-early.service	swap.target	elemental-setup-fs.service	proc-sys-fs-binfmt_misc.automount	paths.target	slices.target	-.slice	system.slice	sockets.target	systemd-coredump.socket	dm-event.socket	systemd-pcrlock.socket	systemd-udevd-kernel.socket	systemd-bootctl.socket	systemd-creds.socket	dbus.socket	iscsid.socket	systemd-sysext.socket	systemd-journald.socket	systemd-udevd-control.socket	systemd-journald-dev-log.socket	systemd-hostnamed.socket	timers.target	btrfs-defrag.timer	aidecheck.timer	snapper-cleanup.timer	systemd-tmpfiles-clean.timer	logrotate.timer	btrfs-trim.timer	fstrim.timer	snapper-timeline.timer	btrfs-scrub.timer	btrfs-balance.timer	audit-rules.service	hardpipe-file-perms.service	sshd.service	remote-fs.target	iscsi.service	systemd-logind.service	NetworkManager.service	hardpipe-login-defs-mount.service	btrfsmaintenance-refresh.path	rke2-server.service	lvm2-monitor.service	elemental-setup-boot.service	auditd.service	getty.target	getty@tty1.service	smartd.service	hardpipe-selinux-relabel.service	elemental-setup-reconcile.service	hardpipe-post-boot-hardening.service	vmtoolsd.service	hardpipe-etcd-user.service	hardpipe-relabel-activeimg.service	kbdsettings.service	elemental-setup-reconcile.timer	rancherd.service	systemd-user-sessions.service	rancher-system-agent.service	elemental-setup-network.service

Scroll back to the first rule

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.