{"platform":{"name":"ubuntu","release":"16.04"},"profiles":[{"name":"Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide","version":"0.1.0","sha256":"f25b1e124d502693a63abee02ed9d176d1f285a6676bcbc62b722a8fae470c9b","title":"Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide","maintainer":"The Authors","summary":"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.","license":"Apache-2.0","copyright":"The Authors","copyright_email":"you@example.com","supports":[],"attributes":[],"groups":[{"id":"controls/V-75909.rb","controls":["V-75909"]},{"id":"controls/V-75849.rb","controls":["V-75849"]},{"id":"controls/V-75479.rb","controls":["V-75479"]},{"id":"controls/V-75469.rb","controls":["V-75469"]},{"id":"controls/V-75529.rb","controls":["V-75529"]},{"id":"controls/V-75859.rb","controls":["V-75859"]},{"id":"controls/V-75391.rb","controls":["V-75391"]},{"id":"controls/V-75879.rb","controls":["V-75879"]},{"id":"controls/V-75789.rb","controls":["V-75789"]},{"id":"controls/V-75449.rb","controls":["V-75449"]},{"id":"controls/V-75509.rb","controls":["V-75509"]},{"id":"controls/V-75519.rb","controls":["V-75519"]},{"id":"controls/V-75459.rb","controls":["V-75459"]},{"id":"controls/V-75799.rb","controls":["V-75799"]},{"id":"controls/V-75869.rb","controls":["V-75869"]},{"id":"controls/V-75829.rb","controls":["V-75829"]},{"id":"controls/V-75559.rb","controls":["V-75559"]},{"id":"controls/V-75699.rb","controls":["V-75699"]},{"id":"controls/V-75689.rb","controls":["V-75689"]},{"id":"controls/V-75549.rb","controls":["V-75549"]},{"id":"controls/V-75819.rb","controls":["V-75819"]},{"id":"controls/V-75569.rb","controls":["V-75569"]},{"id":"controls/V-75439.rb","controls":["V-75439"]},{"id":"controls/V-75579.rb","controls":["V-75579"]},{"id":"controls/V-75809.rb","controls":["V-75809"]},{"id":"controls/V-75533.rb","controls":["V-75533"]},{"id":"controls/V-75473.rb","controls":["V-75473"]},{"id":"controls/V-75711.rb","controls":["V-75711"]},{"id":"controls/V-75591.rb","controls":["V-75591"]},{"id":"controls/V-75903.rb","controls":["V-75903"]},{"id":"controls/V-75843.rb","controls":["V-75843"]},{"id":"controls/V-75507.rb","controls":["V-75507"]},{"id":"controls/V-75787.rb","controls":["V-75787"]},{"id":"controls/V-75877.rb","controls":["V-75877"]},{"id":"controls/V-75725.rb","controls":["V-75725"]},{"id":"controls/V-75665.rb","controls":["V-75665"]},{"id":"controls/V-78007.rb","controls":["V-78007"]},{"id":"controls/V-75735.rb","controls":["V-75735"]},{"id":"controls/V-75867.rb","controls":["V-75867"]},{"id":"controls/V-75797.rb","controls":["V-75797"]},{"id":"controls/V-75517.rb","controls":["V-75517"]},{"id":"controls/V-75457.rb","controls":["V-75457"]},{"id":"controls/V-75853.rb","controls":["V-75853"]},{"id":"controls/V-75581.rb","controls":["V-75581"]},{"id":"controls/V-75641.rb","controls":["V-75641"]},{"id":"controls/V-75463.rb","controls":["V-75463"]},{"id":"controls/V-75523.rb","controls":["V-75523"]},{"id":"controls/V-75783.rb","controls":["V-75783"]},{"id":"controls/V-75443.rb","controls":["V-75443"]},{"id":"controls/V-75503.rb","controls":["V-75503"]},{"id":"controls/V-75721.rb","controls":["V-75721"]},{"id":"controls/V-75661.rb","controls":["V-75661"]},{"id":"controls/V-75873.rb","controls":["V-75873"]},{"id":"controls/V-75537.rb","controls":["V-75537"]},{"id":"controls/V-75477.rb","controls":["V-75477"]},{"id":"controls/V-75907.rb","controls":["V-75907"]},{"id":"controls/V-75595.rb","controls":["V-75595"]},{"id":"controls/V-75847.rb","controls":["V-75847"]},{"id":"controls/V-75655.rb","controls":["V-75655"]},{"id":"controls/V-75715.rb","controls":["V-75715"]},{"id":"controls/V-75645.rb","controls":["V-75645"]},{"id":"controls/V-75857.rb","controls":["V-75857"]},{"id":"controls/V-75585.rb","controls":["V-75585"]},{"id":"controls/V-75527.rb","controls":["V-75527"]},{"id":"controls/V-75863.rb","controls":["V-75863"]},{"id":"controls/V-75731.rb","controls":["V-75731"]},{"id":"controls/V-75513.rb","controls":["V-75513"]},{"id":"controls/V-75453.rb","controls":["V-75453"]},{"id":"controls/V-75793.rb","controls":["V-75793"]},{"id":"controls/V-75881.rb","controls":["V-75881"]},{"id":"controls/V-75553.rb","controls":["V-75553"]},{"id":"controls/V-75693.rb","controls":["V-75693"]},{"id":"controls/V-75823.rb","controls":["V-75823"]},{"id":"controls/V-75771.rb","controls":["V-75771"]},{"id":"controls/V-75631.rb","controls":["V-75631"]},{"id":"controls/V-75567.rb","controls":["V-75567"]},{"id":"controls/V-75605.rb","controls":["V-75605"]},{"id":"controls/V-75745.rb","controls":["V-75745"]},{"id":"controls/V-75817.rb","controls":["V-75817"]},{"id":"controls/V-75485.rb","controls":["V-75485"]},{"id":"controls/V-80965.rb","controls":["V-80965"]},{"id":"controls/V-75807.rb","controls":["V-75807"]},{"id":"controls/V-75495.rb","controls":["V-75495"]},{"id":"controls/V-75755.rb","controls":["V-75755"]},{"id":"controls/V-75615.rb","controls":["V-75615"]},{"id":"controls/V-75437.rb","controls":["V-75437"]},{"id":"controls/V-75577.rb","controls":["V-75577"]},{"id":"controls/V-75621.rb","controls":["V-75621"]},{"id":"controls/V-75761.rb","controls":["V-75761"]},{"id":"controls/V-75833.rb","controls":["V-75833"]},{"id":"controls/V-75543.rb","controls":["V-75543"]},{"id":"controls/V-75891.rb","controls":["V-75891"]},{"id":"controls/V-75563.rb","controls":["V-75563"]},{"id":"controls/V-75481.rb","controls":["V-75481"]},{"id":"controls/V-75813.rb","controls":["V-75813"]},{"id":"controls/V-75601.rb","controls":["V-75601"]},{"id":"controls/V-75741.rb","controls":["V-75741"]},{"id":"controls/V-75697.rb","controls":["V-75697"]},{"id":"controls/V-75885.rb","controls":["V-75885"]},{"id":"controls/V-75557.rb","controls":["V-75557"]},{"id":"controls/V-75775.rb","controls":["V-75775"]},{"id":"controls/V-75635.rb","controls":["V-75635"]},{"id":"controls/V-75827.rb","controls":["V-75827"]},{"id":"controls/V-80961.rb","controls":["V-80961"]},{"id":"controls/V-75837.rb","controls":["V-75837"]},{"id":"controls/V-75625.rb","controls":["V-75625"]},{"id":"controls/V-75765.rb","controls":["V-75765"]},{"id":"controls/V-75547.rb","controls":["V-75547"]},{"id":"controls/V-75895.rb","controls":["V-75895"]},{"id":"controls/V-75687.rb","controls":["V-75687"]},{"id":"controls/V-75751.rb","controls":["V-75751"]},{"id":"controls/V-75611.rb","controls":["V-75611"]},{"id":"controls/V-75491.rb","controls":["V-75491"]},{"id":"controls/V-75803.rb","controls":["V-75803"]},{"id":"controls/V-75573.rb","controls":["V-75573"]},{"id":"controls/V-75871.rb","controls":["V-75871"]},{"id":"controls/V-75723.rb","controls":["V-75723"]},{"id":"controls/V-75663.rb","controls":["V-75663"]},{"id":"controls/V-75441.rb","controls":["V-75441"]},{"id":"controls/V-75501.rb","controls":["V-75501"]},{"id":"controls/V-75781.rb","controls":["V-75781"]},{"id":"controls/V-75657.rb","controls":["V-75657"]},{"id":"controls/V-75717.rb","controls":["V-75717"]},{"id":"controls/V-75597.rb","controls":["V-75597"]},{"id":"controls/V-75905.rb","controls":["V-75905"]},{"id":"controls/V-75845.rb","controls":["V-75845"]},{"id":"controls/V-75535.rb","controls":["V-75535"]},{"id":"controls/V-75475.rb","controls":["V-75475"]},{"id":"controls/V-75389.rb","controls":["V-75389"]},{"id":"controls/V-75465.rb","controls":["V-75465"]},{"id":"controls/V-75525.rb","controls":["V-75525"]},{"id":"controls/V-75855.rb","controls":["V-75855"]},{"id":"controls/V-75587.rb","controls":["V-75587"]},{"id":"controls/V-75707.rb","controls":["V-75707"]},{"id":"controls/V-75647.rb","controls":["V-75647"]},{"id":"controls/V-75791.rb","controls":["V-75791"]},{"id":"controls/V-75511.rb","controls":["V-75511"]},{"id":"controls/V-75451.rb","controls":["V-75451"]},{"id":"controls/V-75733.rb","controls":["V-75733"]},{"id":"controls/V-75901.rb","controls":["V-75901"]},{"id":"controls/V-75593.rb","controls":["V-75593"]},{"id":"controls/V-75841.rb","controls":["V-75841"]},{"id":"controls/V-75653.rb","controls":["V-75653"]},{"id":"controls/V-75713.rb","controls":["V-75713"]},{"id":"controls/V-75531.rb","controls":["V-75531"]},{"id":"controls/V-75471.rb","controls":["V-75471"]},{"id":"controls/V-75727.rb","controls":["V-75727"]},{"id":"controls/V-75667.rb","controls":["V-75667"]},{"id":"controls/V-75875.rb","controls":["V-75875"]},{"id":"controls/V-75785.rb","controls":["V-75785"]},{"id":"controls/V-75445.rb","controls":["V-75445"]},{"id":"controls/V-75505.rb","controls":["V-75505"]},{"id":"controls/V-78005.rb","controls":["V-78005"]},{"id":"controls/V-75515.rb","controls":["V-75515"]},{"id":"controls/V-75455.rb","controls":["V-75455"]},{"id":"controls/V-75795.rb","controls":["V-75795"]},{"id":"controls/V-75865.rb","controls":["V-75865"]},{"id":"controls/V-75737.rb","controls":["V-75737"]},{"id":"controls/V-75461.rb","controls":["V-75461"]},{"id":"controls/V-75521.rb","controls":["V-75521"]},{"id":"controls/V-75643.rb","controls":["V-75643"]},{"id":"controls/V-75851.rb","controls":["V-75851"]},{"id":"controls/V-75911.rb","controls":["V-75911"]},{"id":"controls/V-75583.rb","controls":["V-75583"]},{"id":"controls/V-75603.rb","controls":["V-75603"]},{"id":"controls/V-75743.rb","controls":["V-75743"]},{"id":"controls/V-75811.rb","controls":["V-75811"]},{"id":"controls/V-75483.rb","controls":["V-75483"]},{"id":"controls/V-75561.rb","controls":["V-75561"]},{"id":"controls/V-75825.rb","controls":["V-75825"]},{"id":"controls/V-75777.rb","controls":["V-75777"]},{"id":"controls/V-75637.rb","controls":["V-75637"]},{"id":"controls/V-75887.rb","controls":["V-75887"]},{"id":"controls/V-75555.rb","controls":["V-75555"]},{"id":"controls/V-75695.rb","controls":["V-75695"]},{"id":"controls/V-80957.rb","controls":["V-80957"]},{"id":"controls/V-80963.rb","controls":["V-80963"]},{"id":"controls/V-75545.rb","controls":["V-75545"]},{"id":"controls/V-75897.rb","controls":["V-75897"]},{"id":"controls/V-75627.rb","controls":["V-75627"]},{"id":"controls/V-75767.rb","controls":["V-75767"]},{"id":"controls/V-75835.rb","controls":["V-75835"]},{"id":"controls/V-75571.rb","controls":["V-75571"]},{"id":"controls/V-75801.rb","controls":["V-75801"]},{"id":"controls/V-75493.rb","controls":["V-75493"]},{"id":"controls/V-75753.rb","controls":["V-75753"]},{"id":"controls/V-75613.rb","controls":["V-75613"]},{"id":"controls/V-75773.rb","controls":["V-75773"]},{"id":"controls/V-75633.rb","controls":["V-75633"]},{"id":"controls/V-75821.rb","controls":["V-75821"]},{"id":"controls/V-75691.rb","controls":["V-75691"]},{"id":"controls/V-75883.rb","controls":["V-75883"]},{"id":"controls/V-75551.rb","controls":["V-75551"]},{"id":"controls/V-75487.rb","controls":["V-75487"]},{"id":"controls/V-75815.rb","controls":["V-75815"]},{"id":"controls/V-75607.rb","controls":["V-75607"]},{"id":"controls/V-75747.rb","controls":["V-75747"]},{"id":"controls/V-75565.rb","controls":["V-75565"]},{"id":"controls/V-75435.rb","controls":["V-75435"]},{"id":"controls/V-75575.rb","controls":["V-75575"]},{"id":"controls/V-75757.rb","controls":["V-75757"]},{"id":"controls/V-75617.rb","controls":["V-75617"]},{"id":"controls/V-75497.rb","controls":["V-75497"]},{"id":"controls/V-75805.rb","controls":["V-75805"]},{"id":"controls/V-75541.rb","controls":["V-75541"]},{"id":"controls/V-75893.rb","controls":["V-75893"]},{"id":"controls/V-75831.rb","controls":["V-75831"]},{"id":"controls/V-75623.rb","controls":["V-75623"]},{"id":"controls/V-75393.rb","controls":["V-75393"]},{"id":"controls/V-75729.rb","controls":["V-75729"]},{"id":"controls/V-75739.rb","controls":["V-75739"]},{"id":"controls/V-75599.rb","controls":["V-75599"]},{"id":"controls/V-75659.rb","controls":["V-75659"]},{"id":"controls/V-75719.rb","controls":["V-75719"]},{"id":"controls/V-75709.rb","controls":["V-75709"]},{"id":"controls/V-75649.rb","controls":["V-75649"]},{"id":"controls/V-75589.rb","controls":["V-75589"]},{"id":"controls/V-80969.rb","controls":["V-80969"]},{"id":"controls/V-75609.rb","controls":["V-75609"]},{"id":"controls/V-75749.rb","controls":["V-75749"]},{"id":"controls/V-75489.rb","controls":["V-75489"]},{"id":"controls/V-75499.rb","controls":["V-75499"]},{"id":"controls/V-75759.rb","controls":["V-75759"]},{"id":"controls/V-80959.rb","controls":["V-80959"]},{"id":"controls/V-75889.rb","controls":["V-75889"]},{"id":"controls/V-75779.rb","controls":["V-75779"]},{"id":"controls/V-75639.rb","controls":["V-75639"]},{"id":"controls/V-75629.rb","controls":["V-75629"]},{"id":"controls/V-75769.rb","controls":["V-75769"]},{"id":"controls/V-75899.rb","controls":["V-75899"]}],"controls":[{"id":"V-75909","title":"The Ubuntu operating system, for PKI-based authentication, must\nvalidate certificates by constructing a certification path (which includes\nstatus information) to an accepted trust anchor.","desc":"Without path validation, an informed trust decision by the relying\nparty cannot be made when presented with any certificate not already explicitly\ntrusted.\n\n    A trust anchor is an authoritative entity represented via a public key and\nassociated data. It is used in the context of public key infrastructures, X.509\ndigital certificates, and DNSSEC.\n\n    When there is a chain of trust, usually the top entity to be trusted\nbecomes the trust anchor; it can be, for example, a Certification Authority\n(CA). A certification path starts with the subject certificate and proceeds\nthrough a number of intermediate certificates up to a trusted root certificate,\ntypically issued by a trusted CA.\n\n    This requirement verifies that a certification path to an accepted trust\nanchor is used for certificate validation and that the path includes status\ninformation. Path validation is necessary for a relying party to make an\ninformed trust decision when presented with any certificate not already\nexplicitly trusted. Status information for certification paths includes\ncertificate revocation lists or online certificate status protocol responses.\nValidation of the certificate status information is out of scope for this\nrequirement.","descriptions":[{"label":"default","data":"Without path validation, an informed trust decision by the relying\nparty cannot be made when presented with any certificate not already explicitly\ntrusted.\n\n    A trust anchor is an authoritative entity represented via a public key and\nassociated data. It is used in the context of public key infrastructures, X.509\ndigital certificates, and DNSSEC.\n\n    When there is a chain of trust, usually the top entity to be trusted\nbecomes the trust anchor; it can be, for example, a Certification Authority\n(CA). A certification path starts with the subject certificate and proceeds\nthrough a number of intermediate certificates up to a trusted root certificate,\ntypically issued by a trusted CA.\n\n    This requirement verifies that a certification path to an accepted trust\nanchor is used for certificate validation and that the path includes status\ninformation. Path validation is necessary for a relying party to make an\ninformed trust decision when presented with any certificate not already\nexplicitly trusted. Status information for certification paths includes\ncertificate revocation lists or online certificate status protocol responses.\nValidation of the certificate status information is out of scope for this\nrequirement."},{"label":"check","data":"Verify the Ubuntu operating system, for PKI-based\nauthentication, had valid certificates by constructing a certification path\n(which includes status information) to an accepted trust anchor.\n\nCheck which pkcs11 module is being used via the \"use_pkcs11_module\" in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\" and then ensure \"ca\" is enabled in\n\"cert_policy\" with the following command:\n\n# sudo grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf\n\ncert_policy = ca,signature,ocsp_on;\n\nIf \"cert_policy\" is not set to \"ca\",  has a value of \"none\", or the line\nis commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system, for PKI-based\nauthentication, to validate certificates by constructing a certification path\n(which includes status information) to an accepted trust anchor.\n\nDetermine which pkcs11 module is being used via the \"use_pkcs11_module\" in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\" and ensure \"ca\" is enabled in\n\"cert_policy\".\n\nAdd or update the \"cert_policy\" to ensure \"ca\" is enabled:\n\ncert_policy = ca,signature,ocsp_on;"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000066-GPOS-00034","satisfies":["SRG-OS-000066-GPOS-00034","SRG-OS-000384-GPOS-00167"],"gid":"V-75909","rid":"SV-90589r2_rule","stig_id":"UBTU-16-030830","fix_id":"F-82539r2_fix","cci":["CCI-000185","CCI-001991"],"nist":["IA-5 (2) (a)","IA-5 (2) (d)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75909\" do\n  title \"The Ubuntu operating system, for PKI-based authentication, must\nvalidate certificates by constructing a certification path (which includes\nstatus information) to an accepted trust anchor.\"\n  desc  \"Without path validation, an informed trust decision by the relying\nparty cannot be made when presented with any certificate not already explicitly\ntrusted.\n\n    A trust anchor is an authoritative entity represented via a public key and\nassociated data. It is used in the context of public key infrastructures, X.509\ndigital certificates, and DNSSEC.\n\n    When there is a chain of trust, usually the top entity to be trusted\nbecomes the trust anchor; it can be, for example, a Certification Authority\n(CA). A certification path starts with the subject certificate and proceeds\nthrough a number of intermediate certificates up to a trusted root certificate,\ntypically issued by a trusted CA.\n\n    This requirement verifies that a certification path to an accepted trust\nanchor is used for certificate validation and that the path includes status\ninformation. Path validation is necessary for a relying party to make an\ninformed trust decision when presented with any certificate not already\nexplicitly trusted. Status information for certification paths includes\ncertificate revocation lists or online certificate status protocol responses.\nValidation of the certificate status information is out of scope for this\nrequirement.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000066-GPOS-00034\"\n  tag \"satisfies\": [\"SRG-OS-000066-GPOS-00034\", \"SRG-OS-000384-GPOS-00167\"]\n  tag \"gid\": \"V-75909\"\n  tag \"rid\": \"SV-90589r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030830\"\n  tag \"fix_id\": \"F-82539r2_fix\"\n  tag \"cci\": [\"CCI-000185\", \"CCI-001991\"]\n  tag \"nist\": [\"IA-5 (2) (a)\", \"IA-5 (2) (d)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system, for PKI-based\nauthentication, had valid certificates by constructing a certification path\n(which includes status information) to an accepted trust anchor.\n\nCheck which pkcs11 module is being used via the \\\"use_pkcs11_module\\\" in\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" and then ensure \\\"ca\\\" is enabled in\n\\\"cert_policy\\\" with the following command:\n\n# sudo grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf\n\ncert_policy = ca,signature,ocsp_on;\n\nIf \\\"cert_policy\\\" is not set to \\\"ca\\\",  has a value of \\\"none\\\", or the line\nis commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system, for PKI-based\nauthentication, to validate certificates by constructing a certification path\n(which includes status information) to an accepted trust anchor.\n\nDetermine which pkcs11 module is being used via the \\\"use_pkcs11_module\\\" in\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" and ensure \\\"ca\\\" is enabled in\n\\\"cert_policy\\\".\n\nAdd or update the \\\"cert_policy\\\" to ensure \\\"ca\\\" is enabled:\n\ncert_policy = ca,signature,ocsp_on;\"\n\n  config_file_exists = file('/etc/pam_pkcs11/pam_pkcs11.conf').exist?\n\n  if config_file_exists\n    describe parse_config_file('/etc/pam_pkcs11/pam_pkcs11.conf') do\n      its('use_pkcs11_module') { should_not be_nil }\n    its('cert_policy') { should include 'ca' }\n    end\n  else\n    describe \"/etc/pam_pkcs11/pam_pkcs11.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75909.rb"},"results":[{"status":"failed","code_desc":"/etc/pam_pkcs11/pam_pkcs11.conf exists should equal true","run_time":0.000277,"start_time":"2019-08-06T11:13:27-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75849","title":"The SSH daemon must use privilege separation.","desc":"SSH daemon privilege separation causes the SSH process to drop root\nprivileges when not needed, which would decrease the impact of software\nvulnerabilities in the unprivileged section.","descriptions":[{"label":"default","data":"SSH daemon privilege separation causes the SSH process to drop root\nprivileges when not needed, which would decrease the impact of software\nvulnerabilities in the unprivileged section."},{"label":"check","data":"Check that the SSH daemon performs privilege separation with\nthe following command:\n\n# grep UsePrivilegeSeparation /etc/ssh/sshd_config\n\nUsePrivilegeSeparation yes\n\nIf the \"UsePrivilegeSeparation\" keyword is set to \"no\", is missing, or the\nreturned line is commented out, this is a finding."},{"label":"fix","data":"Configure SSH to use privilege separation. Uncomment the\n\"UsePrivilegeSeparation\" keyword in \"/etc/ssh/sshd_config\" and set the\nvalue to \"yes\":\n\nUsePrivilegeSeparation yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75849","rid":"SV-90529r2_rule","stig_id":"UBTU-16-030340","fix_id":"F-82479r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75849\" do\n  title \"The SSH daemon must use privilege separation.\"\n  desc  \"SSH daemon privilege separation causes the SSH process to drop root\nprivileges when not needed, which would decrease the impact of software\nvulnerabilities in the unprivileged section.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75849\"\n  tag \"rid\": \"SV-90529r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030340\"\n  tag \"fix_id\": \"F-82479r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Check that the SSH daemon performs privilege separation with\nthe following command:\n\n# grep UsePrivilegeSeparation /etc/ssh/sshd_config\n\nUsePrivilegeSeparation yes\n\nIf the \\\"UsePrivilegeSeparation\\\" keyword is set to \\\"no\\\", is missing, or the\nreturned line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure SSH to use privilege separation. Uncomment the\n\\\"UsePrivilegeSeparation\\\" keyword in \\\"/etc/ssh/sshd_config\\\" and set the\nvalue to \\\"yes\\\":\n\nUsePrivilegeSeparation yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('UsePrivilegeSeparation') { should cmp 'yes' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75849.rb"},"results":[{"status":"passed","code_desc":"SSHD Configuration UsePrivilegeSeparation should cmp == \"yes\"","run_time":0.000596,"start_time":"2019-08-06T11:13:27-04:00"}]},{"id":"V-75479","title":"The Ubuntu operating system must not have accounts configured with\nblank or null passwords.","desc":"If an account has an empty password, anyone could log on and run\ncommands with the privileges of that account. Accounts with empty passwords\nshould never be used in operational environments.","descriptions":[{"label":"default","data":"If an account has an empty password, anyone could log on and run\ncommands with the privileges of that account. Accounts with empty passwords\nshould never be used in operational environments."},{"label":"check","data":"To verify that null passwords cannot be used, run the following\ncommand:\n\n# grep pam_unix.so /etc/pam.d/* | grep nullok\nIf this produces any output, it may be possible to log on with accounts with\nempty passwords.\n\nIf null passwords can be used, this is a finding."},{"label":"fix","data":"If an account is configured for password authentication but does\nnot have an assigned password, it may be possible to log on to the account\nwithout authenticating.\n\nRemove any instances of the \"nullok\" option in files under \"/etc/pam.d/\" to\nprevent logons with empty passwords."}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75479","rid":"SV-90159r1_rule","stig_id":"UBTU-16-010250","fix_id":"F-82107r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75479\" do\n  title \"The Ubuntu operating system must not have accounts configured with\nblank or null passwords.\"\n  desc  \"If an account has an empty password, anyone could log on and run\ncommands with the privileges of that account. Accounts with empty passwords\nshould never be used in operational environments.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75479\"\n  tag \"rid\": \"SV-90159r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010250\"\n  tag \"fix_id\": \"F-82107r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"To verify that null passwords cannot be used, run the following\ncommand:\n\n# grep pam_unix.so /etc/pam.d/* | grep nullok\nIf this produces any output, it may be possible to log on with accounts with\nempty passwords.\n\nIf null passwords can be used, this is a finding.\"\n  desc \"fix\", \"If an account is configured for password authentication but does\nnot have an assigned password, it may be possible to log on to the account\nwithout authenticating.\n\nRemove any instances of the \\\"nullok\\\" option in files under \\\"/etc/pam.d/\\\" to\nprevent logons with empty passwords.\"\n\n  describe command(\"grep pam_unix.so /etc/pam.d/* | grep nullok\") do\n    its('stdout.strip') { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75479.rb"},"results":[{"status":"failed","code_desc":"Command: `grep pam_unix.so /etc/pam.d/* | grep nullok` stdout.strip should be empty","run_time":0.021284,"start_time":"2019-08-06T11:13:27-04:00","message":"expected `\"/etc/pam.d/common-auth:auth\\t[success=1 default=ignore]\\tpam_unix.so nullok_secure try_first_pass\".empty?` to return true, got false"}]},{"id":"V-75469","title":"Emergency administrator accounts must never be automatically removed\nor disabled.","desc":"Emergency accounts are privileged accounts that are established in\nresponse to crisis situations where the need for rapid account activation is\nrequired. Therefore, emergency account activation may bypass normal account\nauthorization processes. If these accounts are automatically disabled, system\nmaintenance during emergencies may not be possible, thus adversely affecting\nsystem availability.\n\n    Emergency accounts are different from infrequently used accounts (i.e.,\nlocal logon accounts used by the organization's system administrators when\nnetwork or normal logon/access is not available). Infrequently used accounts\nare not subject to automatic termination dates. Emergency accounts are accounts\ncreated in response to crisis situations, usually for use by maintenance\npersonnel. The automatic expiration or disabling time period may be extended as\nneeded until the crisis is resolved; however, it must not be extended\nindefinitely. A permanent account should be established for privileged users\nwho need long-term maintenance accounts.\n\n    To address access requirements, many Ubuntu operating systems can be\nintegrated with enterprise-level authentication/access mechanisms that meet or\nexceed access control policy requirements.","descriptions":[{"label":"default","data":"Emergency accounts are privileged accounts that are established in\nresponse to crisis situations where the need for rapid account activation is\nrequired. Therefore, emergency account activation may bypass normal account\nauthorization processes. If these accounts are automatically disabled, system\nmaintenance during emergencies may not be possible, thus adversely affecting\nsystem availability.\n\n    Emergency accounts are different from infrequently used accounts (i.e.,\nlocal logon accounts used by the organization's system administrators when\nnetwork or normal logon/access is not available). Infrequently used accounts\nare not subject to automatic termination dates. Emergency accounts are accounts\ncreated in response to crisis situations, usually for use by maintenance\npersonnel. The automatic expiration or disabling time period may be extended as\nneeded until the crisis is resolved; however, it must not be extended\nindefinitely. A permanent account should be established for privileged users\nwho need long-term maintenance accounts.\n\n    To address access requirements, many Ubuntu operating systems can be\nintegrated with enterprise-level authentication/access mechanisms that meet or\nexceed access control policy requirements."},{"label":"check","data":"Verify the Ubuntu operating system is configured such that the\nemergency administrator account is never automatically removed or disabled.\n\nCheck to see if the root account password or account expires with the following\ncommand:\n\n# sudo chage -l root\n\nPassword expires :never\n\nIf \"Password expires\" or \"Account expires\" is set to anything other than\n\"never\", this is a finding."},{"label":"fix","data":"Replace \"[Emergency_Administrator]\" in the following command\nwith the correct emergency administrator account. Run the following command as\nan administrator:\n\n# sudo chage -I -1 -M 99999 [Emergency_Administrator]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000123-GPOS-00064","gid":"V-75469","rid":"SV-90149r1_rule","stig_id":"UBTU-16-010200","fix_id":"F-82097r1_fix","cci":["CCI-001682"],"nist":["AC-2 (2)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75469\" do\n  title \"Emergency administrator accounts must never be automatically removed\nor disabled.\"\n  desc  \"Emergency accounts are privileged accounts that are established in\nresponse to crisis situations where the need for rapid account activation is\nrequired. Therefore, emergency account activation may bypass normal account\nauthorization processes. If these accounts are automatically disabled, system\nmaintenance during emergencies may not be possible, thus adversely affecting\nsystem availability.\n\n    Emergency accounts are different from infrequently used accounts (i.e.,\nlocal logon accounts used by the organization's system administrators when\nnetwork or normal logon/access is not available). Infrequently used accounts\nare not subject to automatic termination dates. Emergency accounts are accounts\ncreated in response to crisis situations, usually for use by maintenance\npersonnel. The automatic expiration or disabling time period may be extended as\nneeded until the crisis is resolved; however, it must not be extended\nindefinitely. A permanent account should be established for privileged users\nwho need long-term maintenance accounts.\n\n    To address access requirements, many Ubuntu operating systems can be\nintegrated with enterprise-level authentication/access mechanisms that meet or\nexceed access control policy requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000123-GPOS-00064\"\n  tag \"gid\": \"V-75469\"\n  tag \"rid\": \"SV-90149r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010200\"\n  tag \"fix_id\": \"F-82097r1_fix\"\n  tag \"cci\": [\"CCI-001682\"]\n  tag \"nist\": [\"AC-2 (2)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is configured such that the\nemergency administrator account is never automatically removed or disabled.\n\nCheck to see if the root account password or account expires with the following\ncommand:\n\n# sudo chage -l root\n\nPassword expires :never\n\nIf \\\"Password expires\\\" or \\\"Account expires\\\" is set to anything other than\n\\\"never\\\", this is a finding.\"\n  desc \"fix\", \"Replace \\\"[Emergency_Administrator]\\\" in the following command\nwith the correct emergency administrator account. Run the following command as\nan administrator:\n\n# sudo chage -I -1 -M 99999 [Emergency_Administrator]\"\n\n  emergency_accounts = input('emergency_accounts')  \n\n  if emergency_accounts.empty?\n    describe \"Emergency accounts\" do\n      it { should be_empty }\n    end\n    describe shadow.where(user: 'root') do\n      its('expiry_dates') { should eq [nil] }\n    end\n  else\n    emergency_accounts.each do |acct|\n      describe command(\"sudo chage -l #{acct} | grep 'Account expires'\") do\n        its('stdout.strip') { should_not match %r{:\\s*never} }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75469.rb"},"results":[{"status":"failed","code_desc":"Emergency accounts should be empty","run_time":0.000164,"start_time":"2019-08-06T11:13:27-04:00","message":"expected `\"Emergency accounts\".empty?` to return true, got false"},{"status":"passed","code_desc":"/etc/shadow with user == \"root\" expiry_dates should eq [nil]","run_time":0.009148,"start_time":"2019-08-06T11:13:27-04:00"}]},{"id":"V-75529","title":"Advance package Tool (APT) must remove all software components after\nupdated versions have been installed.","desc":"Previous versions of software components that are not removed from the\ninformation system after updates have been installed may be exploited by\nadversaries. Some information technology products may remove older versions of\nsoftware automatically from the information system.","descriptions":[{"label":"default","data":"Previous versions of software components that are not removed from the\ninformation system after updates have been installed may be exploited by\nadversaries. Some information technology products may remove older versions of\nsoftware automatically from the information system."},{"label":"check","data":"Verify Advance package Tool (APT) is configured to remove all\nsoftware components after updated versions have been installed.\n\nCheck that APT is configured to remove all software components after updating\nwith the following command:\n\n# grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades\nUnattended-Upgrade::Remove-Unused-Dependencies \"true\";\n\nIf the \"Remove-Unused-Dependencies\" parameter is not set to \"true\", or is\nmissing, this is a finding."},{"label":"fix","data":"Configure APT to remove all software components after updated\nversions have been installed.\n\nAdd or updated the following option to the\n\"/etc/apt/apt.conf.d/50unattended-upgrades\" file:\n\nUnattended-Upgrade::Remove-Unused-Dependencies \"true\";"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000437-GPOS-00194","gid":"V-75529","rid":"SV-90209r1_rule","stig_id":"UBTU-16-010570","fix_id":"F-82157r1_fix","cci":["CCI-002617"],"nist":["SI-2 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75529\" do\n  title \"Advance package Tool (APT) must remove all software components after\nupdated versions have been installed.\"\n  desc  \"Previous versions of software components that are not removed from the\ninformation system after updates have been installed may be exploited by\nadversaries. Some information technology products may remove older versions of\nsoftware automatically from the information system.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000437-GPOS-00194\"\n  tag \"gid\": \"V-75529\"\n  tag \"rid\": \"SV-90209r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010570\"\n  tag \"fix_id\": \"F-82157r1_fix\"\n  tag \"cci\": [\"CCI-002617\"]\n  tag \"nist\": [\"SI-2 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify Advance package Tool (APT) is configured to remove all\nsoftware components after updated versions have been installed.\n\nCheck that APT is configured to remove all software components after updating\nwith the following command:\n\n# grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades\nUnattended-Upgrade::Remove-Unused-Dependencies \\\"true\\\";\n\nIf the \\\"Remove-Unused-Dependencies\\\" parameter is not set to \\\"true\\\", or is\nmissing, this is a finding.\"\n  desc \"fix\", \"Configure APT to remove all software components after updated\nversions have been installed.\n\nAdd or updated the following option to the\n\\\"/etc/apt/apt.conf.d/50unattended-upgrades\\\" file:\n\nUnattended-Upgrade::Remove-Unused-Dependencies \\\"true\\\";\"\n\n  describe directory('/etc/apt/apt.conf.d') do\n    it { should exist }\n  end\n\n  describe command('grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades').stdout.strip do\n    it {should match /^\\s*([^\\s]*::Remove-Unused-Dependencies)\\s*\\\\\"true\\\\\"\\s*;$/}\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75529.rb"},"results":[{"status":"passed","code_desc":"Directory /etc/apt/apt.conf.d should exist","run_time":0.028293,"start_time":"2019-08-06T11:13:27-04:00"},{"status":"failed","code_desc":"should match /^\\s*([^\\s]*::Remove-Unused-Dependencies)\\s*\\\\\"true\\\\\"\\s*;$/","run_time":0.000326,"start_time":"2019-08-06T11:13:27-04:00","message":"expected \"\" to match /^\\s*([^\\s]*::Remove-Unused-Dependencies)\\s*\\\\\"true\\\\\"\\s*;$/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\s*([^\\s]*::Remove-Unused-Dependencies)\\s*\\\\\"true\\\\\"\\s*;$/\n+\"\"\n"}]},{"id":"V-75859","title":"The audit system must take appropriate action when the network cannot\nbe used to off-load audit records.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity."},{"label":"check","data":"Verify that the audit system takes appropriate action if the\nnetwork cannot be used to off-load audit records.\n\nCheck what action will take place if the network connection fails with the\nfollowing command:\n\n# sudo grep -iw \"network_failure\" /etc/audisp/audisp-remote.conf\n\nnetwork_failure_action = stop\n\nIf the value of the “network_failure_action” option is not \"syslog\",\n\"single\", or \"halt\", or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to take appropriate action\nwhen the network cannot be used to off-load audit records.\n\nAdd, edit or uncomment the \"network_failure_action\" option in\n\"/etc/audisp/audisp-remote.conf\". Set it to \"syslog\", \"single\" or\n\"halt\" like the below example:\n\nnetwork_failure_action = single"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000479-GPOS-00224","gid":"V-75859","rid":"SV-90539r2_rule","stig_id":"UBTU-16-030430","fix_id":"F-82489r1_fix","cci":["CCI-001851"],"nist":["AU-4 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75859\" do\n  title \"The audit system must take appropriate action when the network cannot\nbe used to off-load audit records.\"\n  desc  \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000479-GPOS-00224\"\n  tag \"gid\": \"V-75859\"\n  tag \"rid\": \"SV-90539r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030430\"\n  tag \"fix_id\": \"F-82489r1_fix\"\n  tag \"cci\": [\"CCI-001851\"]\n  tag \"nist\": [\"AU-4 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the audit system takes appropriate action if the\nnetwork cannot be used to off-load audit records.\n\nCheck what action will take place if the network connection fails with the\nfollowing command:\n\n# sudo grep -iw \\\"network_failure\\\" /etc/audisp/audisp-remote.conf\n\nnetwork_failure_action = stop\n\nIf the value of the “network_failure_action” option is not \\\"syslog\\\",\n\\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to take appropriate action\nwhen the network cannot be used to off-load audit records.\n\nAdd, edit or uncomment the \\\"network_failure_action\\\" option in\n\\\"/etc/audisp/audisp-remote.conf\\\". Set it to \\\"syslog\\\", \\\"single\\\" or\n\\\"halt\\\" like the below example:\n\nnetwork_failure_action = single\"\n\n  config_file_exists = file('/etc/audisp/audisp-remote.conf').exist?\n\n  if config_file_exists\n    describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n      its('network_failure_action.strip') { should match(/^(syslog|single|halt)$/) }\n    end\n  else\n    describe \"/etc/audisp/audisp-remote.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75859.rb"},"results":[{"status":"failed","code_desc":"/etc/audisp/audisp-remote.conf exists should equal true","run_time":0.000103,"start_time":"2019-08-06T11:13:27-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75391","title":"Ubuntu vendor packaged system security patches and updates must be\ninstalled and up to date.","desc":"Timely patching is critical for maintaining the operational\navailability, confidentiality, and integrity of information technology (IT)\nsystems. However, failure to keep Ubuntu operating system and application\nsoftware patched is a common mistake made by IT professionals. New patches are\nreleased daily, and it is often difficult for even experienced System\nAdministrators to keep abreast of all the new patches. When new weaknesses in\nan Ubuntu operating system exist, patches are usually made available by the\nvendor to resolve the problems. If the most recent security patches and updates\nare not installed, unauthorized users may take advantage of weaknesses in the\nunpatched software. The lack of prompt attention to patching could result in a\nsystem compromise.","descriptions":[{"label":"default","data":"Timely patching is critical for maintaining the operational\navailability, confidentiality, and integrity of information technology (IT)\nsystems. However, failure to keep Ubuntu operating system and application\nsoftware patched is a common mistake made by IT professionals. New patches are\nreleased daily, and it is often difficult for even experienced System\nAdministrators to keep abreast of all the new patches. When new weaknesses in\nan Ubuntu operating system exist, patches are usually made available by the\nvendor to resolve the problems. If the most recent security patches and updates\nare not installed, unauthorized users may take advantage of weaknesses in the\nunpatched software. The lack of prompt attention to patching could result in a\nsystem compromise."},{"label":"check","data":"Verify the Ubuntu operating system security patches and updates\nare installed and up to date. Updates are required to be applied with a\nfrequency determined by the site or Program Management Office (PMO).\n\nObtain the list of available package security updates from Ubuntu. The URL for\nupdates is https://www.Ubuntu.com/usn/. It is important to note that updates\nprovided by Ubuntu may not be present on the system if the underlying packages\nare not installed.\n\nCheck that the available package security updates have been installed on the\nsystem with the following command:\n\n# /usr/lib/update-notifier/apt-check --human-readable\n\n246 packages can be updated.\n0 updates are security updates.\n\nIf security package updates have not been performed on the system within the\ntimeframe that the site/program documentation requires, this is a finding.\n\nTypical update frequency may be overridden by Information Assurance\nVulnerability Alert (IAVA) notifications from JFHQ-DoDIN.\n\nIf the Ubuntu operating system is in non-compliance with the Information\nAssurance Vulnerability Management (IAVM) process, this is a finding."},{"label":"fix","data":"Install the Ubuntu operating system patches or updated packages\navailable from Canonical within 30 days or sooner as local policy dictates."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75391","rid":"SV-90071r4_rule","stig_id":"UBTU-16-010010","fix_id":"F-82019r4_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75391\" do\n  title \"Ubuntu vendor packaged system security patches and updates must be\ninstalled and up to date.\"\n  desc  \"Timely patching is critical for maintaining the operational\navailability, confidentiality, and integrity of information technology (IT)\nsystems. However, failure to keep Ubuntu operating system and application\nsoftware patched is a common mistake made by IT professionals. New patches are\nreleased daily, and it is often difficult for even experienced System\nAdministrators to keep abreast of all the new patches. When new weaknesses in\nan Ubuntu operating system exist, patches are usually made available by the\nvendor to resolve the problems. If the most recent security patches and updates\nare not installed, unauthorized users may take advantage of weaknesses in the\nunpatched software. The lack of prompt attention to patching could result in a\nsystem compromise.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75391\"\n  tag \"rid\": \"SV-90071r4_rule\"\n  tag \"stig_id\": \"UBTU-16-010010\"\n  tag \"fix_id\": \"F-82019r4_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system security patches and updates\nare installed and up to date. Updates are required to be applied with a\nfrequency determined by the site or Program Management Office (PMO).\n\nObtain the list of available package security updates from Ubuntu. The URL for\nupdates is https://www.Ubuntu.com/usn/. It is important to note that updates\nprovided by Ubuntu may not be present on the system if the underlying packages\nare not installed.\n\nCheck that the available package security updates have been installed on the\nsystem with the following command:\n\n# /usr/lib/update-notifier/apt-check --human-readable\n\n246 packages can be updated.\n0 updates are security updates.\n\nIf security package updates have not been performed on the system within the\ntimeframe that the site/program documentation requires, this is a finding.\n\nTypical update frequency may be overridden by Information Assurance\nVulnerability Alert (IAVA) notifications from JFHQ-DoDIN.\n\nIf the Ubuntu operating system is in non-compliance with the Information\nAssurance Vulnerability Management (IAVM) process, this is a finding.\"\n  desc \"fix\", \"Install the Ubuntu operating system patches or updated packages\navailable from Canonical within 30 days or sooner as local policy dictates.\"\n\n  describe command('/usr/lib/update-notifier/apt-check --human-readable') do\n    its('exit_status') { should cmp 0 }\n    its('stdout') { should match '^0 updates are security updates.$' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75391.rb"},"results":[{"status":"passed","code_desc":"Command: `/usr/lib/update-notifier/apt-check --human-readable` exit_status should cmp == 0","run_time":1.054125,"start_time":"2019-08-06T11:13:27-04:00"},{"status":"passed","code_desc":"Command: `/usr/lib/update-notifier/apt-check --human-readable` stdout should match \"^0 updates are security updates.$\"","run_time":0.000136,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75879","title":"The Ubuntu operating system must prevent Internet Protocol version 4\n(IPv4) Internet Control Message Protocol (ICMP) redirect messages from being\naccepted.","desc":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages modify the host's route table and are\nunauthenticated. An illicit ICMP redirect message could result in a\nman-in-the-middle attack.","descriptions":[{"label":"default","data":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages modify the host's route table and are\nunauthenticated. An illicit ICMP redirect message could result in a\nman-in-the-middle attack."},{"label":"check","data":"Verify the Ubuntu operating system will not accept IPv4\nInternet Control Message Protocol (ICMP) redirect messages.\n\nCheck the value of the default \"accept_redirects\" variables with the\nfollowing command:\n\n# sudo sysctl net.ipv4.conf.default.accept_redirects\n\nnet.ipv4.conf.default.accept_redirects=0\n\nIf the returned line does not have a value of \"0\", or a line is not returned,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to prevent Internet\nProtocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect\nmessages from being acceptedr with the following command:\n\n# sudo sysctl -w net.ipv4.conf.default.accept_redirects=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.conf.default.accept_redirects=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75879","rid":"SV-90559r3_rule","stig_id":"UBTU-16-030560","fix_id":"F-82509r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75879\" do\n  title \"The Ubuntu operating system must prevent Internet Protocol version 4\n(IPv4) Internet Control Message Protocol (ICMP) redirect messages from being\naccepted.\"\n  desc  \"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages modify the host's route table and are\nunauthenticated. An illicit ICMP redirect message could result in a\nman-in-the-middle attack.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75879\"\n  tag \"rid\": \"SV-90559r3_rule\"\n  tag \"stig_id\": \"UBTU-16-030560\"\n  tag \"fix_id\": \"F-82509r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system will not accept IPv4\nInternet Control Message Protocol (ICMP) redirect messages.\n\nCheck the value of the default \\\"accept_redirects\\\" variables with the\nfollowing command:\n\n# sudo sysctl net.ipv4.conf.default.accept_redirects\n\nnet.ipv4.conf.default.accept_redirects=0\n\nIf the returned line does not have a value of \\\"0\\\", or a line is not returned,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to prevent Internet\nProtocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect\nmessages from being acceptedr with the following command:\n\n# sudo sysctl -w net.ipv4.conf.default.accept_redirects=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.conf.default.accept_redirects=0\"\n\n  describe kernel_parameter('net.ipv4.conf.default.accept_redirects') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75879.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.conf.default.accept_redirects value should eq 0","run_time":0.009598,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75789","title":"Successful/unsuccessful uses of the pam_timestamp_check command must\ngenerate an audit record.","desc":"At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"pam_timestamp_check\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w pam_timestamp_check /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-pam_timestamp_check\n\nIf the above command does not return the exact same output displayed in the\nexample, this is a finding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"pam_timestamp_check\" command. Add or\nupdate the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-pam_timestamp_check\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75789","rid":"SV-90469r3_rule","stig_id":"UBTU-16-020820","fix_id":"F-82419r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75789\" do\n  title \"Successful/unsuccessful uses of the pam_timestamp_check command must\ngenerate an audit record.\"\n  desc  \"At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75789\"\n  tag \"rid\": \"SV-90469r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020820\"\n  tag \"fix_id\": \"F-82419r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"pam_timestamp_check\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w pam_timestamp_check /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-pam_timestamp_check\n\nIf the above command does not return the exact same output displayed in the\nexample, this is a finding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"pam_timestamp_check\\\" command. Add or\nupdate the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-pam_timestamp_check\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/pam_timestamp_check'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75789.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/pam_timestamp_check exist should equal true","run_time":0.000156,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75449","title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one upper-case character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised."},{"label":"check","data":"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one upper-case character be used.\n\nDetermine if the field \"ucredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n# grep -i \"ucredit\" /etc/security/pwquality.conf\nucredit=-1\n\nIf the \"ucredit\" parameter is not equal to \"-1\", or is commented out, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one upper-case character be used.\n\nAdd or update the following line in the \"/etc/security/pwquality.conf\" file\nto contain the \"ucredit\" parameter:\n\nucredit=-1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000069-GPOS-00037","gid":"V-75449","rid":"SV-90129r2_rule","stig_id":"UBTU-16-010100","fix_id":"F-82077r1_fix","cci":["CCI-000192"],"nist":["IA-5 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75449\" do\n  title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one upper-case character be used.\"\n  desc  \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000069-GPOS-00037\"\n  tag \"gid\": \"V-75449\"\n  tag \"rid\": \"SV-90129r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010100\"\n  tag \"fix_id\": \"F-82077r1_fix\"\n  tag \"cci\": [\"CCI-000192\"]\n  tag \"nist\": [\"IA-5 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one upper-case character be used.\n\nDetermine if the field \\\"ucredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n# grep -i \\\"ucredit\\\" /etc/security/pwquality.conf\nucredit=-1\n\nIf the \\\"ucredit\\\" parameter is not equal to \\\"-1\\\", or is commented out, this\nis a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one upper-case character be used.\n\nAdd or update the following line in the \\\"/etc/security/pwquality.conf\\\" file\nto contain the \\\"ucredit\\\" parameter:\n\nucredit=-1\"\n\n  min_num_uppercase_char = input('min_num_uppercase_char')\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('ucredit') { should cmp min_num_uppercase_char }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75449.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000102,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75509","title":"All persistent disk partitions must implement cryptographic mechanisms\nto prevent unauthorized disclosure or modification of all information that\nrequires at rest protection.","desc":"Ubuntu operating systems handling data requiring \"data at rest\"\nprotections must employ cryptographic mechanisms to prevent unauthorized\ndisclosure and modification of the information at rest.\n\n    Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).","descriptions":[{"label":"default","data":"Ubuntu operating systems handling data requiring \"data at rest\"\nprotections must employ cryptographic mechanisms to prevent unauthorized\ndisclosure and modification of the information at rest.\n\n    Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields)."},{"label":"check","data":"Verify the Ubuntu operating system prevents unauthorized\ndisclosure or modification of all information requiring at rest protection by\nusing disk encryption.\n\nIf there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\nDetermine the partition layout for the system with the following command:\n\n# fdisk –l\n\nVerify that the system partitions are all encrypted with the following command:\n\n# more /etc/crypttab\n\nEvery persistent disk partition present must have an entry in the file. If any\npartitions other than pseudo file systems (such as /proc or /sys) are not\nlisted, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to prevent unauthorized\nmodification of all information at rest by using disk encryption.\n\nEncrypting a partition in an already-installed system is more difficult,\nbecause you need to resize and change existing partitions. To encrypt an entire\npartition, dedicate a partition for encryption in the partition layout."}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000185-GPOS-00079","satisfies":["SRG-OS-000185-GPOS-00079","SRG-OS-000404-GPOS-00183","SRG-OS-000405-GPOS-00184"],"gid":"V-75509","rid":"SV-90189r1_rule","stig_id":"UBTU-16-010400","fix_id":"F-82137r1_fix","cci":["CCI-001199","CCI-002475","CCI-002476"],"nist":["SC-28","SC-28 (1)","SC-28 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75509\" do\n  title \"All persistent disk partitions must implement cryptographic mechanisms\nto prevent unauthorized disclosure or modification of all information that\nrequires at rest protection.\"\n  desc  \"Ubuntu operating systems handling data requiring \\\"data at rest\\\"\nprotections must employ cryptographic mechanisms to prevent unauthorized\ndisclosure and modification of the information at rest.\n\n    Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).\n\n\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000185-GPOS-00079\"\n  tag \"satisfies\": [\"SRG-OS-000185-GPOS-00079\", \"SRG-OS-000404-GPOS-00183\",\n\"SRG-OS-000405-GPOS-00184\"]\n  tag \"gid\": \"V-75509\"\n  tag \"rid\": \"SV-90189r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010400\"\n  tag \"fix_id\": \"F-82137r1_fix\"\n  tag \"cci\": [\"CCI-001199\", \"CCI-002475\", \"CCI-002476\"]\n  tag \"nist\": [\"SC-28\", \"SC-28 (1)\", \"SC-28 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system prevents unauthorized\ndisclosure or modification of all information requiring at rest protection by\nusing disk encryption.\n\nIf there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\nDetermine the partition layout for the system with the following command:\n\n# fdisk –l\n\nVerify that the system partitions are all encrypted with the following command:\n\n# more /etc/crypttab\n\nEvery persistent disk partition present must have an entry in the file. If any\npartitions other than pseudo file systems (such as /proc or /sys) are not\nlisted, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to prevent unauthorized\nmodification of all information at rest by using disk encryption.\n\nEncrypting a partition in an already-installed system is more difficult,\nbecause you need to resize and change existing partitions. To encrypt an entire\npartition, dedicate a partition for encryption in the partition layout.\"\n\n  describe \"Manual test\" do\n    skip \"This control must be reviewed manually\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75509.rb"},"results":[{"status":"skipped","code_desc":"Manual test","run_time":8.0e-06,"start_time":"2019-08-06T11:13:28-04:00","resource":"","skip_message":"This control must be reviewed manually"}]},{"id":"V-75519","title":"The file integrity tool must be configured to verify Access Control\nLists (ACLs).","desc":"ACLs can provide permissions beyond those permitted through the file\nmode and must be verified by file integrity tools.","descriptions":[{"label":"default","data":"ACLs can provide permissions beyond those permitted through the file\nmode and must be verified by file integrity tools."},{"label":"check","data":"Verify the file integrity tool is configured to verify Access\nControl Lists (ACLs).\n\nUse the following command to determine if the file is in a location other than\n\"/etc/aide/aide.conf\":\n\n# find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"acl\" rule has been added to\nthe rule list being applied to the files and directories selection lists with\nthe following command:\n\n# egrep \"[+]?acl\" /etc/aide/aide.conf\n\nVarFile = OwnerMode+n+l+X+acl\n\nIf the \"acl\" rule is not being used on all selection lines in the\n\"/etc/aide.conf\" file, is commented out, or ACLs are not being checked by\nanother file integrity tool, this is a finding."},{"label":"fix","data":"Configure the file integrity tool to check file and directory\nACLs.\n\nIf AIDE is installed, ensure the \"acl\" rule is present on all file and\ndirectory selection lists."}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75519","rid":"SV-90199r3_rule","stig_id":"UBTU-16-010520","fix_id":"F-82147r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75519\" do\n  title \"The file integrity tool must be configured to verify Access Control\nLists (ACLs).\"\n  desc  \"ACLs can provide permissions beyond those permitted through the file\nmode and must be verified by file integrity tools.\"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75519\"\n  tag \"rid\": \"SV-90199r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010520\"\n  tag \"fix_id\": \"F-82147r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the file integrity tool is configured to verify Access\nControl Lists (ACLs).\n\nUse the following command to determine if the file is in a location other than\n\\\"/etc/aide/aide.conf\\\":\n\n# find / -name aide.conf\n\nCheck the \\\"aide.conf\\\" file to determine if the \\\"acl\\\" rule has been added to\nthe rule list being applied to the files and directories selection lists with\nthe following command:\n\n# egrep \\\"[+]?acl\\\" /etc/aide/aide.conf\n\nVarFile = OwnerMode+n+l+X+acl\n\nIf the \\\"acl\\\" rule is not being used on all selection lines in the\n\\\"/etc/aide.conf\\\" file, is commented out, or ACLs are not being checked by\nanother file integrity tool, this is a finding.\"\n  desc \"fix\", \"Configure the file integrity tool to check file and directory\nACLs.\n\nIf AIDE is installed, ensure the \\\"acl\\\" rule is present on all file and\ndirectory selection lists.\"\n\n  describe aide_conf.all_have_rule('acl') do\n    it { should eq true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75519.rb"},"results":[{"status":"failed","code_desc":"false should eq true","run_time":0.000242,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: true\n     got: false\n\n(compared using ==)\n\nDiff:\n@@ -1,2 +1,2 @@\n-true\n+false\n"}]},{"id":"V-75459","title":"The Ubuntu operating system must encrypt all stored passwords with a\nFIPS 140-2 approved cryptographic hashing algorithm.","desc":"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.\n\n    Unapproved mechanisms that are used for authentication to the cryptographic\nmodule are not verified and therefore cannot be relied upon to provide\nconfidentiality or integrity, and DoD data may be compromised.\n\n    FIPS 140-2 is the current standard for validating that mechanisms used to\naccess cryptographic modules utilize authentication that meets DoD requirements.","descriptions":[{"label":"default","data":"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.\n\n    Unapproved mechanisms that are used for authentication to the cryptographic\nmodule are not verified and therefore cannot be relied upon to provide\nconfidentiality or integrity, and DoD data may be compromised.\n\n    FIPS 140-2 is the current standard for validating that mechanisms used to\naccess cryptographic modules utilize authentication that meets DoD requirements."},{"label":"check","data":"Verify that the shadow password suite configuration is set to\nencrypt password with a FIPS 140-2 approved cryptographic hashing algorithm.\n\nCheck the hashing algorithm that is being used to hash passwords with the\nfollowing command:\n\n# cat /etc/login.defs | grep -i crypt\n\nENCRYPT_METHOD SHA512\n\nIf \"ENCRYPT_METHOD\" does not equal SHA512 or greater, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to encrypt all stored\npasswords.\n\nEdit/Modify the following line in the \"/etc/login.defs\" file and set\n\"[ENCRYPT_METHOD]\" to SHA512.\n\nENCRYPT_METHOD SHA512"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000073-GPOS-00041","satisfies":["SRG-OS-000073-GPOS-00041","SRG-OS-000120-GPOS-00061"],"gid":"V-75459","rid":"SV-90139r1_rule","stig_id":"UBTU-16-010150","fix_id":"F-82087r1_fix","cci":["CCI-000196","CCI-000803"],"nist":["IA-5 (1) (c)","IA-7","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75459\" do\n  title \"The Ubuntu operating system must encrypt all stored passwords with a\nFIPS 140-2 approved cryptographic hashing algorithm.\"\n  desc  \"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.\n\n    Unapproved mechanisms that are used for authentication to the cryptographic\nmodule are not verified and therefore cannot be relied upon to provide\nconfidentiality or integrity, and DoD data may be compromised.\n\n    FIPS 140-2 is the current standard for validating that mechanisms used to\naccess cryptographic modules utilize authentication that meets DoD requirements.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000073-GPOS-00041\"\n  tag \"satisfies\": [\"SRG-OS-000073-GPOS-00041\", \"SRG-OS-000120-GPOS-00061\"]\n  tag \"gid\": \"V-75459\"\n  tag \"rid\": \"SV-90139r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010150\"\n  tag \"fix_id\": \"F-82087r1_fix\"\n  tag \"cci\": [\"CCI-000196\", \"CCI-000803\"]\n  tag \"nist\": [\"IA-5 (1) (c)\", \"IA-7\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the shadow password suite configuration is set to\nencrypt password with a FIPS 140-2 approved cryptographic hashing algorithm.\n\nCheck the hashing algorithm that is being used to hash passwords with the\nfollowing command:\n\n# cat /etc/login.defs | grep -i crypt\n\nENCRYPT_METHOD SHA512\n\nIf \\\"ENCRYPT_METHOD\\\" does not equal SHA512 or greater, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to encrypt all stored\npasswords.\n\nEdit/Modify the following line in the \\\"/etc/login.defs\\\" file and set\n\\\"[ENCRYPT_METHOD]\\\" to SHA512.\n\nENCRYPT_METHOD SHA512\"\n\n  describe login_defs do\n    its('ENCRYPT_METHOD') { should eq 'SHA512' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75459.rb"},"results":[{"status":"passed","code_desc":"login.defs ENCRYPT_METHOD should eq \"SHA512\"","run_time":0.000745,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75799","title":"The Network Information Service (NIS) package must not be installed.","desc":"Removing the Network Information Service (NIS) package decreases the\nrisk of the accidental (or intentional) activation of NIS or NIS+ services.","descriptions":[{"label":"default","data":"Removing the Network Information Service (NIS) package decreases the\nrisk of the accidental (or intentional) activation of NIS or NIS+ services."},{"label":"check","data":"Verify that the Network Information Service (NIS) package is\nnot installed on the Ubuntu operating system.\n\nCheck to see if the NIS package is installed with the following command:\n\n#  sudo apt list nis\n\nIf the NIS package is installed, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to disable non-essential\ncapabilities by removing the Network Information Service (NIS) package from the\nsystem with the following command:\n\n# sudo apt-get remove nis"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000095-GPOS-00049","gid":"V-75799","rid":"SV-90479r2_rule","stig_id":"UBTU-16-030010","fix_id":"F-82429r1_fix","cci":["CCI-000381"],"nist":["CM-7 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75799\" do\n  title \"The Network Information Service (NIS) package must not be installed.\"\n  desc  \"Removing the Network Information Service (NIS) package decreases the\nrisk of the accidental (or intentional) activation of NIS or NIS+ services.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000095-GPOS-00049\"\n  tag \"gid\": \"V-75799\"\n  tag \"rid\": \"SV-90479r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030010\"\n  tag \"fix_id\": \"F-82429r1_fix\"\n  tag \"cci\": [\"CCI-000381\"]\n  tag \"nist\": [\"CM-7 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Network Information Service (NIS) package is\nnot installed on the Ubuntu operating system.\n\nCheck to see if the NIS package is installed with the following command:\n\n#  sudo apt list nis\n\nIf the NIS package is installed, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to disable non-essential\ncapabilities by removing the Network Information Service (NIS) package from the\nsystem with the following command:\n\n# sudo apt-get remove nis\"\n\n  describe package('nis') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75799.rb"},"results":[{"status":"passed","code_desc":"System Package nis should not be installed","run_time":0.017241,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75869","title":"The Ubuntu operating system must be configured to use TCP syncookies.","desc":"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n    Managing excess capacity ensures that sufficient capacity is available to\ncounter flooding attacks. Employing increased capacity and service redundancy\nmay reduce the susceptibility to some DoS attacks. Managing excess capacity may\ninclude, for example, establishing selected usage priorities, quotas, or\npartitioning.","descriptions":[{"label":"default","data":"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n    Managing excess capacity ensures that sufficient capacity is available to\ncounter flooding attacks. Employing increased capacity and service redundancy\nmay reduce the susceptibility to some DoS attacks. Managing excess capacity may\ninclude, for example, establishing selected usage priorities, quotas, or\npartitioning."},{"label":"check","data":"Verify the Ubuntu operating system is configured to use TCP\nsyncookies.\n\nCheck the value of TCP syncookies with the following command:\n\n# sysctl net.ipv4.tcp_syncookies\nnet.ipv4.tcp_syncookies = 1\n\nIf the value is not \"1\", this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to use TCP syncookies, by\nrunning the following command:\n\n# sudo sysctl -w net.ipv4.tcp_syncookies=1\n\nIf \"1\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.tcp_syncookies = 1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000142-GPOS-00071","gid":"V-75869","rid":"SV-90549r2_rule","stig_id":"UBTU-16-030510","fix_id":"F-82499r2_fix","cci":["CCI-001095"],"nist":["SC-5 (2)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75869\" do\n  title \"The Ubuntu operating system must be configured to use TCP syncookies.\"\n  desc  \"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n    Managing excess capacity ensures that sufficient capacity is available to\ncounter flooding attacks. Employing increased capacity and service redundancy\nmay reduce the susceptibility to some DoS attacks. Managing excess capacity may\ninclude, for example, establishing selected usage priorities, quotas, or\npartitioning.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000142-GPOS-00071\"\n  tag \"gid\": \"V-75869\"\n  tag \"rid\": \"SV-90549r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030510\"\n  tag \"fix_id\": \"F-82499r2_fix\"\n  tag \"cci\": [\"CCI-001095\"]\n  tag \"nist\": [\"SC-5 (2)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is configured to use TCP\nsyncookies.\n\nCheck the value of TCP syncookies with the following command:\n\n# sysctl net.ipv4.tcp_syncookies\nnet.ipv4.tcp_syncookies = 1\n\nIf the value is not \\\"1\\\", this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to use TCP syncookies, by\nrunning the following command:\n\n# sudo sysctl -w net.ipv4.tcp_syncookies=1\n\nIf \\\"1\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.tcp_syncookies = 1\"\n\n  describe kernel_parameter('net.ipv4.tcp_syncookies') do\n    its('value') { should cmp 1 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75869.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.tcp_syncookies value should cmp == 1","run_time":0.010646,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75829","title":"The Ubuntu operating system must implement DoD-approved encryption to\nprotect the confidentiality of SSH connections.","desc":"Without confidentiality protection mechanisms, unauthorized\nindividuals may gain access to sensitive information via a remote access\nsession.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Encryption provides a means to secure the remote connection to prevent\nunauthorized access to the data traversing the remote access connection (e.g.,\nRDP), thereby providing a degree of confidentiality. The encryption strength of\na mechanism is selected based on the security categorization of the information.","descriptions":[{"label":"default","data":"Without confidentiality protection mechanisms, unauthorized\nindividuals may gain access to sensitive information via a remote access\nsession.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Encryption provides a means to secure the remote connection to prevent\nunauthorized access to the data traversing the remote access connection (e.g.,\nRDP), thereby providing a degree of confidentiality. The encryption strength of\na mechanism is selected based on the security categorization of the information."},{"label":"check","data":"Verify the SSH daemon is configured to only implement\nDoD-approved encryption.\n\nCheck the SSH daemon's current configured ciphers by running the following\ncommand:\n\n# sudo grep -i ciphers /etc/ssh/sshd_config | grep -v '^#'\n\nCiphers aes128-ctr aes192-ctr, aes256-ctr\n\nIf any ciphers other than \"aes128-ctr\", \"aes192-ctr\", or \"aes256-ctr\" are\nlisted, the \"Ciphers\" keyword is missing, or the retuned line is commented\nout, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to allow the SSH daemon to\nonly implement DoD-approved encryption.\n\nEdit the SSH daemon configuration \"/etc/ssh/sshd_config\" and remove any\nciphers not starting with \"aes\" and remove any ciphers ending with \"cbc\".\nIf necessary, append the \"Ciphers\" line to the \"/etc/ssh/sshd_config\"\ndocument.\n\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000033-GPOS-00014","gid":"V-75829","rid":"SV-90509r2_rule","stig_id":"UBTU-16-030230","fix_id":"F-82459r2_fix","cci":["CCI-000068"],"nist":["AC-17 (2)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75829\" do\n  title \"The Ubuntu operating system must implement DoD-approved encryption to\nprotect the confidentiality of SSH connections.\"\n  desc  \"Without confidentiality protection mechanisms, unauthorized\nindividuals may gain access to sensitive information via a remote access\nsession.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Encryption provides a means to secure the remote connection to prevent\nunauthorized access to the data traversing the remote access connection (e.g.,\nRDP), thereby providing a degree of confidentiality. The encryption strength of\na mechanism is selected based on the security categorization of the information.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000033-GPOS-00014\"\n  tag \"gid\": \"V-75829\"\n  tag \"rid\": \"SV-90509r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030230\"\n  tag \"fix_id\": \"F-82459r2_fix\"\n  tag \"cci\": [\"CCI-000068\"]\n  tag \"nist\": [\"AC-17 (2)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH daemon is configured to only implement\nDoD-approved encryption.\n\nCheck the SSH daemon's current configured ciphers by running the following\ncommand:\n\n# sudo grep -i ciphers /etc/ssh/sshd_config | grep -v '^#'\n\nCiphers aes128-ctr aes192-ctr, aes256-ctr\n\nIf any ciphers other than \\\"aes128-ctr\\\", \\\"aes192-ctr\\\", or \\\"aes256-ctr\\\" are\nlisted, the \\\"Ciphers\\\" keyword is missing, or the retuned line is commented\nout, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to allow the SSH daemon to\nonly implement DoD-approved encryption.\n\nEdit the SSH daemon configuration \\\"/etc/ssh/sshd_config\\\" and remove any\nciphers not starting with \\\"aes\\\" and remove any ciphers ending with \\\"cbc\\\".\nIf necessary, append the \\\"Ciphers\\\" line to the \\\"/etc/ssh/sshd_config\\\"\ndocument.\n\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  @ciphers_array = inspec.sshd_config.params['ciphers']\n\n  unless @ciphers_array.nil?\n    @ciphers_array = @ciphers_array.first.split(\",\")\n  end\n\n  describe @ciphers_array do\n    it { should be_in ['aes128-ctr', 'aes192-ctr', 'aes256-ctr'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75829.rb"},"results":[{"status":"failed","code_desc":"should be in \"aes128-ctr\", \"aes192-ctr\", and \"aes256-ctr\"","run_time":0.000178,"start_time":"2019-08-06T11:13:28-04:00","message":"expected `` to be in the list: `[\"aes128-ctr\", \"aes192-ctr\", \"aes256-ctr\"]`"}]},{"id":"V-75559","title":"All local interactive users must have a home directory assigned in the\n/etc/passwd file.","desc":"If local interactive users are not assigned a valid home directory,\nthere is no place for the storage and control of files they should own.","descriptions":[{"label":"default","data":"If local interactive users are not assigned a valid home directory,\nthere is no place for the storage and control of files they should own."},{"label":"check","data":"Verify local interactive users on the Ubuntu operating system\nhave a home directory assigned.\n\nCheck for missing local interactive user home directories with the following\ncommand:\n\n# sudo pwck -r\nuser 'lp': directory '/var/spool/lpd' does not exist\nuser 'news': directory '/var/spool/news' does not exist\nuser 'uucp': directory '/var/spool/uucp' does not exist\nuser 'www-data': directory '/var/www' does not exist\n\nAsk the System Administrator (SA) if any users found without home directories\nare local interactive users. If the SA is unable to provide a response, check\nfor users with a User Identifier (UID) of 1000 or greater with the following\ncommand:\n\n# sudo cut -d: -f 1,3 /etc/passwd | egrep \":[1-4][0-9]{2}$|:[0-9]{1,2}$\"\n\nIf any interactive users do not have a home directory assigned, this is a\nfinding."},{"label":"fix","data":"Assign home directories to all local interactive users on the\nUbuntu operating system that currently do not have a home directory assigned."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75559","rid":"SV-90239r1_rule","stig_id":"UBTU-16-010720","fix_id":"F-82187r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75559\" do\n  title \"All local interactive users must have a home directory assigned in the\n/etc/passwd file.\"\n  desc  \"If local interactive users are not assigned a valid home directory,\nthere is no place for the storage and control of files they should own.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75559\"\n  tag \"rid\": \"SV-90239r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010720\"\n  tag \"fix_id\": \"F-82187r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify local interactive users on the Ubuntu operating system\nhave a home directory assigned.\n\nCheck for missing local interactive user home directories with the following\ncommand:\n\n# sudo pwck -r\nuser 'lp': directory '/var/spool/lpd' does not exist\nuser 'news': directory '/var/spool/news' does not exist\nuser 'uucp': directory '/var/spool/uucp' does not exist\nuser 'www-data': directory '/var/www' does not exist\n\nAsk the System Administrator (SA) if any users found without home directories\nare local interactive users. If the SA is unable to provide a response, check\nfor users with a User Identifier (UID) of 1000 or greater with the following\ncommand:\n\n# sudo cut -d: -f 1,3 /etc/passwd | egrep \\\":[1-4][0-9]{2}$|:[0-9]{1,2}$\\\"\n\nIf any interactive users do not have a home directory assigned, this is a\nfinding.\"\n  desc \"fix\", \"Assign home directories to all local interactive users on the\nUbuntu operating system that currently do not have a home directory assigned.\"\n\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries.each do |user_info|\n    next if exempt_home_users.include?(\"#{user_info.username}\")\n    describe directory(user_info.home) do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75559.rb"},"results":[{"status":"passed","code_desc":"Directory /root should exist","run_time":0.018983,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /home/vagrant should exist","run_time":0.01961,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75699","title":"Successful/unsuccessful uses of the ssh-agent command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged ssh commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged ssh commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"ssh-agent\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep ssh-agent /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"ssh-agent\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75699","rid":"SV-90379r3_rule","stig_id":"UBTU-16-020400","fix_id":"F-82327r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75699\" do\n  title \"Successful/unsuccessful uses of the ssh-agent command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged ssh commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75699\"\n  tag \"rid\": \"SV-90379r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020400\"\n  tag \"fix_id\": \"F-82327r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"ssh-agent\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep ssh-agent /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"ssh-agent\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/ssh-agent'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      its('action.uniq') { should eq ['always'] }\n      its('list.uniq') { should eq ['exit'] }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75699.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/ssh-agent exist should equal true","run_time":0.000151,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75689","title":"The audit system must be configured to audit the execution of\nprivileged functions and prevent all software from executing at higher\nprivilege levels than users executing the software.","desc":"Misuse of privileged functions, either intentionally or\nunintentionally by authorized users, or by unauthorized external entities that\nhave compromised information system accounts, is a serious and ongoing concern\nand can have significant adverse impacts on organizations. Auditing the use of\nprivileged functions is one way to detect such misuse and identify the risk\nfrom insider threats and the advanced persistent threat.","descriptions":[{"label":"default","data":"Misuse of privileged functions, either intentionally or\nunintentionally by authorized users, or by unauthorized external entities that\nhave compromised information system accounts, is a serious and ongoing concern\nand can have significant adverse impacts on organizations. Auditing the use of\nprivileged functions is one way to detect such misuse and identify the risk\nfrom insider threats and the advanced persistent threat."},{"label":"check","data":"Verify the Ubuntu operating system audits the execution of\nprivilege functions.\n\nVerify if the Ubuntu operating system is configured to audit the execution of\nthe \"execve\" system call, by running the following command:\n\n# sudo grep execve /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F key=execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F key=execpriv\n\nIf the command does not return both lines, or the line is commented out, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"execve\" system call.\n\nAdd or update the following file system rules to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F key=execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F key=execpriv\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000326-GPOS-00126","satisfies":["SRG-OS-000326-GPOS-00126","SRG-OS-000327-GPOS-00127"],"gid":"V-75689","rid":"SV-90369r2_rule","stig_id":"UBTU-16-020350","fix_id":"F-82317r2_fix","cci":["CCI-002233","CCI-002234"],"nist":["AC-6 (8)","AC-6 (9)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75689\" do\n  title \"The audit system must be configured to audit the execution of\nprivileged functions and prevent all software from executing at higher\nprivilege levels than users executing the software.\"\n  desc  \"Misuse of privileged functions, either intentionally or\nunintentionally by authorized users, or by unauthorized external entities that\nhave compromised information system accounts, is a serious and ongoing concern\nand can have significant adverse impacts on organizations. Auditing the use of\nprivileged functions is one way to detect such misuse and identify the risk\nfrom insider threats and the advanced persistent threat.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000326-GPOS-00126\"\n  tag \"satisfies\": [\"SRG-OS-000326-GPOS-00126\", \"SRG-OS-000327-GPOS-00127\"]\n  tag \"gid\": \"V-75689\"\n  tag \"rid\": \"SV-90369r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020350\"\n  tag \"fix_id\": \"F-82317r2_fix\"\n  tag \"cci\": [\"CCI-002233\", \"CCI-002234\"]\n  tag \"nist\": [\"AC-6 (8)\", \"AC-6 (9)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system audits the execution of\nprivilege functions.\n\nVerify if the Ubuntu operating system is configured to audit the execution of\nthe \\\"execve\\\" system call, by running the following command:\n\n# sudo grep execve /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F key=execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F key=execpriv\n\nIf the command does not return both lines, or the line is commented out, this\nis a finding. \"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"execve\\\" system call.\n\nAdd or update the following file system rules to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F key=execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F key=execpriv\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"execve\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75689.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"execve\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.00013,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"execve\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000104,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75549","title":"The root account must be the only account having unrestricted access\nto the system.","desc":"If an account other than root also has a User Identifier (UID) of\n\"0\", it has root authority, giving that account unrestricted access to the\nentire Ubuntu operating system. Multiple accounts with a UID of \"0\" afford an\nopportunity for potential intruders to guess a password for a privileged\naccount.","descriptions":[{"label":"default","data":"If an account other than root also has a User Identifier (UID) of\n\"0\", it has root authority, giving that account unrestricted access to the\nentire Ubuntu operating system. Multiple accounts with a UID of \"0\" afford an\nopportunity for potential intruders to guess a password for a privileged\naccount."},{"label":"check","data":"Check the Ubuntu operating system for duplicate User ID (UID)\n\"0\" assignments with the following command:\n\n# awk -F: '$3 == 0 {print $1}' /etc/passwd\n\nroot\n\nIf any accounts other than root have a UID of \"0\", this is a finding."},{"label":"fix","data":"Change the User ID (UID) of any account on the system, other than\nroot, that has a UID of \"0\".\n\nIf the account is associated with system commands or applications, the UID\nshould be changed to one greater than \"0\" but less than \"1000\". Otherwise,\nassign a UID of greater than \"1000\" that has not already been assigned."}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75549","rid":"SV-90229r1_rule","stig_id":"UBTU-16-010670","fix_id":"F-82177r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75549\" do\n  title \"The root account must be the only account having unrestricted access\nto the system.\"\n  desc  \"If an account other than root also has a User Identifier (UID) of\n\\\"0\\\", it has root authority, giving that account unrestricted access to the\nentire Ubuntu operating system. Multiple accounts with a UID of \\\"0\\\" afford an\nopportunity for potential intruders to guess a password for a privileged\naccount.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75549\"\n  tag \"rid\": \"SV-90229r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010670\"\n  tag \"fix_id\": \"F-82177r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Check the Ubuntu operating system for duplicate User ID (UID)\n\\\"0\\\" assignments with the following command:\n\n# awk -F: '$3 == 0 {print $1}' /etc/passwd\n\nroot\n\nIf any accounts other than root have a UID of \\\"0\\\", this is a finding.\"\n  desc \"fix\", \"Change the User ID (UID) of any account on the system, other than\nroot, that has a UID of \\\"0\\\".\n\nIf the account is associated with system commands or applications, the UID\nshould be changed to one greater than \\\"0\\\" but less than \\\"1000\\\". Otherwise,\nassign a UID of greater than \\\"1000\\\" that has not already been assigned.\"\n\n  describe passwd.uids(0) do\n    its('users') { should cmp 'root' }\n    its('count') { should eq 1 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75549.rb"},"results":[{"status":"passed","code_desc":"/etc/passwd with uid == 0 users should cmp == \"root\"","run_time":0.00013,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"/etc/passwd with uid == 0 count should eq 1","run_time":6.6e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75819","title":"The Ubuntu operating system must implement non-executable data to\nprotect its memory from unauthorized code execution.","desc":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n    Examples of attacks are buffer overflow attacks.","descriptions":[{"label":"default","data":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n    Examples of attacks are buffer overflow attacks."},{"label":"check","data":"Verify the NX (no-execution) bit flag is set on the system.\n\nCheck that the no-execution bit flag is set with the following commands:\n\n# dmesg | grep NX\n\n[    0.000000] NX (Execute Disable) protection: active\n\nIf \"dmesg\" does not show \"NX (Execute Disable) protection\" active, check\nthe cpuinfo settings with the following command:\n\n# less /proc/cpuinfo | grep -i flags\nflags       : fpu vme de pse tsc ms nx rdtscp lm constant_tsc\n\nIf \"flags\" does not contain the \"nx\" flag, this is a finding."},{"label":"fix","data":"The NX bit execute protection must be enabled in the system BIOS."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000433-GPOS-00192","gid":"V-75819","rid":"SV-90499r2_rule","stig_id":"UBTU-16-030130","fix_id":"F-82449r1_fix","cci":["CCI-002824"],"nist":["SI-16","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75819\" do\n  title \"The Ubuntu operating system must implement non-executable data to\nprotect its memory from unauthorized code execution.\"\n  desc  \"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n    Examples of attacks are buffer overflow attacks.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000433-GPOS-00192\"\n  tag \"gid\": \"V-75819\"\n  tag \"rid\": \"SV-90499r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030130\"\n  tag \"fix_id\": \"F-82449r1_fix\"\n  tag \"cci\": [\"CCI-002824\"]\n  tag \"nist\": [\"SI-16\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the NX (no-execution) bit flag is set on the system.\n\nCheck that the no-execution bit flag is set with the following commands:\n\n# dmesg | grep NX\n\n[    0.000000] NX (Execute Disable) protection: active\n\nIf \\\"dmesg\\\" does not show \\\"NX (Execute Disable) protection\\\" active, check\nthe cpuinfo settings with the following command:\n\n# less /proc/cpuinfo | grep -i flags\nflags       : fpu vme de pse tsc ms nx rdtscp lm constant_tsc\n\nIf \\\"flags\\\" does not contain the \\\"nx\\\" flag, this is a finding.\"\n  desc \"fix\", \"The NX bit execute protection must be enabled in the system BIOS.\"\n\n  options = {\n    assignment_regex: /^\\s*([^:]*?)\\s*:\\s*(.*?)\\s*$/\n  }\n  describe.one do\n    describe command('dmesg | grep NX').stdout.strip do\n      it { should match %r(.+(NX \\(Execute Disable\\) protection: active)) }\n    end\n    describe parse_config_file('/proc/cpuinfo', options).flags.split(' ') do\n      it { should include 'nx' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75819.rb"},"results":[{"status":"passed","code_desc":"[    0.000000] NX (Execute Disable) protection: active\n[    0.671024] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0\n[    0.671114] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1\n[    0.905180] input: Video Bus as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/LNXVIDEO:00/input/input4 should match /.+(NX \\(Execute Disable\\) protection: active)/","run_time":5.7e-05,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"[\"fpu\", \"vme\", \"de\", \"pse\", \"tsc\", \"msr\", \"pae\", \"mce\", \"cx8\", \"apic\", \"sep\", \"mtrr\", \"pge\", \"mca\", \"cmov\", \"pat\", \"pse36\", \"clflush\", \"mmx\", \"fxsr\", \"sse\", \"sse2\", \"ht\", \"syscall\", \"nx\", \"rdtscp\", \"lm\", \"constant_tsc\", \"rep_good\", \"nopl\", \"xtopology\", \"nonstop_tsc\", \"eagerfpu\", \"pni\", \"pclmulqdq\", \"monitor\", \"ssse3\", \"cx16\", \"pcid\", \"sse4_1\", \"sse4_2\", \"x2apic\", \"movbe\", \"popcnt\", \"aes\", \"xsave\", \"avx\", \"rdrand\", \"hypervisor\", \"lahf_lm\", \"abm\", \"3dnowprefetch\", \"invpcid_single\", \"kaiser\", \"fsgsbase\", \"avx2\", \"invpcid\", \"rdseed\", \"clflushopt\"] should include \"nx\"","run_time":5.1e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75569","title":"All local initialization files must have mode 0740 or less permissive.","desc":"Local initialization files are used to configure the user's shell\nenvironment upon logon. Malicious modification of these files could compromise\naccounts upon logon.","descriptions":[{"label":"default","data":"Local initialization files are used to configure the user's shell\nenvironment upon logon. Malicious modification of these files could compromise\naccounts upon logon."},{"label":"check","data":"Verify that all local initialization files have a mode of\n\"0740\" or less permissive.\n\nCheck the mode on all local initialization files with the following command:\n\nNote: The example will be for the smithj user, who has a home directory of\n\"/home/smithj\".\n\n# ls -al /home/smithj/.* | more\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n\nIf any local initialization files have a mode more permissive than \"0740\",\nthis is a finding."},{"label":"fix","data":"Set the mode of the local initialization files to \"0740\" with\nthe following command:\n\nNote: The example will be for the smithj user, who has a home directory of\n\"/home/smithj\".\n\n# chmod 0740 /home/smithj/.<INIT_FILE>"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75569","rid":"SV-90249r1_rule","stig_id":"UBTU-16-010770","fix_id":"F-82197r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75569\" do\n  title \"All local initialization files must have mode 0740 or less permissive.\"\n  desc  \"Local initialization files are used to configure the user's shell\nenvironment upon logon. Malicious modification of these files could compromise\naccounts upon logon.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75569\"\n  tag \"rid\": \"SV-90249r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010770\"\n  tag \"fix_id\": \"F-82197r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that all local initialization files have a mode of\n\\\"0740\\\" or less permissive.\n\nCheck the mode on all local initialization files with the following command:\n\nNote: The example will be for the smithj user, who has a home directory of\n\\\"/home/smithj\\\".\n\n# ls -al /home/smithj/.* | more\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n\nIf any local initialization files have a mode more permissive than \\\"0740\\\",\nthis is a finding.\"\n  desc \"fix\", \"Set the mode of the local initialization files to \\\"0740\\\" with\nthe following command:\n\nNote: The example will be for the smithj user, who has a home directory of\n\\\"/home/smithj\\\".\n\n# chmod 0740 /home/smithj/.<INIT_FILE>\"\n\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n\n  findings = Set[]\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries.each do |user_info|\n    dot_files = command(\"find #{user_info.home} -xdev -maxdepth 1 -name '.*' -type f\").stdout.split(\"\\n\")\n    dot_files.each do |dot_file|\n      next if !file(dot_file).more_permissive_than?('0740')\n      findings << dot_file\n    end\n  end\n  describe \"All local initialization files have a mode of 0740 or less permissive\" do\n    subject { findings.to_a }\n    it { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75569.rb"},"results":[{"status":"failed","code_desc":"All local initialization files have a mode of 0740 or less permissive should be empty","run_time":0.000173,"start_time":"2019-08-06T11:13:28-04:00","message":"expected `[\"/root/.bashrc\", \"/root/.profile\", \"/home/vagrant/.vbox_version\", \"/home/vagrant/.bash_logout\", \"/ho...hsts\", \"/home/vagrant/.bashrc\", \"/home/vagrant/.sudo_as_admin_successful\", \"/home/vagrant/.profile\"].empty?` to return true, got false"}]},{"id":"V-75439","title":"All users must be able to directly initiate a session lock for all\nconnection types.","desc":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n    The session lock is implemented at the point where session activity can be\ndetermined. Rather than be forced to wait for a period of time to expire before\nthe user session can be locked, Ubuntu operating systems need to provide users\nwith the ability to manually invoke a session lock so users may secure their\nsession should the need arise for them to temporarily vacate the immediate\nphysical vicinity.","descriptions":[{"label":"default","data":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n    The session lock is implemented at the point where session activity can be\ndetermined. Rather than be forced to wait for a period of time to expire before\nthe user session can be locked, Ubuntu operating systems need to provide users\nwith the ability to manually invoke a session lock so users may secure their\nsession should the need arise for them to temporarily vacate the immediate\nphysical vicinity."},{"label":"check","data":"Verify the Ubuntu operating system has the 'vlock' package\ninstalled, by running the following command:\n\n# dpkg -l | grep vlock\n\nvlock_2.2.2-7\n\nIf \"vlock\" is not installed, this is a finding."},{"label":"fix","data":"Install the \"vlock\" (if it is not already installed) package by\nrunning the following command:\n\n# sudo apt-get install vlock"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000028-GPOS-00009","satisfies":["SRG-OS-000028-GPOS-00009","SRG-OS-000030-GPOS-00011","SRG-OS-000031-GPOS-00012"],"gid":"V-75439","rid":"SV-90119r2_rule","stig_id":"UBTU-16-010050","fix_id":"F-82067r1_fix","cci":["CCI-000056","CCI-000058","CCI-000060"],"nist":["AC-11 b","AC-11 a","AC-11 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75439\" do\n  title \"All users must be able to directly initiate a session lock for all\nconnection types.\"\n  desc  \"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n    The session lock is implemented at the point where session activity can be\ndetermined. Rather than be forced to wait for a period of time to expire before\nthe user session can be locked, Ubuntu operating systems need to provide users\nwith the ability to manually invoke a session lock so users may secure their\nsession should the need arise for them to temporarily vacate the immediate\nphysical vicinity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000028-GPOS-00009\"\n  tag \"satisfies\": [\"SRG-OS-000028-GPOS-00009\", \"SRG-OS-000030-GPOS-00011\",\n\"SRG-OS-000031-GPOS-00012\"]\n  tag \"gid\": \"V-75439\"\n  tag \"rid\": \"SV-90119r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010050\"\n  tag \"fix_id\": \"F-82067r1_fix\"\n  tag \"cci\": [\"CCI-000056\", \"CCI-000058\", \"CCI-000060\"]\n  tag \"nist\": [\"AC-11 b\", \"AC-11 a\", \"AC-11 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system has the 'vlock' package\ninstalled, by running the following command:\n\n# dpkg -l | grep vlock\n\nvlock_2.2.2-7\n\nIf \\\"vlock\\\" is not installed, this is a finding.\"\n  desc \"fix\", \"Install the \\\"vlock\\\" (if it is not already installed) package by\nrunning the following command:\n\n# sudo apt-get install vlock\"\n\n  describe package('vlock') do\n    it { should be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75439.rb"},"results":[{"status":"failed","code_desc":"System Package vlock should be installed","run_time":0.014668,"start_time":"2019-08-06T11:13:28-04:00","message":"expected that `System Package vlock` is installed"}]},{"id":"V-75579","title":"File systems that are being imported via Network File System (NFS)\nmust be mounted to prevent files with the setuid and setguid bit set from being\nexecuted.","desc":"The \"nosuid\" mount option causes the system to not execute\n\"setuid\" and \"setgid\" files with owner privileges. This option must be used\nfor mounting any file system not containing approved \"setuid\" and \"setguid\"\nfiles. Executing files from untrusted file systems increases the opportunity\nfor unprivileged users to attain unauthorized administrative access.","descriptions":[{"label":"default","data":"The \"nosuid\" mount option causes the system to not execute\n\"setuid\" and \"setgid\" files with owner privileges. This option must be used\nfor mounting any file system not containing approved \"setuid\" and \"setguid\"\nfiles. Executing files from untrusted file systems increases the opportunity\nfor unprivileged users to attain unauthorized administrative access."},{"label":"check","data":"Verify file systems that are being Network File System (NFS)\nimported are mounted with the \"nosuid\" option.\n\nFind the file system(s) that contain the directories being exported with the\nfollowing command:\n\n# grep nfs /etc/fstab | grep nosuid\n\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d    /store           nfs\nrw,nosuid                                                    0 0\n\nIf a file system found in \"/etc/fstab\" refers to NFS and it does not have the\n\"nosuid\" option set, this is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"nosuid\" option on file\nsystems that are being imported via Network File System (NFS)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75579","rid":"SV-90259r3_rule","stig_id":"UBTU-16-010820","fix_id":"F-82207r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75579\" do\n  title \"File systems that are being imported via Network File System (NFS)\nmust be mounted to prevent files with the setuid and setguid bit set from being\nexecuted.\"\n  desc  \"The \\\"nosuid\\\" mount option causes the system to not execute\n\\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used\nfor mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\"\nfiles. Executing files from untrusted file systems increases the opportunity\nfor unprivileged users to attain unauthorized administrative access.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75579\"\n  tag \"rid\": \"SV-90259r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010820\"\n  tag \"fix_id\": \"F-82207r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify file systems that are being Network File System (NFS)\nimported are mounted with the \\\"nosuid\\\" option.\n\nFind the file system(s) that contain the directories being exported with the\nfollowing command:\n\n# grep nfs /etc/fstab | grep nosuid\n\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d    /store           nfs\nrw,nosuid                                                    0 0\n\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the\n\\\"nosuid\\\" option set, this is a finding.\"\n  desc \"fix\", \"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file\nsystems that are being imported via Network File System (NFS).\"\n\n  device_rules = etc_fstab.where{ file_system_type == 'nfs' }.entries\n  if device_rules.count > 0\n    device_rules.each do |device_rule|\n      describe device_rule do\n        its ('mount_options') { should include 'nosuid' }\n      end\n    end\n  else\n    describe \"No NFS mounts found on the system\" do\n      subject { device_rules }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75579.rb"},"results":[{"status":"passed","code_desc":"No NFS mounts found on the system count should eq 0","run_time":0.000113,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75809","title":"The Ubuntu operating system must be configured to prohibit or restrict\nthe use of functions, ports, protocols, and/or services, as defined in the\nPorts, Protocols, and Services Management (PPSM) Category Assignments List\n(CAL) and vulnerability assessments.","desc":"In order to prevent unauthorized connection of devices, unauthorized\ntransfer of information, or unauthorized tunneling (i.e., embedding of data\ntypes within data types), organizations must disable or restrict unused or\nunnecessary physical and logical ports/protocols on information systems.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services provided by default\nmay not be necessary to support essential organizational operations.\nAdditionally, it is sometimes convenient to provide multiple services from a\nsingle component (e.g., VPN and IPS); however, doing so increases risk over\nlimiting the services provided by any one component.\n\n    To support the requirements and principles of least functionality, the\nUbuntu operating system must support the organizational requirements, providing\nonly essential capabilities and limiting the use of ports, protocols, and/or\nservices to only those required, authorized, and approved to conduct official\nbusiness or to address authorized quality of life issues.","descriptions":[{"label":"default","data":"In order to prevent unauthorized connection of devices, unauthorized\ntransfer of information, or unauthorized tunneling (i.e., embedding of data\ntypes within data types), organizations must disable or restrict unused or\nunnecessary physical and logical ports/protocols on information systems.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services provided by default\nmay not be necessary to support essential organizational operations.\nAdditionally, it is sometimes convenient to provide multiple services from a\nsingle component (e.g., VPN and IPS); however, doing so increases risk over\nlimiting the services provided by any one component.\n\n    To support the requirements and principles of least functionality, the\nUbuntu operating system must support the organizational requirements, providing\nonly essential capabilities and limiting the use of ports, protocols, and/or\nservices to only those required, authorized, and approved to conduct official\nbusiness or to address authorized quality of life issues."},{"label":"check","data":"Verify the Uncomplicated Firewall is configured to employ a\ndeny-all, allow-by-exception policy for allowing connections to other systems.\n\nCheck the Uncomplicated Firewall configuration with the following command:\n# sudo ufw status\nStatus: active\n\n     To                         Action      From\n     --                         ------      ----\n[ 1] 22                         LIMIT IN    Anywhere\n\nIf any services, ports, or applications are \"allowed\" and are not documented\nwith the organization, this is a finding."},{"label":"fix","data":"Add/Modify the Ubuntu operating system's firewall settings and/or\nrunning services to comply with the Ports, Protocols, and Services Management\n(PPSM) Category Assignments List (CAL)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000096-GPOS-00050","gid":"V-75809","rid":"SV-90489r2_rule","stig_id":"UBTU-16-030060","fix_id":"F-82439r1_fix","cci":["CCI-000382"],"nist":["CM-7 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75809\" do\n  title \"The Ubuntu operating system must be configured to prohibit or restrict\nthe use of functions, ports, protocols, and/or services, as defined in the\nPorts, Protocols, and Services Management (PPSM) Category Assignments List\n(CAL) and vulnerability assessments.\"\n  desc  \"In order to prevent unauthorized connection of devices, unauthorized\ntransfer of information, or unauthorized tunneling (i.e., embedding of data\ntypes within data types), organizations must disable or restrict unused or\nunnecessary physical and logical ports/protocols on information systems.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services provided by default\nmay not be necessary to support essential organizational operations.\nAdditionally, it is sometimes convenient to provide multiple services from a\nsingle component (e.g., VPN and IPS); however, doing so increases risk over\nlimiting the services provided by any one component.\n\n    To support the requirements and principles of least functionality, the\nUbuntu operating system must support the organizational requirements, providing\nonly essential capabilities and limiting the use of ports, protocols, and/or\nservices to only those required, authorized, and approved to conduct official\nbusiness or to address authorized quality of life issues.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000096-GPOS-00050\"\n  tag \"gid\": \"V-75809\"\n  tag \"rid\": \"SV-90489r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030060\"\n  tag \"fix_id\": \"F-82439r1_fix\"\n  tag \"cci\": [\"CCI-000382\"]\n  tag \"nist\": [\"CM-7 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Uncomplicated Firewall is configured to employ a\ndeny-all, allow-by-exception policy for allowing connections to other systems.\n\nCheck the Uncomplicated Firewall configuration with the following command:\n# sudo ufw status\nStatus: active\n\n     To                         Action      From\n     --                         ------      ----\n[ 1] 22                         LIMIT IN    Anywhere\n\nIf any services, ports, or applications are \\\"allowed\\\" and are not documented\nwith the organization, this is a finding.\"\n  desc \"fix\", \"Add/Modify the Ubuntu operating system's firewall settings and/or\nrunning services to comply with the Ports, Protocols, and Services Management\n(PPSM) Category Assignments List (CAL).\"\n\n  ufw_status = command('ufw status').stdout.strip.lines.first\n  key, value = ufw_status.split \": \",2\n\n  describe \"UFW status\" do\n    subject { value }\n    it { should cmp 'active' }\n  end\n  describe \"Status listings for any allowed services, ports, or applications must be documented with the organization\" do\n    skip \"Status listings checks must be preformed manually\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75809.rb"},"results":[{"status":"failed","code_desc":"UFW status should cmp == \"active\"","run_time":0.000139,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: \"active\"\n     got: \"inactive\"\n\n(compared using `cmp` matcher)\n"},{"status":"skipped","code_desc":"Status listings for any allowed services, ports, or applications must be documented with the organization","run_time":4.0e-06,"start_time":"2019-08-06T11:13:28-04:00","resource":"","skip_message":"Status listings checks must be preformed manually"}]},{"id":"V-75533","title":"File system automounter must be disabled unless required.","desc":"Automatically mounting file systems permits easy introduction of\nunknown devices, thereby facilitating malicious activity.","descriptions":[{"label":"default","data":"Automatically mounting file systems permits easy introduction of\nunknown devices, thereby facilitating malicious activity."},{"label":"check","data":"Verify the Ubuntu operating system disables the ability to\nautomount devices.\n\nCheck to see if automounter service is active with the following command:\n\n# systemctl status autofs\n autofs.service - LSB: Automounts filesystems on demand\n   Loaded: loaded (/etc/init.d/autofs; bad; vendor preset: enabled)\n   Active: active (running) since Thu 2017-05-04 07:53:51 EDT; 6 days ago\n     Docs: man:systemd-sysv-generator(8)\n   CGroup: /system.slice/autofs.service\n           +-24206 /usr/sbin/automount --pid-file /var/run/autofs.pid\n\nIf the \"autofs\" status is set to \"active\" and is not documented with the\nInformation System Security Officer (ISSO) as an operational requirement, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to disable the ability to\nautomount devices.\n\nTurn off the automount service with the following command:\n\n# sudo systemctl stop autofs\n\nIf \"autofs\" is required for Network File System (NFS), it must be documented\nwith the Information System Security Officer (ISSO)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000114-GPOS-00059","satisfies":["SRG-OS-000114-GPOS-00059","SRG-OS-000378-GPOS-00163","SRG-OS-000480-GPOS-00227"],"gid":"V-75533","rid":"SV-90213r2_rule","stig_id":"UBTU-16-010590","fix_id":"F-82161r2_fix","cci":["CCI-000366","CCI-000778","CCI-001958"],"nist":["CM-6 b","IA-3","IA-3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75533\" do\n  title \"File system automounter must be disabled unless required.\"\n  desc  \"Automatically mounting file systems permits easy introduction of\nunknown devices, thereby facilitating malicious activity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000114-GPOS-00059\"\n  tag \"satisfies\": [\"SRG-OS-000114-GPOS-00059\", \"SRG-OS-000378-GPOS-00163\",\n\"SRG-OS-000480-GPOS-00227\"]\n  tag \"gid\": \"V-75533\"\n  tag \"rid\": \"SV-90213r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010590\"\n  tag \"fix_id\": \"F-82161r2_fix\"\n  tag \"cci\": [\"CCI-000366\", \"CCI-000778\", \"CCI-001958\"]\n  tag \"nist\": [\"CM-6 b\", \"IA-3\", \"IA-3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system disables the ability to\nautomount devices.\n\nCheck to see if automounter service is active with the following command:\n\n# systemctl status autofs\n autofs.service - LSB: Automounts filesystems on demand\n   Loaded: loaded (/etc/init.d/autofs; bad; vendor preset: enabled)\n   Active: active (running) since Thu 2017-05-04 07:53:51 EDT; 6 days ago\n     Docs: man:systemd-sysv-generator(8)\n   CGroup: /system.slice/autofs.service\n           +-24206 /usr/sbin/automount --pid-file /var/run/autofs.pid\n\nIf the \\\"autofs\\\" status is set to \\\"active\\\" and is not documented with the\nInformation System Security Officer (ISSO) as an operational requirement, this\nis a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to disable the ability to\nautomount devices.\n\nTurn off the automount service with the following command:\n\n# sudo systemctl stop autofs\n\nIf \\\"autofs\\\" is required for Network File System (NFS), it must be documented\nwith the Information System Security Officer (ISSO).\"\n\n  describe service(\"autofs\") do\n    it { should_not be_enabled }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75533.rb"},"results":[{"status":"passed","code_desc":"Service autofs should not be enabled","run_time":0.034014,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75473","title":"Passwords for new users must have a 60-day maximum password lifetime\nrestriction.","desc":"Any password, no matter how complex, can eventually be cracked.\nTherefore, passwords need to be changed periodically. If the Ubuntu operating\nsystem does not limit the lifetime of passwords and force users to change their\npasswords, there is the risk that the Ubuntu operating system passwords could\nbe compromised.","descriptions":[{"label":"default","data":"Any password, no matter how complex, can eventually be cracked.\nTherefore, passwords need to be changed periodically. If the Ubuntu operating\nsystem does not limit the lifetime of passwords and force users to change their\npasswords, there is the risk that the Ubuntu operating system passwords could\nbe compromised."},{"label":"check","data":"Verify that the Ubuntu operating system enforces a 60-day\nmaximum password lifetime for new user accounts by running the following\ncommand:\n\n# grep -i pass_max_days /etc/login.defs\nPASS_MAX_DAYS    60\n\nIf the \"PASS_MAX_DAYS\" parameter value is less than \"60\", or commented out,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce a 60-day maximum\npassword lifetime.\n\nAdd, or modify the following line in the \"/etc/login.defs\" file:\n\nPASS_MAX_DAYS    60"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000076-GPOS-00044","gid":"V-75473","rid":"SV-90153r2_rule","stig_id":"UBTU-16-010220","fix_id":"F-82101r2_fix","cci":["CCI-000199"],"nist":["IA-5 (1) (d)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75473\" do\n  title \"Passwords for new users must have a 60-day maximum password lifetime\nrestriction.\"\n  desc  \"Any password, no matter how complex, can eventually be cracked.\nTherefore, passwords need to be changed periodically. If the Ubuntu operating\nsystem does not limit the lifetime of passwords and force users to change their\npasswords, there is the risk that the Ubuntu operating system passwords could\nbe compromised.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000076-GPOS-00044\"\n  tag \"gid\": \"V-75473\"\n  tag \"rid\": \"SV-90153r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010220\"\n  tag \"fix_id\": \"F-82101r2_fix\"\n  tag \"cci\": [\"CCI-000199\"]\n  tag \"nist\": [\"IA-5 (1) (d)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system enforces a 60-day\nmaximum password lifetime for new user accounts by running the following\ncommand:\n\n# grep -i pass_max_days /etc/login.defs\nPASS_MAX_DAYS    60\n\nIf the \\\"PASS_MAX_DAYS\\\" parameter value is less than \\\"60\\\", or commented out,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce a 60-day maximum\npassword lifetime.\n\nAdd, or modify the following line in the \\\"/etc/login.defs\\\" file:\n\nPASS_MAX_DAYS    60\"\n\n  describe login_defs do\n    its('PASS_MAX_DAYS') { should cmp <= 60 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75473.rb"},"results":[{"status":"passed","code_desc":"login.defs PASS_MAX_DAYS should cmp <= 60","run_time":0.000929,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75711","title":"The audit system must be configured to audit any usage of the rmmod\ncommand.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \"rmmod\", by running the\nfollowing command:\n\n# sudo grep \"/sbin/rmmod\" /etc/audit/audit.rules\n\n-w /sbin/rmmod -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe module management program \"rmmod\", by adding the following line to\n\"/etc/audit/audit.rules\":\n\n-w /sbin/rmmod -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215","SRG-OS-000471-GPOS-00216","SRG-OS-000477-GPOS-00222"],"gid":"V-75711","rid":"SV-90391r2_rule","stig_id":"UBTU-16-020430","fix_id":"F-82339r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75711\" do\n  title \"The audit system must be configured to audit any usage of the rmmod\ncommand.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000471-GPOS-00216\", \"SRG-OS-000477-GPOS-00222\"]\n  tag \"gid\": \"V-75711\"\n  tag \"rid\": \"SV-90391r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020430\"\n  tag \"fix_id\": \"F-82339r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \\\"rmmod\\\", by running the\nfollowing command:\n\n# sudo grep \\\"/sbin/rmmod\\\" /etc/audit/audit.rules\n\n-w /sbin/rmmod -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe module management program \\\"rmmod\\\", by adding the following line to\n\\\"/etc/audit/audit.rules\\\":\n\n-w /sbin/rmmod -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/sbin/rmmod'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75711.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /sbin/rmmod exist should equal true","run_time":0.000148,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75591","title":"The Ubuntu operating system must use a separate file system for the\nsystem audit data path.","desc":"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing."},{"label":"check","data":"Verify that a separate file system/partition has been created\nfor the system audit data path.\n\nCheck that a file system/partition has been created for the system audit data\npath with the following command:\n\nNote: /var/log/audit is used as the example as it is a common location.\n\n#grep /var/log/audit /etc/fstab\nUUID=3645951a /var/log/audit ext4 defaults 1 2\n\nIf a separate entry for \"/var/log/audit\" does not exist, ask the System\nAdministrator if the system audit logs are being written to a different file\nsystem/partition on the system, then grep for that file system/partition.\n\nIf a separate file system/partition does not exist for the system audit data\npath, this is a finding."},{"label":"fix","data":"Migrate the system audit data path onto a separate file system."}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75591","rid":"SV-90271r1_rule","stig_id":"UBTU-16-010930","fix_id":"F-82219r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75591\" do\n  title \"The Ubuntu operating system must use a separate file system for the\nsystem audit data path.\"\n  desc  \"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing.\"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75591\"\n  tag \"rid\": \"SV-90271r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010930\"\n  tag \"fix_id\": \"F-82219r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that a separate file system/partition has been created\nfor the system audit data path.\n\nCheck that a file system/partition has been created for the system audit data\npath with the following command:\n\nNote: /var/log/audit is used as the example as it is a common location.\n\n#grep /var/log/audit /etc/fstab\nUUID=3645951a /var/log/audit ext4 defaults 1 2\n\nIf a separate entry for \\\"/var/log/audit\\\" does not exist, ask the System\nAdministrator if the system audit logs are being written to a different file\nsystem/partition on the system, then grep for that file system/partition.\n\nIf a separate file system/partition does not exist for the system audit data\npath, this is a finding.\"\n  desc \"fix\", \"Migrate the system audit data path onto a separate file system.\"\n\n  audit_log_path = input('audit_log_path')\n\n  describe mount(audit_log_path) do\n    it {should be_mounted}\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75591.rb"},"results":[{"status":"failed","code_desc":"Mount /var/log/audit should be mounted","run_time":0.010198,"start_time":"2019-08-06T11:13:28-04:00","message":"\nMount /var/log/audit is not mounted\n"}]},{"id":"V-75903","title":"The Ubuntu operating system must have the packages required for\nmultifactor authentication to be installed.","desc":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST.","descriptions":[{"label":"default","data":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST."},{"label":"check","data":"Verify the Ubuntu operating system has the packages required\nfor multifactor authentication installed.\n\nCheck for the presence of the packages required to support multifactor\nauthentication with the following commands:\n\n# dpkg -l | grep libpam-pkcs11\n\nii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for using PKCS#11\nsmart cards\n\nIf the \"libpam-pkcs11\" package is not installed, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to implement multifactor\nauthentication by installing the required packages.\nInstall the \"libpam-pkcs11\" package on the system with the following command:\n\n# sudo apt install libpam-pkcs11"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000375-GPOS-00160","satisfies":["SRG-OS-000375-GPOS-00160","SRG-OS-000375-GPOS-00161","SRG-OS-000375-GPOS-00162"],"gid":"V-75903","rid":"SV-90583r1_rule","stig_id":"UBTU-16-030800","fix_id":"F-82533r1_fix","cci":["CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (11)","IA-2 (12)","IA-2 (12)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75903\" do\n  title \"The Ubuntu operating system must have the packages required for\nmultifactor authentication to be installed.\"\n  desc  \"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000375-GPOS-00160\"\n  tag \"satisfies\": [\"SRG-OS-000375-GPOS-00160\", \"SRG-OS-000375-GPOS-00161\",\n\"SRG-OS-000375-GPOS-00162\"]\n  tag \"gid\": \"V-75903\"\n  tag \"rid\": \"SV-90583r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030800\"\n  tag \"fix_id\": \"F-82533r1_fix\"\n  tag \"cci\": [\"CCI-001948\", \"CCI-001953\", \"CCI-001954\"]\n  tag \"nist\": [\"IA-2 (11)\", \"IA-2 (12)\", \"IA-2 (12)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system has the packages required\nfor multifactor authentication installed.\n\nCheck for the presence of the packages required to support multifactor\nauthentication with the following commands:\n\n# dpkg -l | grep libpam-pkcs11\n\nii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for using PKCS#11\nsmart cards\n\nIf the \\\"libpam-pkcs11\\\" package is not installed, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to implement multifactor\nauthentication by installing the required packages.\nInstall the \\\"libpam-pkcs11\\\" package on the system with the following command:\n\n# sudo apt install libpam-pkcs11\"\n\n  describe package('libpam-pkcs-11') do\n    it { should be_installed }\n  end\n  \nend\n","source_location":{"line":1,"ref":"./controls/V-75903.rb"},"results":[{"status":"failed","code_desc":"System Package libpam-pkcs-11 should be installed","run_time":0.016368,"start_time":"2019-08-06T11:13:28-04:00","message":"expected that `System Package libpam-pkcs-11` is installed"}]},{"id":"V-75843","title":"The SSH public host key files must have mode 0644 or less permissive.","desc":"If a public host key file is modified by an unauthorized user, the SSH\nservice may be compromised.","descriptions":[{"label":"default","data":"If a public host key file is modified by an unauthorized user, the SSH\nservice may be compromised."},{"label":"check","data":"Verify the SSH public host key files have mode \"0644\" or less\npermissive.\n\nNote: SSH public key files may be found in other directories on the system\ndepending on the installation.\n\nThe following command will find all SSH public key files on the system:\n\n# ls -l /etc/ssh/*.pub\n\n-rw-r--r--  1 root  wheel  618 Nov 28 06:43 ssh_host_dsa_key.pub\n-rw-r--r--  1 root  wheel  347 Nov 28 06:43 ssh_host_key.pub\n-rw-r--r--  1 root  wheel  238 Nov 28 06:43 ssh_host_rsa_key.pub\n\nIf any key.pub file has a mode more permissive than \"0644\", this is a\nfinding."},{"label":"fix","data":"Note: SSH public key files may be found in other directories on\nthe system depending on the installation.\n\nChange the mode of public host key files under \"/etc/ssh\" to \"0644\" with\nthe following command:\n\n# sudo chmod 0644 /etc/ssh/*key.pub\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75843","rid":"SV-90523r2_rule","stig_id":"UBTU-16-030310","fix_id":"F-82473r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75843\" do\n  title \"The SSH public host key files must have mode 0644 or less permissive.\"\n  desc  \"If a public host key file is modified by an unauthorized user, the SSH\nservice may be compromised.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75843\"\n  tag \"rid\": \"SV-90523r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030310\"\n  tag \"fix_id\": \"F-82473r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH public host key files have mode \\\"0644\\\" or less\npermissive.\n\nNote: SSH public key files may be found in other directories on the system\ndepending on the installation.\n\nThe following command will find all SSH public key files on the system:\n\n# ls -l /etc/ssh/*.pub\n\n-rw-r--r--  1 root  wheel  618 Nov 28 06:43 ssh_host_dsa_key.pub\n-rw-r--r--  1 root  wheel  347 Nov 28 06:43 ssh_host_key.pub\n-rw-r--r--  1 root  wheel  238 Nov 28 06:43 ssh_host_rsa_key.pub\n\nIf any key.pub file has a mode more permissive than \\\"0644\\\", this is a\nfinding.\"\n  desc \"fix\", \"Note: SSH public key files may be found in other directories on\nthe system depending on the installation.\n\nChange the mode of public host key files under \\\"/etc/ssh\\\" to \\\"0644\\\" with\nthe following command:\n\n# sudo chmod 0644 /etc/ssh/*key.pub\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  pub_files = command(\"find /etc/ssh -xdev -name '*.pub' -perm /133\").stdout.split(\"\\n\")\n  if !pub_files.nil? and !pub_files.empty?\n    pub_files.each do |pubfile|\n      describe file(pubfile) do\n        it { should_not be_executable.by('user') }\n        it { should_not be_executable.by('group') }\n        it { should_not be_writable.by('group') }\n        it { should_not be_executable.by('others') }\n        it { should_not be_writable.by('others') }\n      end\n    end\n  else\n    describe \"No files have a more permissive mode.\" do\n      subject { pub_files.nil? or pub_files.empty? }\n      it { should eq true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75843.rb"},"results":[{"status":"passed","code_desc":"No files have a more permissive mode. should eq true","run_time":0.000115,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75507","title":"Ubuntu operating systems booted with United Extensible Firmware\nInterface (UEFI) implemented must require authentication upon booting into\nsingle-user mode and maintenance.","desc":"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access. Successful authentication must not automatically give\nan entity access to an asset or security boundary. Authorization procedures and\ncontrols must be implemented to ensure each authenticated entity also has a\nvalidated and current authorization. Authorization is the process of\ndetermining whether an entity, once authenticated, is permitted to access a\nspecific asset. Information systems use access control policies and enforcement\nmechanisms to implement this requirement.\n\n    Access control policies include: identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include:\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.","descriptions":[{"label":"default","data":"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access. Successful authentication must not automatically give\nan entity access to an asset or security boundary. Authorization procedures and\ncontrols must be implemented to ensure each authenticated entity also has a\nvalidated and current authorization. Authorization is the process of\ndetermining whether an entity, once authenticated, is permitted to access a\nspecific asset. Information systems use access control policies and enforcement\nmechanisms to implement this requirement.\n\n    Access control policies include: identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include:\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system."},{"label":"check","data":"Verify that an encrypted root password is set. This is only\napplicable on Ubuntu operating systems that use UEFI.\n\nRun the following command to verify the encrypted password is set:\n\n# grep –i password /boot/efi/EFI/grub.cfg\npassword_pbkdf2 root grub.pbkdf2.sha512.10000.VeryLongString\n\nIf the root password entry does not begin with “password_pbkdf2”, this is a\nfinding."},{"label":"fix","data":"Configure the system to require a password for authentication\nupon booting into single-user and maintenance modes.\n\nGenerate an encrypted (grub) password for root with the following command:\n\n# grub-mkpasswd-pbkdf2\nEnter Password:\nReenter Password:\nPBKDF2 hash of your password is\ngrub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG\n\nUsing the hash from the output, modify the \"/etc/grub.d/10_linux\" file with\nthe following command to add a boot password for the root entry:\n\n# cat << EOF > set superusers=\"root\" password_pbkdf2 root\ngrub.pbkdf2.sha512.VeryLongString > EOF\n\nGenerate an updated \"grub.conf\" file with the new password using the\nfollowing commands:\n\n# grub-mkconfig --output=/tmp/grub2.cfg\n# mv /tmp/grub2.cfg /boot/efi/EFI/grub.cfg"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000080-GPOS-00048","gid":"V-75507","rid":"SV-90187r2_rule","stig_id":"UBTU-16-010390","fix_id":"F-82135r2_fix","cci":["CCI-000213"],"nist":["AC-3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75507\" do\n  title \"Ubuntu operating systems booted with United Extensible Firmware\nInterface (UEFI) implemented must require authentication upon booting into\nsingle-user mode and maintenance.\"\n  desc  \"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access. Successful authentication must not automatically give\nan entity access to an asset or security boundary. Authorization procedures and\ncontrols must be implemented to ensure each authenticated entity also has a\nvalidated and current authorization. Authorization is the process of\ndetermining whether an entity, once authenticated, is permitted to access a\nspecific asset. Information systems use access control policies and enforcement\nmechanisms to implement this requirement.\n\n    Access control policies include: identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include:\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000080-GPOS-00048\"\n  tag \"gid\": \"V-75507\"\n  tag \"rid\": \"SV-90187r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010390\"\n  tag \"fix_id\": \"F-82135r2_fix\"\n  tag \"cci\": [\"CCI-000213\"]\n  tag \"nist\": [\"AC-3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an encrypted root password is set. This is only\napplicable on Ubuntu operating systems that use UEFI.\n\nRun the following command to verify the encrypted password is set:\n\n# grep –i password /boot/efi/EFI/grub.cfg\npassword_pbkdf2 root grub.pbkdf2.sha512.10000.VeryLongString\n\nIf the root password entry does not begin with “password_pbkdf2”, this is a\nfinding.\"\n  desc \"fix\", \"Configure the system to require a password for authentication\nupon booting into single-user and maintenance modes.\n\nGenerate an encrypted (grub) password for root with the following command:\n\n# grub-mkpasswd-pbkdf2\nEnter Password:\nReenter Password:\nPBKDF2 hash of your password is\ngrub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG\n\nUsing the hash from the output, modify the \\\"/etc/grub.d/10_linux\\\" file with\nthe following command to add a boot password for the root entry:\n\n# cat << EOF > set superusers=\\\"root\\\" password_pbkdf2 root\ngrub.pbkdf2.sha512.VeryLongString > EOF\n\nGenerate an updated \\\"grub.conf\\\" file with the new password using the\nfollowing commands:\n\n# grub-mkconfig --output=/tmp/grub2.cfg\n# mv /tmp/grub2.cfg /boot/efi/EFI/grub.cfg\"\n\n  describe file('/boot/efi/EFI/grub.cfg') do\n    its('content') { should match \"^password_pbkdf2\" }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75507.rb"},"results":[{"status":"failed","code_desc":"File /boot/efi/EFI/grub.cfg content should match \"^password_pbkdf2\"","run_time":0.018101,"start_time":"2019-08-06T11:13:28-04:00","message":"expected nil to match \"^password_pbkdf2\""}]},{"id":"V-75787","title":"Successful/unsuccessful uses of the crontab command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"crontab\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w crontab /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-crontab\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"crontab\" command. Add or update the\nfollowing rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-crontab\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75787","rid":"SV-90467r3_rule","stig_id":"UBTU-16-020810","fix_id":"F-82417r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75787\" do\n  title \"Successful/unsuccessful uses of the crontab command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75787\"\n  tag \"rid\": \"SV-90467r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020810\"\n  tag \"fix_id\": \"F-82417r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"crontab\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w crontab /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-crontab\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"crontab\\\" command. Add or update the\nfollowing rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-crontab\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/crontab'\n  \n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75787.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/crontab exist should equal true","run_time":0.000121,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75877","title":"The Ubuntu operating system must not respond to Internet Protocol\nversion 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a\nbroadcast address.","desc":"Responding to broadcast Internet Control Message Protocol (ICMP)\nechoes facilitates network mapping and provides a vector for amplification\nattacks.","descriptions":[{"label":"default","data":"Responding to broadcast Internet Control Message Protocol (ICMP)\nechoes facilitates network mapping and provides a vector for amplification\nattacks."},{"label":"check","data":"Verify the Ubuntu operating system does not respond to IPv4\nInternet Control Message Protocol (ICMP) echoes sent to a broadcast address.\n\nCheck the value of the \"icmp_echo_ignore_broadcasts\" variable with the\nfollowing command:\n\n# sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts\nnet.ipv4.icmp_echo_ignore_broadcasts=1\n\nIf the returned line does not have a value of \"1\", a line is not returned, or\nthe retuned line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to not respond to Internet\nProtocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent\nto a broadcast address with the following command:\n\n# sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1\n\nIf \"1\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.icmp_echo_ignore_broadcasts=1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75877","rid":"SV-90557r2_rule","stig_id":"UBTU-16-030550","fix_id":"F-82507r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75877\" do\n  title \"The Ubuntu operating system must not respond to Internet Protocol\nversion 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a\nbroadcast address.\"\n  desc  \"Responding to broadcast Internet Control Message Protocol (ICMP)\nechoes facilitates network mapping and provides a vector for amplification\nattacks.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75877\"\n  tag \"rid\": \"SV-90557r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030550\"\n  tag \"fix_id\": \"F-82507r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system does not respond to IPv4\nInternet Control Message Protocol (ICMP) echoes sent to a broadcast address.\n\nCheck the value of the \\\"icmp_echo_ignore_broadcasts\\\" variable with the\nfollowing command:\n\n# sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts\nnet.ipv4.icmp_echo_ignore_broadcasts=1\n\nIf the returned line does not have a value of \\\"1\\\", a line is not returned, or\nthe retuned line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to not respond to Internet\nProtocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent\nto a broadcast address with the following command:\n\n# sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1\n\nIf \\\"1\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.icmp_echo_ignore_broadcasts=1\"\n\n  describe kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do\n    its('value') { should eq 1 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75877.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.icmp_echo_ignore_broadcasts value should eq 1","run_time":0.008355,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75725","title":"The audit system must be configured to audit any usage of the\nlremovexattr system call.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \"lremovexattr\" system call, by running the following\ncommand:\n\n# sudo grep -w lremovexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"lremovexattr\" system call, by adding the following lines to\n\"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000458-GPOS-00203","SRG-OS-000462-GPOS-00206","SRG-OS-000463-GPOS-00207","SRG-OS-000471-GPOS-00215","SRG-OS-000474-GPOS-00219"],"gid":"V-75725","rid":"SV-90405r2_rule","stig_id":"UBTU-16-020500","fix_id":"F-82353r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75725\" do\n  title \"The audit system must be configured to audit any usage of the\nlremovexattr system call.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000458-GPOS-00203\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000463-GPOS-00207\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000474-GPOS-00219\"]\n  tag \"gid\": \"V-75725\"\n  tag \"rid\": \"SV-90405r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020500\"\n  tag \"fix_id\": \"F-82353r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \\\"lremovexattr\\\" system call, by running the following\ncommand:\n\n# sudo grep -w lremovexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"lremovexattr\\\" system call, by adding the following lines to\n\\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"lremovexattr\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75725.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"lremovexattr\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000189,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"lremovexattr\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000217,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75665","title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/gshadow.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \"/etc/gshadow\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following\ncommand:\n\n# sudo grep /etc/gshadow /etc/audit/audit.rules\n\n-w /etc/gshadow -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \"/etc/gshadow\".\n\nAdd or update the following file system rule to \"/etc/audit/audit.rules\":\n\n-w /etc/gshadow -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000304-GPOS-00121","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000470-GPOS-00214","SRG-OS-000471-GPOS-00215"],"gid":"V-75665","rid":"SV-90345r3_rule","stig_id":"UBTU-16-020320","fix_id":"F-82293r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002132","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","AC-2 (4)","MA-4 (1)\n(a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75665\" do\n  title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/gshadow.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000304-GPOS-00121\",\n\"SRG-OS-000392-GPOS-00172\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000470-GPOS-00214\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75665\"\n  tag \"rid\": \"SV-90345r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020320\"\n  tag \"fix_id\": \"F-82293r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002132\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"AC-2 (4)\", \"MA-4 (1)\n(a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \\\"/etc/gshadow\\\".\n\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following\ncommand:\n\n# sudo grep /etc/gshadow /etc/audit/audit.rules\n\n-w /etc/gshadow -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \\\"/etc/gshadow\\\".\n\nAdd or update the following file system rule to \\\"/etc/audit/audit.rules\\\":\n\n-w /etc/gshadow -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/etc/gshadow'\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75665.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /etc/gshadow exist should equal true","run_time":0.000109,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-78007","title":"The system must update the DoD-approved virus scan program every seven\ndays or more frequently.","desc":"Virus scanning software can be used to protect a system from\npenetration from computer viruses and to limit their spread through\nintermediate systems.\n\n    The virus scanning software should be configured to check for software and\nvirus definition updates with a frequency no longer than seven days. If a\nmanual process is required to update the virus scan software or definitions, it\nmust be documented with the Information System Security Officer (ISSO).","descriptions":[{"label":"default","data":"Virus scanning software can be used to protect a system from\npenetration from computer viruses and to limit their spread through\nintermediate systems.\n\n    The virus scanning software should be configured to check for software and\nvirus definition updates with a frequency no longer than seven days. If a\nmanual process is required to update the virus scan software or definitions, it\nmust be documented with the Information System Security Officer (ISSO)."},{"label":"check","data":"Verify the system is using a DoD-approved virus scan program\nand the virus definition file is less than seven days old.\n\nCheck for the presence of \"McAfee VirusScan Enterprise for Linux\" with the\nfollowing command:\n\n# systemctl status nails\n\nnails - service for McAfee VirusScan Enterprise for Linux\n\n> Loaded: loaded\n/opt/NAI/package/McAfeeVSEForLinux/McAfeeVSEForLinux-2.0.2.<build_number>;\nenabled)\n\n> Active: active (running) since Mon 2015-09-27 04:11:22 UTC;21 min ago\n\nIf the \"nails\" service is not active, check for the presence of \"clamav\" on\nthe system with the following command:\n\n# systemctl status clamav-daemon.socket\n\nsystemctl status clamav-daemon.socket\n\nclamav-daemon.socket - Socket for Clam AntiVirus userspace daemon\n\nLoaded: loaded (/lib/systemd/system/clamav-daemon.socket; enabled)\n\nActive: active (running) since Mon 2015-01-12 09:32:59 UTC; 7min ago\n\nIf \"McAfee VirusScan Enterprise for Linux\" is active on the system, check the\ndates of the virus definition files with the following command:\n\n# ls -al /opt/NAI/LinuxShield/engine/dat/*.dat\n\n-rwxr-xr-x 1 root root 243217 Mar 5 2017 avvclean.dat\n-rwxr-xr-x 1 root root 16995 Mar 5 2017 avvnames.dat\n-rwxr-xr-x 1 root root 4713245 Mar 5 2017 avvscan.dat\n\nIf the virus definition files have dates older than seven days from the current\ndate, this is a finding.\n\nIf \"clamav\" is active on the system, check the dates of the virus database\nwith the following commands:\n\n# grep -I databasedirectory /etc/clamav.conf\n\nDatabaseDirectory /var/lib/clamav\n\n# ls -al /var/lib/clamav/*.cvd\n\n-rwxr-xr-x 1 root root 149156 Mar 5 2011 daily.cvd\n\nIf the database file has a date older than seven days from the current date,\nthis is a finding."},{"label":"fix","data":"Update the approved DoD virus scan software and virus definition\nfiles."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-78007","rid":"SV-92703r1_rule","stig_id":"UBTU-16-030910","fix_id":"F-84717r1_fix","cci":["CCI-001668"],"nist":["SI-3 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-78007\" do\n  title \"The system must update the DoD-approved virus scan program every seven\ndays or more frequently.\"\n  desc  \"Virus scanning software can be used to protect a system from\npenetration from computer viruses and to limit their spread through\nintermediate systems.\n\n    The virus scanning software should be configured to check for software and\nvirus definition updates with a frequency no longer than seven days. If a\nmanual process is required to update the virus scan software or definitions, it\nmust be documented with the Information System Security Officer (ISSO).\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-78007\"\n  tag \"rid\": \"SV-92703r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030910\"\n  tag \"fix_id\": \"F-84717r1_fix\"\n  tag \"cci\": [\"CCI-001668\"]\n  tag \"nist\": [\"SI-3 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system is using a DoD-approved virus scan program\nand the virus definition file is less than seven days old.\n\nCheck for the presence of \\\"McAfee VirusScan Enterprise for Linux\\\" with the\nfollowing command:\n\n# systemctl status nails\n\nnails - service for McAfee VirusScan Enterprise for Linux\n\n> Loaded: loaded\n/opt/NAI/package/McAfeeVSEForLinux/McAfeeVSEForLinux-2.0.2.<build_number>;\nenabled)\n\n> Active: active (running) since Mon 2015-09-27 04:11:22 UTC;21 min ago\n\nIf the \\\"nails\\\" service is not active, check for the presence of \\\"clamav\\\" on\nthe system with the following command:\n\n# systemctl status clamav-daemon.socket\n\nsystemctl status clamav-daemon.socket\n\nclamav-daemon.socket - Socket for Clam AntiVirus userspace daemon\n\nLoaded: loaded (/lib/systemd/system/clamav-daemon.socket; enabled)\n\nActive: active (running) since Mon 2015-01-12 09:32:59 UTC; 7min ago\n\nIf \\\"McAfee VirusScan Enterprise for Linux\\\" is active on the system, check the\ndates of the virus definition files with the following command:\n\n# ls -al /opt/NAI/LinuxShield/engine/dat/*.dat\n\n-rwxr-xr-x 1 root root 243217 Mar 5 2017 avvclean.dat\n-rwxr-xr-x 1 root root 16995 Mar 5 2017 avvnames.dat\n-rwxr-xr-x 1 root root 4713245 Mar 5 2017 avvscan.dat\n\nIf the virus definition files have dates older than seven days from the current\ndate, this is a finding.\n\nIf \\\"clamav\\\" is active on the system, check the dates of the virus database\nwith the following commands:\n\n# grep -I databasedirectory /etc/clamav.conf\n\nDatabaseDirectory /var/lib/clamav\n\n# ls -al /var/lib/clamav/*.cvd\n\n-rwxr-xr-x 1 root root 149156 Mar 5 2011 daily.cvd\n\nIf the database file has a date older than seven days from the current date,\nthis is a finding.\n\"\n  desc \"fix\", \"Update the approved DoD virus scan software and virus definition\nfiles.\"\n\n  org_name = input('org_name')\n  is_antivirus_active = false\n  seven_days = 604800 # (7 days * 24 hours * 60 minutes * 60 seconds)\n  \n  # McAfee VirusScan Enterprise for Linux\n  def_files = command(\"find /opt/NAI/LinuxShield/engine/dat -type f -name *.dat\").stdout.split(\"\\n\")\n  if ( service('nails').installed? && service('nails').enabled? && service('nails').running? )\n    if !def_files.nil? and !def_files.empty?\n      def_files.each do |deffile|\n        describe file(deffile) do\n          its('mtime') { should >= Time.now.to_i - seven_days }\n        end\n      end\n    else\n      describe \"No McAfee VirusScan Enterprise for Linux definition files have been found\" do\n        subject { def_files.nil? or def_files.empty? }\n        it { should eq false }\n      end\n    end\n    is_antivirus_active = true\n  end\n  \n  # ClamAV\n  def_files = command(\"find /var/lib/clamav -type f -name *.cvd\").stdout.split(\"\\n\")\n  if ( service('clamav-daemon.service').installed? && service('clamav-daemon.service').enabled? && service('clamav-daemon.service').running? )\n    if !def_files.nil? and !def_files.empty?\n      def_files.each do |deffile|\n        describe file(deffile) do\n          its('mtime') { should >= Time.now.to_i - seven_days }\n        end\n      end\n    else\n      describe \"No ClamAV definition files have been found\" do\n        subject { def_files.nil? or def_files.empty? }\n        it { should eq false }\n      end\n    end\n    is_antivirus_active = true\n  end\n\n  if !is_antivirus_active\n    describe (\"No \" + org_name + \"-approved virus scan program is found to be active on the system\") do\n      subject { is_antivirus_active }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-78007.rb"},"results":[{"status":"failed","code_desc":"No DoD-approved virus scan program is found to be active on the system should equal true","run_time":8.3e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75735","title":"Successful/unsuccessful uses of the lchown command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"lchown\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w lchown /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"lchown\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75735","rid":"SV-90415r3_rule","stig_id":"UBTU-16-020550","fix_id":"F-82363r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75735\" do\n  title \"Successful/unsuccessful uses of the lchown command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75735\"\n  tag \"rid\": \"SV-90415r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020550\"\n  tag \"fix_id\": \"F-82363r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"lchown\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w lchown /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"lchown\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"lchown\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75735.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"lchown\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000109,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"lchown\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":9.8e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75867","title":"Wireless network adapters must be disabled.","desc":"Without protection of communications with wireless peripherals,\nconfidentiality and integrity may be compromised because unprotected\ncommunications can be intercepted and either read, altered, or used to\ncompromise the Ubuntu operating system.\n\n    This requirement applies to wireless peripheral technologies (e.g.,\nwireless mice, keyboards, displays, etc.) used with an Ubuntu operating system.\nWireless peripherals (e.g., Wi-Fi/Bluetooth/IR Keyboards, Mice, and Pointing\nDevices and Near Field Communications [NFC]) present a unique challenge by\ncreating an open, unsecured port on a computer. Wireless peripherals must meet\nDoD requirements for wireless data transmission and be approved for use by the\nAO. Even though some wireless peripherals, such as mice and pointing devices,\ndo not ordinarily carry information that need to be protected, modification of\ncommunications with these wireless peripherals may be used to compromise the\nUbuntu operating system. Communication paths outside the physical protection of\na controlled boundary are exposed to the possibility of interception and\nmodification.\n\n    Protecting the confidentiality and integrity of communications with\nwireless peripherals can be accomplished by physical means (e.g., employing\nphysical barriers to wireless radio frequencies) or by logical means (e.g.,\nemploying cryptographic techniques). If physical means of protection are\nemployed, then logical means (cryptography) do not have to be employed, and\nvice versa. If the wireless peripheral is only passing telemetry data,\nencryption of the data may not be required.","descriptions":[{"label":"default","data":"Without protection of communications with wireless peripherals,\nconfidentiality and integrity may be compromised because unprotected\ncommunications can be intercepted and either read, altered, or used to\ncompromise the Ubuntu operating system.\n\n    This requirement applies to wireless peripheral technologies (e.g.,\nwireless mice, keyboards, displays, etc.) used with an Ubuntu operating system.\nWireless peripherals (e.g., Wi-Fi/Bluetooth/IR Keyboards, Mice, and Pointing\nDevices and Near Field Communications [NFC]) present a unique challenge by\ncreating an open, unsecured port on a computer. Wireless peripherals must meet\nDoD requirements for wireless data transmission and be approved for use by the\nAO. Even though some wireless peripherals, such as mice and pointing devices,\ndo not ordinarily carry information that need to be protected, modification of\ncommunications with these wireless peripherals may be used to compromise the\nUbuntu operating system. Communication paths outside the physical protection of\na controlled boundary are exposed to the possibility of interception and\nmodification.\n\n    Protecting the confidentiality and integrity of communications with\nwireless peripherals can be accomplished by physical means (e.g., employing\nphysical barriers to wireless radio frequencies) or by logical means (e.g.,\nemploying cryptographic techniques). If physical means of protection are\nemployed, then logical means (cryptography) do not have to be employed, and\nvice versa. If the wireless peripheral is only passing telemetry data,\nencryption of the data may not be required."},{"label":"check","data":"Verify that there are no wireless interfaces configured on the\nsystem.\n\nCheck that the system does not have active wireless interfaces with the\nfollowing command:\n\nNote: This requirement is Not Applicable for systems that do not have physical\nwireless network radios.\n\n# ifconfig -a | more\n\neth0 Link encap:Ethernet HWaddr ff:ff:ff:ff:ff:ff\ninet addr:192.168.2.100 Bcast:192.168.2.255 Mask:255.255.255.0\n...\n\neth1 IEEE 802.11b ESSID:\"tacnet\"\nMode:Managed Frequency:2.412 GHz Access Point: 00:40:E7:22:45:CD\n...\n\nlo Link encap:Local Loopback\ninet addr:127.0.0.1 Mask:255.0.0.0\ninet6 addr: ::1/128 Scope:Host\n...\n\nIf a wireless interface is configured and has not been documented and approved\nby the Information System Security Officer (ISSO), this is a finding."},{"label":"fix","data":"Configure the system to disable all wireless network interfaces\nwith the following command:\n\n# sudo ifdown [ADAPTER_NAME]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000299-GPOS-00117","satisfies":["SRG-OS-000299-GPOS-00117","SRG-OS-000300-GPOS-00118","SRG-OS-000481-GPOS-000481"],"gid":"V-75867","rid":"SV-90547r1_rule","stig_id":"UBTU-16-030500","fix_id":"F-82497r1_fix","cci":["CCI-001443","CCI-001444","CCI-002418"],"nist":["AC-18 (1)","AC-18 (1)","SC-8","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75867\" do\n  title \"Wireless network adapters must be disabled.\"\n  desc  \"Without protection of communications with wireless peripherals,\nconfidentiality and integrity may be compromised because unprotected\ncommunications can be intercepted and either read, altered, or used to\ncompromise the Ubuntu operating system.\n\n    This requirement applies to wireless peripheral technologies (e.g.,\nwireless mice, keyboards, displays, etc.) used with an Ubuntu operating system.\nWireless peripherals (e.g., Wi-Fi/Bluetooth/IR Keyboards, Mice, and Pointing\nDevices and Near Field Communications [NFC]) present a unique challenge by\ncreating an open, unsecured port on a computer. Wireless peripherals must meet\nDoD requirements for wireless data transmission and be approved for use by the\nAO. Even though some wireless peripherals, such as mice and pointing devices,\ndo not ordinarily carry information that need to be protected, modification of\ncommunications with these wireless peripherals may be used to compromise the\nUbuntu operating system. Communication paths outside the physical protection of\na controlled boundary are exposed to the possibility of interception and\nmodification.\n\n    Protecting the confidentiality and integrity of communications with\nwireless peripherals can be accomplished by physical means (e.g., employing\nphysical barriers to wireless radio frequencies) or by logical means (e.g.,\nemploying cryptographic techniques). If physical means of protection are\nemployed, then logical means (cryptography) do not have to be employed, and\nvice versa. If the wireless peripheral is only passing telemetry data,\nencryption of the data may not be required.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000299-GPOS-00117\"\n  tag \"satisfies\": [\"SRG-OS-000299-GPOS-00117\", \"SRG-OS-000300-GPOS-00118\",\n\"SRG-OS-000481-GPOS-000481\"]\n  tag \"gid\": \"V-75867\"\n  tag \"rid\": \"SV-90547r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030500\"\n  tag \"fix_id\": \"F-82497r1_fix\"\n  tag \"cci\": [\"CCI-001443\", \"CCI-001444\", \"CCI-002418\"]\n  tag \"nist\": [\"AC-18 (1)\", \"AC-18 (1)\", \"SC-8\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that there are no wireless interfaces configured on the\nsystem.\n\nCheck that the system does not have active wireless interfaces with the\nfollowing command:\n\nNote: This requirement is Not Applicable for systems that do not have physical\nwireless network radios.\n\n# ifconfig -a | more\n\neth0 Link encap:Ethernet HWaddr ff:ff:ff:ff:ff:ff\ninet addr:192.168.2.100 Bcast:192.168.2.255 Mask:255.255.255.0\n...\n\neth1 IEEE 802.11b ESSID:\\\"tacnet\\\"\nMode:Managed Frequency:2.412 GHz Access Point: 00:40:E7:22:45:CD\n...\n\nlo Link encap:Local Loopback\ninet addr:127.0.0.1 Mask:255.0.0.0\ninet6 addr: ::1/128 Scope:Host\n...\n\nIf a wireless interface is configured and has not been documented and approved\nby the Information System Security Officer (ISSO), this is a finding.\"\n  desc \"fix\", \"Configure the system to disable all wireless network interfaces\nwith the following command:\n\n# sudo ifdown [ADAPTER_NAME]\"\n\n  allowed_network_interfaces = input('allowed_network_interfaces')\n  ifconfig_output = command('ifconfig -s | cut -d \" \" -f 1').stdout.split(\"\\n\")\n  system_network_interfaces = ifconfig_output.drop(1)\n\n  other_network_interfaces = system_network_interfaces - allowed_network_interfaces\n\n  if other_network_interfaces.count > 0\n    other_network_interfaces.each do |net_int|\n      describe (\"Interface: \" + net_int + \" not permitted\") do\n        subject { net_int }\n        it { should be_empty }\n      end\n    end\n  else\n    describe \"Number of wireless network interfaces found\" do\n      subject { other_network_interfaces }\n      its('count') { should eq 0 }\n    end\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75867.rb"},"results":[{"status":"passed","code_desc":"Number of wireless network interfaces found count should eq 0","run_time":6.4e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75797","title":"The telnet package must not be installed.","desc":"It is detrimental for Ubuntu operating systems to provide, or install\nby default, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services, provided by\ndefault, may not be necessary to support essential organizational operations\n(e.g., key missions, functions).\n\n    Examples of non-essential capabilities include, but are not limited to,\ngames, software packages, tools, and demonstration software, not related to\nrequirements or providing a wide array of functionality not required for every\nmission, but which cannot be disabled.","descriptions":[{"label":"default","data":"It is detrimental for Ubuntu operating systems to provide, or install\nby default, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services, provided by\ndefault, may not be necessary to support essential organizational operations\n(e.g., key missions, functions).\n\n    Examples of non-essential capabilities include, but are not limited to,\ngames, software packages, tools, and demonstration software, not related to\nrequirements or providing a wide array of functionality not required for every\nmission, but which cannot be disabled."},{"label":"check","data":"Verify that the telnet package is not installed on the Ubuntu\noperating system.\n\nCheck that the telnet daemon is not installed on the Ubuntu operating system by\nrunning the following command:\n\n# sudo apt list telnetd\n\nIf the package is installed, this is a finding."},{"label":"fix","data":"Remove the telnet package from the Ubuntu operating system by\nrunning the following command:\n\n# sudo apt-get remove telnetd"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000074-GPOS-00042","satisfies":["SRG-OS-000074-GPOS-00042","SRG-OS-000095-GPOS-00049"],"gid":"V-75797","rid":"SV-90477r2_rule","stig_id":"UBTU-16-030000","fix_id":"F-82427r1_fix","cci":["CCI-000197","CCI-000381"],"nist":["IA-5 (1) (c)","CM-7 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75797\" do\n  title \"The telnet package must not be installed.\"\n  desc  \"It is detrimental for Ubuntu operating systems to provide, or install\nby default, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services, provided by\ndefault, may not be necessary to support essential organizational operations\n(e.g., key missions, functions).\n\n    Examples of non-essential capabilities include, but are not limited to,\ngames, software packages, tools, and demonstration software, not related to\nrequirements or providing a wide array of functionality not required for every\nmission, but which cannot be disabled.\n\n\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000074-GPOS-00042\"\n  tag \"satisfies\": [\"SRG-OS-000074-GPOS-00042\", \"SRG-OS-000095-GPOS-00049\"]\n  tag \"gid\": \"V-75797\"\n  tag \"rid\": \"SV-90477r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030000\"\n  tag \"fix_id\": \"F-82427r1_fix\"\n  tag \"cci\": [\"CCI-000197\", \"CCI-000381\"]\n  tag \"nist\": [\"IA-5 (1) (c)\", \"CM-7 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the telnet package is not installed on the Ubuntu\noperating system.\n\nCheck that the telnet daemon is not installed on the Ubuntu operating system by\nrunning the following command:\n\n# sudo apt list telnetd\n\nIf the package is installed, this is a finding.\"\n  desc \"fix\", \"Remove the telnet package from the Ubuntu operating system by\nrunning the following command:\n\n# sudo apt-get remove telnetd\"\n\n  describe package('telnet') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75797.rb"},"results":[{"status":"failed","code_desc":"System Package telnet should not be installed","run_time":0.015609,"start_time":"2019-08-06T11:13:28-04:00","message":"expected System Package telnet not to be installed"}]},{"id":"V-75517","title":"The file integrity tool must perform verification of the correct\noperation of security functions: upon system start-up and/or restart; upon\ncommand by a user with privileged access; and/or every 30 days.","desc":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n    Notifications provided by information systems include, for example,\nelectronic alerts to system administrators, messages to local computer\nconsoles, and/or hardware indications, such as lights.\n\n    This requirement applies to Ubuntu operating systems performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.","descriptions":[{"label":"default","data":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n    Notifications provided by information systems include, for example,\nelectronic alerts to system administrators, messages to local computer\nconsoles, and/or hardware indications, such as lights.\n\n    This requirement applies to Ubuntu operating systems performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality."},{"label":"check","data":"Verify that Advanced Intrusion Detection Environment (AIDE)\nperforms a verification of the operation of security functions every 30 days.\n\nNote: A file integrity tool other than AIDE may be used, but the tool must be\nexecuted at least once per week.\n\nCheck that AIDE is being executed every 30 days or less with the following\ncommand:\n\n# ls -al /etc/cron.daily/aide\n\n-rwxr-xr-x 1 root root 26049 Oct 24 2014 /etc/cron.daily/aide\n\nIf the \"/etc/cron.daily/aide\" file does not exist or the cron job is not\nconfigured to run at least every 30 days, this is a finding."},{"label":"fix","data":"The cron file for AIDE is fairly complex as it creates the\nreport. The easiest way to create the file is to update the AIDE package with\nthe following command:\n\n# sudo apt-get install aide"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000446-GPOS-00200","gid":"V-75517","rid":"SV-90197r2_rule","stig_id":"UBTU-16-010510","fix_id":"F-82145r1_fix","cci":["CCI-002699"],"nist":["SI-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75517\" do\n  title \"The file integrity tool must perform verification of the correct\noperation of security functions: upon system start-up and/or restart; upon\ncommand by a user with privileged access; and/or every 30 days.\"\n  desc  \"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n    Notifications provided by information systems include, for example,\nelectronic alerts to system administrators, messages to local computer\nconsoles, and/or hardware indications, such as lights.\n\n    This requirement applies to Ubuntu operating systems performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000446-GPOS-00200\"\n  tag \"gid\": \"V-75517\"\n  tag \"rid\": \"SV-90197r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010510\"\n  tag \"fix_id\": \"F-82145r1_fix\"\n  tag \"cci\": [\"CCI-002699\"]\n  tag \"nist\": [\"SI-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Advanced Intrusion Detection Environment (AIDE)\nperforms a verification of the operation of security functions every 30 days.\n\nNote: A file integrity tool other than AIDE may be used, but the tool must be\nexecuted at least once per week.\n\nCheck that AIDE is being executed every 30 days or less with the following\ncommand:\n\n# ls -al /etc/cron.daily/aide\n\n-rwxr-xr-x 1 root root 26049 Oct 24 2014 /etc/cron.daily/aide\n\nIf the \\\"/etc/cron.daily/aide\\\" file does not exist or the cron job is not\nconfigured to run at least every 30 days, this is a finding.\"\n  desc \"fix\", \"The cron file for AIDE is fairly complex as it creates the\nreport. The easiest way to create the file is to update the AIDE package with\nthe following command:\n\n# sudo apt-get install aide\"\n\n  # Checking if a cron file for aide exists\n  describe file('/etc/cron.daily/aide') do\n    it { should exist }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75517.rb"},"results":[{"status":"failed","code_desc":"File /etc/cron.daily/aide should exist","run_time":0.008288,"start_time":"2019-08-06T11:13:28-04:00","message":"expected File /etc/cron.daily/aide to exist"}]},{"id":"V-75457","title":"The Ubuntu operating system must require the change of at least 8\ncharacters when passwords are changed.","desc":"If the Ubuntu operating system allows the user to consecutively reuse\nextensive portions of passwords, this increases the chances of password\ncompromise by increasing the window of opportunity for attempts at guessing and\nbrute-force attacks.\n\n    The number of changed characters refers to the number of changes required\nwith respect to the total number of positions in the current password. In other\nwords, characters may be the same within the two passwords; however, the\npositions of the like characters must be different.\n\n    If the password length is an odd number then number of changed characters\nmust be rounded up. For example, a password length of 15 characters must\nrequire the change of at least 8 characters.","descriptions":[{"label":"default","data":"If the Ubuntu operating system allows the user to consecutively reuse\nextensive portions of passwords, this increases the chances of password\ncompromise by increasing the window of opportunity for attempts at guessing and\nbrute-force attacks.\n\n    The number of changed characters refers to the number of changes required\nwith respect to the total number of positions in the current password. In other\nwords, characters may be the same within the two passwords; however, the\npositions of the like characters must be different.\n\n    If the password length is an odd number then number of changed characters\nmust be rounded up. For example, a password length of 15 characters must\nrequire the change of at least 8 characters."},{"label":"check","data":"Verify the Ubuntu operating system requires the change of at\nleast \"8\" characters when passwords are changed.\n\nDetermine if the field \"difok\" is set in the \"/etc/security/pwquality.conf\"\nfile with the following command:\n\n# grep -i \"difok\" /etc/security/pwquality.conf\ndifok=8\n\nIf the \"difok\" parameter is less than \"8\", or is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to require the change of at\nleast \"8\" characters when passwords are changed.\n\nAdd or update the following line in the \"/etc/security/pwquality.conf\" file\nto include the \"difok=8\" parameter:\n\ndifok=8"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000072-GPOS-00040","gid":"V-75457","rid":"SV-90137r2_rule","stig_id":"UBTU-16-010140","fix_id":"F-82085r2_fix","cci":["CCI-000195"],"nist":["IA-5 (1) (b)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75457\" do\n  title \"The Ubuntu operating system must require the change of at least 8\ncharacters when passwords are changed.\"\n  desc  \"If the Ubuntu operating system allows the user to consecutively reuse\nextensive portions of passwords, this increases the chances of password\ncompromise by increasing the window of opportunity for attempts at guessing and\nbrute-force attacks.\n\n    The number of changed characters refers to the number of changes required\nwith respect to the total number of positions in the current password. In other\nwords, characters may be the same within the two passwords; however, the\npositions of the like characters must be different.\n\n    If the password length is an odd number then number of changed characters\nmust be rounded up. For example, a password length of 15 characters must\nrequire the change of at least 8 characters.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000072-GPOS-00040\"\n  tag \"gid\": \"V-75457\"\n  tag \"rid\": \"SV-90137r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010140\"\n  tag \"fix_id\": \"F-82085r2_fix\"\n  tag \"cci\": [\"CCI-000195\"]\n  tag \"nist\": [\"IA-5 (1) (b)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system requires the change of at\nleast \\\"8\\\" characters when passwords are changed.\n\nDetermine if the field \\\"difok\\\" is set in the \\\"/etc/security/pwquality.conf\\\"\nfile with the following command:\n\n# grep -i \\\"difok\\\" /etc/security/pwquality.conf\ndifok=8\n\nIf the \\\"difok\\\" parameter is less than \\\"8\\\", or is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to require the change of at\nleast \\\"8\\\" characters when passwords are changed.\n\nAdd or update the following line in the \\\"/etc/security/pwquality.conf\\\" file\nto include the \\\"difok=8\\\" parameter:\n\ndifok=8\"\n\n  min_num_characters_to_change = input('min_num_characters_to_change')\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n  \n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('difok') { should cmp min_num_characters_to_change }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75457.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000118,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75853","title":"Remote X connections for interactive users must be encrypted.","desc":"Open X displays allow an attacker to capture keystrokes and execute\ncommands remotely.","descriptions":[{"label":"default","data":"Open X displays allow an attacker to capture keystrokes and execute\ncommands remotely."},{"label":"check","data":"Verify remote X connections for interactive users are encrypted.\n\nCheck that remote X connections are encrypted with the following command:\n\n# grep -i x11forwarding /etc/ssh/sshd_config\nX11Forwarding yes\n\nIf the \"X11Forwarding\" keyword is set to \"no\", is missing, or is commented\nout, this is a finding."},{"label":"fix","data":"Configure SSH to encrypt connections for interactive users.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the\n\"X11Forwarding\" keyword and set its value to \"yes\":\n\nX11Forwarding yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75853","rid":"SV-90533r2_rule","stig_id":"UBTU-16-030400","fix_id":"F-82483r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75853\" do\n  title \"Remote X connections for interactive users must be encrypted.\"\n  desc  \"Open X displays allow an attacker to capture keystrokes and execute\ncommands remotely.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75853\"\n  tag \"rid\": \"SV-90533r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030400\"\n  tag \"fix_id\": \"F-82483r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify remote X connections for interactive users are encrypted.\n\nCheck that remote X connections are encrypted with the following command:\n\n# grep -i x11forwarding /etc/ssh/sshd_config\nX11Forwarding yes\n\nIf the \\\"X11Forwarding\\\" keyword is set to \\\"no\\\", is missing, or is commented\nout, this is a finding.\"\n  desc \"fix\", \"Configure SSH to encrypt connections for interactive users.\n\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the\n\\\"X11Forwarding\\\" keyword and set its value to \\\"yes\\\":\n\nX11Forwarding yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('x11forwarding') { should cmp 'yes' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75853.rb"},"results":[{"status":"passed","code_desc":"SSHD Configuration x11forwarding should cmp == \"yes\"","run_time":0.000417,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75581","title":"File systems that are being imported via Network File System (NFS)\nmust be mounted to prevent binary files from being executed.","desc":"The \"noexec\" mount option causes the system to not execute binary\nfiles. This option must be used for mounting any file system not containing\napproved binary files as they may be incompatible. Executing files from\nuntrusted file systems increases the opportunity for unprivileged users to\nattain unauthorized administrative access.","descriptions":[{"label":"default","data":"The \"noexec\" mount option causes the system to not execute binary\nfiles. This option must be used for mounting any file system not containing\napproved binary files as they may be incompatible. Executing files from\nuntrusted file systems increases the opportunity for unprivileged users to\nattain unauthorized administrative access."},{"label":"check","data":"Verify file systems that are being Network File System (NFS)\nimported are mounted with the \"noexec\" option.\n\nFind the file system(s) that contain the directories being exported with the\nfollowing command:\n\n# grep nfs /etc/fstab | grep noexec\n\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d    /store           nfs\nrw,noexec                                                    0 0\n\nIf a file system found in \"/etc/fstab\" refers to NFS and it does not have the\n\"noexec\" option set, and use of NFS exported binaries is not documented with\nthe Information System Security Officer (ISSO) as an operational requirement,\nthis is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"noexec\" option on file\nsystems that are being imported via Network File System (NFS)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75581","rid":"SV-90261r2_rule","stig_id":"UBTU-16-010830","fix_id":"F-82209r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75581\" do\n  title \"File systems that are being imported via Network File System (NFS)\nmust be mounted to prevent binary files from being executed.\"\n  desc  \"The \\\"noexec\\\" mount option causes the system to not execute binary\nfiles. This option must be used for mounting any file system not containing\napproved binary files as they may be incompatible. Executing files from\nuntrusted file systems increases the opportunity for unprivileged users to\nattain unauthorized administrative access.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75581\"\n  tag \"rid\": \"SV-90261r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010830\"\n  tag \"fix_id\": \"F-82209r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify file systems that are being Network File System (NFS)\nimported are mounted with the \\\"noexec\\\" option.\n\nFind the file system(s) that contain the directories being exported with the\nfollowing command:\n\n# grep nfs /etc/fstab | grep noexec\n\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d    /store           nfs\nrw,noexec                                                    0 0\n\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the\n\\\"noexec\\\" option set, and use of NFS exported binaries is not documented with\nthe Information System Security Officer (ISSO) as an operational requirement,\nthis is a finding.\"\n  desc \"fix\", \"Configure the \\\"/etc/fstab\\\" to use the \\\"noexec\\\" option on file\nsystems that are being imported via Network File System (NFS).\"\n\n  device_rules = etc_fstab.where{ file_system_type == 'nfs' }.entries\n  if device_rules.count > 0\n    device_rules.each do |device_rule|\n      describe device_rule do\n        its ('mount_options') { should include 'noexec' }\n      end\n    end\n  else\n    describe \"No NFS mounts found on the system\" do\n      subject { device_rules }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75581.rb"},"results":[{"status":"passed","code_desc":"No NFS mounts found on the system count should eq 0","run_time":7.6e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75641","title":"Audit logs must be group-owned by root to prevent unauthorized read\naccess.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.","descriptions":[{"label":"default","data":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity."},{"label":"check","data":"Verify the audit logs are group-owned by \"root\". First\ndetermine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log file, determine if the audit log is\ngroup-owned by \"root\" using the following command:\n\n# sudo ls -la /var/log/audit/audit.log\nrw------- 2 root root 8096 Jun 26 11:56 /var/log/audit/audit.log\n\nIf the audit log is not group-owned by \"root\", this is a finding."},{"label":"fix","data":"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct group-owner as \"root\" with the following\ncommand:\n\n# sudo chgrp root [audit_log_file]\n\nReplace \"[audit_log_file]\" to the correct audit log path, by default this\nlocation is \"/var/log/audit/audit.log\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029","SRG-OS-000206-GPOS-00084"],"gid":"V-75641","rid":"SV-90321r2_rule","stig_id":"UBTU-16-020120","fix_id":"F-82269r2_fix","cci":["CCI-000162","CCI-000163","CCI-000164","CCI-001314"],"nist":["AU-9","AU-9","AU-9","SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75641\" do\n  title \"Audit logs must be group-owned by root to prevent unauthorized read\naccess.\"\n  desc  \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000057-GPOS-00027\"\n  tag \"satisfies\": [\"SRG-OS-000057-GPOS-00027\", \"SRG-OS-000058-GPOS-00028\",\n\"SRG-OS-000059-GPOS-00029\", \"SRG-OS-000206-GPOS-00084\"]\n  tag \"gid\": \"V-75641\"\n  tag \"rid\": \"SV-90321r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020120\"\n  tag \"fix_id\": \"F-82269r2_fix\"\n  tag \"cci\": [\"CCI-000162\", \"CCI-000163\", \"CCI-000164\", \"CCI-001314\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit logs are group-owned by \\\"root\\\". First\ndetermine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log file, determine if the audit log is\ngroup-owned by \\\"root\\\" using the following command:\n\n# sudo ls -la /var/log/audit/audit.log\nrw------- 2 root root 8096 Jun 26 11:56 /var/log/audit/audit.log\n\nIf the audit log is not group-owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct group-owner as \\\"root\\\" with the following\ncommand:\n\n# sudo chgrp root [audit_log_file]\n\nReplace \\\"[audit_log_file]\\\" to the correct audit log path, by default this\nlocation is \\\"/var/log/audit/audit.log\\\".\"\n\n  log_file_path = auditd_conf.log_file\n\n  describe file(log_file_path) do\n    its('group') { should cmp 'root' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75641.rb"},"results":[{"status":"passed","code_desc":"File /var/log/audit/audit.log group should cmp == \"root\"","run_time":0.000111,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75463","title":"The Ubuntu operating system must employ FIPS 140-2 approved\ncryptographic hashing algorithms for all created passwords.","desc":"The system must use a strong hashing algorithm to store the password.\nThe system must use a sufficient number of hashing rounds to ensure the\nrequired level of entropy.\n\n    Passwords need to be protected at all times, and encryption is the standard\nmethod for protecting passwords. If passwords are not encrypted, they can be\nplainly read (i.e., clear text) and easily compromised.","descriptions":[{"label":"default","data":"The system must use a strong hashing algorithm to store the password.\nThe system must use a sufficient number of hashing rounds to ensure the\nrequired level of entropy.\n\n    Passwords need to be protected at all times, and encryption is the standard\nmethod for protecting passwords. If passwords are not encrypted, they can be\nplainly read (i.e., clear text) and easily compromised."},{"label":"check","data":"Verify the shadow password suite configuration is set to create\npasswords using a strong cryptographic hash with the following command:\n\nCheck that a minimum number of hash rounds is configured by running the\nfollowing command:\n\n# grep rounds /etc/pam.d/common-password\n\npassword  [success=1 default=ignore]  pam_unix.so obscure sha512 rounds=5000\n\nIf \"rounds\" has a value below \"5000\", or is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to encrypt all stored\npasswords with a strong cryptographic hash.\n\nEdit/modify the following line in the \"/etc/pam.d/common-password\" file and\nset \"rounds\" to a value no lower than \"5000\":\n\npassword  [success=1 default=ignore]  pam_unix.so obscure sha512 rounds=5000"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000073-GPOS-00041","satisfies":["SRG-OS-000073-GPOS-00041","SRG-OS-000120-GPOS-00061"],"gid":"V-75463","rid":"SV-90143r2_rule","stig_id":"UBTU-16-010170","fix_id":"F-82091r2_fix","cci":["CCI-000196","CCI-000803"],"nist":["IA-5 (1) (c)","IA-7","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75463\" do\n  title \"The Ubuntu operating system must employ FIPS 140-2 approved\ncryptographic hashing algorithms for all created passwords.\"\n  desc  \"The system must use a strong hashing algorithm to store the password.\nThe system must use a sufficient number of hashing rounds to ensure the\nrequired level of entropy.\n\n    Passwords need to be protected at all times, and encryption is the standard\nmethod for protecting passwords. If passwords are not encrypted, they can be\nplainly read (i.e., clear text) and easily compromised.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000073-GPOS-00041\"\n  tag \"satisfies\": [\"SRG-OS-000073-GPOS-00041\", \"SRG-OS-000120-GPOS-00061\"]\n  tag \"gid\": \"V-75463\"\n  tag \"rid\": \"SV-90143r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010170\"\n  tag \"fix_id\": \"F-82091r2_fix\"\n  tag \"cci\": [\"CCI-000196\", \"CCI-000803\"]\n  tag \"nist\": [\"IA-5 (1) (c)\", \"IA-7\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the shadow password suite configuration is set to create\npasswords using a strong cryptographic hash with the following command:\n\nCheck that a minimum number of hash rounds is configured by running the\nfollowing command:\n\n# grep rounds /etc/pam.d/common-password\n\npassword  [success=1 default=ignore]  pam_unix.so obscure sha512 rounds=5000\n\nIf \\\"rounds\\\" has a value below \\\"5000\\\", or is commented out, this is a\nfinding.\n\"\n  desc \"fix\", \"Configure the Ubuntu operating system to encrypt all stored\npasswords with a strong cryptographic hash.\n\nEdit/modify the following line in the \\\"/etc/pam.d/common-password\\\" file and\nset \\\"rounds\\\" to a value no lower than \\\"5000\\\":\n\npassword  [success=1 default=ignore]  pam_unix.so obscure sha512 rounds=5000\"\n\n  describe file(\"/etc/pam.d/common-password\") do\n    it { should exist }\n  end\n\n  describe command(\"grep rounds /etc/pam.d/common-password\") do\n    its('exit_status') { should eq 0 }\n    its('stdout') { should match /^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+rounds=([5-9]\\d\\d\\d|[1-9]\\d\\d\\d\\d+)($|\\s+.*$)/ }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75463.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/common-password should exist","run_time":0.009452,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"failed","code_desc":"Command: `grep rounds /etc/pam.d/common-password` exit_status should eq 0","run_time":0.007799,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: 0\n     got: 1\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Command: `grep rounds /etc/pam.d/common-password` stdout should match /^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+rounds=([5-9]\\d\\d\\d|[1-9]\\d\\d\\d\\d+)($|\\s+.*$)/","run_time":0.000249,"start_time":"2019-08-06T11:13:28-04:00","message":"expected \"\" to match /^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+rounds=([5-9]\\d\\d\\d|[1-9]\\d\\d\\d\\d+)($|\\s+.*$)/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+rounds=([5-9]\\d\\d\\d|[1-9]\\d\\d\\d\\d+)($|\\s+.*$)/\n+\"\"\n"}]},{"id":"V-75523","title":"The file integrity tool must notify the system administrator when\nchanges to the baseline configuration or anomalies in the operation of any\nsecurity functions are discovered.","desc":"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the Ubuntu\noperating system. Changes to Ubuntu operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n    Security function is defined as the hardware, software, and/or firmware of\nthe information system responsible for enforcing the system security policy and\nsupporting the isolation of code and data on which the protection is based.\nSecurity functionality includes, but is not limited to, establishing system\naccounts, configuring access authorizations (i.e., permissions, privileges),\nsetting events to be audited, and setting intrusion detection parameters.\n\n    Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO\nand SAs must be notified via email and/or monitoring system trap when there is\nan unauthorized modification of a configuration item.\n\n    Notifications provided by information systems include messages to local\ncomputer consoles, and/or hardware indications, such as lights.\n\n    This capability must take into account operational requirements for\navailability for selecting an appropriate response. The organization may choose\nto shut down or restart the information system upon security function anomaly\ndetection.","descriptions":[{"label":"default","data":"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the Ubuntu\noperating system. Changes to Ubuntu operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n    Security function is defined as the hardware, software, and/or firmware of\nthe information system responsible for enforcing the system security policy and\nsupporting the isolation of code and data on which the protection is based.\nSecurity functionality includes, but is not limited to, establishing system\naccounts, configuring access authorizations (i.e., permissions, privileges),\nsetting events to be audited, and setting intrusion detection parameters.\n\n    Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO\nand SAs must be notified via email and/or monitoring system trap when there is\nan unauthorized modification of a configuration item.\n\n    Notifications provided by information systems include messages to local\ncomputer consoles, and/or hardware indications, such as lights.\n\n    This capability must take into account operational requirements for\navailability for selecting an appropriate response. The organization may choose\nto shut down or restart the information system upon security function anomaly\ndetection."},{"label":"check","data":"Verify that Advanced Intrusion Detection Environment (AIDE)\nnotifies the system administrator when anomalies in the operation of any\nsecurity functions are discovered.\n\nCheck that AIDE notifies the system administrator when anomalies in the\noperation of any security functions are discovered with the following command:\n\n# sudo grep SILENTREPORTS /etc/default/aide\n\nSILENTREPORTS=no\n\nIf the \"/etc/cron.daily/aide\" file does not exist, the cron job is configured\nwith the \"SILENTREPORTS=yes\" option, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Modify the \"SILENTREPORTS\" parameter in \"/etc/default/aide\"\nfile with a value \"no\" of if it does not already exist:\n\nSILENTREPORTS=no"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000363-GPOS-00150","satisfies":["SRG-OS-000363-GPOS-00150","SRG-OS-000447-GPOS-00201"],"gid":"V-75523","rid":"SV-90203r3_rule","stig_id":"UBTU-16-010540","fix_id":"F-82151r2_fix","cci":["CCI-001744","CCI-002702"],"nist":["CM-3 (5)","SI-6 d","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75523\" do\n  title \"The file integrity tool must notify the system administrator when\nchanges to the baseline configuration or anomalies in the operation of any\nsecurity functions are discovered.\"\n  desc  \"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the Ubuntu\noperating system. Changes to Ubuntu operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n    Security function is defined as the hardware, software, and/or firmware of\nthe information system responsible for enforcing the system security policy and\nsupporting the isolation of code and data on which the protection is based.\nSecurity functionality includes, but is not limited to, establishing system\naccounts, configuring access authorizations (i.e., permissions, privileges),\nsetting events to be audited, and setting intrusion detection parameters.\n\n    Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO\nand SAs must be notified via email and/or monitoring system trap when there is\nan unauthorized modification of a configuration item.\n\n    Notifications provided by information systems include messages to local\ncomputer consoles, and/or hardware indications, such as lights.\n\n    This capability must take into account operational requirements for\navailability for selecting an appropriate response. The organization may choose\nto shut down or restart the information system upon security function anomaly\ndetection.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000363-GPOS-00150\"\n  tag \"satisfies\": [\"SRG-OS-000363-GPOS-00150\", \"SRG-OS-000447-GPOS-00201\"]\n  tag \"gid\": \"V-75523\"\n  tag \"rid\": \"SV-90203r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010540\"\n  tag \"fix_id\": \"F-82151r2_fix\"\n  tag \"cci\": [\"CCI-001744\", \"CCI-002702\"]\n  tag \"nist\": [\"CM-3 (5)\", \"SI-6 d\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Advanced Intrusion Detection Environment (AIDE)\nnotifies the system administrator when anomalies in the operation of any\nsecurity functions are discovered.\n\nCheck that AIDE notifies the system administrator when anomalies in the\noperation of any security functions are discovered with the following command:\n\n# sudo grep SILENTREPORTS /etc/default/aide\n\nSILENTREPORTS=no\n\nIf the \\\"/etc/cron.daily/aide\\\" file does not exist, the cron job is configured\nwith the \\\"SILENTREPORTS=yes\\\" option, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Modify the \\\"SILENTREPORTS\\\" parameter in \\\"/etc/default/aide\\\"\nfile with a value \\\"no\\\" of if it does not already exist:\n\nSILENTREPORTS=no\n\"\n\n  # Checking if a cron file for aide exists\n  describe file('/etc/cron.daily/aide') do\n    it { should exist }\n  end\n\n  describe parse_config_file('/etc/default/aide').params['SILENTREPORTS'] do\n    it { should eq \"yes\" }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75523.rb"},"results":[{"status":"failed","code_desc":"File /etc/cron.daily/aide should exist","run_time":0.000116,"start_time":"2019-08-06T11:13:28-04:00","message":"expected File /etc/cron.daily/aide to exist"},{"status":"failed","code_desc":"should eq \"yes\"","run_time":8.2e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: \"yes\"\n     got: nil\n\n(compared using ==)\n"}]},{"id":"V-75783","title":"Successful/unsuccessful uses of the chage command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"chage\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w chage /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chage\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"chage\" command. Add or update the\nfollowing rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chage\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75783","rid":"SV-90463r3_rule","stig_id":"UBTU-16-020790","fix_id":"F-82413r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75783\" do\n  title \"Successful/unsuccessful uses of the chage command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75783\"\n  tag \"rid\": \"SV-90463r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020790\"\n  tag \"fix_id\": \"F-82413r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"chage\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w chage /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chage\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"chage\\\" command. Add or update the\nfollowing rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chage\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/chage'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75783.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/chage exist should equal true","run_time":8.9e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75443","title":"The Ubuntu operating system must limit the number of concurrent\nsessions to ten for all accounts and/or account types.","desc":"Ubuntu operating system management includes the ability to control the\nnumber of users and user sessions that utilize an Ubuntu operating system.\nLimiting the number of allowed users and sessions per user is helpful in\nreducing the risks related to DoS attacks.\n\n    This requirement addresses concurrent sessions for information system\naccounts and does not address concurrent sessions by single users via multiple\nsystem accounts. The maximum number of concurrent sessions should be defined\nbased upon mission needs and the operational environment for each system.","descriptions":[{"label":"default","data":"Ubuntu operating system management includes the ability to control the\nnumber of users and user sessions that utilize an Ubuntu operating system.\nLimiting the number of allowed users and sessions per user is helpful in\nreducing the risks related to DoS attacks.\n\n    This requirement addresses concurrent sessions for information system\naccounts and does not address concurrent sessions by single users via multiple\nsystem accounts. The maximum number of concurrent sessions should be defined\nbased upon mission needs and the operational environment for each system."},{"label":"check","data":"Verify that the Ubuntu operating system limits the number of\nconcurrent sessions to \"10\" for all accounts and/or account types by running\nthe following command:\n\n# grep maxlogins /etc/security/limits.conf\n\nThe result must contain the following line:\n\n* hard maxlogins 10\n\nIf the \"maxlogins\" item is missing or the value is not set to \"10\" or less,\nor is commented out,  this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to limit the number of\nconcurrent sessions to ten for all accounts and/or account types.\n\nAdd the following line to the top of the /etc/security/limits.conf:\n\n* hard maxlogins 10"}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000027-GPOS-00008","gid":"V-75443","rid":"SV-90123r2_rule","stig_id":"UBTU-16-010070","fix_id":"F-82071r1_fix","cci":["CCI-000054"],"nist":["AC-10","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75443\" do\n  title \"The Ubuntu operating system must limit the number of concurrent\nsessions to ten for all accounts and/or account types.\"\n  desc  \"Ubuntu operating system management includes the ability to control the\nnumber of users and user sessions that utilize an Ubuntu operating system.\nLimiting the number of allowed users and sessions per user is helpful in\nreducing the risks related to DoS attacks.\n\n    This requirement addresses concurrent sessions for information system\naccounts and does not address concurrent sessions by single users via multiple\nsystem accounts. The maximum number of concurrent sessions should be defined\nbased upon mission needs and the operational environment for each system.\n  \"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000027-GPOS-00008\"\n  tag \"gid\": \"V-75443\"\n  tag \"rid\": \"SV-90123r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010070\"\n  tag \"fix_id\": \"F-82071r1_fix\"\n  tag \"cci\": [\"CCI-000054\"]\n  tag \"nist\": [\"AC-10\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system limits the number of\nconcurrent sessions to \\\"10\\\" for all accounts and/or account types by running\nthe following command:\n\n# grep maxlogins /etc/security/limits.conf\n\nThe result must contain the following line:\n\n* hard maxlogins 10\n\nIf the \\\"maxlogins\\\" item is missing or the value is not set to \\\"10\\\" or less,\nor is commented out,  this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to limit the number of\nconcurrent sessions to ten for all accounts and/or account types.\n\nAdd the following line to the top of the /etc/security/limits.conf:\n\n* hard maxlogins 10\"\n\n  describe limits_conf do\n    its('*') { should include ['hard', 'maxlogins', input('maxlogins').to_s] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75443.rb"},"results":[{"status":"failed","code_desc":"limits.conf * should include [\"hard\", \"maxlogins\", \"10\"]","run_time":0.000328,"start_time":"2019-08-06T11:13:28-04:00","message":"expected nil to include [\"hard\", \"maxlogins\", \"10\"], but it does not respond to `include?`"}]},{"id":"V-75503","title":"The Ubuntu operating system must implement NSA-approved cryptography\nto protect classified information in accordance with applicable federal laws,\nExecutive Orders, directives, policies, regulations, and standards.","desc":"Use of weak or untested encryption algorithms undermines the purposes\nof utilizing encryption to protect data. The Ubuntu operating system must\nimplement cryptographic modules adhering to the higher standards approved by\nthe federal government since this provides assurance they have been tested and\nvalidated.","descriptions":[{"label":"default","data":"Use of weak or untested encryption algorithms undermines the purposes\nof utilizing encryption to protect data. The Ubuntu operating system must\nimplement cryptographic modules adhering to the higher standards approved by\nthe federal government since this provides assurance they have been tested and\nvalidated."},{"label":"check","data":"Verify the system is configured to run in FIPS mode.\n\nCheck that the system is configured to run in FIPS mode with the following\ncommand:\n\n# grep -i 1 /proc/sys/crypto/fips_enabled\n1\n\nIf a value of \"1\" is not returned, this is a finding."},{"label":"fix","data":"Configure the system to run in FIPS mode. Add \"fips=1\" to the\nkernel parameter during the Ubuntu operating systems install.\n\nEnabling a FIPS mode on a pre-existing system involves a number of\nmodifications to the Ubuntu operating system. Refer to the Ubuntu Server 16.04\nFIPS 140-2 security policy document for instructions."}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000396-GPOS-00176","satisfies":["SRG-OS-000396-GPOS-00176","SRG-OS-000478-GPOS-00223"],"gid":"V-75503","rid":"SV-90183r1_rule","stig_id":"UBTU-16-010370","fix_id":"F-82131r1_fix","cci":["CCI-002450"],"nist":["SC-13","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75503\" do\n  title \"The Ubuntu operating system must implement NSA-approved cryptography\nto protect classified information in accordance with applicable federal laws,\nExecutive Orders, directives, policies, regulations, and standards.\"\n  desc  \"Use of weak or untested encryption algorithms undermines the purposes\nof utilizing encryption to protect data. The Ubuntu operating system must\nimplement cryptographic modules adhering to the higher standards approved by\nthe federal government since this provides assurance they have been tested and\nvalidated.\n\n\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000396-GPOS-00176\"\n  tag \"satisfies\": [\"SRG-OS-000396-GPOS-00176\", \"SRG-OS-000478-GPOS-00223\"]\n  tag \"gid\": \"V-75503\"\n  tag \"rid\": \"SV-90183r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010370\"\n  tag \"fix_id\": \"F-82131r1_fix\"\n  tag \"cci\": [\"CCI-002450\"]\n  tag \"nist\": [\"SC-13\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system is configured to run in FIPS mode.\n\nCheck that the system is configured to run in FIPS mode with the following\ncommand:\n\n# grep -i 1 /proc/sys/crypto/fips_enabled\n1\n\nIf a value of \\\"1\\\" is not returned, this is a finding.\"\n  desc \"fix\", \"Configure the system to run in FIPS mode. Add \\\"fips=1\\\" to the\nkernel parameter during the Ubuntu operating systems install.\n\nEnabling a FIPS mode on a pre-existing system involves a number of\nmodifications to the Ubuntu operating system. Refer to the Ubuntu Server 16.04\nFIPS 140-2 security policy document for instructions.\"\n\n  config_file = '/proc/sys/crypto/fips_enabled'\n  config_file_exists = file(config_file).exist?\n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      it { should cmp '1' }\n    end\n  else\n    describe ('FIPS is enabled') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75503.rb"},"results":[{"status":"failed","code_desc":"FIPS is enabled should equal true","run_time":8.6e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75721","title":"The audit system must be configured to audit any usage of the\nfsetxattr system call.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \"fsetxattr\" system call, by running the following\ncommand:\n\n# sudo grep -w fsetxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"fsetxattr\" system call, by adding the following lines to\n\"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000458-GPOS-00203","SRG-OS-000462-GPOS-00206","SRG-OS-000463-GPOS-00207","SRG-OS-000471-GPOS-00215","SRG-OS-000474-GPOS-00219"],"gid":"V-75721","rid":"SV-90401r2_rule","stig_id":"UBTU-16-020480","fix_id":"F-82349r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75721\" do\n  title \"The audit system must be configured to audit any usage of the\nfsetxattr system call.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000458-GPOS-00203\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000463-GPOS-00207\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000474-GPOS-00219\"]\n  tag \"gid\": \"V-75721\"\n  tag \"rid\": \"SV-90401r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020480\"\n  tag \"fix_id\": \"F-82349r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \\\"fsetxattr\\\" system call, by running the following\ncommand:\n\n# sudo grep -w fsetxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"fsetxattr\\\" system call, by adding the following lines to\n\\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"fsetxattr\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75721.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"fsetxattr\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000113,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"fsetxattr\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000102,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75661","title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/passwd.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \"/etc/passwd\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following\ncommand:\n\n# sudo grep /etc/passwd /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \"/etc/passwd\".\n\nAdd or update the following file system rule to \"/etc/audit/audit.rules\":\n\n-w /etc/passwd -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000304-GPOS-00121","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000470-GPOS-00214","SRG-OS-000471-GPOS-00215"],"gid":"V-75661","rid":"SV-90341r3_rule","stig_id":"UBTU-16-020300","fix_id":"F-82289r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002132","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","AC-2 (4)","MA-4 (1)\n(a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75661\" do\n  title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/passwd.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000304-GPOS-00121\",\n\"SRG-OS-000392-GPOS-00172\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000470-GPOS-00214\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75661\"\n  tag \"rid\": \"SV-90341r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020300\"\n  tag \"fix_id\": \"F-82289r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002132\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"AC-2 (4)\", \"MA-4 (1)\n(a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \\\"/etc/passwd\\\".\n\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following\ncommand:\n\n# sudo grep /etc/passwd /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \\\"/etc/passwd\\\".\n\nAdd or update the following file system rule to \\\"/etc/audit/audit.rules\\\":\n\n-w /etc/passwd -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/etc/passwd'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75661.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /etc/passwd exist should equal true","run_time":0.000116,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75873","title":"The Ubuntu operating system must not forward Internet Protocol version\n4 (IPv4) source-routed packets.","desc":"Source-routed packets allow the source of the packet to suggest that\nrouters forward the packet along a different path than configured on the\nrouter, which can be used to bypass network security measures. This requirement\napplies only to the forwarding of source-routed traffic, such as when IPv4\nforwarding is enabled and the system is functioning as a router.","descriptions":[{"label":"default","data":"Source-routed packets allow the source of the packet to suggest that\nrouters forward the packet along a different path than configured on the\nrouter, which can be used to bypass network security measures. This requirement\napplies only to the forwarding of source-routed traffic, such as when IPv4\nforwarding is enabled and the system is functioning as a router."},{"label":"check","data":"Verify the Ubuntu operating system does not accept IPv4\nsource-routed packets.\n\nCheck the value of the accept source route variable with the following command:\n\n# sudo sysctl net.ipv4.conf.all.accept_source_route\n\nnet.ipv4.conf.all.accept_source_route=0\n\nIf the returned line does not have a value of \"0\", a line is not returned, or\nthe returned line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to not forward Internet\nProtocol version 4 (IPv4) source-routed packets with the following command:\n\n# sudo sysctl -w net.ipv4.conf.all.accept_source_route=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.conf.all.accept_source_route=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75873","rid":"SV-90553r3_rule","stig_id":"UBTU-16-030530","fix_id":"F-82503r3_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75873\" do\n  title \"The Ubuntu operating system must not forward Internet Protocol version\n4 (IPv4) source-routed packets.\"\n  desc  \"Source-routed packets allow the source of the packet to suggest that\nrouters forward the packet along a different path than configured on the\nrouter, which can be used to bypass network security measures. This requirement\napplies only to the forwarding of source-routed traffic, such as when IPv4\nforwarding is enabled and the system is functioning as a router.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75873\"\n  tag \"rid\": \"SV-90553r3_rule\"\n  tag \"stig_id\": \"UBTU-16-030530\"\n  tag \"fix_id\": \"F-82503r3_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system does not accept IPv4\nsource-routed packets.\n\nCheck the value of the accept source route variable with the following command:\n\n# sudo sysctl net.ipv4.conf.all.accept_source_route\n\nnet.ipv4.conf.all.accept_source_route=0\n\nIf the returned line does not have a value of \\\"0\\\", a line is not returned, or\nthe returned line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to not forward Internet\nProtocol version 4 (IPv4) source-routed packets with the following command:\n\n# sudo sysctl -w net.ipv4.conf.all.accept_source_route=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.conf.all.accept_source_route=0\"\n\n  describe kernel_parameter('net.ipv4.conf.all.accept_source_route') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75873.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.conf.all.accept_source_route value should eq 0","run_time":0.007623,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75537","title":"The Apparmor module must be configured to employ a deny-all,\npermit-by-exception policy to allow the execution of authorized software\nprograms and limit the ability of non-privileged users to grant other users\ndirect access to the contents of their home directories/folders.","desc":"The organization must identify authorized software programs and permit\nexecution of authorized software. The process used to identify software\nprograms that are authorized to execute on organizational information systems\nis commonly referred to as whitelisting.\n\n    Utilizing a whitelist provides a configuration management method for\nallowing the execution of only authorized software. Using only authorized\nsoftware decreases risk by limiting the number of potential vulnerabilities.\nVerification of white-listed software occurs prior to execution or at system\nstartup.\n\n    Users' home directories/folders may contain information of a sensitive\nnature. Non-privileged users should coordinate any sharing of information with\nan SA through shared resources.","descriptions":[{"label":"default","data":"The organization must identify authorized software programs and permit\nexecution of authorized software. The process used to identify software\nprograms that are authorized to execute on organizational information systems\nis commonly referred to as whitelisting.\n\n    Utilizing a whitelist provides a configuration management method for\nallowing the execution of only authorized software. Using only authorized\nsoftware decreases risk by limiting the number of potential vulnerabilities.\nVerification of white-listed software occurs prior to execution or at system\nstartup.\n\n    Users' home directories/folders may contain information of a sensitive\nnature. Non-privileged users should coordinate any sharing of information with\nan SA through shared resources."},{"label":"check","data":"Verify the Ubuntu operating system is configured to employ a\ndeny-all, permit-by-exception policy to allow the execution of authorized\nsoftware programs and access to user home directories.\n\nCheck that \"Apparmor\" is configured to employ application whitelisting and\nhome directory access control with the following command:\n\n# sudo apparmor_status\n\napparmor module is loaded.\n13 profiles are loaded.\n13 profiles are in enforce mode.\n   /sbin/dhclient\n   ...\n   lxc-container-default-with-nesting\n0 profiles are in complain mode.\n\nIf the defined profiles do not match the organization’s list of authorized\nsoftware, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to employ a deny-all,\npermit-by-exception policy to allow the execution of authorized software\nprograms.\n\nInstall \"Apparmor\" (if it is not installed) with the following command:\n\n# sudo apt-get install libpam-apparmor\n\nEnable/Activate \"Apparmor\" (if it is not already active) with the following\ncommand:\n\n# sudo systemctl enable apparmor.service\n\nStart \"Apparmor\" with the following command:\n\n# sudo systemctl start apparmor.service\n\nNote: Apparmor must have properly configured profiles for applications and home\ndirectories. All configurations will be based on the actual system setup and\norganization and normally are on a per role basis. See the \"Apparmor\"\ndocumentation for more information on configuring profiles."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000368-GPOS-00154","satisfies":["SRG-OS-000368-GPOS-00154","SRG-OS-000370-GPOS-00155"],"gid":"V-75537","rid":"SV-90217r2_rule","stig_id":"UBTU-16-010610","fix_id":"F-82165r1_fix","cci":["CCI-001764","CCI-001774"],"nist":["CM-7 (2)","CM-7 (5) (b)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75537\" do\n  title \"The Apparmor module must be configured to employ a deny-all,\npermit-by-exception policy to allow the execution of authorized software\nprograms and limit the ability of non-privileged users to grant other users\ndirect access to the contents of their home directories/folders.\"\n  desc  \"The organization must identify authorized software programs and permit\nexecution of authorized software. The process used to identify software\nprograms that are authorized to execute on organizational information systems\nis commonly referred to as whitelisting.\n\n    Utilizing a whitelist provides a configuration management method for\nallowing the execution of only authorized software. Using only authorized\nsoftware decreases risk by limiting the number of potential vulnerabilities.\nVerification of white-listed software occurs prior to execution or at system\nstartup.\n\n    Users' home directories/folders may contain information of a sensitive\nnature. Non-privileged users should coordinate any sharing of information with\nan SA through shared resources.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000368-GPOS-00154\"\n  tag \"satisfies\": [\"SRG-OS-000368-GPOS-00154\", \"SRG-OS-000370-GPOS-00155\"]\n  tag \"gid\": \"V-75537\"\n  tag \"rid\": \"SV-90217r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010610\"\n  tag \"fix_id\": \"F-82165r1_fix\"\n  tag \"cci\": [\"CCI-001764\", \"CCI-001774\"]\n  tag \"nist\": [\"CM-7 (2)\", \"CM-7 (5) (b)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is configured to employ a\ndeny-all, permit-by-exception policy to allow the execution of authorized\nsoftware programs and access to user home directories.\n\nCheck that \\\"Apparmor\\\" is configured to employ application whitelisting and\nhome directory access control with the following command:\n\n# sudo apparmor_status\n\napparmor module is loaded.\n13 profiles are loaded.\n13 profiles are in enforce mode.\n   /sbin/dhclient\n   ...\n   lxc-container-default-with-nesting\n0 profiles are in complain mode.\n\nIf the defined profiles do not match the organization’s list of authorized\nsoftware, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to employ a deny-all,\npermit-by-exception policy to allow the execution of authorized software\nprograms.\n\nInstall \\\"Apparmor\\\" (if it is not installed) with the following command:\n\n# sudo apt-get install libpam-apparmor\n\nEnable/Activate \\\"Apparmor\\\" (if it is not already active) with the following\ncommand:\n\n# sudo systemctl enable apparmor.service\n\nStart \\\"Apparmor\\\" with the following command:\n\n# sudo systemctl start apparmor.service\n\nNote: Apparmor must have properly configured profiles for applications and home\ndirectories. All configurations will be based on the actual system setup and\norganization and normally are on a per role basis. See the \\\"Apparmor\\\"\ndocumentation for more information on configuring profiles.\"\n\n  describe \"Manual test\" do\n    skip \"This control must be reviewed manually\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75537.rb"},"results":[{"status":"skipped","code_desc":"Manual test","run_time":4.0e-06,"start_time":"2019-08-06T11:13:28-04:00","resource":"","skip_message":"This control must be reviewed manually"}]},{"id":"V-75477","title":"Passwords must have a minimum of 15-characters.","desc":"The shorter the password, the lower the number of possible\ncombinations that need to be tested before the password is compromised.\n\n    Password complexity, or strength, is a measure of the effectiveness of a\npassword in resisting attempts at guessing and brute-force attacks. Password\nlength is one factor of several that helps to determine strength and how long\nit takes to crack a password. Use of more characters in a password helps to\nexponentially increase the time and/or resources required to compromise the\npassword.","descriptions":[{"label":"default","data":"The shorter the password, the lower the number of possible\ncombinations that need to be tested before the password is compromised.\n\n    Password complexity, or strength, is a measure of the effectiveness of a\npassword in resisting attempts at guessing and brute-force attacks. Password\nlength is one factor of several that helps to determine strength and how long\nit takes to crack a password. Use of more characters in a password helps to\nexponentially increase the time and/or resources required to compromise the\npassword."},{"label":"check","data":"Verify that the Ubuntu operating system enforces a minimum\n\"15\" character password length, by running the following command:\n\n# grep -i minlen /etc/security/pwquality.conf\n minlen=15\n\nIf \"minlen\" parameter value is not \"15\" or higher, or is commented out,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce a minimum\n15-character password length.\n\nAdd, or modify the \"minlen\" parameter value to the following line in\n\"/etc/security/pwquality.conf\" file:\n\nminlen=15"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000078-GPOS-00046","gid":"V-75477","rid":"SV-90157r2_rule","stig_id":"UBTU-16-010240","fix_id":"F-82105r1_fix","cci":["CCI-000205"],"nist":["IA-5 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75477\" do\n  title \"Passwords must have a minimum of 15-characters.\"\n  desc  \"The shorter the password, the lower the number of possible\ncombinations that need to be tested before the password is compromised.\n\n    Password complexity, or strength, is a measure of the effectiveness of a\npassword in resisting attempts at guessing and brute-force attacks. Password\nlength is one factor of several that helps to determine strength and how long\nit takes to crack a password. Use of more characters in a password helps to\nexponentially increase the time and/or resources required to compromise the\npassword.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000078-GPOS-00046\"\n  tag \"gid\": \"V-75477\"\n  tag \"rid\": \"SV-90157r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010240\"\n  tag \"fix_id\": \"F-82105r1_fix\"\n  tag \"cci\": [\"CCI-000205\"]\n  tag \"nist\": [\"IA-5 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system enforces a minimum\n\\\"15\\\" character password length, by running the following command:\n\n# grep -i minlen /etc/security/pwquality.conf\n minlen=15\n\nIf \\\"minlen\\\" parameter value is not \\\"15\\\" or higher, or is commented out,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce a minimum\n15-character password length.\n\nAdd, or modify the \\\"minlen\\\" parameter value to the following line in\n\\\"/etc/security/pwquality.conf\\\" file:\n\nminlen=15\"\n\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('minlen') { should cmp >= '15' }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75477.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000179,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75907","title":"The Ubuntu operating system must implement certificate status checking\nfor multifactor authentication.","desc":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST.","descriptions":[{"label":"default","data":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST."},{"label":"check","data":"Verify the Ubuntu operating system implements certificate\nstatus checking for multifactor authentication.\n\nCheck that certificate status checking for multifactor authentication is\nimplemented with the following command:\n\n# sudo grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep ocsp_on\n\ncert_policy = ca,signature,ocsp_on;\n\nIf \"cert_policy\" is not set to \"ocsp_on\", has a value of \"none\", or the\nline is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to certificate status\nchecking for multifactor authentication.\n\nModify all of the cert_policy lines in \"/etc/pam_pkcs11/pam_pkcs11.conf\" to\ninclude \"ocsp_on\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000375-GPOS-00160","satisfies":["SRG-OS-000375-GPOS-00160","SRG-OS-000375-GPOS-00161","SRG-OS-000375-GPOS-00162"],"gid":"V-75907","rid":"SV-90587r2_rule","stig_id":"UBTU-16-030820","fix_id":"F-82537r2_fix","cci":["CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (11)","IA-2 (12)","IA-2 (12)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75907\" do\n  title \"The Ubuntu operating system must implement certificate status checking\nfor multifactor authentication.\"\n  desc  \"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000375-GPOS-00160\"\n  tag \"satisfies\": [\"SRG-OS-000375-GPOS-00160\", \"SRG-OS-000375-GPOS-00161\",\n\"SRG-OS-000375-GPOS-00162\"]\n  tag \"gid\": \"V-75907\"\n  tag \"rid\": \"SV-90587r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030820\"\n  tag \"fix_id\": \"F-82537r2_fix\"\n  tag \"cci\": [\"CCI-001948\", \"CCI-001953\", \"CCI-001954\"]\n  tag \"nist\": [\"IA-2 (11)\", \"IA-2 (12)\", \"IA-2 (12)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system implements certificate\nstatus checking for multifactor authentication.\n\nCheck that certificate status checking for multifactor authentication is\nimplemented with the following command:\n\n# sudo grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep ocsp_on\n\ncert_policy = ca,signature,ocsp_on;\n\nIf \\\"cert_policy\\\" is not set to \\\"ocsp_on\\\", has a value of \\\"none\\\", or the\nline is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to certificate status\nchecking for multifactor authentication.\n\nModify all of the cert_policy lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" to\ninclude \\\"ocsp_on\\\".\"\n\n  config_file_exists = file('/etc/pam_pkcs11/pam_pkcs11.conf').exist?\n\n  if config_file_exists\n    describe parse_config_file('/etc/pam_pkcs11/pam_pkcs11.conf') do\n      its('cert_policy') { should include 'ocsp_on' }\n    end\n  else\n    describe \"/etc/pam_pkcs11/pam_pkcs11.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75907.rb"},"results":[{"status":"failed","code_desc":"/etc/pam_pkcs11/pam_pkcs11.conf exists should equal true","run_time":8.9e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75595","title":"The /var/log directory must be owned by root.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify the /var/log directory is owned by root.\n\nCheck that the /var/log directory is owned by root with the following command:\n\n# ls -lad /var/log | cut -d' ' -f3\n\nroot\n\nIf \"root\" is not returned as a result, this is a finding."},{"label":"fix","data":"Change the owner of the directory /var/log to root by running the\nfollowing command:\n\n# sudo chown root /var/log"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75595","rid":"SV-90275r2_rule","stig_id":"UBTU-16-010950","fix_id":"F-82223r1_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75595\" do\n  title \"The /var/log directory must be owned by root.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75595\"\n  tag \"rid\": \"SV-90275r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010950\"\n  tag \"fix_id\": \"F-82223r1_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the /var/log directory is owned by root.\n\nCheck that the /var/log directory is owned by root with the following command:\n\n# ls -lad /var/log | cut -d' ' -f3\n\nroot\n\nIf \\\"root\\\" is not returned as a result, this is a finding.\"\n  desc \"fix\", \"Change the owner of the directory /var/log to root by running the\nfollowing command:\n\n# sudo chown root /var/log\"\n\n  describe directory('/var/log') do\n    its('owner') { should cmp 'syslog'}\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75595.rb"},"results":[{"status":"failed","code_desc":"Directory /var/log owner should cmp == \"syslog\"","run_time":0.010137,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: \"syslog\"\n     got: \"root\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75847","title":"The SSH daemon must perform strict mode checking of home directory\nconfiguration files.","desc":"If other users have access to modify user-specific SSH configuration\nfiles, they may be able to log on to the system as another user.","descriptions":[{"label":"default","data":"If other users have access to modify user-specific SSH configuration\nfiles, they may be able to log on to the system as another user."},{"label":"check","data":"Verify the SSH daemon performs strict mode checking of home\ndirectory configuration files.\n\nCheck that the SSH daemon performs strict mode checking of home directory\nconfiguration files with the following command:\n\n# grep StrictModes /etc/ssh/sshd_config\n\nStrictModes yes\n\nIf \"StrictModes\" is set to \"no\", is missing, or the returned line is\ncommented out, this is a finding."},{"label":"fix","data":"Configure SSH to perform strict mode checking of home directory\nconfiguration files. Uncomment the \"StrictModes\" keyword in\n\"/etc/ssh/sshd_config\" and set the value to \"yes\":\n\nStrictModes yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75847","rid":"SV-90527r2_rule","stig_id":"UBTU-16-030330","fix_id":"F-82477r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75847\" do\n  title \"The SSH daemon must perform strict mode checking of home directory\nconfiguration files.\"\n  desc  \"If other users have access to modify user-specific SSH configuration\nfiles, they may be able to log on to the system as another user.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75847\"\n  tag \"rid\": \"SV-90527r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030330\"\n  tag \"fix_id\": \"F-82477r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH daemon performs strict mode checking of home\ndirectory configuration files.\n\nCheck that the SSH daemon performs strict mode checking of home directory\nconfiguration files with the following command:\n\n# grep StrictModes /etc/ssh/sshd_config\n\nStrictModes yes\n\nIf \\\"StrictModes\\\" is set to \\\"no\\\", is missing, or the returned line is\ncommented out, this is a finding.\"\n  desc \"fix\", \"Configure SSH to perform strict mode checking of home directory\nconfiguration files. Uncomment the \\\"StrictModes\\\" keyword in\n\\\"/etc/ssh/sshd_config\\\" and set the value to \\\"yes\\\":\n\nStrictModes yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('StrictModes') { should cmp 'yes' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75847.rb"},"results":[{"status":"passed","code_desc":"SSHD Configuration StrictModes should cmp == \"yes\"","run_time":0.00053,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75655","title":"Audit tools must be owned by root.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":[{"label":"default","data":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators."},{"label":"check","data":"Verify the audit tools are owned by \"root\" to prevent any\nunauthorized access, deletion, or modification.\n\nCheck the owner of each audit tool by running the following command:\n\n# ls -la /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace\n/sbin/auditd /sbin/audispd /sbin/augenrules\n-rwxr-xr-x 1 root root 97128 Jan 18 2016 /sbin/augenrules\n\nIf any of the audit tools are not owned by \"root\", this is a finding."},{"label":"fix","data":"Configure the audit tools to be owned by \"root\", by running the\nfollowing command:\n\n# sudo chown root [audit_tool]\n\nReplace \"[audit_tool]\" with each audit tool not owned by \"root\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000256-GPOS-00097","satisfies":["SRG-OS-000256-GPOS-00097","SRG-OS-000257-GPOS-00098","SRG-OS-000258-GPOS-00099"],"gid":"V-75655","rid":"SV-90335r2_rule","stig_id":"UBTU-16-020190","fix_id":"F-82283r2_fix","cci":["CCI-001493","CCI-001494","CCI-001495"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75655\" do\n  title \"Audit tools must be owned by root.\"\n  desc  \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000256-GPOS-00097\"\n  tag \"satisfies\": [\"SRG-OS-000256-GPOS-00097\", \"SRG-OS-000257-GPOS-00098\",\n\"SRG-OS-000258-GPOS-00099\"]\n  tag \"gid\": \"V-75655\"\n  tag \"rid\": \"SV-90335r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020190\"\n  tag \"fix_id\": \"F-82283r2_fix\"\n  tag \"cci\": [\"CCI-001493\", \"CCI-001494\", \"CCI-001495\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit tools are owned by \\\"root\\\" to prevent any\nunauthorized access, deletion, or modification.\n\nCheck the owner of each audit tool by running the following command:\n\n# ls -la /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace\n/sbin/auditd /sbin/audispd /sbin/augenrules\n-rwxr-xr-x 1 root root 97128 Jan 18 2016 /sbin/augenrules\n\nIf any of the audit tools are not owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit tools to be owned by \\\"root\\\", by running the\nfollowing command:\n\n# sudo chown root [audit_tool]\n\nReplace \\\"[audit_tool]\\\" with each audit tool not owned by \\\"root\\\".\"\n\n  audit_tools = input('audit_tools')\n\n  audit_tools.each do |tool|\n    describe file(tool) do\n      its('owner') { should cmp 'root' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75655.rb"},"results":[{"status":"passed","code_desc":"File /sbin/auditctl owner should cmp == \"root\"","run_time":0.009282,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"File /sbin/aureport owner should cmp == \"root\"","run_time":0.008278,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"File /sbin/ausearch owner should cmp == \"root\"","run_time":0.010224,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"File /sbin/autrace owner should cmp == \"root\"","run_time":0.008672,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"File /sbin/auditd owner should cmp == \"root\"","run_time":0.009965,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"File /sbin/audispd owner should cmp == \"root\"","run_time":0.010196,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"File /sbin/augenrules owner should cmp == \"root\"","run_time":0.01019,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75715","title":"The audit system must be configured to audit any usage of the kmod\ncommand.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \"kmod\", by running the\nfollowing command:\n\n# sudo grep \"/bin/kmod\" /etc/audit/audit.rules\n\n-w /bin/kmod -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe module management program \"kmod\" by adding the following line to\n\"/etc/audit/audit.rules\":\n\n-w /bin/kmod -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75715","rid":"SV-90395r2_rule","stig_id":"UBTU-16-020450","fix_id":"F-82343r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75715\" do\n  title \"The audit system must be configured to audit any usage of the kmod\ncommand.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75715\"\n  tag \"rid\": \"SV-90395r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020450\"\n  tag \"fix_id\": \"F-82343r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \\\"kmod\\\", by running the\nfollowing command:\n\n# sudo grep \\\"/bin/kmod\\\" /etc/audit/audit.rules\n\n-w /bin/kmod -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe module management program \\\"kmod\\\" by adding the following line to\n\\\"/etc/audit/audit.rules\\\":\n\n-w /bin/kmod -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/bin/kmod'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75715.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /bin/kmod exist should equal true","run_time":0.000152,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75645","title":"Audit log directory must be group-owned by root to prevent\nunauthorized read access.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.","descriptions":[{"label":"default","data":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity."},{"label":"check","data":"Verify the audit log directory is group-owned by \"root\" to\nprevent unauthorized read access.\n\nDetermine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nDetermine the audit log directory by using the output of the above command (ex:\n\"/var/log/audit/\"). Run the following command with the correct audit log\ndirectory path:\n\n# sudo ls -ld /var/log/audit\ndrwxr-x--- 2 root root 8096 Jun 26 11:56 /var/log/audit\n\nIf the audit log directory is not group-owned by \"root\", this is a finding."},{"label":"fix","data":"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct group-owner as \"root\" with the following\ncommand:\n\n# sudo chgrp root [audit_log_directory]\n\nReplace \"[audit_log_directory]\" with the correct audit log directory path, by\ndefault this location is usually \"/var/log/audit\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-75645","rid":"SV-90325r2_rule","stig_id":"UBTU-16-020140","fix_id":"F-82273r2_fix","cci":["CCI-000162","CCI-000163","CCI-000164"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75645\" do\n  title \"Audit log directory must be group-owned by root to prevent\nunauthorized read access.\"\n  desc  \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000057-GPOS-00027\"\n  tag \"satisfies\": [\"SRG-OS-000057-GPOS-00027\", \"SRG-OS-000058-GPOS-00028\",\n\"SRG-OS-000059-GPOS-00029\"]\n  tag \"gid\": \"V-75645\"\n  tag \"rid\": \"SV-90325r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020140\"\n  tag \"fix_id\": \"F-82273r2_fix\"\n  tag \"cci\": [\"CCI-000162\", \"CCI-000163\", \"CCI-000164\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit log directory is group-owned by \\\"root\\\" to\nprevent unauthorized read access.\n\nDetermine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nDetermine the audit log directory by using the output of the above command (ex:\n\\\"/var/log/audit/\\\"). Run the following command with the correct audit log\ndirectory path:\n\n# sudo ls -ld /var/log/audit\ndrwxr-x--- 2 root root 8096 Jun 26 11:56 /var/log/audit\n\nIf the audit log directory is not group-owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct group-owner as \\\"root\\\" with the following\ncommand:\n\n# sudo chgrp root [audit_log_directory]\n\nReplace \\\"[audit_log_directory]\\\" with the correct audit log directory path, by\ndefault this location is usually \\\"/var/log/audit\\\".\"\n\n  log_file_path = input('log_file_path')\n  log_file_dir = input('log_file_dir')\n\n  describe directory(log_file_dir) do\n    its('group') { should cmp 'root' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75645.rb"},"results":[{"status":"passed","code_desc":"Directory /var/log/audit/ group should cmp == \"root\"","run_time":0.008695,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75857","title":"All networked systems must have and implement SSH to protect the\nconfidentiality and integrity of transmitted and received information, as well\nas information during preparation for transmission.","desc":"Without protection of the transmitted information, confidentiality and\nintegrity may be compromised because unprotected communications can be\nintercepted and either read or altered.\n\n    This requirement applies to both internal and external networks and all\ntypes of information system components from which information can be\ntransmitted (e.g., servers, mobile devices, notebook computers, printers,\ncopiers, scanners, and facsimile machines). Communication paths outside the\nphysical protection of a controlled boundary are exposed to the possibility of\ninterception and modification.\n\n    Protecting the confidentiality and integrity of organizational information\ncan be accomplished by physical means (e.g., employing physical distribution\nsystems) or by logical means (e.g., employing cryptographic techniques). If\nphysical means of protection are employed, logical means (cryptography) do not\nhave to be employed, and vice versa.","descriptions":[{"label":"default","data":"Without protection of the transmitted information, confidentiality and\nintegrity may be compromised because unprotected communications can be\nintercepted and either read or altered.\n\n    This requirement applies to both internal and external networks and all\ntypes of information system components from which information can be\ntransmitted (e.g., servers, mobile devices, notebook computers, printers,\ncopiers, scanners, and facsimile machines). Communication paths outside the\nphysical protection of a controlled boundary are exposed to the possibility of\ninterception and modification.\n\n    Protecting the confidentiality and integrity of organizational information\ncan be accomplished by physical means (e.g., employing physical distribution\nsystems) or by logical means (e.g., employing cryptographic techniques). If\nphysical means of protection are employed, logical means (cryptography) do not\nhave to be employed, and vice versa."},{"label":"check","data":"Verify the \"ssh\" meta-package is installed.\n\nCheck that the ssh package is installed with the following command:\n\n$ dpkg -l | grep openssh\n\nii openssh-client 1:7.2p2-4Ubuntu2.1\namd64 secure shell (SSH) client, for secure access to\nremote machines\nii openssh-server 1:7.2p2-4Ubuntu2.1\namd64 secure shell (SSH) server, for secure access\nfrom remote machines\nii openssh-sftp-server 1:7.2p2-4Ubuntu2.1\namd64 secure shell (SSH) sftp server module, for SFTP\naccess from remote machines\n\nIf the \"openssh\" server package is not installed, this is a finding.\n\nCheck that the \"sshd.service\" is loaded and active with the following command:\n\n# systemctl status sshd.service | egrep -i \"(active|loaded)\"\n\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\nActive: active (running) since Sun 2016-06-05 23:46:29 CDT; 1h 4min ago\n\nIf \"sshd.service\" is not active or loaded, this is a finding."},{"label":"fix","data":"Install the \"ssh\" meta-package on the system with the following\ncommand:\n\n# sudo apt install ssh\n\nEnable the \"ssh\" service to start automatically on reboot with the following\ncommand:\n\n# sudo systemctl enable sshd.service"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000423-GPOS-00187","satisfies":["SRG-OS-000423-GPOS-00187","SRG-OS-000424-GPOS-00188","SRG-OS-000425-GPOS-00189","SRG-OS-000426-GPOS-00190"],"gid":"V-75857","rid":"SV-90537r1_rule","stig_id":"UBTU-16-030420","fix_id":"F-82487r1_fix","cci":["CCI-002418","CCI-002420","CCI-002421","CCI-002422"],"nist":["SC-8","SC-8 (2)","SC-8 (1)","SC-8 (2)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75857\" do\n  title \"All networked systems must have and implement SSH to protect the\nconfidentiality and integrity of transmitted and received information, as well\nas information during preparation for transmission.\"\n  desc  \"Without protection of the transmitted information, confidentiality and\nintegrity may be compromised because unprotected communications can be\nintercepted and either read or altered.\n\n    This requirement applies to both internal and external networks and all\ntypes of information system components from which information can be\ntransmitted (e.g., servers, mobile devices, notebook computers, printers,\ncopiers, scanners, and facsimile machines). Communication paths outside the\nphysical protection of a controlled boundary are exposed to the possibility of\ninterception and modification.\n\n    Protecting the confidentiality and integrity of organizational information\ncan be accomplished by physical means (e.g., employing physical distribution\nsystems) or by logical means (e.g., employing cryptographic techniques). If\nphysical means of protection are employed, logical means (cryptography) do not\nhave to be employed, and vice versa.\n\n\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000423-GPOS-00187\"\n  tag \"satisfies\": [\"SRG-OS-000423-GPOS-00187\", \"SRG-OS-000424-GPOS-00188\",\n\"SRG-OS-000425-GPOS-00189\", \"SRG-OS-000426-GPOS-00190\"]\n  tag \"gid\": \"V-75857\"\n  tag \"rid\": \"SV-90537r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030420\"\n  tag \"fix_id\": \"F-82487r1_fix\"\n  tag \"cci\": [\"CCI-002418\", \"CCI-002420\", \"CCI-002421\", \"CCI-002422\"]\n  tag \"nist\": [\"SC-8\", \"SC-8 (2)\", \"SC-8 (1)\", \"SC-8 (2)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the \\\"ssh\\\" meta-package is installed.\n\nCheck that the ssh package is installed with the following command:\n\n$ dpkg -l | grep openssh\n\nii openssh-client 1:7.2p2-4Ubuntu2.1\namd64 secure shell (SSH) client, for secure access to\nremote machines\nii openssh-server 1:7.2p2-4Ubuntu2.1\namd64 secure shell (SSH) server, for secure access\nfrom remote machines\nii openssh-sftp-server 1:7.2p2-4Ubuntu2.1\namd64 secure shell (SSH) sftp server module, for SFTP\naccess from remote machines\n\nIf the \\\"openssh\\\" server package is not installed, this is a finding.\n\nCheck that the \\\"sshd.service\\\" is loaded and active with the following command:\n\n# systemctl status sshd.service | egrep -i \\\"(active|loaded)\\\"\n\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\nActive: active (running) since Sun 2016-06-05 23:46:29 CDT; 1h 4min ago\n\nIf \\\"sshd.service\\\" is not active or loaded, this is a finding.\"\n  desc \"fix\", \"Install the \\\"ssh\\\" meta-package on the system with the following\ncommand:\n\n# sudo apt install ssh\n\nEnable the \\\"ssh\\\" service to start automatically on reboot with the following\ncommand:\n\n# sudo systemctl enable sshd.service\"\n\n  describe package('openssh-server') do\n    it { should be_installed }\n  end\n\n  describe service('sshd') do\n    it { should be_enabled }\n    it { should be_installed }\n    it { should be_running }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75857.rb"},"results":[{"status":"passed","code_desc":"System Package openssh-server should be installed","run_time":0.01555,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Service sshd should be enabled","run_time":0.034073,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Service sshd should be installed","run_time":0.000111,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Service sshd should be running","run_time":6.8e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75585","title":"Kernel core dumps must be disabled unless needed.","desc":"Kernel core dumps may contain the full contents of system memory at\nthe time of the crash. Kernel core dumps may consume a considerable amount of\ndisk space and may result in denial of service by exhausting the available\nspace on the target file system partition.","descriptions":[{"label":"default","data":"Kernel core dumps may contain the full contents of system memory at\nthe time of the crash. Kernel core dumps may consume a considerable amount of\ndisk space and may result in denial of service by exhausting the available\nspace on the target file system partition."},{"label":"check","data":"Verify that kernel core dumps are disabled unless needed.\n\nCheck the status of the \"kdump\" service with the following command:\n\n# systemctl status kdump.service\nLoaded: not-found (Reason: No such file or directory)\nActive: inactive (dead)\n\nIf the \"kdump\" service is active, ask the System Administrator if the use of\nthe service is required and documented with the Information System Security\nOfficer (ISSO).\n\nIf the service is active and is not documented, this is a finding."},{"label":"fix","data":"If kernel core dumps are not required, disable the \"kdump\"\nservice with the following command:\n\n# systemctl disable kdump.service\n\nIf kernel core dumps are required, document the need with the Information\nSystem Security Officer (ISSO)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75585","rid":"SV-90265r1_rule","stig_id":"UBTU-16-010900","fix_id":"F-82213r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75585\" do\n  title \"Kernel core dumps must be disabled unless needed.\"\n  desc  \"Kernel core dumps may contain the full contents of system memory at\nthe time of the crash. Kernel core dumps may consume a considerable amount of\ndisk space and may result in denial of service by exhausting the available\nspace on the target file system partition.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75585\"\n  tag \"rid\": \"SV-90265r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010900\"\n  tag \"fix_id\": \"F-82213r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that kernel core dumps are disabled unless needed.\n\nCheck the status of the \\\"kdump\\\" service with the following command:\n\n# systemctl status kdump.service\nLoaded: not-found (Reason: No such file or directory)\nActive: inactive (dead)\n\nIf the \\\"kdump\\\" service is active, ask the System Administrator if the use of\nthe service is required and documented with the Information System Security\nOfficer (ISSO).\n\nIf the service is active and is not documented, this is a finding.\"\n  desc \"fix\", \"If kernel core dumps are not required, disable the \\\"kdump\\\"\nservice with the following command:\n\n# systemctl disable kdump.service\n\nIf kernel core dumps are required, document the need with the Information\nSystem Security Officer (ISSO).\"\n\nis_kdump_required = input('is_kdump_required')\n  if is_kdump_required\n    describe service('kdump') do\n      it { should be_enabled }\n      it { should be_installed }\n      it { should be_running }\n    end\n  else\n    describe service('kdump') do\n      it { should_not be_enabled }\n      it { should_not be_installed }\n      it { should_not be_running }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75585.rb"},"results":[{"status":"passed","code_desc":"Service kdump should not be enabled","run_time":0.03122,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Service kdump should not be installed","run_time":0.000122,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Service kdump should not be running","run_time":7.5e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75527","title":"Advance package Tool (APT) must be configured to prevent the\ninstallation of patches, service packs, device drivers, or Ubuntu operating\nsystem components without verification they have been digitally signed using a\ncertificate that is recognized and approved by the organization.","desc":"Changes to any software components can have significant effects on the\noverall security of the Ubuntu operating system. This requirement ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor.\n\n    Accordingly, patches, service packs, device drivers, or Ubuntu operating\nsystem components must be signed with a certificate recognized and approved by\nthe organization.\n\n    Verifying the authenticity of the software prior to installation validates\nthe integrity of the patch or upgrade received from a vendor. Setting the\n\"Verify-Peer\" Boolean will determine whether or not the server's host\ncertificate should be verified against trusted certificates. This ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor. Self-signed certificates are disallowed by this requirement. The Ubuntu\noperating system should not have to verify the software again. This requirement\ndoes not mandate DoD certificates for this purpose; however, the certificate\nused to verify the software must be from an approved CA.","descriptions":[{"label":"default","data":"Changes to any software components can have significant effects on the\noverall security of the Ubuntu operating system. This requirement ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor.\n\n    Accordingly, patches, service packs, device drivers, or Ubuntu operating\nsystem components must be signed with a certificate recognized and approved by\nthe organization.\n\n    Verifying the authenticity of the software prior to installation validates\nthe integrity of the patch or upgrade received from a vendor. Setting the\n\"Verify-Peer\" Boolean will determine whether or not the server's host\ncertificate should be verified against trusted certificates. This ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor. Self-signed certificates are disallowed by this requirement. The Ubuntu\noperating system should not have to verify the software again. This requirement\ndoes not mandate DoD certificates for this purpose; however, the certificate\nused to verify the software must be from an approved CA."},{"label":"check","data":"Verify that Advance package Tool (APT) is configured to prevent\nthe installation of patches, service packs, device drivers, or Ubuntu operating\nsystem components without verification they have been digitally signed using a\ncertificate that is recognized and approved by the organization.\n\nCheck that the \"AllowUnauthenticated\" variable is not set at all or set to\n\"false\" with the following command:\n\n# grep -i allowunauth /etc/apt/apt.conf.d/*\n/etc/apt/apt.conf.d/01-vendor-Ubuntu:APT::Get::AllowUnauthenticated \"false\";\n\nIf any of the files returned from the command with \"AllowUnauthenticated\" set\nto \"true\", this is a finding."},{"label":"fix","data":"Configure Advance package Tool (APT) to prevent the installation\nof patches, service packs, device drivers, or Ubuntu operating system\ncomponents without verification they have been digitally signed using a\ncertificate that is recognized and approved by the organization.\n\nRemove/Update any APT configuration file that contain the variable\n\"AllowUnauthenticated\" to \"false\", or remove \"AllowUnauthenticated\"\nentirely from each file. Below is an example of setting the\n\"AllowUnauthenticated\" variable to \"false\":\n\nAPT::Get::AllowUnauthenticated \"false\";"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000366-GPOS-00153","gid":"V-75527","rid":"SV-90207r2_rule","stig_id":"UBTU-16-010560","fix_id":"F-82155r1_fix","cci":["CCI-001749"],"nist":["CM-5 (3)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75527\" do\n  title \"Advance package Tool (APT) must be configured to prevent the\ninstallation of patches, service packs, device drivers, or Ubuntu operating\nsystem components without verification they have been digitally signed using a\ncertificate that is recognized and approved by the organization.\"\n  desc  \"Changes to any software components can have significant effects on the\noverall security of the Ubuntu operating system. This requirement ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor.\n\n    Accordingly, patches, service packs, device drivers, or Ubuntu operating\nsystem components must be signed with a certificate recognized and approved by\nthe organization.\n\n    Verifying the authenticity of the software prior to installation validates\nthe integrity of the patch or upgrade received from a vendor. Setting the\n\\\"Verify-Peer\\\" Boolean will determine whether or not the server's host\ncertificate should be verified against trusted certificates. This ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor. Self-signed certificates are disallowed by this requirement. The Ubuntu\noperating system should not have to verify the software again. This requirement\ndoes not mandate DoD certificates for this purpose; however, the certificate\nused to verify the software must be from an approved CA.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000366-GPOS-00153\"\n  tag \"gid\": \"V-75527\"\n  tag \"rid\": \"SV-90207r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010560\"\n  tag \"fix_id\": \"F-82155r1_fix\"\n  tag \"cci\": [\"CCI-001749\"]\n  tag \"nist\": [\"CM-5 (3)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Advance package Tool (APT) is configured to prevent\nthe installation of patches, service packs, device drivers, or Ubuntu operating\nsystem components without verification they have been digitally signed using a\ncertificate that is recognized and approved by the organization.\n\nCheck that the \\\"AllowUnauthenticated\\\" variable is not set at all or set to\n\\\"false\\\" with the following command:\n\n# grep -i allowunauth /etc/apt/apt.conf.d/*\n/etc/apt/apt.conf.d/01-vendor-Ubuntu:APT::Get::AllowUnauthenticated \\\"false\\\";\n\nIf any of the files returned from the command with \\\"AllowUnauthenticated\\\" set\nto \\\"true\\\", this is a finding.\"\n  desc \"fix\", \"Configure Advance package Tool (APT) to prevent the installation\nof patches, service packs, device drivers, or Ubuntu operating system\ncomponents without verification they have been digitally signed using a\ncertificate that is recognized and approved by the organization.\n\nRemove/Update any APT configuration file that contain the variable\n\\\"AllowUnauthenticated\\\" to \\\"false\\\", or remove \\\"AllowUnauthenticated\\\"\nentirely from each file. Below is an example of setting the\n\\\"AllowUnauthenticated\\\" variable to \\\"false\\\":\n\nAPT::Get::AllowUnauthenticated \\\"false\\\";\"\n\n  describe directory('/etc/apt/apt.conf.d') do\n    it { should exist }\n  end\n\n  apt_allowuanuth = command('grep -i allowunauth /etc/apt/apt.conf.d/*').stdout.strip.split(\"\\n\") \n  if apt_allowuanuth.empty? \n    describe \"apt conf files do not contain AllowUnauthenticated\" do\n      # Do Nothing\n    end\n  else\n    apt_allowuanuth.each do |line|\n      describe \"#{line} contains AllowUnauthenctication\" do\n        subject {line}\n        it {should_not match /.*false.*/ }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75527.rb"},"results":[{"status":"passed","code_desc":"Directory /etc/apt/apt.conf.d should exist","run_time":8.0e-05,"start_time":"2019-08-06T11:13:28-04:00"}]},{"id":"V-75863","title":"All remote access methods must be monitored.","desc":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated monitoring\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Automated monitoring of remote access sessions allows organizations to\ndetect cyber attacks and also ensure ongoing compliance with remote access\npolicies by auditing connection activities of remote access capabilities, such\nas Remote Desktop Protocol (RDP), on a variety of information system components\n(e.g., servers, workstations, notebook computers, smartphones, and tablets).","descriptions":[{"label":"default","data":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated monitoring\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Automated monitoring of remote access sessions allows organizations to\ndetect cyber attacks and also ensure ongoing compliance with remote access\npolicies by auditing connection activities of remote access capabilities, such\nas Remote Desktop Protocol (RDP), on a variety of information system components\n(e.g., servers, workstations, notebook computers, smartphones, and tablets)."},{"label":"check","data":"Verify that the Ubuntu operating system monitors all remote\naccess methods.\n\nCheck that remote access methods are being logged by running the following\ncommand:\n\n# grep -E '(auth.*|authpriv.*|daemon.*)' /etc/rsyslog.d/50-default.conf\n\nauth,authpriv.* /var/log/auth.log\ndaemon.notice /var/log/messages\n\nIf \"auth.*\", \"authpriv.*\" or \"daemon.*\" are not configured to be logged,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to monitor all remote\naccess methods by adding the following lines to the\n\"/etc/rsyslog.d/50-default.conf\" file:\n\nauth.*,authpriv.* /var/log/secure\ndaemon.notice /var/log/messages\n\nThe \"rsyslog\" service must be restarted for the changes to take effect. To\nrestart the \"rsyslog\" service, run the following command:\n\n# sudo systemctl restart rsyslog.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000032-GPOS-00013","gid":"V-75863","rid":"SV-90543r2_rule","stig_id":"UBTU-16-030450","fix_id":"F-82493r2_fix","cci":["CCI-000067"],"nist":["AC-17 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75863\" do\n  title \"All remote access methods must be monitored.\"\n  desc  \"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated monitoring\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Automated monitoring of remote access sessions allows organizations to\ndetect cyber attacks and also ensure ongoing compliance with remote access\npolicies by auditing connection activities of remote access capabilities, such\nas Remote Desktop Protocol (RDP), on a variety of information system components\n(e.g., servers, workstations, notebook computers, smartphones, and tablets).\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000032-GPOS-00013\"\n  tag \"gid\": \"V-75863\"\n  tag \"rid\": \"SV-90543r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030450\"\n  tag \"fix_id\": \"F-82493r2_fix\"\n  tag \"cci\": [\"CCI-000067\"]\n  tag \"nist\": [\"AC-17 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system monitors all remote\naccess methods.\n\nCheck that remote access methods are being logged by running the following\ncommand:\n\n# grep -E '(auth.*|authpriv.*|daemon.*)' /etc/rsyslog.d/50-default.conf\n\nauth,authpriv.* /var/log/auth.log\ndaemon.notice /var/log/messages\n\nIf \\\"auth.*\\\", \\\"authpriv.*\\\" or \\\"daemon.*\\\" are not configured to be logged,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to monitor all remote\naccess methods by adding the following lines to the\n\\\"/etc/rsyslog.d/50-default.conf\\\" file:\n\nauth.*,authpriv.* /var/log/secure\ndaemon.notice /var/log/messages\n\nThe \\\"rsyslog\\\" service must be restarted for the changes to take effect. To\nrestart the \\\"rsyslog\\\" service, run the following command:\n\n# sudo systemctl restart rsyslog.service\"\n\n  options = {\n    assignment_regex: /^\\s*([^:]*?)\\s*\\t\\s*(.*?)\\s*$/\n  }\n  config_file = '/etc/rsyslog.d/50-default.conf'\n  auth_setting = parse_config_file(config_file, options).params['auth,authpriv.*']\n  daemon_setting = parse_config_file(config_file, options).params['daemon.notice']\n  describe auth_setting do\n    it { should_not be_nil }\n    it { should_not be_empty  }\n  end\n  describe daemon_setting do\n    it { should_not be_nil }\n    it { should_not be_empty  }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75863.rb"},"results":[{"status":"passed","code_desc":"/var/log/auth.log should not be nil","run_time":7.3e-05,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"/var/log/auth.log should not be empty","run_time":8.4e-05,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"failed","code_desc":"should not be nil","run_time":7.7e-05,"start_time":"2019-08-06T11:13:28-04:00","message":"expected: not nil\n     got: nil"},{"status":"failed","code_desc":"should not be empty","run_time":0.000184,"start_time":"2019-08-06T11:13:28-04:00","message":"expected nil to respond to `empty?`"}]},{"id":"V-75731","title":"Successful/unsuccessful uses of the fchown command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"fchown\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w fchown /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchown\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75731","rid":"SV-90411r3_rule","stig_id":"UBTU-16-020530","fix_id":"F-82359r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75731\" do\n  title \"Successful/unsuccessful uses of the fchown command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75731\"\n  tag \"rid\": \"SV-90411r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020530\"\n  tag \"fix_id\": \"F-82359r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"fchown\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w fchown /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchown\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"fchown\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75731.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchown\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000142,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchown\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000109,"start_time":"2019-08-06T11:13:28-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75513","title":"All world-writable directories must be group-owned by root, sys, bin,\nor an application group.","desc":"If a world-writable directory has the sticky bit set and is not\ngroup-owned by a privileged Group Identifier (GID), unauthorized users may be\nable to modify files created by others.\n\n    The only authorized public directories are those temporary directories\nsupplied with the system or those designed to be temporary file repositories.\nThe setting is normally reserved for directories used by the system and by\nusers for temporary file storage, (e.g., /tmp), and for directories requiring\nglobal read/write access.","descriptions":[{"label":"default","data":"If a world-writable directory has the sticky bit set and is not\ngroup-owned by a privileged Group Identifier (GID), unauthorized users may be\nable to modify files created by others.\n\n    The only authorized public directories are those temporary directories\nsupplied with the system or those designed to be temporary file repositories.\nThe setting is normally reserved for directories used by the system and by\nusers for temporary file storage, (e.g., /tmp), and for directories requiring\nglobal read/write access."},{"label":"check","data":"Verify that all world-writable directories are group-owned by\nroot to prevent unauthorized and unintended information transferred via shared\nsystem resources.\n\nCheck the system for world-writable directories with the following command:\n\n# sudo find / -type d -perm -0002 -exec ls -lLd {} \\;\n\ndrwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp\n\nIf any world-writable directories are not owned by root, sys, bin, or an\napplication group associated with the directory, this is a finding."},{"label":"fix","data":"Change the group of the world-writable directories to root, sys,\nbin, or an application group with the following command, replacing\n\"[world-writable Directory]\":\n\n# sudo chgrp root [world-writable Directory]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000138-GPOS-00069","gid":"V-75513","rid":"SV-90193r3_rule","stig_id":"UBTU-16-010420","fix_id":"F-82141r2_fix","cci":["CCI-001090"],"nist":["SC-4","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75513\" do\n  title \"All world-writable directories must be group-owned by root, sys, bin,\nor an application group.\"\n  desc  \"If a world-writable directory has the sticky bit set and is not\ngroup-owned by a privileged Group Identifier (GID), unauthorized users may be\nable to modify files created by others.\n\n    The only authorized public directories are those temporary directories\nsupplied with the system or those designed to be temporary file repositories.\nThe setting is normally reserved for directories used by the system and by\nusers for temporary file storage, (e.g., /tmp), and for directories requiring\nglobal read/write access.\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000138-GPOS-00069\"\n  tag \"gid\": \"V-75513\"\n  tag \"rid\": \"SV-90193r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010420\"\n  tag \"fix_id\": \"F-82141r2_fix\"\n  tag \"cci\": [\"CCI-001090\"]\n  tag \"nist\": [\"SC-4\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that all world-writable directories are group-owned by\nroot to prevent unauthorized and unintended information transferred via shared\nsystem resources.\n\nCheck the system for world-writable directories with the following command:\n\n# sudo find / -type d -perm -0002 -exec ls -lLd {} \\\\;\n\ndrwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp\n\nIf any world-writable directories are not owned by root, sys, bin, or an\napplication group associated with the directory, this is a finding.\"\n  desc \"fix\", \"Change the group of the world-writable directories to root, sys,\nbin, or an application group with the following command, replacing\n\\\"[world-writable Directory]\\\":\n\n# sudo chgrp root [world-writable Directory]\"\n\n  application_groups = input('application_groups')\n\n  directories = command(\"sudo find / -type d -perm -0002 -exec ls -Ld {} \\\\;\").stdout.strip.split(\"\\n\").entries\n  if directories.count > 0\n    directories.each do |entry|\n      describe directory(entry) do\n        its('group') { should be_in ['root','sys', 'bin'] + application_groups}\n      end\n    end\n  else\n    describe \"No world-writable directories found\" do\n      skip \"No world-writable directories found on the system\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75513.rb"},"results":[{"status":"passed","code_desc":"Directory /dev/mqueue group should be in \"root\", \"sys\", and \"bin\"","run_time":0.010999,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /dev/shm group should be in \"root\", \"sys\", and \"bin\"","run_time":0.011457,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /var/crash group should be in \"root\", \"sys\", and \"bin\"","run_time":0.009832,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /var/tmp group should be in \"root\", \"sys\", and \"bin\"","run_time":0.008756,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /run/lock group should be in \"root\", \"sys\", and \"bin\"","run_time":0.010783,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /tmp group should be in \"root\", \"sys\", and \"bin\"","run_time":0.015643,"start_time":"2019-08-06T11:13:28-04:00"},{"status":"passed","code_desc":"Directory /tmp/.XIM-unix group should be in \"root\", \"sys\", and \"bin\"","run_time":0.009807,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"Directory /tmp/.ICE-unix group should be in \"root\", \"sys\", and \"bin\"","run_time":0.010221,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"Directory /tmp/.font-unix group should be in \"root\", \"sys\", and \"bin\"","run_time":0.010203,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"Directory /tmp/.X11-unix group should be in \"root\", \"sys\", and \"bin\"","run_time":0.013599,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"Directory /tmp/.Test-unix group should be in \"root\", \"sys\", and \"bin\"","run_time":0.010362,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75453","title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one numeric character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised."},{"label":"check","data":"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one numeric character be used.\n\nDetermine if the field \"dcredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n# grep -i \"dcredit\" /etc/security/pwquality.conf\ndcredit=-1\n\nIf the \"dcredit\" parameter is not equal to \"-1\", or is commented out, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one numeric character be used.\n\nAdd or update the following line in the \"/etc/security/pwquality.conf\" file\nto contain the \"dcredit\" parameter:\n\ndcredit=-1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000071-GPOS-00039","gid":"V-75453","rid":"SV-90133r2_rule","stig_id":"UBTU-16-010120","fix_id":"F-82081r1_fix","cci":["CCI-000194"],"nist":["IA-5 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75453\" do\n  title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one numeric character be used.\"\n  desc  \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000071-GPOS-00039\"\n  tag \"gid\": \"V-75453\"\n  tag \"rid\": \"SV-90133r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010120\"\n  tag \"fix_id\": \"F-82081r1_fix\"\n  tag \"cci\": [\"CCI-000194\"]\n  tag \"nist\": [\"IA-5 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one numeric character be used.\n\nDetermine if the field \\\"dcredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n# grep -i \\\"dcredit\\\" /etc/security/pwquality.conf\ndcredit=-1\n\nIf the \\\"dcredit\\\" parameter is not equal to \\\"-1\\\", or is commented out, this\nis a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one numeric character be used.\n\nAdd or update the following line in the \\\"/etc/security/pwquality.conf\\\" file\nto contain the \\\"dcredit\\\" parameter:\n\ndcredit=-1\"\n\n  min_num_numeric_char = input('min_num_numeric_char')\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n  \n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('ucredit') { should cmp min_num_numeric_char }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75453.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000153,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75793","title":"Successful/unsuccessful uses of the finit_module command must generate\nan audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"finit_module\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w \"finit_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"finit_module\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75793","rid":"SV-90473r3_rule","stig_id":"UBTU-16-020840","fix_id":"F-82423r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75793\" do\n  title \"Successful/unsuccessful uses of the finit_module command must generate\nan audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75793\"\n  tag \"rid\": \"SV-90473r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020840\"\n  tag \"fix_id\": \"F-82423r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"finit_module\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w \\\"finit_module\\\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"finit_module\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"finit_module\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75793.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"finit_module\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000127,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"finit_module\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000141,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75881","title":"The Ubuntu operating system must ignore Internet Protocol version 4\n(IPv4) Internet Control Message Protocol (ICMP) redirect messages.","desc":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages modify the host's route table and are\nunauthenticated. An illicit ICMP redirect message could result in a\nman-in-the-middle attack.","descriptions":[{"label":"default","data":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages modify the host's route table and are\nunauthenticated. An illicit ICMP redirect message could result in a\nman-in-the-middle attack."},{"label":"check","data":"Verify the Ubuntu operating system ignores Internet Protocol\nversion 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.\n\nCheck the value of the \"accept_redirects\" variables with the following\ncommand:\n\n# sudo sysctl net.ipv4.conf.all.accept_redirects\n\nnet.ipv4.conf.all.accept_redirects=0\n\nIf both of the returned lines do not have a value of \"0\", or a line is not\nreturned, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to ignore Internet Protocol\nversion 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages\nwith the following command:\n\n# sudo sysctl -w net.ipv4.conf.all.accept_redirects=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.conf.all.accept_redirects=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75881","rid":"SV-90561r2_rule","stig_id":"UBTU-16-030570","fix_id":"F-82511r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75881\" do\n  title \"The Ubuntu operating system must ignore Internet Protocol version 4\n(IPv4) Internet Control Message Protocol (ICMP) redirect messages.\"\n  desc  \"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages modify the host's route table and are\nunauthenticated. An illicit ICMP redirect message could result in a\nman-in-the-middle attack.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75881\"\n  tag \"rid\": \"SV-90561r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030570\"\n  tag \"fix_id\": \"F-82511r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system ignores Internet Protocol\nversion 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.\n\nCheck the value of the \\\"accept_redirects\\\" variables with the following\ncommand:\n\n# sudo sysctl net.ipv4.conf.all.accept_redirects\n\nnet.ipv4.conf.all.accept_redirects=0\n\nIf both of the returned lines do not have a value of \\\"0\\\", or a line is not\nreturned, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to ignore Internet Protocol\nversion 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages\nwith the following command:\n\n# sudo sysctl -w net.ipv4.conf.all.accept_redirects=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.conf.all.accept_redirects=0\"\n\n  describe kernel_parameter('net.ipv4.conf.all.accept_redirects') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75881.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.conf.all.accept_redirects value should eq 0","run_time":0.00828,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75553","title":"Pluggable Authentication Module (PAM) must prohibit the use of cached\nauthentications after one day.","desc":"If cached authentication information is out-of-date, the validity of\nthe authentication information may be questionable.","descriptions":[{"label":"default","data":"If cached authentication information is out-of-date, the validity of\nthe authentication information may be questionable."},{"label":"check","data":"Verify that Pluggable Authentication Module (PAM) prohibits the\nuse of cached authentications after one day.\n\nNote: If smart card authentication is not being used on the system this item is\nNot Applicable.\n\nCheck that PAM prohibits the use of cached authentications after one day with\nthe following command:\n\n# sudo grep -i \"timestamp_timeout\" /etc/pam.d/*\n\ntimestamp_timeout=86400\n\nIf \"timestamp_timeout\" is not set to a value of \"86400\" or less, or is\ncommented out, this is a finding."},{"label":"fix","data":"Configure Pluggable Authentication Module (PAM) to prohibit the\nuse of cached authentications after one day.\n\nAdd or change the following line in \"/etc/pam.d/common-auth\" or\n\"/etc/pam.d/common-session\" just below the line \"[pam]\".\n\ntimestamp_timeout = 86400"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000383-GPOS-00166","gid":"V-75553","rid":"SV-90233r2_rule","stig_id":"UBTU-16-010690","fix_id":"F-82181r2_fix","cci":["CCI-002007"],"nist":["IA-5 (13)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75553\" do\n  title \"Pluggable Authentication Module (PAM) must prohibit the use of cached\nauthentications after one day.\"\n  desc  \"If cached authentication information is out-of-date, the validity of\nthe authentication information may be questionable.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000383-GPOS-00166\"\n  tag \"gid\": \"V-75553\"\n  tag \"rid\": \"SV-90233r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010690\"\n  tag \"fix_id\": \"F-82181r2_fix\"\n  tag \"cci\": [\"CCI-002007\"]\n  tag \"nist\": [\"IA-5 (13)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Pluggable Authentication Module (PAM) prohibits the\nuse of cached authentications after one day.\n\nNote: If smart card authentication is not being used on the system this item is\nNot Applicable.\n\nCheck that PAM prohibits the use of cached authentications after one day with\nthe following command:\n\n# sudo grep -i \\\"timestamp_timeout\\\" /etc/pam.d/*\n\ntimestamp_timeout=86400\n\nIf \\\"timestamp_timeout\\\" is not set to a value of \\\"86400\\\" or less, or is\ncommented out, this is a finding.\"\n  desc \"fix\", \"Configure Pluggable Authentication Module (PAM) to prohibit the\nuse of cached authentications after one day.\n\nAdd or change the following line in \\\"/etc/pam.d/common-auth\\\" or\n\\\"/etc/pam.d/common-session\\\" just below the line \\\"[pam]\\\".\n\ntimestamp_timeout = 86400\"\n\n  describe.one do\n    describe parse_config_file('/etc/pam.d/common-auth') do\n      its('timestamp_timeout') { should be <= '86400' }\n    end\n\n    describe parse_config_file('/etc/pam.d/common-session') do\n      its('timestamp_timeout') { should be <= '86400' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75553.rb"},"results":[{"status":"failed","code_desc":"Parse Config File /etc/pam.d/common-auth timestamp_timeout should be <= 86400","run_time":0.000167,"start_time":"2019-08-06T11:13:29-04:00","message":"expected: <= \"86400\"\n     got:    nil","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Parse Config File /etc/pam.d/common-session timestamp_timeout should be <= 86400","run_time":9.8e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"expected: <= \"86400\"\n     got:    nil","exception":"RSpec::Core::MultipleExceptionError"}]},{"id":"V-75693","title":"Successful/unsuccessful uses of the chfn command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged password commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged password commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"chfn\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep chfn /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"passwd\" command. Add or update the\nfollowing rule in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75693","rid":"SV-90373r3_rule","stig_id":"UBTU-16-020370","fix_id":"F-82321r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75693\" do\n  title \"Successful/unsuccessful uses of the chfn command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged password commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75693\"\n  tag \"rid\": \"SV-90373r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020370\"\n  tag \"fix_id\": \"F-82321r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"chfn\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep chfn /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"passwd\\\" command. Add or update the\nfollowing rule in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/chfn'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      its('action.uniq') { should eq ['always'] }\n      its('list.uniq') { should eq ['exit'] }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75693.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/chfn exist should equal true","run_time":9.7e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75823","title":"The Ubuntu operating system must enforce SSHv2 for network access to\nall accounts.","desc":"A replay attack may enable an unauthorized user to gain access to the\nUbuntu operating system. Authentication sessions between the authenticator and\nthe Ubuntu operating system validating the user credentials must not be\nvulnerable to a replay attack.\n\n    An authentication process resists replay attacks if it is impractical to\nachieve a successful authentication by recording and replaying a previous\nauthentication message.\n\n    A privileged account is any information system account with authorizations\nof a privileged user.\n\n    Techniques used to address this include protocols using nonces (e.g.,\nnumbers generated for a specific one-time use) or challenges (e.g., TLS,\nWS_Security). Additional techniques include time-synchronous or\nchallenge-response one-time authenticators.","descriptions":[{"label":"default","data":"A replay attack may enable an unauthorized user to gain access to the\nUbuntu operating system. Authentication sessions between the authenticator and\nthe Ubuntu operating system validating the user credentials must not be\nvulnerable to a replay attack.\n\n    An authentication process resists replay attacks if it is impractical to\nachieve a successful authentication by recording and replaying a previous\nauthentication message.\n\n    A privileged account is any information system account with authorizations\nof a privileged user.\n\n    Techniques used to address this include protocols using nonces (e.g.,\nnumbers generated for a specific one-time use) or challenges (e.g., TLS,\nWS_Security). Additional techniques include time-synchronous or\nchallenge-response one-time authenticators."},{"label":"check","data":"Verify that the Ubuntu operating system enforces SSH protocol 2\nfor network access.\n\nCheck the protocol versions that SSH allows with the following command:\n\n#grep -i protocol /etc/ssh/sshd_config\n\nProtocol 2\n\nIf the returned line allows for use of protocol \"1\", is commented out, or the\nline is missing, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce SSHv2 for\nnetwork access to all accounts.\n\nAdd or update the following line in the \"/etc/ssh/sshd_config\" file:\n\nProtocol 2\n\nRestart the ssh service.\n\n# systemctl restart sshd.service"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000112-GPOS-00057","satisfies":["SRG-OS-000112-GPOS-00057","SRG-OS-000113-GPOS-00058"],"gid":"V-75823","rid":"SV-90503r1_rule","stig_id":"UBTU-16-030200","fix_id":"F-82453r1_fix","cci":["CCI-001941","CCI-001942"],"nist":["IA-2 (8)","IA-2 (9)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75823\" do\n  title \"The Ubuntu operating system must enforce SSHv2 for network access to\nall accounts.\"\n  desc  \"A replay attack may enable an unauthorized user to gain access to the\nUbuntu operating system. Authentication sessions between the authenticator and\nthe Ubuntu operating system validating the user credentials must not be\nvulnerable to a replay attack.\n\n    An authentication process resists replay attacks if it is impractical to\nachieve a successful authentication by recording and replaying a previous\nauthentication message.\n\n    A privileged account is any information system account with authorizations\nof a privileged user.\n\n    Techniques used to address this include protocols using nonces (e.g.,\nnumbers generated for a specific one-time use) or challenges (e.g., TLS,\nWS_Security). Additional techniques include time-synchronous or\nchallenge-response one-time authenticators.\n\n\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000112-GPOS-00057\"\n  tag \"satisfies\": [\"SRG-OS-000112-GPOS-00057\", \"SRG-OS-000113-GPOS-00058\"]\n  tag \"gid\": \"V-75823\"\n  tag \"rid\": \"SV-90503r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030200\"\n  tag \"fix_id\": \"F-82453r1_fix\"\n  tag \"cci\": [\"CCI-001941\", \"CCI-001942\"]\n  tag \"nist\": [\"IA-2 (8)\", \"IA-2 (9)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system enforces SSH protocol 2\nfor network access.\n\nCheck the protocol versions that SSH allows with the following command:\n\n#grep -i protocol /etc/ssh/sshd_config\n\nProtocol 2\n\nIf the returned line allows for use of protocol \\\"1\\\", is commented out, or the\nline is missing, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce SSHv2 for\nnetwork access to all accounts.\n\nAdd or update the following line in the \\\"/etc/ssh/sshd_config\\\" file:\n\nProtocol 2\n\nRestart the ssh service.\n\n# systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('Protocol') { should cmp 2 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75823.rb"},"results":[{"status":"passed","code_desc":"SSHD Configuration Protocol should cmp == 2","run_time":0.000407,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75771","title":"Successful/unsuccessful modifications to the tallylog file must\ngenerate an audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful modifications to the \"tallylog\" file occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w tallylog /etc/audit/audit.rules\n\n-w /var/log/tallylog -p wa -k logins\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \"tallylog\" file occur.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-w /var/log/tallylog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215","SRG-OS-000473-GPOS-00218"],"gid":"V-75771","rid":"SV-90451r3_rule","stig_id":"UBTU-16-020730","fix_id":"F-82399r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75771\" do\n  title \"Successful/unsuccessful modifications to the tallylog file must\ngenerate an audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000473-GPOS-00218\"]\n  tag \"gid\": \"V-75771\"\n  tag \"rid\": \"SV-90451r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020730\"\n  tag \"fix_id\": \"F-82399r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful modifications to the \\\"tallylog\\\" file occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w tallylog /etc/audit/audit.rules\n\n-w /var/log/tallylog -p wa -k logins\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \\\"tallylog\\\" file occur.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-w /var/log/tallylog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/var/log/tallylog'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75771.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /var/log/tallylog exist should equal true","run_time":8.7e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75631","title":"The audit system must take appropriate action when audit storage is\nfull.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity."},{"label":"check","data":"Verify the action that the audit system takes when the storage\nvolume becomes full.\n\nCheck the action that the audit system takes when the storage volume becomes\nfull with the following command:\n\n# sudo grep disk_full /etc/audisp/audisp-remote.conf\n\ndisk_full_action = single\n\nIf the value of the \"disk_full_action\" option is not \"syslog\", \"single\",\nor \"halt\", or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the audit system to take an appropriate action when the\naudit storage is full.\n\nAdd, edit or uncomment the \"disk_full_action\" option in\n\"/etc/audisp/audisp-remote.conf\". Set it to \"syslog\", \"single\" or\n\"halt\" like the below example:\n\ndisk_full_action = single"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000479-GPOS-00224","gid":"V-75631","rid":"SV-90311r1_rule","stig_id":"UBTU-16-020070","fix_id":"F-82259r1_fix","cci":["CCI-001851"],"nist":["AU-4 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75631\" do\n  title \"The audit system must take appropriate action when audit storage is\nfull.\"\n  desc  \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000479-GPOS-00224\"\n  tag \"gid\": \"V-75631\"\n  tag \"rid\": \"SV-90311r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020070\"\n  tag \"fix_id\": \"F-82259r1_fix\"\n  tag \"cci\": [\"CCI-001851\"]\n  tag \"nist\": [\"AU-4 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the action that the audit system takes when the storage\nvolume becomes full.\n\nCheck the action that the audit system takes when the storage volume becomes\nfull with the following command:\n\n# sudo grep disk_full /etc/audisp/audisp-remote.conf\n\ndisk_full_action = single\n\nIf the value of the \\\"disk_full_action\\\" option is not \\\"syslog\\\", \\\"single\\\",\nor \\\"halt\\\", or the line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the audit system to take an appropriate action when the\naudit storage is full.\n\nAdd, edit or uncomment the \\\"disk_full_action\\\" option in\n\\\"/etc/audisp/audisp-remote.conf\\\". Set it to \\\"syslog\\\", \\\"single\\\" or\n\\\"halt\\\" like the below example:\n\ndisk_full_action = single\"\n\n  config_file_exists = file('/etc/audisp/audisp-remote.conf').exist?\n\n  if config_file_exists\n    describe auditd_conf('/etc/audisp/audisp-remote.conf') do\n      its('disk_full_action') { should_not be_empty }\n      its('disk_full_action') { should cmp %r((?:SYSLOG|SINGLE|HALT))i }\n    end\n  else\n    describe \"/etc/audisp/audisp-remote.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75631.rb"},"results":[{"status":"failed","code_desc":"/etc/audisp/audisp-remote.conf exists should equal true","run_time":7.9e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75567","title":"All local interactive user home directories must be group-owned by the\nhome directory owners primary group.","desc":"If the Group Identifier (GID) of a local interactive user’s home\ndirectory is not the same as the primary GID of the user, this would allow\nunauthorized access to the user’s files, and users that share the same group\nmay not be able to access files that they legitimately should.","descriptions":[{"label":"default","data":"If the Group Identifier (GID) of a local interactive user’s home\ndirectory is not the same as the primary GID of the user, this would allow\nunauthorized access to the user’s files, and users that share the same group\nmay not be able to access files that they legitimately should."},{"label":"check","data":"Verify the assigned home directory of all local interactive\nusers is group-owned by that user’s primary Group Identifier (GID).\n\nCheck the home directory assignment for all non-privileged users on the system\nwith the following command:\n\nNote: This may miss local interactive users that have been assigned a\nprivileged UID. Evidence of interactive use may be obtained from a number of\nlog files containing system logon information. The returned directory\n\"/home/smithj\" is used as an example.\n\n# ls -ld $(awk -F: '($3>=1000)&&($1!=\"nobody\"){print $6}' /etc/passwd)\n\ndrwxr-x--- 2 smithj admin 4096 Jun 5 12:41 smithj\n\nCheck the user's primary group with the following command:\n\n# grep admin /etc/group\nadmin:x:250:smithj,jonesj,jacksons\n\nIf the user home directory referenced in \"/etc/passwd\" is not group-owned by\nthat user’s primary GID, this is a finding."},{"label":"fix","data":"Change the group owner of a local interactive user’s home\ndirectory to the group found in \"/etc/passwd\". To change the group owner of a\nlocal interactive user’s home directory, use the following command:\n\nNote: The example will be for the user \"smithj\", who has a home directory of\n\"/home/smithj\", and has a primary group of users.\n\n# chgrp users /home/smithj"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75567","rid":"SV-90247r1_rule","stig_id":"UBTU-16-010760","fix_id":"F-82195r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75567\" do\n  title \"All local interactive user home directories must be group-owned by the\nhome directory owners primary group.\"\n  desc  \"If the Group Identifier (GID) of a local interactive user’s home\ndirectory is not the same as the primary GID of the user, this would allow\nunauthorized access to the user’s files, and users that share the same group\nmay not be able to access files that they legitimately should.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75567\"\n  tag \"rid\": \"SV-90247r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010760\"\n  tag \"fix_id\": \"F-82195r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the assigned home directory of all local interactive\nusers is group-owned by that user’s primary Group Identifier (GID).\n\nCheck the home directory assignment for all non-privileged users on the system\nwith the following command:\n\nNote: This may miss local interactive users that have been assigned a\nprivileged UID. Evidence of interactive use may be obtained from a number of\nlog files containing system logon information. The returned directory\n\\\"/home/smithj\\\" is used as an example.\n\n# ls -ld $(awk -F: '($3>=1000)&&($1!=\\\"nobody\\\"){print $6}' /etc/passwd)\n\ndrwxr-x--- 2 smithj admin 4096 Jun 5 12:41 smithj\n\nCheck the user's primary group with the following command:\n\n# grep admin /etc/group\nadmin:x:250:smithj,jonesj,jacksons\n\nIf the user home directory referenced in \\\"/etc/passwd\\\" is not group-owned by\nthat user’s primary GID, this is a finding.\"\n  desc \"fix\", \"Change the group owner of a local interactive user’s home\ndirectory to the group found in \\\"/etc/passwd\\\". To change the group owner of a\nlocal interactive user’s home directory, use the following command:\n\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of\n\\\"/home/smithj\\\", and has a primary group of users.\n\n# chgrp users /home/smithj\"\n\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n\n  findings = Set[]\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries.each do |user_info|\n    next if exempt_home_users.include?(\"#{user_info.username}\")\n    findings = findings + command(\"find #{user_info.home} -maxdepth 0 -not -gid #{user_info.gid}\").stdout.split(\"\\n\")\n  end\n  describe \"Home directories that are not group-owned by the user's primary GID\" do\n    subject { findings.to_a }\n    it { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75567.rb"},"results":[{"status":"passed","code_desc":"Home directories that are not group-owned by the user's primary GID should be empty","run_time":8.9e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75605","title":"Library files must have mode 0755 or less permissive.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":[{"label":"default","data":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications."},{"label":"check","data":"Verify the system-wide shared library files contained in the\nfollowing directories have mode \"0755\" or less permissive.\n\nCheck that the system-wide shared library files contained in the following\ndirectories have mode \"0755\" or less permissive with the following command:\n\nNote: Replace \"[directory]\" with one of the following paths:\n/lib\n/lib64\n/usr/lib\n\n# find /lib /lib64 /usr/lib -perm /022 -type f | xargs ls -la\n/usr/lib64/pkcs11-spy.so\n\nIf any system-wide shared library file is found to be group-writable or\nworld-writable, this is a finding."},{"label":"fix","data":"Configure the library files to be protected from unauthorized\naccess. Run the following command, replacing \"[file]\" with any library file\nwith a mode more permissive than 0755.\n\n# sudo chmod 0755 [file]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-75605","rid":"SV-90285r2_rule","stig_id":"UBTU-16-011000","fix_id":"F-82233r1_fix","cci":["CCI-001499"],"nist":["CM-5 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75605\" do\n  title \"Library files must have mode 0755 or less permissive.\"\n  desc  \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000259-GPOS-00100\"\n  tag \"gid\": \"V-75605\"\n  tag \"rid\": \"SV-90285r2_rule\"\n  tag \"stig_id\": \"UBTU-16-011000\"\n  tag \"fix_id\": \"F-82233r1_fix\"\n  tag \"cci\": [\"CCI-001499\"]\n  tag \"nist\": [\"CM-5 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system-wide shared library files contained in the\nfollowing directories have mode \\\"0755\\\" or less permissive.\n\nCheck that the system-wide shared library files contained in the following\ndirectories have mode \\\"0755\\\" or less permissive with the following command:\n\nNote: Replace \\\"[directory]\\\" with one of the following paths:\n/lib\n/lib64\n/usr/lib\n\n# find /lib /lib64 /usr/lib -perm /022 -type f | xargs ls -la\n/usr/lib64/pkcs11-spy.so\n\nIf any system-wide shared library file is found to be group-writable or\nworld-writable, this is a finding.\"\n  desc \"fix\", \"Configure the library files to be protected from unauthorized\naccess. Run the following command, replacing \\\"[file]\\\" with any library file\nwith a mode more permissive than 0755.\n\n# sudo chmod 0755 [file]\"\n\n  library_files = command('find /lib /lib64 /usr/lib -perm /022 -type f').stdout.strip.split(\"\\n\").entries\n\n  if library_files.count > 0\n    library_files.each do |lib_file|\n      describe file(lib_file) do\n        it { should_not be_more_permissive_than('0755') }\n      end\n    end\n  else\n    describe \"Number of system-wide shared library files found in /lib, /lib64, or /usr/lib, that are less permissive than 0755\" do\n      subject { library_files }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75605.rb"},"results":[{"status":"passed","code_desc":"Number of system-wide shared library files found in /lib, /lib64, or /usr/lib, that are less permissive than 0755 count should eq 0","run_time":6.6e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75745","title":"Successful/unsuccessful uses of the truncate command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"truncate\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw truncate /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"truncate\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75745","rid":"SV-90425r3_rule","stig_id":"UBTU-16-020600","fix_id":"F-82373r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75745\" do\n  title \"Successful/unsuccessful uses of the truncate command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75745\"\n  tag \"rid\": \"SV-90425r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020600\"\n  tag \"fix_id\": \"F-82373r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"truncate\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw truncate /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"truncate\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"truncate\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EPERM' }\n  end\n  describe auditd.syscall(\"truncate\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EACCES' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75745.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"truncate\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000115,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"truncate\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":9.9e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"truncate\" arch == \"b64\" exit.uniq should include \"-EPERM\"","run_time":0.00012,"start_time":"2019-08-06T11:13:29-04:00","message":"expected [] to include \"-EPERM\""},{"status":"failed","code_desc":"Auditd Rules with syscall == \"truncate\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000101,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"truncate\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":9.5e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"truncate\" arch == \"b64\" exit.uniq should include \"-EACCES\"","run_time":0.000107,"start_time":"2019-08-06T11:13:29-04:00","message":"expected [] to include \"-EACCES\""}]},{"id":"V-75817","title":"The Ubuntu operating system must record time stamps for audit records\nthat can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time\n(GMT).","desc":"If time stamps are not consistently applied and there is no common\ntime reference, it is difficult to perform forensic analysis.\n\n    Time stamps generated by the Ubuntu operating system include date and time.\nTime is commonly expressed in Coordinated Universal Time (UTC), a modern\ncontinuation of Greenwich Mean Time (GMT), or local time with an offset from\nUTC.","descriptions":[{"label":"default","data":"If time stamps are not consistently applied and there is no common\ntime reference, it is difficult to perform forensic analysis.\n\n    Time stamps generated by the Ubuntu operating system include date and time.\nTime is commonly expressed in Coordinated Universal Time (UTC), a modern\ncontinuation of Greenwich Mean Time (GMT), or local time with an offset from\nUTC."},{"label":"check","data":"The time zone must be configured to use Coordinated Universal\nTime (UTC) or Greenwich Mean Time (GMT). To verify run the following command.\n\n# sudo timedatectl status | grep -i \"time zone\"\nTime zone: UTC (UTC, +0000)\n\nIf \"Time zone\" is not set to UTC or GMT, this is a finding."},{"label":"fix","data":"To configure the system time zone to use Coordinated Universal\nTime (UTC) or Greenwich Mean Time (GMT), run the following command replacing\n[ZONE] with UTC or GMT.\n\n# sudo timedatectl set-timezone [ZONE]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000359-GPOS-00146","gid":"V-75817","rid":"SV-90497r2_rule","stig_id":"UBTU-16-030120","fix_id":"F-82447r1_fix","cci":["CCI-001890"],"nist":["AU-8 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75817\" do\n  title \"The Ubuntu operating system must record time stamps for audit records\nthat can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time\n(GMT).\"\n  desc  \"If time stamps are not consistently applied and there is no common\ntime reference, it is difficult to perform forensic analysis.\n\n    Time stamps generated by the Ubuntu operating system include date and time.\nTime is commonly expressed in Coordinated Universal Time (UTC), a modern\ncontinuation of Greenwich Mean Time (GMT), or local time with an offset from\nUTC.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000359-GPOS-00146\"\n  tag \"gid\": \"V-75817\"\n  tag \"rid\": \"SV-90497r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030120\"\n  tag \"fix_id\": \"F-82447r1_fix\"\n  tag \"cci\": [\"CCI-001890\"]\n  tag \"nist\": [\"AU-8 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"The time zone must be configured to use Coordinated Universal\nTime (UTC) or Greenwich Mean Time (GMT). To verify run the following command.\n\n# sudo timedatectl status | grep -i \\\"time zone\\\"\nTime zone: UTC (UTC, +0000)\n\nIf \\\"Time zone\\\" is not set to UTC or GMT, this is a finding.\"\n  desc \"fix\", \"To configure the system time zone to use Coordinated Universal\nTime (UTC) or Greenwich Mean Time (GMT), run the following command replacing\n[ZONE] with UTC or GMT.\n\n# sudo timedatectl set-timezone [ZONE]\"\n\n  time_zone = command('timedatectl status | grep -i \"time zone\"').stdout.strip\n\n  describe time_zone do\n    it { should match 'UTC' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75817.rb"},"results":[{"status":"passed","code_desc":"Time zone: Etc/UTC (UTC, +0000) should match \"UTC\"","run_time":6.7e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75485","title":"Account identifiers (individuals, groups, roles, and devices) must\ndisabled after 35 days of inactivity.","desc":"Inactive identifiers pose a risk to systems and applications because\nattackers may exploit an inactive identifier and potentially obtain undetected\naccess to the system. Owners of inactive accounts will not notice if\nunauthorized access to their user account has been obtained.\n\n    Ubuntu operating systems need to track periods of inactivity and disable\napplication identifiers after 35 days of inactivity.","descriptions":[{"label":"default","data":"Inactive identifiers pose a risk to systems and applications because\nattackers may exploit an inactive identifier and potentially obtain undetected\naccess to the system. Owners of inactive accounts will not notice if\nunauthorized access to their user account has been obtained.\n\n    Ubuntu operating systems need to track periods of inactivity and disable\napplication identifiers after 35 days of inactivity."},{"label":"check","data":"Verify the account identifiers (individuals, groups, roles, and\ndevices) are disabled after \"35\" days of inactivity with the following\ncommand:\n\nCheck the account inactivity value by performing the following command:\n\n# sudo grep -i inactive /etc/default/useradd\n\nINACTIVE=35\n\nIf \"INACTIVE\" is not set to a value \"0<[VALUE]<=35\", or is commented out,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to disable account\nidentifiers after 35 days of inactivity after the password expiration.\n\nRun the following command to change the configuration for useradd:\n\n# sudo useradd -D -f 35\n\nDoD recommendation is 35 days, but a lower value is acceptable. The value\n\"-1\" will disable this feature, and \"0\" will disable the account\nimmediately after the password expires."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000118-GPOS-00060","gid":"V-75485","rid":"SV-90165r3_rule","stig_id":"UBTU-16-010280","fix_id":"F-82113r1_fix","cci":["CCI-000795"],"nist":["IA-4 e","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75485\" do\n  title \"Account identifiers (individuals, groups, roles, and devices) must\ndisabled after 35 days of inactivity.\"\n  desc  \"Inactive identifiers pose a risk to systems and applications because\nattackers may exploit an inactive identifier and potentially obtain undetected\naccess to the system. Owners of inactive accounts will not notice if\nunauthorized access to their user account has been obtained.\n\n    Ubuntu operating systems need to track periods of inactivity and disable\napplication identifiers after 35 days of inactivity.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000118-GPOS-00060\"\n  tag \"gid\": \"V-75485\"\n  tag \"rid\": \"SV-90165r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010280\"\n  tag \"fix_id\": \"F-82113r1_fix\"\n  tag \"cci\": [\"CCI-000795\"]\n  tag \"nist\": [\"IA-4 e\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the account identifiers (individuals, groups, roles, and\ndevices) are disabled after \\\"35\\\" days of inactivity with the following\ncommand:\n\nCheck the account inactivity value by performing the following command:\n\n# sudo grep -i inactive /etc/default/useradd\n\nINACTIVE=35\n\nIf \\\"INACTIVE\\\" is not set to a value \\\"0<[VALUE]<=35\\\", or is commented out,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to disable account\nidentifiers after 35 days of inactivity after the password expiration.\n\nRun the following command to change the configuration for useradd:\n\n# sudo useradd -D -f 35\n\nDoD recommendation is 35 days, but a lower value is acceptable. The value\n\\\"-1\\\" will disable this feature, and \\\"0\\\" will disable the account\nimmediately after the password expires.\"\n\n  max_account_inactive_days = input('max_account_inactive_days')\n  config_file = '/etc/default/useradd'\n  config_file_exists = file(config_file).exist?\n  \n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('INACTIVE') { should cmp > '0' }\n      its('INACTIVE') { should cmp <= max_account_inactive_days }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75485.rb"},"results":[{"status":"failed","code_desc":"Parse Config File /etc/default/useradd INACTIVE should cmp > \"0\"","run_time":0.000146,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected it to be > \"0\"\n     got: nil\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"Parse Config File /etc/default/useradd INACTIVE should cmp <= 35","run_time":0.000127,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected it to be <= 35\n     got: nil\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-80965","title":"The audit records must be off-loaded onto a different system or\nstorage media from the system being audited.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity."},{"label":"check","data":"Verify the audit system off-loads audit records to a different\nsystem or storage media from the system being audited.\n\nCheck that the records are being off-loaded to a remote server with the\nfollowing command:\n\n# sudo grep -i remote_server /etc/audisp/audisp-remote.conf\n\nremote_server = 10.0.1.2\n\nIf \"remote_server\" is not configured, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to off-load audit records to a\ndifferent system or storage media from the system being audited.\n\nSet the \"remote_server\" option in \"/etc/audisp/audisp-remote.conf\" with the\nIP address of the log server. See the example below.\n\nremote_server = 10.0.1.2\n\nIn order for the changes to take effect, the audit daemon must be restarted.\nThe audit daemon can be restarted with the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000342-GPOS-00133","gid":"V-80965","rid":"SV-95677r1_rule","stig_id":"UBTU-16-020220","fix_id":"F-87825r1_fix","cci":["CCI-001851"],"nist":["AU-4 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-80965\" do\n  title \"The audit records must be off-loaded onto a different system or\nstorage media from the system being audited.\"\n  desc  \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000342-GPOS-00133\"\n  tag \"gid\": \"V-80965\"\n  tag \"rid\": \"SV-95677r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020220\"\n  tag \"fix_id\": \"F-87825r1_fix\"\n  tag \"cci\": [\"CCI-001851\"]\n  tag \"nist\": [\"AU-4 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit system off-loads audit records to a different\nsystem or storage media from the system being audited.\n\nCheck that the records are being off-loaded to a remote server with the\nfollowing command:\n\n# sudo grep -i remote_server /etc/audisp/audisp-remote.conf\n\nremote_server = 10.0.1.2\n\nIf \\\"remote_server\\\" is not configured, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to off-load audit records to a\ndifferent system or storage media from the system being audited.\n\nSet the \\\"remote_server\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" with the\nIP address of the log server. See the example below.\n\nremote_server = 10.0.1.2\n\nIn order for the changes to take effect, the audit daemon must be restarted.\nThe audit daemon can be restarted with the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  config_file_exists = file('/etc/audisp/audisp-remote.conf').exist?\n\n  if config_file_exists\n    describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n      its('remote_server') { should match /./ }\n    end\n  else\n    describe \"/etc/audisp/audisp-remote.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-80965.rb"},"results":[{"status":"failed","code_desc":"/etc/audisp/audisp-remote.conf exists should equal true","run_time":8.8e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75807","title":"An application firewall must employ a deny-all, allow-by-exception\npolicy for allowing connections to other systems.","desc":"Failure to restrict network connectivity only to authorized systems\npermits inbound connections from malicious systems. It also permits outbound\nconnections that may facilitate exfiltration of DoD data.","descriptions":[{"label":"default","data":"Failure to restrict network connectivity only to authorized systems\npermits inbound connections from malicious systems. It also permits outbound\nconnections that may facilitate exfiltration of DoD data."},{"label":"check","data":"Verify the Uncomplicated Firewall is configured to employ a\ndeny-all, allow-by-exception policy for allowing connections to other systems.\n\nCheck the Uncomplicated Firewall configuration with the following command:\n# sudo ufw status\nStatus: active\n\n     To                         Action      From\n     --                         ------      ----\n[ 1] 22                         LIMIT IN    Anywhere\n\nIf any services, ports, or applications are \"allowed\" and are not documented\nwith the organization, this is a finding."},{"label":"fix","data":"Configure the Uncomplicated Firewall to employ a deny-all,\nallow-by-exception policy for allowing connections to other systems.\n\nRemove any service that is not needed or documented by the organization with\nthe following command (replace [NUMBER] with the rule number):\n\n# sudo ufw delete [NUMBER]\n\nAnother option would be to set the Uncomplicated Firewall back to default with\nthe following commands:\n\n# sudo ufw default deny incoming\n# sudo ufw default allow outgoing\n\nNote: UFW’s defaults are to deny all incoming connections and allow all\noutgoing connections."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000297-GPOS-00115","satisfies":["SRG-OS-000297-GPOS-00115","SRG-OS-000480-GPOS-00231"],"gid":"V-75807","rid":"SV-90487r2_rule","stig_id":"UBTU-16-030050","fix_id":"F-82437r1_fix","cci":["CCI-000366","CCI-002080","CCI-002314"],"nist":["CM-6 b","CA-3 (5)","AC-17 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75807\" do\n  title \"An application firewall must employ a deny-all, allow-by-exception\npolicy for allowing connections to other systems.\"\n  desc  \"Failure to restrict network connectivity only to authorized systems\npermits inbound connections from malicious systems. It also permits outbound\nconnections that may facilitate exfiltration of DoD data.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000297-GPOS-00115\"\n  tag \"satisfies\": [\"SRG-OS-000297-GPOS-00115\", \"SRG-OS-000480-GPOS-00231\"]\n  tag \"gid\": \"V-75807\"\n  tag \"rid\": \"SV-90487r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030050\"\n  tag \"fix_id\": \"F-82437r1_fix\"\n  tag \"cci\": [\"CCI-000366\", \"CCI-002080\", \"CCI-002314\"]\n  tag \"nist\": [\"CM-6 b\", \"CA-3 (5)\", \"AC-17 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Uncomplicated Firewall is configured to employ a\ndeny-all, allow-by-exception policy for allowing connections to other systems.\n\nCheck the Uncomplicated Firewall configuration with the following command:\n# sudo ufw status\nStatus: active\n\n     To                         Action      From\n     --                         ------      ----\n[ 1] 22                         LIMIT IN    Anywhere\n\nIf any services, ports, or applications are \\\"allowed\\\" and are not documented\nwith the organization, this is a finding.\"\n  desc \"fix\", \"Configure the Uncomplicated Firewall to employ a deny-all,\nallow-by-exception policy for allowing connections to other systems.\n\nRemove any service that is not needed or documented by the organization with\nthe following command (replace [NUMBER] with the rule number):\n\n# sudo ufw delete [NUMBER]\n\nAnother option would be to set the Uncomplicated Firewall back to default with\nthe following commands:\n\n# sudo ufw default deny incoming\n# sudo ufw default allow outgoing\n\nNote: UFW’s defaults are to deny all incoming connections and allow all\noutgoing connections.\"\n\n  ufw_status = command('ufw status').stdout.strip.lines.first\n  key, value = ufw_status.split \": \",2\n\n  describe \"UFW status\" do\n    subject { value }\n    it { should cmp 'active' }\n  end\n  describe \"Status listings for any allowed services, ports, or applications must be documented with the organization\" do\n    skip \"Status listings checks must be preformed manually\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75807.rb"},"results":[{"status":"failed","code_desc":"UFW status should cmp == \"active\"","run_time":0.000148,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"active\"\n     got: \"inactive\"\n\n(compared using `cmp` matcher)\n"},{"status":"skipped","code_desc":"Status listings for any allowed services, ports, or applications must be documented with the organization","run_time":4.0e-06,"start_time":"2019-08-06T11:13:29-04:00","resource":"","skip_message":"Status listings checks must be preformed manually"}]},{"id":"V-75495","title":"Unattended or automatic login via the GUI must not be allowed.","desc":"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.","descriptions":[{"label":"default","data":"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security."},{"label":"check","data":"Verify that unattended or automatic login via the GUI is\ndisabled.\n\nCheck that unattended or automatic login is disabled with the following command:\n\n# sudo grep -i automaticloginenable /etc/gdm3/custom.conf\n\nAutomaticLoginEnable=false\n\nIf the \"AutomaticLoginEnable\" parameter is not set to \"false\", or is\ncommented out, this is a finding."},{"label":"fix","data":"Configure the GUI to not allow unattended or automatic login to\nthe system.\n\nAdd or edit the following line in the \"/etc/gdm3/custom.conf\" file directly\nbelow the \"[daemon]\" tag:\n\nAutomaticLoginEnable=false"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-75495","rid":"SV-90175r2_rule","stig_id":"UBTU-16-010330","fix_id":"F-82123r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75495\" do\n  title \"Unattended or automatic login via the GUI must not be allowed.\"\n  desc  \"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00229\"\n  tag \"gid\": \"V-75495\"\n  tag \"rid\": \"SV-90175r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010330\"\n  tag \"fix_id\": \"F-82123r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that unattended or automatic login via the GUI is\ndisabled.\n\nCheck that unattended or automatic login is disabled with the following command:\n\n# sudo grep -i automaticloginenable /etc/gdm3/custom.conf\n\nAutomaticLoginEnable=false\n\nIf the \\\"AutomaticLoginEnable\\\" parameter is not set to \\\"false\\\", or is\ncommented out, this is a finding.\"\n  desc \"fix\", \"Configure the GUI to not allow unattended or automatic login to\nthe system.\n\nAdd or edit the following line in the \\\"/etc/gdm3/custom.conf\\\" file directly\nbelow the \\\"[daemon]\\\" tag:\n\nAutomaticLoginEnable=false\"\n\ngnome_installed = (package('ubuntu-gnome-desktop').installed? || package('ubuntu-desktop').installed?)\n\n  if gnome_installed\n    describe parse_config_file('/etc/gdm3/custom.conf') do\n      its('AutomaticLoginEnable') { should cmp 'false' }\n    end\n  else\n    describe \"Not Applicable as GNOME dekstop environment is installed\" do\n      subject { gnome_installed }\n      it { should be false }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75495.rb"},"results":[{"status":"passed","code_desc":"Not Applicable as GNOME dekstop environment is installed should equal false","run_time":6.7e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75755","title":"Successful/unsuccessful uses of the sudo command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"sudo\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w sudo /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"sudo\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75755","rid":"SV-90435r3_rule","stig_id":"UBTU-16-020650","fix_id":"F-82383r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75755\" do\n  title \"Successful/unsuccessful uses of the sudo command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75755\"\n  tag \"rid\": \"SV-90435r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020650\"\n  tag \"fix_id\": \"F-82383r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"sudo\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w sudo /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"sudo\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"  \n\n  @audit_file = '/usr/bin/sudo'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75755.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/sudo exist should equal true","run_time":8.3e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75615","title":"System commands must be group-owned by root.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":[{"label":"default","data":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications."},{"label":"check","data":"Verify the system commands contained in the following\ndirectories are group-owned by \"root\".\n\nCheck that the system command files contained in the following directories are\ngroup-owned by \"root\" with the following command:\n\n# sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root | xargs ls -la\n\nIf the command returns any files that are not group-owned by \"root\", and if\nthey are not SGID and owned by a privileged group, this is a finding."},{"label":"fix","data":"Configure the system commands to be protected from unauthorized\naccess.\n\nRun the following command, replacing \"[FILE]\" with any system command file\nnot group-owned by \"root\".\n\n# sudo chgrp root [FILE]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-75615","rid":"SV-90295r2_rule","stig_id":"UBTU-16-011050","fix_id":"F-82243r2_fix","cci":["CCI-001499"],"nist":["CM-5 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75615\" do\n  title \"System commands must be group-owned by root.\"\n  desc  \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000259-GPOS-00100\"\n  tag \"gid\": \"V-75615\"\n  tag \"rid\": \"SV-90295r2_rule\"\n  tag \"stig_id\": \"UBTU-16-011050\"\n  tag \"fix_id\": \"F-82243r2_fix\"\n  tag \"cci\": [\"CCI-001499\"]\n  tag \"nist\": [\"CM-5 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system commands contained in the following\ndirectories are group-owned by \\\"root\\\".\n\nCheck that the system command files contained in the following directories are\ngroup-owned by \\\"root\\\" with the following command:\n\n# sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root | xargs ls -la\n\nIf the command returns any files that are not group-owned by \\\"root\\\", and if\nthey are not SGID and owned by a privileged group, this is a finding.\"\n  desc \"fix\", \"Configure the system commands to be protected from unauthorized\naccess.\n\nRun the following command, replacing \\\"[FILE]\\\" with any system command file\nnot group-owned by \\\"root\\\".\n\n# sudo chgrp root [FILE]\"\n\n  system_commands = command('find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root').stdout.strip.split(\"\\n\").entries\n  valid_system_commands = Set[]\n\n  if system_commands.count > 0\n    system_commands.each do |sys_cmd|\n      if file(sys_cmd).exist?\n        valid_system_commands = valid_system_commands << sys_cmd\n      end\n    end\n  end\n\n  if valid_system_commands.count > 0\n    valid_system_commands.each do |val_sys_cmd|\n      describe file(val_sys_cmd) do\n        its('group') { should cmp 'root' }\n      end\n    end\n  else\n    describe \"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are NOT group-owned by root\" do\n      subject { valid_system_commands }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75615.rb"},"results":[{"status":"failed","code_desc":"File /sbin/pam_extrausers_chkpwd group should cmp == \"root\"","run_time":0.012084,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"shadow\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /sbin/unix_chkpwd group should cmp == \"root\"","run_time":0.012941,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"shadow\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/bsd-write group should cmp == \"root\"","run_time":0.011484,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"tty\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/wall group should cmp == \"root\"","run_time":0.010474,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"tty\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/screen group should cmp == \"root\"","run_time":0.008977,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"utmp\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/ssh-agent group should cmp == \"root\"","run_time":0.010055,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"ssh\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/mlocate group should cmp == \"root\"","run_time":0.009782,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"mlocate\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/expiry group should cmp == \"root\"","run_time":0.009661,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"shadow\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/at group should cmp == \"root\"","run_time":0.011262,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"daemon\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/chage group should cmp == \"root\"","run_time":0.009804,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"shadow\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/bin/crontab group should cmp == \"root\"","run_time":0.010291,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"root\"\n     got: \"crontab\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75437","title":"The Ubuntu operating system must enable a user session lock until that\nuser re-establishes access using established identification and authentication\nprocedures.","desc":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n    The session lock is implemented at the point where session activity can be\ndetermined.\n\n    Regardless of where the session lock is determined and implemented, once\ninvoked, the session lock shall remain in place until the user\nre-authenticates. No other activity aside from re-authentication shall unlock\nthe system.","descriptions":[{"label":"default","data":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n    The session lock is implemented at the point where session activity can be\ndetermined.\n\n    Regardless of where the session lock is determined and implemented, once\ninvoked, the session lock shall remain in place until the user\nre-authenticates. No other activity aside from re-authentication shall unlock\nthe system."},{"label":"check","data":"Verify the operating system allows a user to lock the current\ngraphical user interface (GUI) session.\n\nNote: If the Ubuntu operating system does not have GNOME installed, this\nrequirement is Not Applicable.\n\nCheck to see if the Ubuntu operating system allows the user to lock the current\nGUI session with the following command:\n\n# gsettings get org.gnome.desktop.lock-enabled\n\ntrue\n\nIf \"lock-enabled\" is not set to \"true\", this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system so that it allows a user to\nlock the current GUI session.\n\nNote: If the Ubuntu operating system does not have GNOME installed, this\nrequirement is Not Applicable.\n\nSet the \"lock-enabled\" setting in GNOME to allow GUI session locks with the\nfollowing command:\n\nNote: The command must be performed from a terminal window inside the graphical\nuser interface (GUI).\n\n# sudo gsettings set org.gnome.desktop.lock-enabled true"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000028-GPOS-00009","gid":"V-75437","rid":"SV-90117r3_rule","stig_id":"UBTU-16-010040","fix_id":"F-82065r2_fix","cci":["CCI-000056"],"nist":["AC-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75437\" do\n  title \"The Ubuntu operating system must enable a user session lock until that\nuser re-establishes access using established identification and authentication\nprocedures.\"\n  desc  \"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n    The session lock is implemented at the point where session activity can be\ndetermined.\n\n    Regardless of where the session lock is determined and implemented, once\ninvoked, the session lock shall remain in place until the user\nre-authenticates. No other activity aside from re-authentication shall unlock\nthe system.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000028-GPOS-00009\"\n  tag \"gid\": \"V-75437\"\n  tag \"rid\": \"SV-90117r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010040\"\n  tag \"fix_id\": \"F-82065r2_fix\"\n  tag \"cci\": [\"CCI-000056\"]\n  tag \"nist\": [\"AC-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the operating system allows a user to lock the current\ngraphical user interface (GUI) session.\n\nNote: If the Ubuntu operating system does not have GNOME installed, this\nrequirement is Not Applicable.\n\nCheck to see if the Ubuntu operating system allows the user to lock the current\nGUI session with the following command:\n\n# gsettings get org.gnome.desktop.lock-enabled\n\ntrue\n\nIf \\\"lock-enabled\\\" is not set to \\\"true\\\", this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system so that it allows a user to\nlock the current GUI session.\n\nNote: If the Ubuntu operating system does not have GNOME installed, this\nrequirement is Not Applicable.\n\nSet the \\\"lock-enabled\\\" setting in GNOME to allow GUI session locks with the\nfollowing command:\n\nNote: The command must be performed from a terminal window inside the graphical\nuser interface (GUI).\n\n# sudo gsettings set org.gnome.desktop.lock-enabled true\"\n\n  gnome_installed = (package('ubuntu-gnome-desktop').installed? || package('ubuntu-desktop').installed?)\n\n  if gnome_installed\n    lock_enabled = command('gsettings get org.gnome.desktop.screensaver lock-enabled')\n    describe lock_enabled do\n      its('stdout') { should cmp 'true' }\n    end\n  else\n    describe \"Not Applicable as GNOME dekstop environment is installed\" do\n      subject { gnome_installed }\n      it { should be false }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75437.rb"},"results":[{"status":"passed","code_desc":"Not Applicable as GNOME dekstop environment is installed should equal false","run_time":0.000108,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75577","title":"File systems that are used with removable media must be mounted to\nprevent files with the setuid and setguid bit set from being executed.","desc":"The \"nosuid\" mount option causes the system to not execute\n\"setuid\" and \"setgid\" files with owner privileges. This option must be used\nfor mounting any file system not containing approved \"setuid\" and \"setguid\"\nfiles. Executing files from untrusted file systems increases the opportunity\nfor unprivileged users to attain unauthorized administrative access.","descriptions":[{"label":"default","data":"The \"nosuid\" mount option causes the system to not execute\n\"setuid\" and \"setgid\" files with owner privileges. This option must be used\nfor mounting any file system not containing approved \"setuid\" and \"setguid\"\nfiles. Executing files from untrusted file systems increases the opportunity\nfor unprivileged users to attain unauthorized administrative access."},{"label":"check","data":"Verify file systems that are used for removable media are\nmounted with the \"nosuid\" option.\n\nCheck the file systems that are mounted at boot time with the following command:\n\n# more /etc/fstab\n\nUUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat\nnoauto,owner,ro,nosuid 0 0\n\nIf a file system found in \"/etc/fstab\" refers to removable media and it does\nnot have the \"nosuid\" option set, this is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"nosuid\" option on file\nsystems that are associated with removable media."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75577","rid":"SV-90257r3_rule","stig_id":"UBTU-16-010810","fix_id":"F-82205r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75577\" do\n  title \"File systems that are used with removable media must be mounted to\nprevent files with the setuid and setguid bit set from being executed.\"\n  desc  \"The \\\"nosuid\\\" mount option causes the system to not execute\n\\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used\nfor mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\"\nfiles. Executing files from untrusted file systems increases the opportunity\nfor unprivileged users to attain unauthorized administrative access.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75577\"\n  tag \"rid\": \"SV-90257r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010810\"\n  tag \"fix_id\": \"F-82205r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify file systems that are used for removable media are\nmounted with the \\\"nosuid\\\" option.\n\nCheck the file systems that are mounted at boot time with the following command:\n\n# more /etc/fstab\n\nUUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat\nnoauto,owner,ro,nosuid 0 0\n\nIf a file system found in \\\"/etc/fstab\\\" refers to removable media and it does\nnot have the \\\"nosuid\\\" option set, this is a finding.\"\n  desc \"fix\", \"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file\nsystems that are associated with removable media.\"\n\n  removable_media_mount_points = input('removable_media_mount_points')\n\n  if removable_media_mount_points.count > 0\n    removable_media_mount_points.each do |mount_point|\n      describe mount(mount_point) do\n        its('options') { should include 'nosuid' }\n      end\n    end\n  else\n    describe \"Removable media mount points\" do\n      subject { removable_media_mount_points }\n      its('count') { should cmp 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75577.rb"},"results":[{"status":"passed","code_desc":"Removable media mount points count should cmp == 0","run_time":0.000133,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75621","title":"The Ubuntu operating system must allocate audit record storage\ncapacity to store at least one weeks worth of audit records, when audit records\nare not immediately sent to a central audit record storage facility.","desc":"In order to ensure Ubuntu operating systems have a sufficient storage\ncapacity in which to write the audit logs, Ubuntu operating systems need to be\nable to allocate audit record storage capacity.\n\n    The task of allocating audit record storage capacity is usually performed\nduring initial installation of the Ubuntu operating system.","descriptions":[{"label":"default","data":"In order to ensure Ubuntu operating systems have a sufficient storage\ncapacity in which to write the audit logs, Ubuntu operating systems need to be\nable to allocate audit record storage capacity.\n\n    The task of allocating audit record storage capacity is usually performed\nduring initial installation of the Ubuntu operating system."},{"label":"check","data":"Verify the Ubuntu operating system allocates audit record\nstorage capacity to store at least one week's worth of audit records when audit\nrecords are not immediately sent to a central audit record storage facility.\n\nDetermine which partition the audit records are being written to with the\nfollowing command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nCheck the size of the partition that audit records are written to (with the\nexample being /var/log/audit/) with the following command:\n\n# df –h /var/log/audit/\n/dev/sda2 24G 10.4G 13.6G 43% /var/log/audit\n\nIf the audit records are not written to a partition made specifically for audit\nrecords (/var/log/audit is a separate partition), determine the amount of space\nbeing used by other files in the partition with the following command:\n\n#du –sh [audit_partition]\n1.8G /var/log/audit\n\nNote: The partition size needed to capture a week's worth of audit records is\nbased on the activity level of the system and the total storage capacity\navailable. In normal circumstances, 10.0 GB of storage space for audit records\nwill be sufficient.\n\nIf the audit record partition is not allocated for sufficient storage capacity,\nthis is a finding."},{"label":"fix","data":"Allocate enough storage capacity for at least one week's worth of\naudit records when audit records are not immediately sent to a central audit\nrecord storage facility.\n\nIf audit records are stored on a partition made specifically for audit records,\nuse the \"X\" program to resize the partition with sufficient space to contain\none week's worth of audit records.\n\nIf audit records are not stored on a partition made specifically for audit\nrecords, a new partition with sufficient amount of space will need be to be\ncreated."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000341-GPOS-00132","gid":"V-75621","rid":"SV-90301r2_rule","stig_id":"UBTU-16-020020","fix_id":"F-82249r1_fix","cci":["CCI-001849"],"nist":["AU-4","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75621\" do\n  title \"The Ubuntu operating system must allocate audit record storage\ncapacity to store at least one weeks worth of audit records, when audit records\nare not immediately sent to a central audit record storage facility.\"\n  desc  \"In order to ensure Ubuntu operating systems have a sufficient storage\ncapacity in which to write the audit logs, Ubuntu operating systems need to be\nable to allocate audit record storage capacity.\n\n    The task of allocating audit record storage capacity is usually performed\nduring initial installation of the Ubuntu operating system.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000341-GPOS-00132\"\n  tag \"gid\": \"V-75621\"\n  tag \"rid\": \"SV-90301r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020020\"\n  tag \"fix_id\": \"F-82249r1_fix\"\n  tag \"cci\": [\"CCI-001849\"]\n  tag \"nist\": [\"AU-4\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system allocates audit record\nstorage capacity to store at least one week's worth of audit records when audit\nrecords are not immediately sent to a central audit record storage facility.\n\nDetermine which partition the audit records are being written to with the\nfollowing command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nCheck the size of the partition that audit records are written to (with the\nexample being /var/log/audit/) with the following command:\n\n# df –h /var/log/audit/\n/dev/sda2 24G 10.4G 13.6G 43% /var/log/audit\n\nIf the audit records are not written to a partition made specifically for audit\nrecords (/var/log/audit is a separate partition), determine the amount of space\nbeing used by other files in the partition with the following command:\n\n#du –sh [audit_partition]\n1.8G /var/log/audit\n\nNote: The partition size needed to capture a week's worth of audit records is\nbased on the activity level of the system and the total storage capacity\navailable. In normal circumstances, 10.0 GB of storage space for audit records\nwill be sufficient.\n\nIf the audit record partition is not allocated for sufficient storage capacity,\nthis is a finding.\"\n  desc \"fix\", \"Allocate enough storage capacity for at least one week's worth of\naudit records when audit records are not immediately sent to a central audit\nrecord storage facility.\n\nIf audit records are stored on a partition made specifically for audit records,\nuse the \\\"X\\\" program to resize the partition with sufficient space to contain\none week's worth of audit records.\n\nIf audit records are not stored on a partition made specifically for audit\nrecords, a new partition with sufficient amount of space will need be to be\ncreated.\"\n\n  log_file_path = input('log_file_path')\n  log_file_dir = input('log_file_dir')\n  available_storage = filesystem(log_file_dir).free_kb\n  log_file_size = file(log_file_path).size\n  standard_audit_log_size = input('standard_audit_log_size')\n  \n  describe ('Current audit log file size is less than the specified standard of ' + standard_audit_log_size.to_s) do\n    subject { log_file_size.to_i }\n    it { should be <= standard_audit_log_size }\n  end\n  describe ('Available storage for audit log should be more than the defined standard of ' + standard_audit_log_size.to_s) do\n    subject { available_storage.to_i }\n    it { should be > standard_audit_log_size}\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75621.rb"},"results":[{"status":"passed","code_desc":"Current audit log file size is less than the specified standard of 1073741824 should be <= 1073741824","run_time":6.6e-05,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"failed","code_desc":"Available storage for audit log should be more than the defined standard of 1073741824 should be > 1073741824","run_time":0.000111,"start_time":"2019-08-06T11:13:29-04:00","message":"expected: > 1073741824\n     got:   59408508"}]},{"id":"V-75761","title":"Successful/unsuccessful uses of the newgrp command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w newgrp /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"newgrp\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75761","rid":"SV-90441r4_rule","stig_id":"UBTU-16-020680","fix_id":"F-82389r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75761\" do\n  title \"Successful/unsuccessful uses of the newgrp command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75761\"\n  tag \"rid\": \"SV-90441r4_rule\"\n  tag \"stig_id\": \"UBTU-16-020680\"\n  tag \"fix_id\": \"F-82389r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w newgrp /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\n\n\n\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"newgrp\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/newgrp'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75761.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/newgrp exist should equal true","run_time":9.9e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75833","title":"Unattended or automatic login via ssh must not be allowed.","desc":"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.","descriptions":[{"label":"default","data":"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security."},{"label":"check","data":"Verify that unattended or automatic login via ssh is disabled.\n\nCheck that unattended or automatic login via ssh is disabled with the following\ncommand:\n\n# egrep '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config\n\nPermitEmptyPasswords no\nPermitUserEnvironment no\n\nIf \"PermitEmptyPasswords\" or \"PermitUserEnvironment\" keywords are not set\nto \"no\", is missing completely, or they are commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to allow the SSH daemon to\nnot allow unattended or automatic login to the system.\n\nAdd or edit the following lines in the \"/etc/ssh/sshd_config\" file:\n\nPermitEmptyPasswords no\nPermitUserEnvironment no\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-75833","rid":"SV-90513r2_rule","stig_id":"UBTU-16-030250","fix_id":"F-82463r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75833\" do\n  title \"Unattended or automatic login via ssh must not be allowed.\"\n  desc  \"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00229\"\n  tag \"gid\": \"V-75833\"\n  tag \"rid\": \"SV-90513r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030250\"\n  tag \"fix_id\": \"F-82463r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that unattended or automatic login via ssh is disabled.\n\nCheck that unattended or automatic login via ssh is disabled with the following\ncommand:\n\n# egrep '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config\n\nPermitEmptyPasswords no\nPermitUserEnvironment no\n\nIf \\\"PermitEmptyPasswords\\\" or \\\"PermitUserEnvironment\\\" keywords are not set\nto \\\"no\\\", is missing completely, or they are commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to allow the SSH daemon to\nnot allow unattended or automatic login to the system.\n\nAdd or edit the following lines in the \\\"/etc/ssh/sshd_config\\\" file:\n\nPermitEmptyPasswords no\nPermitUserEnvironment no\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('PermitEmptyPasswords') { should cmp 'no' }\n    its('PermitUserEnvironment') { should cmp 'no' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75833.rb"},"results":[{"status":"passed","code_desc":"SSHD Configuration PermitEmptyPasswords should cmp == \"no\"","run_time":0.000444,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"failed","code_desc":"SSHD Configuration PermitUserEnvironment should cmp == \"no\"","run_time":0.000147,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"no\"\n     got: nil\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75543","title":"Default permissions must be defined in such a way that all\nauthenticated users can only read and modify their own files.","desc":"Setting the most restrictive default permissions ensures that when new\naccounts are created they do not have unnecessary access.","descriptions":[{"label":"default","data":"Setting the most restrictive default permissions ensures that when new\naccounts are created they do not have unnecessary access."},{"label":"check","data":"Verify the Ubuntu operating system defines default permissions\nfor all authenticated users in such a way that the user can only read and\nmodify their own files.\n\nCheck that the Ubuntu operating system defines default permissions for all\nauthenticated users with the following command:\n\n# grep -i \"umask\" /etc/login.defs\n\nUMASK 077\n\nIf the \"UMASK\" variable is set to \"000\", this is a finding with the\nseverity raised to a CAT I.\n\nIf the value of \"UMASK\" is not set to \"077\", \"UMASK\" is commented out or\n\"UMASK\" is missing completely, this is a finding."},{"label":"fix","data":"Configure the system to define the default permissions for all\nauthenticated users in such a way that the user can only read and modify their\nown files.\n\nEdit the \"UMASK\" parameter in the \"/etc/login.defs\" file to match the\nexample below:\n\nUMASK 077"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00228","gid":"V-75543","rid":"SV-90223r2_rule","stig_id":"UBTU-16-010640","fix_id":"F-82171r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75543\" do\n  title \"Default permissions must be defined in such a way that all\nauthenticated users can only read and modify their own files.\"\n  desc  \"Setting the most restrictive default permissions ensures that when new\naccounts are created they do not have unnecessary access.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00228\"\n  tag \"gid\": \"V-75543\"\n  tag \"rid\": \"SV-90223r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010640\"\n  tag \"fix_id\": \"F-82171r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system defines default permissions\nfor all authenticated users in such a way that the user can only read and\nmodify their own files.\n\nCheck that the Ubuntu operating system defines default permissions for all\nauthenticated users with the following command:\n\n# grep -i \\\"umask\\\" /etc/login.defs\n\nUMASK 077\n\nIf the \\\"UMASK\\\" variable is set to \\\"000\\\", this is a finding with the\nseverity raised to a CAT I.\n\nIf the value of \\\"UMASK\\\" is not set to \\\"077\\\", \\\"UMASK\\\" is commented out or\n\\\"UMASK\\\" is missing completely, this is a finding.\"\n  desc \"fix\", \"Configure the system to define the default permissions for all\nauthenticated users in such a way that the user can only read and modify their\nown files.\n\nEdit the \\\"UMASK\\\" parameter in the \\\"/etc/login.defs\\\" file to match the\nexample below:\n\nUMASK 077\"\n\n  describe login_defs do\n    its('UMASK') { should eq '077' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75543.rb"},"results":[{"status":"failed","code_desc":"login.defs UMASK should eq \"077\"","run_time":0.000746,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"077\"\n     got: \"027\"\n\n(compared using ==)\n"}]},{"id":"V-75891","title":"The Ubuntu operating system must be configured to prevent unrestricted\nmail relaying.","desc":"If unrestricted mail relaying is permitted, unauthorized senders could\nuse this host as a mail relay for the purpose of sending spam or other\nunauthorized activity.","descriptions":[{"label":"default","data":"If unrestricted mail relaying is permitted, unauthorized senders could\nuse this host as a mail relay for the purpose of sending spam or other\nunauthorized activity."},{"label":"check","data":"Determine if \"postfix\" is installed with the following\ncommands:\n\nNote: If postfix is not installed, this is Not Applicable.\n\n# dpkg -l | grep postfix\nii  postfix                                    3.1.0-3\n\nVerify the Ubuntu operating system is configured to prevent unrestricted mail\nrelaying.\n\nIf postfix is installed, determine if it is configured to reject connections\nfrom unknown or untrusted networks with the following command:\n\n# postconf -n smtpd_client_restrictions\n\nsmtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject\n\nIf the \"smtpd_relay_restrictions\" parameter contains any entries other than\n\"permit_mynetworks\", \"permit_sasl_authenticated\" and \"reject\", is\nmissing, or is commented out, this is a finding."},{"label":"fix","data":"If \"postfix\" is installed, modify the \"/etc/postfix/main.cf\"\nfile to restrict client connections to the local network with the following\ncommand:\n\n# sudo postconf -e 'smtpd_relay_restrictions = permit_mynetworks,\npermit_sasl_authenticated, reject'"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75891","rid":"SV-90571r2_rule","stig_id":"UBTU-16-030620","fix_id":"F-82521r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75891\" do\n  title \"The Ubuntu operating system must be configured to prevent unrestricted\nmail relaying.\"\n  desc  \"If unrestricted mail relaying is permitted, unauthorized senders could\nuse this host as a mail relay for the purpose of sending spam or other\nunauthorized activity.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75891\"\n  tag \"rid\": \"SV-90571r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030620\"\n  tag \"fix_id\": \"F-82521r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Determine if \\\"postfix\\\" is installed with the following\ncommands:\n\nNote: If postfix is not installed, this is Not Applicable.\n\n# dpkg -l | grep postfix\nii  postfix                                    3.1.0-3\n\nVerify the Ubuntu operating system is configured to prevent unrestricted mail\nrelaying.\n\nIf postfix is installed, determine if it is configured to reject connections\nfrom unknown or untrusted networks with the following command:\n\n# postconf -n smtpd_client_restrictions\n\nsmtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject\n\nIf the \\\"smtpd_relay_restrictions\\\" parameter contains any entries other than\n\\\"permit_mynetworks\\\", \\\"permit_sasl_authenticated\\\" and \\\"reject\\\", is\nmissing, or is commented out, this is a finding.\"\n  desc \"fix\", \"If \\\"postfix\\\" is installed, modify the \\\"/etc/postfix/main.cf\\\"\nfile to restrict client connections to the local network with the following\ncommand:\n\n# sudo postconf -e 'smtpd_relay_restrictions = permit_mynetworks,\npermit_sasl_authenticated, reject'\"\n\n  is_postfix_installed = package('postfix').installed?\n\n  if is_postfix_installed\n    postconf_output = command('postconf -n smtpd_client_restrictions').stdout.strip\n    smtpd_relay_restrictions = postconf_output.split(' = ')[1].split(', ')\n    describe smtpd_relay_restrictions do\n      it { should be_in [\"permit_mynetworks\", \"permit_sasl_authenticated\", \"reject\"] }\n    end\n  else\n    describe \"Control Not Applicable as postfix is not installed\" do\n      subject { is_postfix_installed }\n      it { should be false }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75891.rb"},"results":[{"status":"passed","code_desc":"Control Not Applicable as postfix is not installed should equal false","run_time":7.5e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75563","title":"All local interactive user home directories defined in the /etc/passwd\nfile must exist.","desc":"If a local interactive user has a home directory defined that does not\nexist, the user may be given access to the / directory as the current working\ndirectory upon logon. This could create a Denial of Service because the user\nwould not be able to access their logon configuration files, and it may give\nthem visibility to system files they normally would not be able to access.","descriptions":[{"label":"default","data":"If a local interactive user has a home directory defined that does not\nexist, the user may be given access to the / directory as the current working\ndirectory upon logon. This could create a Denial of Service because the user\nwould not be able to access their logon configuration files, and it may give\nthem visibility to system files they normally would not be able to access."},{"label":"check","data":"Verify the assigned home directory of all local interactive\nusers on the Ubuntu operating system exists.\n\nCheck the home directory assignment for all local interactive non-privileged\nusers with the following command:\n\n# ls -ld $(awk -F: '($3>=1000)&&($1!=\"nobody\"){print $6}' /etc/passwd)\n\ndrwxr-xr-x 2 smithj admin 4096 Jun 5 12:41 smithj\n\nNote: This may miss interactive users that have been assigned a privileged User\nID (UID). Evidence of interactive use may be obtained from a number of log\nfiles containing system logon information.\n\nCheck that all referenced home directories exist with the following command:\n\n# pwck -r\n\nuser 'smithj': directory '/home/smithj' does not exist\n\nIf any home directories referenced in \"/etc/passwd\" are returned as not\ndefined, this is a finding."},{"label":"fix","data":"Create home directories to all local interactive users that\ncurrently do not have a home directory assigned. Use the following commands to\ncreate the user home directory assigned in \"/etc/ passwd\":\n\nNote: The example will be for the user smithj, who has a home directory of\n\"/home/smithj\", a User ID (UID) of \"smithj\", and a Group Identifier (GID)\nof \"users assigned\" in \"/etc/passwd\".\n\n# mkdir /home/smithj\n# chown smithj /home/smithj\n# chgrp users /home/smithj\n# chmod 0750 /home/smithj"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75563","rid":"SV-90243r1_rule","stig_id":"UBTU-16-010740","fix_id":"F-82191r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75563\" do\n  title \"All local interactive user home directories defined in the /etc/passwd\nfile must exist.\"\n  desc  \"If a local interactive user has a home directory defined that does not\nexist, the user may be given access to the / directory as the current working\ndirectory upon logon. This could create a Denial of Service because the user\nwould not be able to access their logon configuration files, and it may give\nthem visibility to system files they normally would not be able to access.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75563\"\n  tag \"rid\": \"SV-90243r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010740\"\n  tag \"fix_id\": \"F-82191r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the assigned home directory of all local interactive\nusers on the Ubuntu operating system exists.\n\nCheck the home directory assignment for all local interactive non-privileged\nusers with the following command:\n\n# ls -ld $(awk -F: '($3>=1000)&&($1!=\\\"nobody\\\"){print $6}' /etc/passwd)\n\ndrwxr-xr-x 2 smithj admin 4096 Jun 5 12:41 smithj\n\nNote: This may miss interactive users that have been assigned a privileged User\nID (UID). Evidence of interactive use may be obtained from a number of log\nfiles containing system logon information.\n\nCheck that all referenced home directories exist with the following command:\n\n# pwck -r\n\nuser 'smithj': directory '/home/smithj' does not exist\n\nIf any home directories referenced in \\\"/etc/passwd\\\" are returned as not\ndefined, this is a finding.\"\n  desc \"fix\", \"Create home directories to all local interactive users that\ncurrently do not have a home directory assigned. Use the following commands to\ncreate the user home directory assigned in \\\"/etc/ passwd\\\":\n\nNote: The example will be for the user smithj, who has a home directory of\n\\\"/home/smithj\\\", a User ID (UID) of \\\"smithj\\\", and a Group Identifier (GID)\nof \\\"users assigned\\\" in \\\"/etc/passwd\\\".\n\n# mkdir /home/smithj\n# chown smithj /home/smithj\n# chgrp users /home/smithj\n# chmod 0750 /home/smithj\"\n\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries.each do |user_info|\n    next if exempt_home_users.include?(\"#{user_info.username}\")\n    describe directory(user_info.home) do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75563.rb"},"results":[{"status":"passed","code_desc":"Directory /root should exist","run_time":8.5e-05,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"Directory /home/vagrant should exist","run_time":6.7e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75481","title":"The Ubuntu operating system must prevent the use of dictionary words\nfor passwords.","desc":"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, this increases the chances of password compromise by\nincreasing the opportunity for successful guesses and brute-force attacks.","descriptions":[{"label":"default","data":"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, this increases the chances of password compromise by\nincreasing the opportunity for successful guesses and brute-force attacks."},{"label":"check","data":"Verify the Ubuntu operating system prevents the use of\ndictionary words for passwords.\n\nCheck that the Ubuntu operating system uses the cracklib library to prevent the\nuse of dictionary words with the following command:\n\n# grep dictcheck /etc/security/pwquality.conf\n\ndictcheck=1\n\nIf the \"dictcheck\" parameter is not set to \"1\", or is commented out, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to prevent the use of\ndictionary words for passwords.\n\nEdit the file \"/etc/security/pwquality.conf\" by adding a line such as:\n\ndictcheck=1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00225","gid":"V-75481","rid":"SV-90161r3_rule","stig_id":"UBTU-16-010260","fix_id":"F-82109r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75481\" do\n  title \"The Ubuntu operating system must prevent the use of dictionary words\nfor passwords.\"\n  desc  \"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, this increases the chances of password compromise by\nincreasing the opportunity for successful guesses and brute-force attacks.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00225\"\n  tag \"gid\": \"V-75481\"\n  tag \"rid\": \"SV-90161r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010260\"\n  tag \"fix_id\": \"F-82109r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system prevents the use of\ndictionary words for passwords.\n\nCheck that the Ubuntu operating system uses the cracklib library to prevent the\nuse of dictionary words with the following command:\n\n# grep dictcheck /etc/security/pwquality.conf\n\ndictcheck=1\n\nIf the \\\"dictcheck\\\" parameter is not set to \\\"1\\\", or is commented out, this\nis a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to prevent the use of\ndictionary words for passwords.\n\nEdit the file \\\"/etc/security/pwquality.conf\\\" by adding a line such as:\n\ndictcheck=1\"\n\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('dictcheck') { should cmp '1' }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75481.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000101,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75813","title":"The Ubuntu operating system must compare internal information system\nclocks at least every 24 hours with a server which is synchronized to an\nauthoritative time source, such as the United States Naval Observatory (USNO)\ntime servers, or a time server designated for the appropriate DoD network\n(NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).","desc":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events. Sources outside the configured acceptable\nallowance (drift) may be inaccurate.\n\n    Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network.\n\n    Organizations should consider endpoints that may not have regular access to\nthe authoritative time server (e.g., mobile, teleworking, and tactical\nendpoints).","descriptions":[{"label":"default","data":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events. Sources outside the configured acceptable\nallowance (drift) may be inaccurate.\n\n    Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network.\n\n    Organizations should consider endpoints that may not have regular access to\nthe authoritative time server (e.g., mobile, teleworking, and tactical\nendpoints)."},{"label":"check","data":"The system clock must be configured to compare the system clock\nat least every 24 hours to the authoritative time source.\n\nNote: If the system is not networked this item is Not Applicable.\n\nCheck the value of \"maxpoll\" in the \"/etc/ntp.conf\" file with the following\ncommand:\n\n# sudo  grep -i maxpoll /etc/ntp.conf\nmaxpoll = 17\n\nIf \"maxpoll\" is not set to \"17\" or does not exist, this is a finding.\n\nVerify that the \"ntp.conf\" file is configured to an authoritative DoD time\nsource by running the following command:\n\n# grep -i server /etc/ntp.conf\nserver 0.us.pool.ntp.org iburst\n\nIf the parameter \"server\" is not set, is not set to an authoritative DoD time\nsource, or is commented out, this is a finding."},{"label":"fix","data":"Note: If the system is not networked this item is Not Applicable.\n\nTo configure the system clock to compare the system clock at least every 24\nhours to the authoritative time source, edit the \"/etc/ntp.conf\" file. Add or\ncorrect the following lines, by replacing \"[source]\" in the following line\nwith an authoritative DoD time source.\n\nmaxpoll = 17\nserver [source] iburst\n\nIf the \"NTP\" service was running and the value of \"maxpoll\" or \"server\"\nwas updated then the service must be restarted using the following command:\n\n# sudo systemctl restart ntp.service\n\nIf the \"NTP\" service was not running then it must be started."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000355-GPOS-00143","gid":"V-75813","rid":"SV-90493r2_rule","stig_id":"UBTU-16-030100","fix_id":"F-82443r2_fix","cci":["CCI-001891"],"nist":["AU-8 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75813\" do\n  title \"The Ubuntu operating system must compare internal information system\nclocks at least every 24 hours with a server which is synchronized to an\nauthoritative time source, such as the United States Naval Observatory (USNO)\ntime servers, or a time server designated for the appropriate DoD network\n(NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).\"\n  desc  \"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events. Sources outside the configured acceptable\nallowance (drift) may be inaccurate.\n\n    Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network.\n\n    Organizations should consider endpoints that may not have regular access to\nthe authoritative time server (e.g., mobile, teleworking, and tactical\nendpoints).\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000355-GPOS-00143\"\n  tag \"gid\": \"V-75813\"\n  tag \"rid\": \"SV-90493r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030100\"\n  tag \"fix_id\": \"F-82443r2_fix\"\n  tag \"cci\": [\"CCI-001891\"]\n  tag \"nist\": [\"AU-8 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"The system clock must be configured to compare the system clock\nat least every 24 hours to the authoritative time source.\n\nNote: If the system is not networked this item is Not Applicable.\n\nCheck the value of \\\"maxpoll\\\" in the \\\"/etc/ntp.conf\\\" file with the following\ncommand:\n\n# sudo  grep -i maxpoll /etc/ntp.conf\nmaxpoll = 17\n\nIf \\\"maxpoll\\\" is not set to \\\"17\\\" or does not exist, this is a finding.\n\nVerify that the \\\"ntp.conf\\\" file is configured to an authoritative DoD time\nsource by running the following command:\n\n# grep -i server /etc/ntp.conf\nserver 0.us.pool.ntp.org iburst\n\nIf the parameter \\\"server\\\" is not set, is not set to an authoritative DoD time\nsource, or is commented out, this is a finding.\"\n  desc \"fix\", \"Note: If the system is not networked this item is Not Applicable.\n\nTo configure the system clock to compare the system clock at least every 24\nhours to the authoritative time source, edit the \\\"/etc/ntp.conf\\\" file. Add or\ncorrect the following lines, by replacing \\\"[source]\\\" in the following line\nwith an authoritative DoD time source.\n\nmaxpoll = 17\nserver [source] iburst\n\nIf the \\\"NTP\\\" service was running and the value of \\\"maxpoll\\\" or \\\"server\\\"\nwas updated then the service must be restarted using the following command:\n\n# sudo systemctl restart ntp.service\n\nIf the \\\"NTP\\\" service was not running then it must be started.\"\n\n  is_system_networked = input('is_system_networked')\n  if is_system_networked\n    ntp_conf_exists = file('/etc/ntp.conf').exist?\n    if ntp_conf_exists\n      describe ntp_conf do\n        it { should exist }\n        its('maxpoll') { should cmp 17 }\n        its('server') { should_not be_empty }\n        its('server') { should_not eq nil }\n      end\n    else\n      describe \"/etc/ntp.conf exists\" do\n        subject { ntp_conf_exists }\n        it { should be true }\n      end\n    end\n  else\n    describe \"System is not networked\" do\n      skip \"This control is Not Applicable as the system is not networked\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75813.rb"},"results":[{"status":"failed","code_desc":"/etc/ntp.conf exists should equal true","run_time":9.4e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75601","title":"The /var/log/syslog file must be owned by syslog.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify that the /var/log/syslog file is owned by syslog.\n\nCheck that the /var/log/syslog file is owned by syslog with the following\ncommand:\n\n# ls -la /var/log/syslog | cut -d' ' -f3\n\nsyslog\n\nIf \"syslog\" is not returned as a result, this is a finding."},{"label":"fix","data":"Change the owner of the file /var/log/syslog to syslog by running\nthe following command:\n\n# sudo chown syslog /var/log/syslog"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75601","rid":"SV-90281r2_rule","stig_id":"UBTU-16-010980","fix_id":"F-82229r1_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75601\" do\n  title \"The /var/log/syslog file must be owned by syslog.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75601\"\n  tag \"rid\": \"SV-90281r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010980\"\n  tag \"fix_id\": \"F-82229r1_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the /var/log/syslog file is owned by syslog.\n\nCheck that the /var/log/syslog file is owned by syslog with the following\ncommand:\n\n# ls -la /var/log/syslog | cut -d' ' -f3\n\nsyslog\n\nIf \\\"syslog\\\" is not returned as a result, this is a finding.\"\n  desc \"fix\", \"Change the owner of the file /var/log/syslog to syslog by running\nthe following command:\n\n# sudo chown syslog /var/log/syslog\"\n\n  describe file('/var/log/syslog') do\n    its('owner') { should cmp 'syslog' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75601.rb"},"results":[{"status":"passed","code_desc":"File /var/log/syslog owner should cmp == \"syslog\"","run_time":0.011778,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75741","title":"Successful/unsuccessful uses of the fchmodat command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"fchmodat\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w fchmodat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchmodat\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75741","rid":"SV-90421r3_rule","stig_id":"UBTU-16-020580","fix_id":"F-82369r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75741\" do\n  title \"Successful/unsuccessful uses of the fchmodat command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75741\"\n  tag \"rid\": \"SV-90421r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020580\"\n  tag \"fix_id\": \"F-82369r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"fchmodat\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w fchmodat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchmodat\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"fchmodat\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75741.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchmodat\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.00023,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchmodat\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000136,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75697","title":"Successful/unsuccessful uses of the umount command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"umount\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep umount /etc/audit/audit.rules\n\n-a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"umount\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-75697","rid":"SV-90377r3_rule","stig_id":"UBTU-16-020390","fix_id":"F-82325r2_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75697\" do\n  title \"Successful/unsuccessful uses of the umount command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000042-GPOS-00020\"\n  tag \"satisfies\": [\"SRG-OS-000042-GPOS-00020\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75697\"\n  tag \"rid\": \"SV-90377r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020390\"\n  tag \"fix_id\": \"F-82325r2_fix\"\n  tag \"cci\": [\"CCI-000135\", \"CCI-000172\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3 (1)\", \"AU-12 c\", \"MA-4 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"umount\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep umount /etc/audit/audit.rules\n\n-a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"umount\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/bin/umount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/bin/umount'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      its('action.uniq') { should eq ['always'] }\n      its('list.uniq') { should eq ['exit'] }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75697.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /bin/umount exist should equal true","run_time":0.000119,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75885","title":"The Ubuntu operating system must not send Internet Protocol version 4\n(IPv4) Internet Control Message Protocol (ICMP) redirects.","desc":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages contain information from the system's route table,\npossibly revealing portions of the network topology.","descriptions":[{"label":"default","data":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages contain information from the system's route table,\npossibly revealing portions of the network topology."},{"label":"check","data":"Verify the Ubuntu operating system does not send Internet\nProtocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect\nmessages.\n\nCheck the value of the \"all send_redirects\" variables with the following\ncommand:\n\n#  sudo sysctl net.ipv4.conf.all.send_redirects\n\nnet.ipv4.conf.all.send_redirects=0\n\nIf the returned line does not have a value of \"0\", or a line is not returned,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to not allow interfaces to\nperform Internet Protocol version 4 (IPv4) Internet Control Message Protocol\n(ICMP) redirects with the following command:\n\n# sudo sysctl -w net.ipv4.conf.all.send_redirects=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.conf.all.send_redirects=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75885","rid":"SV-90565r2_rule","stig_id":"UBTU-16-030590","fix_id":"F-82515r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75885\" do\n  title \"The Ubuntu operating system must not send Internet Protocol version 4\n(IPv4) Internet Control Message Protocol (ICMP) redirects.\"\n  desc  \"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages contain information from the system's route table,\npossibly revealing portions of the network topology.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75885\"\n  tag \"rid\": \"SV-90565r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030590\"\n  tag \"fix_id\": \"F-82515r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system does not send Internet\nProtocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect\nmessages.\n\nCheck the value of the \\\"all send_redirects\\\" variables with the following\ncommand:\n\n#  sudo sysctl net.ipv4.conf.all.send_redirects\n\nnet.ipv4.conf.all.send_redirects=0\n\nIf the returned line does not have a value of \\\"0\\\", or a line is not returned,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to not allow interfaces to\nperform Internet Protocol version 4 (IPv4) Internet Control Message Protocol\n(ICMP) redirects with the following command:\n\n# sudo sysctl -w net.ipv4.conf.all.send_redirects=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.conf.all.send_redirects=0\"\n\n  describe kernel_parameter('net.ipv4.conf.all.send_redirects') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75885.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.conf.all.send_redirects value should eq 0","run_time":0.009374,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75557","title":"All files and directories must have a valid group owner.","desc":"Files without a valid group owner may be unintentionally inherited if\na group is assigned the same Group Identifier (GID) as the GID of the files\nwithout a valid group owner.","descriptions":[{"label":"default","data":"Files without a valid group owner may be unintentionally inherited if\na group is assigned the same Group Identifier (GID) as the GID of the files\nwithout a valid group owner."},{"label":"check","data":"Verify all files and directories on the Ubuntu operating system\nhave a valid group.\n\nCheck the owner of all files and directories with the following command:\n\n# sudo find / -nogroup\n\nIf any files on the system do not have an assigned group, this is a finding."},{"label":"fix","data":"Either remove all files and directories from the Ubuntu operating\nsystem that do not have a valid group, or assign a valid group to all files and\ndirectories on the system with the \"chgrp\" command:\n\n# sudo chgrp <group> <file>"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75557","rid":"SV-90237r1_rule","stig_id":"UBTU-16-010710","fix_id":"F-82185r1_fix","cci":["CCI-002165"],"nist":["AC-3 (4)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75557\" do\n  title \"All files and directories must have a valid group owner.\"\n  desc  \"Files without a valid group owner may be unintentionally inherited if\na group is assigned the same Group Identifier (GID) as the GID of the files\nwithout a valid group owner.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75557\"\n  tag \"rid\": \"SV-90237r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010710\"\n  tag \"fix_id\": \"F-82185r1_fix\"\n  tag \"cci\": [\"CCI-002165\"]\n  tag \"nist\": [\"AC-3 (4)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify all files and directories on the Ubuntu operating system\nhave a valid group.\n\nCheck the owner of all files and directories with the following command:\n\n# sudo find / -nogroup\n\nIf any files on the system do not have an assigned group, this is a finding.\"\n  desc \"fix\", \"Either remove all files and directories from the Ubuntu operating\nsystem that do not have a valid group, or assign a valid group to all files and\ndirectories on the system with the \\\"chgrp\\\" command:\n\n# sudo chgrp <group> <file>\"\n\n  dir_list = command(\"find / -nogroup\").stdout.strip.split(\"\\n\")\n  if (dir_list.count > 0)\n    dir_list.each do |entry|\n      describe directory(entry) do\n        its('group') { should_not be_empty }\n      end\n    end\n  else\n    describe \"The number of files and directories without a valid group\" do\n      subject { dir_list }\n      its('count') { should cmp 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75557.rb"},"results":[{"status":"passed","code_desc":"The number of files and directories without a valid group count should cmp == 0","run_time":0.00018,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75775","title":"Successful/unsuccessful modifications to the lastlog file must\ngenerate an audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful modifications to the \"lastlog\" file occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w lastlog /etc/audit/audit.rules\n\n-w /var/log/lastlog -p wa -k logins\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \"lastlog\" file occur.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-w /var/log/lastlog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215","SRG-OS-000473-GPOS-00218"],"gid":"V-75775","rid":"SV-90455r3_rule","stig_id":"UBTU-16-020750","fix_id":"F-82403r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75775\" do\n  title \"Successful/unsuccessful modifications to the lastlog file must\ngenerate an audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000473-GPOS-00218\"]\n  tag \"gid\": \"V-75775\"\n  tag \"rid\": \"SV-90455r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020750\"\n  tag \"fix_id\": \"F-82403r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful modifications to the \\\"lastlog\\\" file occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w lastlog /etc/audit/audit.rules\n\n-w /var/log/lastlog -p wa -k logins\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \\\"lastlog\\\" file occur.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-w /var/log/lastlog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/var/log/lastlog'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75775.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /var/log/lastlog exist should equal true","run_time":0.000136,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75635","title":"Audit logs must have a mode of 0600 or less permissive to prevent\nunauthorized read access.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.","descriptions":[{"label":"default","data":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity."},{"label":"check","data":"Verify the audit logs have a mode of \"0600\" or less\npermissive.\n\nFirst determine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\n\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log file, check if the audit log has a mode of\n\"0600\" or less permissive with the following command:\n\n# sudo stat -c \"%a %n\" /var/log/audit/audit.log\n\n600 /var/log/audit/audit.log\n\nIf the audit log has a mode more permissive than \"0600\", this is a finding."},{"label":"fix","data":"Configure the audit log to be protected from unauthorized read\naccess by setting the correct permissive mode with the following command:\n\n# sudo chmod 0600 [audit_log_file]\n\nReplace \"[audit_log_file]\" to the correct audit log path, by default this\nlocation is \"/var/log/audit/audit.log\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-75635","rid":"SV-90315r2_rule","stig_id":"UBTU-16-020090","fix_id":"F-82263r1_fix","cci":["CCI-000162","CCI-000163","CCI-000164"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75635\" do\n  title \"Audit logs must have a mode of 0600 or less permissive to prevent\nunauthorized read access.\"\n  desc  \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000057-GPOS-00027\"\n  tag \"satisfies\": [\"SRG-OS-000057-GPOS-00027\", \"SRG-OS-000058-GPOS-00028\",\n\"SRG-OS-000059-GPOS-00029\"]\n  tag \"gid\": \"V-75635\"\n  tag \"rid\": \"SV-90315r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020090\"\n  tag \"fix_id\": \"F-82263r1_fix\"\n  tag \"cci\": [\"CCI-000162\", \"CCI-000163\", \"CCI-000164\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit logs have a mode of \\\"0600\\\" or less\npermissive.\n\nFirst determine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\n\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log file, check if the audit log has a mode of\n\\\"0600\\\" or less permissive with the following command:\n\n# sudo stat -c \\\"%a %n\\\" /var/log/audit/audit.log\n\n600 /var/log/audit/audit.log\n\nIf the audit log has a mode more permissive than \\\"0600\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit log to be protected from unauthorized read\naccess by setting the correct permissive mode with the following command:\n\n# sudo chmod 0600 [audit_log_file]\n\nReplace \\\"[audit_log_file]\\\" to the correct audit log path, by default this\nlocation is \\\"/var/log/audit/audit.log\\\".\"\n\n  log_file = auditd_conf.log_file\n\n  log_file_exists = !log_file.nil?\n  if log_file_exists\n    describe file(log_file) do\n      it { should_not be_more_permissive_than('0600') }\n    end\n  else\n    describe ('Audit log file '+ log_file + ' exists') do\n      subject { log_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75635.rb"},"results":[{"status":"passed","code_desc":"File /var/log/audit/audit.log should not be more permissive than \"0600\"","run_time":0.009314,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75827","title":"The Ubuntu operating system must not permit direct logons to the root\naccount using remote access via SSH.","desc":"Even though the communications channel may be encrypted, an additional\nlayer of security is gained by extending the policy of not logging on directly\nas root. In addition, logging on with a user-specific account provides\nindividual accountability of actions performed on the system.","descriptions":[{"label":"default","data":"Even though the communications channel may be encrypted, an additional\nlayer of security is gained by extending the policy of not logging on directly\nas root. In addition, logging on with a user-specific account provides\nindividual accountability of actions performed on the system."},{"label":"check","data":"Verify remote access using SSH prevents users from logging on\ndirectly as \"root\".\n\nCheck that SSH prevents users from logging on directly as \"root\" with the\nfollowing command:\n\n# grep PermitRootLogin /etc/ssh/sshd_config\nPermitRootLogin no\n\nIf the \"PermitRootLogin\" keyword is set to \"yes\", is missing, or is\ncommented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to stop users from logging\non remotely as the \"root\" user via SSH.\n\nEdit the appropriate  \"/etc/ssh/sshd_config\" file to uncomment or add the\nline for the \"PermitRootLogin\" keyword and set its value to \"no\":\n\nPermitRootLogin no\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75827","rid":"SV-90507r2_rule","stig_id":"UBTU-16-030220","fix_id":"F-82457r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75827\" do\n  title \"The Ubuntu operating system must not permit direct logons to the root\naccount using remote access via SSH.\"\n  desc  \"Even though the communications channel may be encrypted, an additional\nlayer of security is gained by extending the policy of not logging on directly\nas root. In addition, logging on with a user-specific account provides\nindividual accountability of actions performed on the system.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75827\"\n  tag \"rid\": \"SV-90507r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030220\"\n  tag \"fix_id\": \"F-82457r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify remote access using SSH prevents users from logging on\ndirectly as \\\"root\\\".\n\nCheck that SSH prevents users from logging on directly as \\\"root\\\" with the\nfollowing command:\n\n# grep PermitRootLogin /etc/ssh/sshd_config\nPermitRootLogin no\n\nIf the \\\"PermitRootLogin\\\" keyword is set to \\\"yes\\\", is missing, or is\ncommented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to stop users from logging\non remotely as the \\\"root\\\" user via SSH.\n\nEdit the appropriate  \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the\nline for the \\\"PermitRootLogin\\\" keyword and set its value to \\\"no\\\":\n\nPermitRootLogin no\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('PermitRootLogin') { should cmp 'no' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75827.rb"},"results":[{"status":"failed","code_desc":"SSHD Configuration PermitRootLogin should cmp == \"no\"","run_time":0.000583,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: \"no\"\n     got: \"prohibit-password\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-80961","title":"The Ubuntu operating system must notify the System Administrator (SA)\nand Information System Security Officer (ISSO) (at a minimum) when allocated\naudit record storage volume reaches 75% of the repository maximum audit record\nstorage capacity.","desc":"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.","descriptions":[{"label":"default","data":"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion."},{"label":"check","data":"Verify the Ubuntu operating system notifies the System\nAdministrator (SA) and Information System Security Officer (ISSO) (at a\nminimum) when allocated audit record storage volume reaches 75% of the\nrepository maximum audit record storage capacity.\n\nCheck the system configuration to determine the partition the audit records are\nbeing written to with the following command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nCheck the size of the partition that audit records are written to (with the\nexample being \"/var/log/audit/\"):\n\n# df -h /var/log/audit/\n1.0G /var/log/audit\n\nIf the audit records are not being written to a partition specifically created\nfor audit records (in this example \"/var/log/audit\" is a separate partition),\ndetermine the amount of space other files in the partition are currently\noccupying with the following command:\n\n# du -sh <partition>\n1.0G /var\n\nDetermine what the threshold is for the system to take action when 75% of the\nrepository maximum audit record storage capacity is reached:\n\n# grep -i space_left /etc/audit/auditd.conf\nspace_left = 250\n\nIf the value of the \"space_left\" keyword is not set to 25% of the total\npartition size, this is a finding."},{"label":"fix","data":"Configure the operating system to immediately notify the SA and\nISSO (at a minimum) when allocated audit record storage volume reaches 75% of\nthe repository maximum audit record storage capacity.\n\nCheck the system configuration to determine the partition the audit records are\nbeing written to:\n\n# grep log_file /etc/audit/auditd.conf\n\nDetermine the size of the partition that audit records are written to (with the\nexample being \"/var/log/audit/\"):\n\n# df -h /var/log/audit/\n\nSet the value of the \"space_left\" keyword in \"/etc/audit/auditd.conf\" to\n25% of the partition size."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000343-GPOS-00134","gid":"V-80961","rid":"SV-95673r1_rule","stig_id":"UBTU-16-020021","fix_id":"F-87821r1_fix","cci":["CCI-001855"],"nist":["AU-5 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-80961\" do\n  title \"The Ubuntu operating system must notify the System Administrator (SA)\nand Information System Security Officer (ISSO) (at a minimum) when allocated\naudit record storage volume reaches 75% of the repository maximum audit record\nstorage capacity.\"\n  desc  \"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000343-GPOS-00134\"\n  tag \"gid\": \"V-80961\"\n  tag \"rid\": \"SV-95673r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020021\"\n  tag \"fix_id\": \"F-87821r1_fix\"\n  tag \"cci\": [\"CCI-001855\"]\n  tag \"nist\": [\"AU-5 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system notifies the System\nAdministrator (SA) and Information System Security Officer (ISSO) (at a\nminimum) when allocated audit record storage volume reaches 75% of the\nrepository maximum audit record storage capacity.\n\nCheck the system configuration to determine the partition the audit records are\nbeing written to with the following command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nCheck the size of the partition that audit records are written to (with the\nexample being \\\"/var/log/audit/\\\"):\n\n# df -h /var/log/audit/\n1.0G /var/log/audit\n\nIf the audit records are not being written to a partition specifically created\nfor audit records (in this example \\\"/var/log/audit\\\" is a separate partition),\ndetermine the amount of space other files in the partition are currently\noccupying with the following command:\n\n# du -sh <partition>\n1.0G /var\n\nDetermine what the threshold is for the system to take action when 75% of the\nrepository maximum audit record storage capacity is reached:\n\n# grep -i space_left /etc/audit/auditd.conf\nspace_left = 250\n\nIf the value of the \\\"space_left\\\" keyword is not set to 25% of the total\npartition size, this is a finding.\"\n  desc \"fix\", \"Configure the operating system to immediately notify the SA and\nISSO (at a minimum) when allocated audit record storage volume reaches 75% of\nthe repository maximum audit record storage capacity.\n\nCheck the system configuration to determine the partition the audit records are\nbeing written to:\n\n# grep log_file /etc/audit/auditd.conf\n\nDetermine the size of the partition that audit records are written to (with the\nexample being \\\"/var/log/audit/\\\"):\n\n# df -h /var/log/audit/\n\nSet the value of the \\\"space_left\\\" keyword in \\\"/etc/audit/auditd.conf\\\" to\n25% of the partition size.\"\n\n  space_left_percent = input('space_left_percent')\n  audit_log_path = input('log_file_dir')\n  \n  describe filesystem(audit_log_path) do\n    its('percent_free') { should be >= space_left_percent }\n  end\n\n  partition_threshold_mb = (filesystem(audit_log_path).size_kb / 1024 * 0.25).to_i\n  system_alert_configuration_mb = auditd_conf.space_left.to_i\n\n  describe \"The space_left configuration\" do\n    subject { system_alert_configuration_mb }\n    it { should >= partition_threshold_mb }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-80961.rb"},"results":[{"status":"passed","code_desc":"FileSystem /var/log/audit/ percent_free should be >= 25","run_time":0.000165,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"failed","code_desc":"The space_left configuration should >= 15672","run_time":0.020654,"start_time":"2019-08-06T11:13:29-04:00","message":"expected: >= 15672\n     got:    75"}]},{"id":"V-75837","title":"The Ubuntu operating system for all network connections associated\nwith SSH traffic must immediately terminate at the end of the session or after\n10 minutes of inactivity.","desc":"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n    Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n    Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n    This capability is typically reserved for specific Ubuntu operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.","descriptions":[{"label":"default","data":"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n    Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n    Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n    This capability is typically reserved for specific Ubuntu operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance."},{"label":"check","data":"Verify that all network connections associated with SSH traffic\nare automatically terminated at the end of the session or after \"10\" minutes\nof inactivity.\n\nCheck that the \"ClientAliveInterval\" variable is set to a value of \"600\" or\nless by performing the following command:\n\n# sudo grep -i clientalive /etc/ssh/sshd_config\n\nClientAliveInterval 600\n\nClientAliveCountMax  1\n\nIf \"ClientAliveInterval\" or \"ClientAliveCountMax\" does not exist,\n\"ClientAliveInterval\" is not set to a value of \"600\" or less and\n\"ClientAliveCountMax\" is not set to a value of \"1\" or greater in\n\"/etc/ssh/sshd_config\", or either line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to automatically terminate\nall network connections associated with SSH traffic at the end of a session or\nafter a \"10\" minute period of inactivity.\n\nModify or append the following lines in the \"/etc/ssh/sshd_config\" file\nreplacing \"[Interval]\" with a value of \"600\" or less and \"[CountMax] with\na value of \"1\" or greater:\n\nClientAliveInterval 600\n\nClientAliveCountMax  1\n\nIn order for the changes to take effect, the SSH daemon must be restarted.\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000163-GPOS-00072","gid":"V-75837","rid":"SV-90517r2_rule","stig_id":"UBTU-16-030270","fix_id":"F-82467r2_fix","cci":["CCI-000879","CCI-001133","CCI-002361"],"nist":["MA-4 e","SC-10","AC-12","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75837\" do\n  title \"The Ubuntu operating system for all network connections associated\nwith SSH traffic must immediately terminate at the end of the session or after\n10 minutes of inactivity.\"\n  desc  \"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n    Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n    Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n    This capability is typically reserved for specific Ubuntu operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000163-GPOS-00072\"\n  tag \"gid\": \"V-75837\"\n  tag \"rid\": \"SV-90517r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030270\"\n  tag \"fix_id\": \"F-82467r2_fix\"\n  tag \"cci\": [\"CCI-000879\", \"CCI-001133\", \"CCI-002361\"]\n  tag \"nist\": [\"MA-4 e\", \"SC-10\", \"AC-12\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that all network connections associated with SSH traffic\nare automatically terminated at the end of the session or after \\\"10\\\" minutes\nof inactivity.\n\nCheck that the \\\"ClientAliveInterval\\\" variable is set to a value of \\\"600\\\" or\nless by performing the following command:\n\n# sudo grep -i clientalive /etc/ssh/sshd_config\n\nClientAliveInterval 600\n\nClientAliveCountMax  1\n\nIf \\\"ClientAliveInterval\\\" or \\\"ClientAliveCountMax\\\" does not exist,\n\\\"ClientAliveInterval\\\" is not set to a value of \\\"600\\\" or less and\n\\\"ClientAliveCountMax\\\" is not set to a value of \\\"1\\\" or greater in\n\\\"/etc/ssh/sshd_config\\\", or either line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to automatically terminate\nall network connections associated with SSH traffic at the end of a session or\nafter a \\\"10\\\" minute period of inactivity.\n\nModify or append the following lines in the \\\"/etc/ssh/sshd_config\\\" file\nreplacing \\\"[Interval]\\\" with a value of \\\"600\\\" or less and \\\"[CountMax] with\na value of \\\"1\\\" or greater:\n\nClientAliveInterval 600\n\nClientAliveCountMax  1\n\nIn order for the changes to take effect, the SSH daemon must be restarted.\n\n# sudo systemctl restart sshd.service\"\n\n  client_alive_interval = input('client_alive_interval')\n  client_alive_count_max = input('client_alive_count_max')\n\n  describe sshd_config do\n    its('ClientAliveInterval') { should be <= client_alive_interval }\n    its('ClientAliveCountMax') { should be >= client_alive_count_max }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75837.rb"},"results":[{"status":"failed","code_desc":"SSHD Configuration ClientAliveInterval should be <= 600","run_time":0.000513,"start_time":"2019-08-06T11:13:29-04:00","message":"expected: <= 600\n     got:    nil"},{"status":"failed","code_desc":"SSHD Configuration ClientAliveCountMax should be >= 1","run_time":0.000131,"start_time":"2019-08-06T11:13:29-04:00","message":"expected: >= 1\n     got:    nil"}]},{"id":"V-75625","title":"The System Administrator (SA) and Information System Security Officer\n(ISSO) (at a minimum) must be alerted of an audit processing failure event.","desc":"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n    Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n    This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.","descriptions":[{"label":"default","data":"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n    Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n    This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both."},{"label":"check","data":"Verify that the System Administrator (SA) and Information\nSystem Security Officer (ISSO) (at a minimum) are notified in the event of an\naudit processing failure.\n\nCheck that the Ubuntu operating system notifies the SA and ISSO (at a minimum)\nin the event of an audit processing failure with the following command:\n\n#sudo grep space_left_action /etc/audit/auditd.conf\n\naction_mail_acct = root\n\nIf the value of the \"action_mail_acct\" keyword is not set to \"root\" and/or\nother accounts for security personnel, the \"action_mail_acct\" keyword is\nmissing, or the retuned line is commented out, this is a finding."},{"label":"fix","data":"Configure \"auditd\" service to notify the System Administrator\n(SA) and Information System Security Officer (ISSO) in the event of an audit\nprocessing failure.\n\nEdit the following line in \"/etc/audit/auditd.conf\" to ensure that\nadministrators are notified via email for those situations:\n\naction_mail_acct = root"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000046-GPOS-00022","gid":"V-75625","rid":"SV-90305r2_rule","stig_id":"UBTU-16-020040","fix_id":"F-82253r1_fix","cci":["CCI-000139"],"nist":["AU-5 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75625\" do\n  title \"The System Administrator (SA) and Information System Security Officer\n(ISSO) (at a minimum) must be alerted of an audit processing failure event.\"\n  desc  \"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n    Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n    This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000046-GPOS-00022\"\n  tag \"gid\": \"V-75625\"\n  tag \"rid\": \"SV-90305r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020040\"\n  tag \"fix_id\": \"F-82253r1_fix\"\n  tag \"cci\": [\"CCI-000139\"]\n  tag \"nist\": [\"AU-5 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the System Administrator (SA) and Information\nSystem Security Officer (ISSO) (at a minimum) are notified in the event of an\naudit processing failure.\n\nCheck that the Ubuntu operating system notifies the SA and ISSO (at a minimum)\nin the event of an audit processing failure with the following command:\n\n#sudo grep space_left_action /etc/audit/auditd.conf\n\naction_mail_acct = root\n\nIf the value of the \\\"action_mail_acct\\\" keyword is not set to \\\"root\\\" and/or\nother accounts for security personnel, the \\\"action_mail_acct\\\" keyword is\nmissing, or the retuned line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure \\\"auditd\\\" service to notify the System Administrator\n(SA) and Information System Security Officer (ISSO) in the event of an audit\nprocessing failure.\n\nEdit the following line in \\\"/etc/audit/auditd.conf\\\" to ensure that\nadministrators are notified via email for those situations:\n\naction_mail_acct = root\"\n\n  security_accounts = input('security_accounts').join('|')\n  space_left_action = auditd_conf.space_left_action\n\n  describe \"System Administrator (SA) and Information System Security Officer (ISSO) are notified in the event of an audit processing failure\" do\n    subject { security_accounts.include?(space_left_action) }\n    it { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75625.rb"},"results":[{"status":"failed","code_desc":"System Administrator (SA) and Information System Security Officer (ISSO) are notified in the event of an audit processing failure should equal true","run_time":0.000118,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75765","title":"Successful/unsuccessful uses of the apparmor_parser command must\ngenerate an audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"apparmor_parser\" command\noccur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w apparmor_parser /etc/audit/audit.rules\n\n-a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"apparmor_parser\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75765","rid":"SV-90445r3_rule","stig_id":"UBTU-16-020700","fix_id":"F-82393r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75765\" do\n  title \"Successful/unsuccessful uses of the apparmor_parser command must\ngenerate an audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75765\"\n  tag \"rid\": \"SV-90445r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020700\"\n  tag \"fix_id\": \"F-82393r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"apparmor_parser\\\" command\noccur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w apparmor_parser /etc/audit/audit.rules\n\n-a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"apparmor_parser\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/sbin/apparmor_parser'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75765.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /sbin/apparmor_parser exist should equal true","run_time":9.7e-05,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75547","title":"Duplicate User IDs (UIDs) must not exist for interactive users.","desc":"To assure accountability and prevent unauthenticated access,\ninteractive users must be identified and authenticated to prevent potential\nmisuse and compromise of the system.\n\n    Interactive users include organizational employees or individuals the\norganization deems to have equivalent status of employees (e.g., contractors).\nInteractive users (and processes acting on behalf of users) must be uniquely\nidentified and authenticated to all accesses, except for the following:\n\n    1) Accesses explicitly identified and documented by the organization.\nOrganizations document specific user actions that can be performed on the\ninformation system without identification or authentication; and\n\n    2) Accesses that occur through authorized use of group authenticators\nwithout individual authentication. Organizations may require unique\nidentification of individuals in group accounts (e.g., shared privilege\naccounts) or for detailed accountability of individual activity.","descriptions":[{"label":"default","data":"To assure accountability and prevent unauthenticated access,\ninteractive users must be identified and authenticated to prevent potential\nmisuse and compromise of the system.\n\n    Interactive users include organizational employees or individuals the\norganization deems to have equivalent status of employees (e.g., contractors).\nInteractive users (and processes acting on behalf of users) must be uniquely\nidentified and authenticated to all accesses, except for the following:\n\n    1) Accesses explicitly identified and documented by the organization.\nOrganizations document specific user actions that can be performed on the\ninformation system without identification or authentication; and\n\n    2) Accesses that occur through authorized use of group authenticators\nwithout individual authentication. Organizations may require unique\nidentification of individuals in group accounts (e.g., shared privilege\naccounts) or for detailed accountability of individual activity."},{"label":"check","data":"Verify that the Ubuntu operating system contains no duplicate\nUser IDs (UIDs) for interactive users.\n\nCheck that the Ubuntu operating system contains no duplicate UIDs for\ninteractive users with the following command:\n\n# awk -F \":\" 'list[$3]++{print $1, $3}' /etc/passwd\n\nIf output is produced, and the accounts listed are interactive user accounts,\nthis is a finding."},{"label":"fix","data":"Edit the file \"/etc/passwd\" and provide each interactive user\naccount that has a duplicate User ID (UID) with a unique UID."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000104-GPOS-00051","satisfies":["SRG-OS-000104-GPOS-00051","SRG-OS-000121-GPOS-00062","SRG-OS-000134-GPOS-00068"],"gid":"V-75547","rid":"SV-90227r2_rule","stig_id":"UBTU-16-010660","fix_id":"F-82175r1_fix","cci":["CCI-000764","CCI-000804","CCI-001084"],"nist":["IA-2","IA-8","SC-3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75547\" do\n  title \"Duplicate User IDs (UIDs) must not exist for interactive users.\"\n  desc  \"To assure accountability and prevent unauthenticated access,\ninteractive users must be identified and authenticated to prevent potential\nmisuse and compromise of the system.\n\n    Interactive users include organizational employees or individuals the\norganization deems to have equivalent status of employees (e.g., contractors).\nInteractive users (and processes acting on behalf of users) must be uniquely\nidentified and authenticated to all accesses, except for the following:\n\n    1) Accesses explicitly identified and documented by the organization.\nOrganizations document specific user actions that can be performed on the\ninformation system without identification or authentication; and\n\n    2) Accesses that occur through authorized use of group authenticators\nwithout individual authentication. Organizations may require unique\nidentification of individuals in group accounts (e.g., shared privilege\naccounts) or for detailed accountability of individual activity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000104-GPOS-00051\"\n  tag \"satisfies\": [\"SRG-OS-000104-GPOS-00051\", \"SRG-OS-000121-GPOS-00062\",\n\"SRG-OS-000134-GPOS-00068\"]\n  tag \"gid\": \"V-75547\"\n  tag \"rid\": \"SV-90227r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010660\"\n  tag \"fix_id\": \"F-82175r1_fix\"\n  tag \"cci\": [\"CCI-000764\", \"CCI-000804\", \"CCI-001084\"]\n  tag \"nist\": [\"IA-2\", \"IA-8\", \"SC-3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system contains no duplicate\nUser IDs (UIDs) for interactive users.\n\nCheck that the Ubuntu operating system contains no duplicate UIDs for\ninteractive users with the following command:\n\n# awk -F \\\":\\\" 'list[$3]++{print $1, $3}' /etc/passwd\n\nIf output is produced, and the accounts listed are interactive user accounts,\nthis is a finding.\"\n  desc \"fix\", \"Edit the file \\\"/etc/passwd\\\" and provide each interactive user\naccount that has a duplicate User ID (UID) with a unique UID.\"\n  \n  non_interactive_shells = input('non_interactive_shells')\n\n  ignore_shells = non_interactive_shells.join('|')\n  user_list = command(\"awk -F \\\":\\\" 'list[$3]++{print $1}' /etc/passwd\").stdout.split(\"\\n\")\n  findings = Set[]\n  \n  user_list.each do |user_name|\n    findings = findings << user_name\n  end\n  describe \"Duplicate User IDs (UIDs) must not exist for interactive users\" do\n    subject { findings.to_a }\n    it { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75547.rb"},"results":[{"status":"passed","code_desc":"Duplicate User IDs (UIDs) must not exist for interactive users should be empty","run_time":0.000106,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75895","title":"A File Transfer Protocol (FTP) server package must not be installed\nunless needed.","desc":"The FTP service provides an unencrypted remote access that does not\nprovide for the confidentiality and integrity of user passwords or the remote\nsession. If a privileged user were to log on using this service, the privileged\nuser password could be compromised. SSH or other encrypted file transfer\nmethods must be used in place of this service.","descriptions":[{"label":"default","data":"The FTP service provides an unencrypted remote access that does not\nprovide for the confidentiality and integrity of user passwords or the remote\nsession. If a privileged user were to log on using this service, the privileged\nuser password could be compromised. SSH or other encrypted file transfer\nmethods must be used in place of this service."},{"label":"check","data":"Verify a File Transfer Protocol (FTP) server has not been\ninstalled on the system.\n\nCheck to see if a FTP server has been installed with the following commands:\n\n# dpkg -l | grep vsftpd\nii vsftpd 3.0.3-3Ubuntu2\n\nIf \"vsftpd\" is installed and is not documented with the Information System\nSecurity Officer (ISSO) as an operational requirement, this is a finding."},{"label":"fix","data":"Document the \"vsftpd\" package with the Information System\nSecurity Officer (ISSO) as an operational requirement or remove it from the\nsystem with the following command:\n\n# sudo apt-get remove vsftpd"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75895","rid":"SV-90575r1_rule","stig_id":"UBTU-16-030710","fix_id":"F-82525r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75895\" do\n  title \"A File Transfer Protocol (FTP) server package must not be installed\nunless needed.\"\n  desc  \"The FTP service provides an unencrypted remote access that does not\nprovide for the confidentiality and integrity of user passwords or the remote\nsession. If a privileged user were to log on using this service, the privileged\nuser password could be compromised. SSH or other encrypted file transfer\nmethods must be used in place of this service.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75895\"\n  tag \"rid\": \"SV-90575r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030710\"\n  tag \"fix_id\": \"F-82525r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify a File Transfer Protocol (FTP) server has not been\ninstalled on the system.\n\nCheck to see if a FTP server has been installed with the following commands:\n\n# dpkg -l | grep vsftpd\nii vsftpd 3.0.3-3Ubuntu2\n\nIf \\\"vsftpd\\\" is installed and is not documented with the Information System\nSecurity Officer (ISSO) as an operational requirement, this is a finding.\"\n  desc \"fix\", \"Document the \\\"vsftpd\\\" package with the Information System\nSecurity Officer (ISSO) as an operational requirement or remove it from the\nsystem with the following command:\n\n# sudo apt-get remove vsftpd\"\n\n  describe package('vsftpd') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75895.rb"},"results":[{"status":"passed","code_desc":"System Package vsftpd should not be installed","run_time":0.018081,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75687","title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/security/opasswd.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \"/etc/security/opasswd\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following\ncommand:\n\n# sudo grep /etc/security/opasswd /etc/audit/audit.rules\n\n-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \"/etc/security/opasswd\".\n\nAdd or update the following file system rule to \"/etc/audit/audit.rules\":\n\n-w /etc/security/opasswd -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000304-GPOS-00121","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000470-GPOS-00214","SRG-OS-000471-GPOS-00215"],"gid":"V-75687","rid":"SV-90367r3_rule","stig_id":"UBTU-16-020340","fix_id":"F-82315r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002132","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","AC-2 (4)","MA-4 (1)\n(a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75687\" do\n  title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/security/opasswd.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000304-GPOS-00121\",\n\"SRG-OS-000392-GPOS-00172\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000470-GPOS-00214\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75687\"\n  tag \"rid\": \"SV-90367r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020340\"\n  tag \"fix_id\": \"F-82315r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002132\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"AC-2 (4)\", \"MA-4 (1)\n(a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \\\"/etc/security/opasswd\\\".\n\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following\ncommand:\n\n# sudo grep /etc/security/opasswd /etc/audit/audit.rules\n\n-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \\\"/etc/security/opasswd\\\".\n\nAdd or update the following file system rule to \\\"/etc/audit/audit.rules\\\":\n\n-w /etc/security/opasswd -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/etc/security/opasswd'\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75687.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /etc/security/opasswd exist should equal true","run_time":0.000172,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75751","title":"Successful/unsuccessful uses of the openat command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"openat\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw openat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"openat\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75751","rid":"SV-90431r3_rule","stig_id":"UBTU-16-020630","fix_id":"F-82379r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75751\" do\n  title \"Successful/unsuccessful uses of the openat command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75751\"\n  tag \"rid\": \"SV-90431r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020630\"\n  tag \"fix_id\": \"F-82379r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"openat\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw openat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"openat\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"openat\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EPERM' }\n  end\n  describe auditd.syscall(\"openat\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EACCES' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75751.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"openat\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000157,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"openat\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000124,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"openat\" arch == \"b64\" exit.uniq should include \"-EPERM\"","run_time":0.000153,"start_time":"2019-08-06T11:13:29-04:00","message":"expected [] to include \"-EPERM\""},{"status":"failed","code_desc":"Auditd Rules with syscall == \"openat\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000125,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"openat\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000129,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"openat\" arch == \"b64\" exit.uniq should include \"-EACCES\"","run_time":0.000131,"start_time":"2019-08-06T11:13:29-04:00","message":"expected [] to include \"-EACCES\""}]},{"id":"V-75611","title":"System commands must have mode 0755 or less permissive.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":[{"label":"default","data":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications."},{"label":"check","data":"Verify the system commands contained in the following\ndirectories have mode \"0755\" or less permissive.\n\nCheck that the system command files contained in the following directories have\nmode \"0755\" or less permissive with the following command:\n\n# find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm\n/022 | xargs ls -la\n\nIf any system commands are found to be group-writable or world-writable, this\nis a finding."},{"label":"fix","data":"Configure the system commands to be protected from unauthorized\naccess.\n\nRun the following command, replacing \"[FILE]\" with any system command with a\nmode more permissive than \"0755\".\n\n# sudo chmod 0755 [FILE]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-75611","rid":"SV-90291r2_rule","stig_id":"UBTU-16-011030","fix_id":"F-82239r2_fix","cci":["CCI-001499"],"nist":["CM-5 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75611\" do\n  title \"System commands must have mode 0755 or less permissive.\"\n  desc  \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000259-GPOS-00100\"\n  tag \"gid\": \"V-75611\"\n  tag \"rid\": \"SV-90291r2_rule\"\n  tag \"stig_id\": \"UBTU-16-011030\"\n  tag \"fix_id\": \"F-82239r2_fix\"\n  tag \"cci\": [\"CCI-001499\"]\n  tag \"nist\": [\"CM-5 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system commands contained in the following\ndirectories have mode \\\"0755\\\" or less permissive.\n\nCheck that the system command files contained in the following directories have\nmode \\\"0755\\\" or less permissive with the following command:\n\n# find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm\n/022 | xargs ls -la\n\nIf any system commands are found to be group-writable or world-writable, this\nis a finding.\"\n  desc \"fix\", \"Configure the system commands to be protected from unauthorized\naccess.\n\nRun the following command, replacing \\\"[FILE]\\\" with any system command with a\nmode more permissive than \\\"0755\\\".\n\n# sudo chmod 0755 [FILE]\"\n\n  system_commands = command('find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022').stdout.strip.split(\"\\n\").entries\n  valid_system_commands = Set[]\n\n  if system_commands.count > 0\n    system_commands.each do |sys_cmd|\n      if file(sys_cmd).exist?\n        valid_system_commands = valid_system_commands << sys_cmd\n      end\n    end\n  end\n\n  if valid_system_commands.count > 0\n    valid_system_commands.each do |val_sys_cmd|\n      describe file(val_sys_cmd) do\n        it { should_not be_more_permissive_than('0755') }\n      end\n    end\n  else\n    describe \"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are less permissive than 0755\" do\n      subject { valid_system_commands }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75611.rb"},"results":[{"status":"passed","code_desc":"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are less permissive than 0755 count should eq 0","run_time":8.3e-05,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75491","title":"Temporary user accounts must be provisioned with an expiration time of\n72 hours or less.","desc":"If temporary user accounts remain active when no longer needed or for\nan excessive period, these accounts may be used to gain unauthorized access. To\nmitigate this risk, automated termination of all temporary accounts must be set\nupon account creation.\n\n    Temporary accounts are established as part of normal account activation\nprocedures when there is a need for short-term accounts without the demand for\nimmediacy in account activation.\n\n    If temporary accounts are used, the Ubuntu operating system must be\nconfigured to automatically terminate these types of accounts after a\nDoD-defined time period of 72 hours.\n\n    To address access requirements, many Ubuntu operating systems may be\nintegrated with enterprise-level authentication/access mechanisms that meet or\nexceed access control policy requirements.","descriptions":[{"label":"default","data":"If temporary user accounts remain active when no longer needed or for\nan excessive period, these accounts may be used to gain unauthorized access. To\nmitigate this risk, automated termination of all temporary accounts must be set\nupon account creation.\n\n    Temporary accounts are established as part of normal account activation\nprocedures when there is a need for short-term accounts without the demand for\nimmediacy in account activation.\n\n    If temporary accounts are used, the Ubuntu operating system must be\nconfigured to automatically terminate these types of accounts after a\nDoD-defined time period of 72 hours.\n\n    To address access requirements, many Ubuntu operating systems may be\nintegrated with enterprise-level authentication/access mechanisms that meet or\nexceed access control policy requirements."},{"label":"check","data":"Verify that temporary accounts have been provisioned with an\nexpiration date for 72 hours.\n\nFor every existing temporary account, run the following command to obtain its\naccount expiration information.\n\n# sudo chage -l system_account_name\n\nVerify each of these accounts has an expiration date set within 72 hours.\nIf any temporary accounts have no expiration date set or do not expire within\n72 hours, this is a finding."},{"label":"fix","data":"If a temporary account must be created configure the system to\nterminate the account after a 72 hour time period with the following command to\nset an expiration date on it. Substitute \"system_account_name\" with the\naccount to be created.\n\n# sudo chage -E `date -d \"+3 days\" +%Y-%m-%d` system_account_name"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000002-GPOS-00002","gid":"V-75491","rid":"SV-90171r1_rule","stig_id":"UBTU-16-010310","fix_id":"F-82119r1_fix","cci":["CCI-000016"],"nist":["AC-2 (2)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75491\" do\n  title \"Temporary user accounts must be provisioned with an expiration time of\n72 hours or less.\"\n  desc  \"If temporary user accounts remain active when no longer needed or for\nan excessive period, these accounts may be used to gain unauthorized access. To\nmitigate this risk, automated termination of all temporary accounts must be set\nupon account creation.\n\n    Temporary accounts are established as part of normal account activation\nprocedures when there is a need for short-term accounts without the demand for\nimmediacy in account activation.\n\n    If temporary accounts are used, the Ubuntu operating system must be\nconfigured to automatically terminate these types of accounts after a\nDoD-defined time period of 72 hours.\n\n    To address access requirements, many Ubuntu operating systems may be\nintegrated with enterprise-level authentication/access mechanisms that meet or\nexceed access control policy requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000002-GPOS-00002\"\n  tag \"gid\": \"V-75491\"\n  tag \"rid\": \"SV-90171r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010310\"\n  tag \"fix_id\": \"F-82119r1_fix\"\n  tag \"cci\": [\"CCI-000016\"]\n  tag \"nist\": [\"AC-2 (2)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that temporary accounts have been provisioned with an\nexpiration date for 72 hours.\n\nFor every existing temporary account, run the following command to obtain its\naccount expiration information.\n\n# sudo chage -l system_account_name\n\nVerify each of these accounts has an expiration date set within 72 hours.\nIf any temporary accounts have no expiration date set or do not expire within\n72 hours, this is a finding.\"\n  desc \"fix\", \"If a temporary account must be created configure the system to\nterminate the account after a 72 hour time period with the following command to\nset an expiration date on it. Substitute \\\"system_account_name\\\" with the\naccount to be created.\n\n# sudo chage -E `date -d \\\"+3 days\\\" +%Y-%m-%d` system_account_name\"\n\n  temporary_accounts = input('temporary_accounts')\n\n  if temporary_accounts.empty?\n    describe \"Temporary accounts\" do\n      it { should be_empty }\n    end\n  else\n    temporary_accounts.each do |acct|\n      describe command(\"sudo chage -l #{acct} | grep 'Account expires'\") do\n        its('stdout.strip') { should_not match %r{:\\s*never} }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75491.rb"},"results":[{"status":"failed","code_desc":"Temporary accounts should be empty","run_time":0.00014,"start_time":"2019-08-06T11:13:29-04:00","message":"expected `\"Temporary accounts\".empty?` to return true, got false"}]},{"id":"V-75803","title":"An application firewall must be installed.","desc":"Uncomplicated Firewall provides a easy and effective way to\nblock/limit remote access to the system, via ports, services and protocols.\n\n    Remote access services, such as those providing remote access to network\ndevices and information systems, which lack automated control capabilities,\nincrease risk and make remote user access management difficult at best.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).","descriptions":[{"label":"default","data":"Uncomplicated Firewall provides a easy and effective way to\nblock/limit remote access to the system, via ports, services and protocols.\n\n    Remote access services, such as those providing remote access to network\ndevices and information systems, which lack automated control capabilities,\nincrease risk and make remote user access management difficult at best.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets)."},{"label":"check","data":"Verify that the Uncomplicated Firewall is installed.\n\nCheck that the Uncomplicated Firewall is installed with the following command:\n\n# sudo apt list ufw\n\nii  ufw         0.35-0Ubuntu2 [installed]\n\nIf the \"ufw\" package is not installed, ask the System Administrator if\nanother application firewall is installed. If no application firewall is\ninstalled this is a finding."},{"label":"fix","data":"Install Uncomplicated Firewall with the following command:\n\n# sudo apt-get install ufw"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000297-GPOS-00115","gid":"V-75803","rid":"SV-90483r2_rule","stig_id":"UBTU-16-030030","fix_id":"F-82433r1_fix","cci":["CCI-002314"],"nist":["AC-17 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75803\" do\n  title \"An application firewall must be installed.\"\n  desc  \"Uncomplicated Firewall provides a easy and effective way to\nblock/limit remote access to the system, via ports, services and protocols.\n\n    Remote access services, such as those providing remote access to network\ndevices and information systems, which lack automated control capabilities,\nincrease risk and make remote user access management difficult at best.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000297-GPOS-00115\"\n  tag \"gid\": \"V-75803\"\n  tag \"rid\": \"SV-90483r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030030\"\n  tag \"fix_id\": \"F-82433r1_fix\"\n  tag \"cci\": [\"CCI-002314\"]\n  tag \"nist\": [\"AC-17 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Uncomplicated Firewall is installed.\n\nCheck that the Uncomplicated Firewall is installed with the following command:\n\n# sudo apt list ufw\n\nii  ufw         0.35-0Ubuntu2 [installed]\n\nIf the \\\"ufw\\\" package is not installed, ask the System Administrator if\nanother application firewall is installed. If no application firewall is\ninstalled this is a finding.\"\n  desc \"fix\", \"Install Uncomplicated Firewall with the following command:\n\n# sudo apt-get install ufw\"\n\n  describe package('ufw') do\n    it { should be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75803.rb"},"results":[{"status":"passed","code_desc":"System Package ufw should be installed","run_time":0.021274,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75573","title":"Local initialization files must not execute world-writable programs.","desc":null,"descriptions":[],"impact":0.5,"refs":[],"tags":{},"code":"control \"V-75573\" do\n  title \"Local initialization files must not execute world-writable programs.\"\n  if disable_slow_controls\n    desc \"This control consistently takes a long to run and has been disabled\n          using the disable_slow_controls attribute.\"\n  else\n  desc  \"If user start-up files execute world-writable programs, especially in\nunprotected directories, they could be maliciously modified to destroy user\nfiles or otherwise compromise the system at the user level. If the system is\ncompromised at the user level, it is easier to elevate privileges to eventually\ncompromise the system at the root and network level.\"\n  end\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75573\"\n  tag \"rid\": \"SV-90253r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010790\"\n  tag \"fix_id\": \"F-82201r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that local initialization files do not execute\nworld-writable programs.\n\nCheck the system for world-writable files with the following command:\n\n# sudo find / -perm -002 -type f -exec ls -ld {} \\\\; | more\n\nFor all files listed, check for their presence in the local initialization\nfiles with the following commands:\n\nNote: The example will be for a system that is configured to create users’ home\ndirectories in the \\\"/home\\\" directory.\n\n# grep <file> /home/*/.*\n\nIf any local initialization files are found to reference world-writable files,\nthis is a finding.\"\n  desc \"fix\", \"Set the mode on files being executed by the local initialization\nfiles with the following command:\n\n# chmod 0755 <file>\"\n\n  disable_slow_controls = input('disable_slow_controls')\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  if disable_slow_controls\n    describe \"This control consistently takes a long to run and has been disabled\n  using the DISABLE_SLOW_CONTROLS attribute.\" do\n      skip \"This control consistently takes a long to run and has been disabled\n  using the DISABLE_SLOW_CONTROLS attribute. You must enable this control for a\n  full accredidation for production.\"\n  end\n  else\n    ignore_shells = non_interactive_shells.join('|')\n    \n    #Get home directory for users with UID >= 1000 or UID == 0 and support interactive logins.\n    dotfiles = Set[]\n    u = users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries\n    #For each user, build and execute a find command that identifies initialization files\n    #in a user's home directory.\n    u.each do |user|\n      dotfiles = dotfiles + command(\"find #{user.home} -xdev -maxdepth 2 -name '.*' ! -name \\\".bash_history\\\" -type f\").stdout.split(\"\\n\")\n    end\n    ww_files = Set[]\n    ww_files = command('find / -perm -002 -type f -exec ls {} \\;').stdout.lines\n    #Check each dotfile for existence of each world-writeable file\n    findings = Set[]\n    dotfiles.each do |dotfile|\n      dotfile = dotfile.strip\n      ww_files.each do |ww_file|\n        ww_file = ww_file.strip\n        count = command(\"grep -c \\\"#{ww_file}\\\" \\\"#{dotfile}\\\"\").stdout.strip.to_i\n        findings << dotfile if count > 0\n      end\n    end\n    describe \"Local initialization files that are found to reference world-writable files\" do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75573.rb"},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/V-75573.rb:1 ","run_time":0.02347,"start_time":"2019-08-06T11:13:29-04:00","message":"undefined local variable or method `disable_slow_controls' for #<#<Class:0x00007fbcc8d54008>:0x00007fbcd0002b90>","exception":"RuntimeError","backtrace":["/usr/local/lib/ruby/gems/2.6.0/gems/inspec-4.10.4/lib/inspec/rule.rb:64:in `block (2 levels) in initialize'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:257:in `instance_exec'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:257:in `block in run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:503:in `block in with_around_and_singleton_context_hooks'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:460:in `block in with_around_example_hooks'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/hooks.rb:464:in `block in run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/hooks.rb:602:in `run_around_example_hooks_for'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/hooks.rb:464:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:460:in `with_around_example_hooks'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:503:in `with_around_and_singleton_context_hooks'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example.rb:254:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:633:in `block in run_examples'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:629:in `map'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:629:in `run_examples'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:595:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:596:in `block in run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:596:in `map'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/example_group.rb:596:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/runner.rb:116:in `block (3 levels) in run_specs'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/runner.rb:116:in `map'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/runner.rb:116:in `block (2 levels) in run_specs'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/configuration.rb:2008:in `with_suite_hooks'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/runner.rb:111:in `block in run_specs'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/reporter.rb:74:in `report'","/usr/local/lib/ruby/gems/2.6.0/gems/rspec-core-3.8.2/lib/rspec/core/runner.rb:110:in `run_specs'","/usr/local/lib/ruby/gems/2.6.0/gems/inspec-4.10.4/lib/inspec/runner_rspec.rb:75:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/inspec-4.10.4/lib/inspec/runner.rb:151:in `run_tests'","/usr/local/lib/ruby/gems/2.6.0/gems/inspec-4.10.4/lib/inspec/runner.rb:122:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/inspec-4.10.4/lib/inspec/cli.rb:293:in `exec'","/usr/local/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/command.rb:27:in `run'","/usr/local/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/invocation.rb:126:in `invoke_command'","/usr/local/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor.rb:387:in `dispatch'","/usr/local/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/base.rb:466:in `start'","/usr/local/lib/ruby/gems/2.6.0/gems/inspec-4.10.4/lib/inspec/base_cli.rb:33:in `start'","/usr/local/lib/ruby/gems/2.6.0/gems/inspec-bin-4.10.4/bin/inspec:11:in `<top (required)>'","/usr/local/lib/ruby/gems/2.6.0/bin/inspec:23:in `load'","/usr/local/lib/ruby/gems/2.6.0/bin/inspec:23:in `<main>'"]}]},{"id":"V-75871","title":"For Ubuntu operating systems using Domain Name Servers (DNS)\nresolution, at least two name servers must be configured.","desc":"To provide availability for name resolution services, multiple\nredundant name servers are mandated. A failure in name resolution could lead to\nthe failure of security functions requiring name resolution, which may include\ntime synchronization, centralized authentication, and remote system logging.","descriptions":[{"label":"default","data":"To provide availability for name resolution services, multiple\nredundant name servers are mandated. A failure in name resolution could lead to\nthe failure of security functions requiring name resolution, which may include\ntime synchronization, centralized authentication, and remote system logging."},{"label":"check","data":"Determine whether the Ubuntu operating system is using local or\nDomain Name Server (DNS) name resolution with the following command:\n\n# grep hosts /etc/nsswitch.conf\nhosts:   files dns\n\nIf the DNS entry is missing from the host’s line in the \"/etc/nsswitch.conf\"\nfile, the \"/etc/resolv.conf\" file must be empty.\n\nIf the \"/etc/resolv.conf\" file is not empty, this is a finding.\n\nIf the DNS entry is found on the host’s line of the \"/etc/nsswitch.conf\"\nfile, verify the Ubuntu operating system is configured to use two or more name\nservers for DNS resolution.\n\nDetermine the name servers used by the system with the following command:\n\n# sudo grep nameserver /etc/resolv.conf\n\nnameserver 192.168.1.2\n\nnameserver 192.168.1.3\n\nIf less than two lines are returned that are not commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to use two or more name\nservers for Domain Name Server (DNS) resolution.\n\nEdit the \"/etc/resolv.conf\" file to uncomment or add the two or more\n\"nameserver\" option lines with the IP address of local authoritative name\nservers. If local host resolution is being performed, the \"/etc/resolv.conf\"\nfile must be empty. An empty \"/etc/resolv.conf\" file can be created as\nfollows:\n\n# echo -n > /etc/resolv.conf"}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75871","rid":"SV-90551r2_rule","stig_id":"UBTU-16-030520","fix_id":"F-82501r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75871\" do\n  title \"For Ubuntu operating systems using Domain Name Servers (DNS)\nresolution, at least two name servers must be configured.\"\n  desc  \"To provide availability for name resolution services, multiple\nredundant name servers are mandated. A failure in name resolution could lead to\nthe failure of security functions requiring name resolution, which may include\ntime synchronization, centralized authentication, and remote system logging.\"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75871\"\n  tag \"rid\": \"SV-90551r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030520\"\n  tag \"fix_id\": \"F-82501r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Determine whether the Ubuntu operating system is using local or\nDomain Name Server (DNS) name resolution with the following command:\n\n# grep hosts /etc/nsswitch.conf\nhosts:   files dns\n\nIf the DNS entry is missing from the host’s line in the \\\"/etc/nsswitch.conf\\\"\nfile, the \\\"/etc/resolv.conf\\\" file must be empty.\n\nIf the \\\"/etc/resolv.conf\\\" file is not empty, this is a finding.\n\nIf the DNS entry is found on the host’s line of the \\\"/etc/nsswitch.conf\\\"\nfile, verify the Ubuntu operating system is configured to use two or more name\nservers for DNS resolution.\n\nDetermine the name servers used by the system with the following command:\n\n# sudo grep nameserver /etc/resolv.conf\n\nnameserver 192.168.1.2\n\nnameserver 192.168.1.3\n\nIf less than two lines are returned that are not commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to use two or more name\nservers for Domain Name Server (DNS) resolution.\n\nEdit the \\\"/etc/resolv.conf\\\" file to uncomment or add the two or more\n\\\"nameserver\\\" option lines with the IP address of local authoritative name\nservers. If local host resolution is being performed, the \\\"/etc/resolv.conf\\\"\nfile must be empty. An empty \\\"/etc/resolv.conf\\\" file can be created as\nfollows:\n\n# echo -n > /etc/resolv.conf\"\n\n  describe file('/etc/nsswitch.conf') do\n    it { should exist }\n  end\n\n  options = {\n    assignment_regex: /^\\s*([^:]*?)\\s*:\\s*(.*?)\\s*$/\n  }\n\n  dns_entry_exists = parse_config_file('/etc/nsswitch.conf',options).params('hosts').match?(%r(dns))\n  if dns_entry_exists\n    describe \"DNS entry exists in /etc/nsswitch.conf\" do\n      subject { dns_entry_exists }\n      it { should be true }\n    end\n  else\n    describe file('/etc/resolv.conf') do\n      its('content') { should match %r(/^(?!(#.*)).+/m) }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75871.rb"},"results":[{"status":"passed","code_desc":"File /etc/nsswitch.conf should exist","run_time":0.011922,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"DNS entry exists in /etc/nsswitch.conf should equal true","run_time":0.000124,"start_time":"2019-08-06T11:13:29-04:00"}]},{"id":"V-75723","title":"The audit system must be configured to audit any usage of the\nremovexattr system call.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \"removexattr\" system call, by running the following\ncommand:\n\n# sudo grep -w removexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"removexattr\" system call, by adding the following lines to\n\"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000458-GPOS-00203","SRG-OS-000462-GPOS-00206","SRG-OS-000463-GPOS-00207","SRG-OS-000471-GPOS-00215","SRG-OS-000474-GPOS-00219"],"gid":"V-75723","rid":"SV-90403r2_rule","stig_id":"UBTU-16-020490","fix_id":"F-82351r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75723\" do\n  title \"The audit system must be configured to audit any usage of the\nremovexattr system call.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000458-GPOS-00203\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000463-GPOS-00207\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000474-GPOS-00219\"]\n  tag \"gid\": \"V-75723\"\n  tag \"rid\": \"SV-90403r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020490\"\n  tag \"fix_id\": \"F-82351r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \\\"removexattr\\\" system call, by running the following\ncommand:\n\n# sudo grep -w removexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"removexattr\\\" system call, by adding the following lines to\n\\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"removexattr\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75723.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"removexattr\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000177,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"removexattr\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000128,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75663","title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/group.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \"/etc/group\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following\ncommand:\n\n# sudo grep /etc/group /etc/audit/audit.rules\n\n-w /etc/group -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \"/etc/group\".\n\nAdd or update the following file system rule to \"/etc/audit/audit.rules\":\n\n-w /etc/group -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000304-GPOS-00121","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000470-GPOS-00214","SRG-OS-000471-GPOS-00215"],"gid":"V-75663","rid":"SV-90343r3_rule","stig_id":"UBTU-16-020310","fix_id":"F-82291r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002132","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","AC-2 (4)","MA-4 (1)\n(a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75663\" do\n  title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/group.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000304-GPOS-00121\",\n\"SRG-OS-000392-GPOS-00172\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000470-GPOS-00214\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75663\"\n  tag \"rid\": \"SV-90343r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020310\"\n  tag \"fix_id\": \"F-82291r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002132\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"AC-2 (4)\", \"MA-4 (1)\n(a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \\\"/etc/group\\\".\n\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following\ncommand:\n\n# sudo grep /etc/group /etc/audit/audit.rules\n\n-w /etc/group -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \\\"/etc/group\\\".\n\nAdd or update the following file system rule to \\\"/etc/audit/audit.rules\\\":\n\n-w /etc/group -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/etc/group'\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75663.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /etc/group exist should equal true","run_time":0.000108,"start_time":"2019-08-06T11:13:29-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75441","title":"Ubuntu operating system sessions must be automatically logged out\nafter 15 minutes of inactivity.","desc":"An Ubuntu operating system needs to be able to identify when a user's\nsessions has idled for longer than 15 minutes. The Ubuntu operating system must\nlogout a users' session after 15 minutes to prevent anyone from gaining access\nto the machine while the user is away.","descriptions":[{"label":"default","data":"An Ubuntu operating system needs to be able to identify when a user's\nsessions has idled for longer than 15 minutes. The Ubuntu operating system must\nlogout a users' session after 15 minutes to prevent anyone from gaining access\nto the machine while the user is away."},{"label":"check","data":"Verify the Ubuntu operating system initiates a session logout\nafter a \"15\" minutes of inactivity.\n\nCheck that the proper auto logout script exists with the following command:\n\n# cat /etc/profile.d/autologout.sh\nTMOUT=900\nreadonly TMOUT\nexport TMOUT\n\nIf the file \"/etc/profile.d/autologout.sh\" does not exist, the timeout values\nare commented out, the output from the function call are not the same, this is\na finding."},{"label":"fix","data":"Configure the Ubuntu operating system to initiate a session\nlogout after a \"15\" minutes of inactivity.\n\nCreate a file to contain the system-wide session auto logout script (if it does\nnot already exist) with the following command:\n\n# sudo touch /etc/profile.d/autologout.sh\n\nAdd the following lines to the \"/etc/profile.d/autologout.sh\" script:\n\nTMOUT=900\nreadonly TMOUT\nexport TMOUT"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-75441","rid":"SV-90121r2_rule","stig_id":"UBTU-16-010060","fix_id":"F-82069r2_fix","cci":["CCI-000057"],"nist":["AC-11 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75441\" do\n  title \"Ubuntu operating system sessions must be automatically logged out\nafter 15 minutes of inactivity.\"\n  desc  \"An Ubuntu operating system needs to be able to identify when a user's\nsessions has idled for longer than 15 minutes. The Ubuntu operating system must\nlogout a users' session after 15 minutes to prevent anyone from gaining access\nto the machine while the user is away.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000029-GPOS-00010\"\n  tag \"gid\": \"V-75441\"\n  tag \"rid\": \"SV-90121r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010060\"\n  tag \"fix_id\": \"F-82069r2_fix\"\n  tag \"cci\": [\"CCI-000057\"]\n  tag \"nist\": [\"AC-11 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system initiates a session logout\nafter a \\\"15\\\" minutes of inactivity.\n\nCheck that the proper auto logout script exists with the following command:\n\n# cat /etc/profile.d/autologout.sh\nTMOUT=900\nreadonly TMOUT\nexport TMOUT\n\nIf the file \\\"/etc/profile.d/autologout.sh\\\" does not exist, the timeout values\nare commented out, the output from the function call are not the same, this is\na finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to initiate a session\nlogout after a \\\"15\\\" minutes of inactivity.\n\nCreate a file to contain the system-wide session auto logout script (if it does\nnot already exist) with the following command:\n\n# sudo touch /etc/profile.d/autologout.sh\n\nAdd the following lines to the \\\"/etc/profile.d/autologout.sh\\\" script:\n\nTMOUT=900\nreadonly TMOUT\nexport TMOUT\"\n\n  describe file('/etc/profile.d/autologout.sh') do\n    it { should exist }\n    its('content') { should match /^\\s*TMOUT=900\\s*$/ }\n    its('content') { should match /^\\s*readonly\\s+TMOUT\\s*$/ }\n    its('content') { should match /^\\s*export\\s+TMOUT\\s*$/ }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75441.rb"},"results":[{"status":"failed","code_desc":"File /etc/profile.d/autologout.sh should exist","run_time":0.010208,"start_time":"2019-08-06T11:13:29-04:00","message":"expected File /etc/profile.d/autologout.sh to exist"},{"status":"failed","code_desc":"File /etc/profile.d/autologout.sh content should match /^\\s*TMOUT=900\\s*$/","run_time":0.020803,"start_time":"2019-08-06T11:13:29-04:00","message":"expected nil to match /^\\s*TMOUT=900\\s*$/"},{"status":"failed","code_desc":"File /etc/profile.d/autologout.sh content should match /^\\s*readonly\\s+TMOUT\\s*$/","run_time":0.00014,"start_time":"2019-08-06T11:13:29-04:00","message":"expected nil to match /^\\s*readonly\\s+TMOUT\\s*$/"},{"status":"failed","code_desc":"File /etc/profile.d/autologout.sh content should match /^\\s*export\\s+TMOUT\\s*$/","run_time":0.000103,"start_time":"2019-08-06T11:13:29-04:00","message":"expected nil to match /^\\s*export\\s+TMOUT\\s*$/"}]},{"id":"V-75501","title":"There must be no shosts.equiv files on the Ubuntu operating system.","desc":"The shosts.equiv files are used to configure host-based authentication\nfor the system via SSH. Host-based authentication is not sufficient for\npreventing unauthorized access to the system, as it does not require\ninteractive identification and authentication of a connection request, or for\nthe use of two-factor authentication.","descriptions":[{"label":"default","data":"The shosts.equiv files are used to configure host-based authentication\nfor the system via SSH. Host-based authentication is not sufficient for\npreventing unauthorized access to the system, as it does not require\ninteractive identification and authentication of a connection request, or for\nthe use of two-factor authentication."},{"label":"check","data":"Verify there are no \"shosts.equiv\" files on the Ubuntu\noperating system.\n\nCheck for the existence of these files with the following command:\n\n# find / -name shosts.equiv\n\nIf a \"shosts.equiv\" file is found, this is a finding."},{"label":"fix","data":"Remove any found \"shosts.equiv\" files from the Ubuntu operating\nsystem.\n\n# rm /etc/ssh/shosts.equiv"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75501","rid":"SV-90181r2_rule","stig_id":"UBTU-16-010360","fix_id":"F-82129r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75501\" do\n  title \"There must be no shosts.equiv files on the Ubuntu operating system.\"\n  desc  \"The shosts.equiv files are used to configure host-based authentication\nfor the system via SSH. Host-based authentication is not sufficient for\npreventing unauthorized access to the system, as it does not require\ninteractive identification and authentication of a connection request, or for\nthe use of two-factor authentication.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75501\"\n  tag \"rid\": \"SV-90181r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010360\"\n  tag \"fix_id\": \"F-82129r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify there are no \\\"shosts.equiv\\\" files on the Ubuntu\noperating system.\n\nCheck for the existence of these files with the following command:\n\n# find / -name shosts.equiv\n\nIf a \\\"shosts.equiv\\\" file is found, this is a finding.\"\n  desc \"fix\", \"Remove any found \\\"shosts.equiv\\\" files from the Ubuntu operating\nsystem.\n\n# rm /etc/ssh/shosts.equiv\"\n\n  describe command(\"sudo find / -name shosts.equiv\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75501.rb"},"results":[{"status":"passed","code_desc":"Command: `sudo find / -name shosts.equiv` exit_status should eq 0","run_time":0.627935,"start_time":"2019-08-06T11:13:29-04:00"},{"status":"passed","code_desc":"Command: `sudo find / -name shosts.equiv` stdout.strip should be empty","run_time":0.000147,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75781","title":"Successful/unsuccessful uses of the gpasswd command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"gpasswd\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w gpasswd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"gpasswd\" command. Add or update the\nfollowing rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75781","rid":"SV-90461r3_rule","stig_id":"UBTU-16-020780","fix_id":"F-82411r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75781\" do\n  title \"Successful/unsuccessful uses of the gpasswd command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75781\"\n  tag \"rid\": \"SV-90461r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020780\"\n  tag \"fix_id\": \"F-82411r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"gpasswd\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w gpasswd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"gpasswd\\\" command. Add or update the\nfollowing rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/gpasswd'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75781.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/gpasswd exist should equal true","run_time":0.000129,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75657","title":"Audit tools must be group-owned by root.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":[{"label":"default","data":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators."},{"label":"check","data":"Verify the audit tools are group-owned by \"root\" to prevent\nany unauthorized access, deletion, or modification.\n\nCheck the owner of each audit tool by running the following commands:\n\n# ls -la /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace\n/sbin/auditd /sbin/audispd /sbin/augenrules\n-rwxr-xr-x 1 root root 97128 Jan 18 2016 /sbin/augenrules\n\nIf any of the audit tools are not group-owned by \"root\", this is a finding."},{"label":"fix","data":"Configure the audit tools to be group-owned by \"root\", by\nrunning the following command:\n\n# sudo chgrp root [audit_tool]\n\nReplace \"[audit_tool]\" with each audit tool not group-owned by \"root\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000256-GPOS-00097","satisfies":["SRG-OS-000256-GPOS-00097","SRG-OS-000257-GPOS-00098","SRG-OS-000258-GPOS-00099"],"gid":"V-75657","rid":"SV-90337r2_rule","stig_id":"UBTU-16-020200","fix_id":"F-82285r2_fix","cci":["CCI-001493","CCI-001494","CCI-001495"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75657\" do\n  title \"Audit tools must be group-owned by root.\"\n  desc  \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000256-GPOS-00097\"\n  tag \"satisfies\": [\"SRG-OS-000256-GPOS-00097\", \"SRG-OS-000257-GPOS-00098\",\n\"SRG-OS-000258-GPOS-00099\"]\n  tag \"gid\": \"V-75657\"\n  tag \"rid\": \"SV-90337r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020200\"\n  tag \"fix_id\": \"F-82285r2_fix\"\n  tag \"cci\": [\"CCI-001493\", \"CCI-001494\", \"CCI-001495\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit tools are group-owned by \\\"root\\\" to prevent\nany unauthorized access, deletion, or modification.\n\nCheck the owner of each audit tool by running the following commands:\n\n# ls -la /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace\n/sbin/auditd /sbin/audispd /sbin/augenrules\n-rwxr-xr-x 1 root root 97128 Jan 18 2016 /sbin/augenrules\n\nIf any of the audit tools are not group-owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit tools to be group-owned by \\\"root\\\", by\nrunning the following command:\n\n# sudo chgrp root [audit_tool]\n\nReplace \\\"[audit_tool]\\\" with each audit tool not group-owned by \\\"root\\\".\"\n\n  audit_tools = input('audit_tools')\n\n  audit_tools.each do |tool|\n    describe file(tool) do\n      its('group') { should cmp 'root' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75657.rb"},"results":[{"status":"passed","code_desc":"File /sbin/auditctl group should cmp == \"root\"","run_time":0.00016,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/aureport group should cmp == \"root\"","run_time":0.000123,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/ausearch group should cmp == \"root\"","run_time":0.000224,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/autrace group should cmp == \"root\"","run_time":0.000121,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/auditd group should cmp == \"root\"","run_time":0.00012,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/audispd group should cmp == \"root\"","run_time":0.000119,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/augenrules group should cmp == \"root\"","run_time":0.000187,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75717","title":"The audit system must be configured to audit any usage of the setxattr\nsystem call.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \"setxattr\" system call, by running the following command:\n\n# sudo grep -w setxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"setxattr\" system call, by adding the following lines to\n\"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75717","rid":"SV-90397r2_rule","stig_id":"UBTU-16-020460","fix_id":"F-82345r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75717\" do\n  title \"The audit system must be configured to audit any usage of the setxattr\nsystem call.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75717\"\n  tag \"rid\": \"SV-90397r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020460\"\n  tag \"fix_id\": \"F-82345r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \\\"setxattr\\\" system call, by running the following command:\n\n# sudo grep -w setxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"setxattr\\\" system call, by adding the following lines to\n\\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"setxattr\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75717.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"setxattr\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000218,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"setxattr\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000151,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75597","title":"The /var/log directory must have mode 0770 or less permissive.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify that the \"/var/log\" directory has a mode of \"0770\"\nor less.\n\nCheck the mode of the \"/var/log\" directory with the following command:\n\n# stat -c \"%a %n\" /var/log\n\n770\n\nIf a value of \"0770\" or less permissive is not returned, this is a finding."},{"label":"fix","data":"Change the permissions of the directory \"/var/log\" to \"0770\"\nby running the following command:\n\n# sudo chmod 0770 /var/log"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75597","rid":"SV-90277r3_rule","stig_id":"UBTU-16-010960","fix_id":"F-82225r2_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75597\" do\n  title \"The /var/log directory must have mode 0770 or less permissive.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75597\"\n  tag \"rid\": \"SV-90277r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010960\"\n  tag \"fix_id\": \"F-82225r2_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the \\\"/var/log\\\" directory has a mode of \\\"0770\\\"\nor less.\n\nCheck the mode of the \\\"/var/log\\\" directory with the following command:\n\n# stat -c \\\"%a %n\\\" /var/log\n\n770\n\nIf a value of \\\"0770\\\" or less permissive is not returned, this is a finding.\"\n  desc \"fix\", \"Change the permissions of the directory \\\"/var/log\\\" to \\\"0770\\\"\nby running the following command:\n\n# sudo chmod 0770 /var/log\"\n\n  describe directory('/var/log') do\n    it { should_not be_more_permissive_than('0770') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75597.rb"},"results":[{"status":"failed","code_desc":"Directory /var/log should not be more permissive than \"0770\"","run_time":0.010109,"start_time":"2019-08-06T11:13:30-04:00","message":"expected `Directory /var/log.more_permissive_than?(\"0770\")` to return false, got true"}]},{"id":"V-75905","title":"The Ubuntu operating system must accept Personal Identity Verification\n(PIV) credentials.","desc":"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n    DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.","descriptions":[{"label":"default","data":"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n    DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems."},{"label":"check","data":"Verify the Ubuntu operating system accepts Personal Identity\nVerification (PIV) credentials.\n\nCheck that the \"opensc-pcks11\" package is installed on the system with the\nfollowing command:\n\n# dpkg -l | grep opensc-pkcs11\n\nii opensc-pkcs11:amd64 0.15.0-1Ubuntu1 amd64 Smart card utilities with support\nfor PKCS#15 compatible cards\n\nIf the \"opensc-pcks11\" package is not installed, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to accept Personal Identity\nVerification (PIV) credentials.\n\nInstall the \"opensc-pkcs11\" package using the following command:\n\n# sudo apt-get install opensc-pkcs11"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000376-GPOS-00161","gid":"V-75905","rid":"SV-90585r1_rule","stig_id":"UBTU-16-030810","fix_id":"F-82535r1_fix","cci":["CCI-001953"],"nist":["IA-2 (12)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75905\" do\n  title \"The Ubuntu operating system must accept Personal Identity Verification\n(PIV) credentials.\"\n  desc  \"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n    DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000376-GPOS-00161\"\n  tag \"gid\": \"V-75905\"\n  tag \"rid\": \"SV-90585r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030810\"\n  tag \"fix_id\": \"F-82535r1_fix\"\n  tag \"cci\": [\"CCI-001953\"]\n  tag \"nist\": [\"IA-2 (12)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system accepts Personal Identity\nVerification (PIV) credentials.\n\nCheck that the \\\"opensc-pcks11\\\" package is installed on the system with the\nfollowing command:\n\n# dpkg -l | grep opensc-pkcs11\n\nii opensc-pkcs11:amd64 0.15.0-1Ubuntu1 amd64 Smart card utilities with support\nfor PKCS#15 compatible cards\n\nIf the \\\"opensc-pcks11\\\" package is not installed, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to accept Personal Identity\nVerification (PIV) credentials.\n\nInstall the \\\"opensc-pkcs11\\\" package using the following command:\n\n# sudo apt-get install opensc-pkcs11\"\n\n  describe package('opensc-pkcs11') do\n    it { should be_installed }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75905.rb"},"results":[{"status":"failed","code_desc":"System Package opensc-pkcs11 should be installed","run_time":0.01783,"start_time":"2019-08-06T11:13:30-04:00","message":"expected that `System Package opensc-pkcs11` is installed"}]},{"id":"V-75845","title":"The SSH private host key files must have mode 0600 or less permissive.","desc":"If an unauthorized user obtains the private SSH host key file, the\nhost could be impersonated.","descriptions":[{"label":"default","data":"If an unauthorized user obtains the private SSH host key file, the\nhost could be impersonated."},{"label":"check","data":"Verify the SSH private host key files have mode \"0600\" or\nless permissive.\n\nCheck the mode of the private host key files under \"/etc/ssh\" file with the\nfollowing command:\n\n# ls -alL /etc/ssh/ssh_host*key\n\n-rw-------  1 root  wheel  668 Nov 28 06:43 ssh_host_dsa_key\n-rw-------  1 root  wheel  582 Nov 28 06:43 ssh_host_key\n-rw-------  1 root  wheel  887 Nov 28 06:43 ssh_host_rsa_key\n\nIf any private host key file has a mode more permissive than \"0600\", this is\na finding."},{"label":"fix","data":"Configure the mode of SSH private host key files under\n\"/etc/ssh\" to \"0600\" with the following command:\n\n#sudo chmod 0600 /etc/ssh/ssh_host*key\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75845","rid":"SV-90525r2_rule","stig_id":"UBTU-16-030320","fix_id":"F-82475r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75845\" do\n  title \"The SSH private host key files must have mode 0600 or less permissive.\"\n  desc  \"If an unauthorized user obtains the private SSH host key file, the\nhost could be impersonated.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75845\"\n  tag \"rid\": \"SV-90525r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030320\"\n  tag \"fix_id\": \"F-82475r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH private host key files have mode \\\"0600\\\" or\nless permissive.\n\nCheck the mode of the private host key files under \\\"/etc/ssh\\\" file with the\nfollowing command:\n\n# ls -alL /etc/ssh/ssh_host*key\n\n-rw-------  1 root  wheel  668 Nov 28 06:43 ssh_host_dsa_key\n-rw-------  1 root  wheel  582 Nov 28 06:43 ssh_host_key\n-rw-------  1 root  wheel  887 Nov 28 06:43 ssh_host_rsa_key\n\nIf any private host key file has a mode more permissive than \\\"0600\\\", this is\na finding.\"\n  desc \"fix\", \"Configure the mode of SSH private host key files under\n\\\"/etc/ssh\\\" to \\\"0600\\\" with the following command:\n\n#sudo chmod 0600 /etc/ssh/ssh_host*key\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  key_files = command(\"find /etc/ssh -xdev -name '*ssh_host*key' -perm /177\").stdout.split(\"\\n\")\n  if !key_files.nil? and !key_files.empty?\n    key_files.each do |keyfile|\n      describe file(keyfile) do\n        it { should_not be_executable.by('user') }\n        it { should_not be_readable.by('group') }\n        it { should_not be_writable.by('group') }\n        it { should_not be_executable.by('group') }\n        it { should_not be_readable.by('others') }\n        it { should_not be_writable.by('others') }\n        it { should_not be_executable.by('others') }\n      end\n    end\n  else\n    describe \"No files have a more permissive mode.\" do\n      subject { key_files.nil? or key_files.empty? }\n      it { should eq true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75845.rb"},"results":[{"status":"passed","code_desc":"No files have a more permissive mode. should eq true","run_time":0.000108,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75535","title":"Pam_Apparmor must be configured to allow system administrators to pass\ninformation to any other Ubuntu operating system administrator or user, change\nsecurity attributes, and to confine all non-privileged users from executing\nfunctions to include disabling, circumventing, or altering implemented security\nsafeguards/countermeasures.","desc":"Discretionary Access Control (DAC) is based on the notion that\nindividual users are \"owners\" of objects and therefore have discretion over\nwho should be authorized to access the object and in which mode (e.g., read or\nwrite). Ownership is usually acquired as a consequence of creating the object\nor via specified ownership assignment. DAC allows the owner to determine who\nwill have access to objects they control. An example of DAC includes\nuser-controlled file permissions.\n\n    When discretionary access control policies are implemented, subjects are\nnot constrained with regard to what actions they can take with information for\nwhich they have already been granted access. Thus, subjects that have been\ngranted access to information are not prevented from passing (i.e., the\nsubjects have the discretion to pass) the information to other subjects or\nobjects. A subject that is constrained in its operation by Mandatory Access\nControl policies is still able to operate under the less rigorous constraints\nof this requirement. Thus, while Mandatory Access Control imposes constraints\npreventing a subject from passing information to another subject operating at a\ndifferent sensitivity level, this requirement permits the subject to pass the\ninformation to any subject at the same sensitivity level. The policy is bounded\nby the information system boundary. Once the information is passed outside the\ncontrol of the information system, additional means may be required to ensure\nthe constraints remain in effect. While the older, more traditional definitions\nof discretionary access control require identity-based access control, that\nlimitation is not required for this use of discretionary access control.","descriptions":[{"label":"default","data":"Discretionary Access Control (DAC) is based on the notion that\nindividual users are \"owners\" of objects and therefore have discretion over\nwho should be authorized to access the object and in which mode (e.g., read or\nwrite). Ownership is usually acquired as a consequence of creating the object\nor via specified ownership assignment. DAC allows the owner to determine who\nwill have access to objects they control. An example of DAC includes\nuser-controlled file permissions.\n\n    When discretionary access control policies are implemented, subjects are\nnot constrained with regard to what actions they can take with information for\nwhich they have already been granted access. Thus, subjects that have been\ngranted access to information are not prevented from passing (i.e., the\nsubjects have the discretion to pass) the information to other subjects or\nobjects. A subject that is constrained in its operation by Mandatory Access\nControl policies is still able to operate under the less rigorous constraints\nof this requirement. Thus, while Mandatory Access Control imposes constraints\npreventing a subject from passing information to another subject operating at a\ndifferent sensitivity level, this requirement permits the subject to pass the\ninformation to any subject at the same sensitivity level. The policy is bounded\nby the information system boundary. Once the information is passed outside the\ncontrol of the information system, additional means may be required to ensure\nthe constraints remain in effect. While the older, more traditional definitions\nof discretionary access control require identity-based access control, that\nlimitation is not required for this use of discretionary access control."},{"label":"check","data":"Verify the Ubuntu operating system is configured to allow\nsystem administrators to pass information to any other Ubuntu operating system\nadministrator or user.\n\nCheck that \"Pam_Apparmor\" is installed on the system with the following\ncommand:\n\n# sudo apt list libpam-apparmor\n\nlibpam-apparmor/xenial-updates,now 2.10.95-0ubuntu2.7 amd64 [installed]\n\nIf the \"Pam_Apparmor\" package is not installed, this is a finding.\n\nCheck that Pam_Apparmor has properly configured profiles\n\n# sudo apparmor_status\n\napparmor module is loaded.\n13 profiles are loaded.\n13 profiles are in enforce mode.\n   /sbin/dhclient\n   ...\n   lxc-container-default-with-nesting\n0 profiles are in complain mode.\n\nIf all loaded profiles are not in \"enforce\" mode, or there are any profiles\nin \"complain\" mode, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to allow system\nadministrators to pass information to any other Ubuntu operating system\nadministrator or user.\n\nInstall \"Pam_Apparmor\" (if it is not installed) with the following command:\n\n# sudo apt-get install libpam-apparmor\n\nEnable/Activate \"Apparmor\" (if it is not already active) with the following\ncommand:\n\n# sudo systemctl enable apparmor.service\n\nStart \"Apparmor\" with the following command:\n\n# sudo systemctl start apparmor.service\n\nNote: Pam_Apparmor must have properly configured profiles. All configurations\nwill be based on the actual system setup and organization. See the\n\"Pam_Apparmor\" documentation for more information on configuring profiles."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000312-GPOS-00122","satisfies":["SRG-OS-000312-GPOS-00122","SRG-OS-000312-GPOS-00123","SRG-OS-000312-GPOS-00124","SRG-OS-000324-GPOS-00125"],"gid":"V-75535","rid":"SV-90215r2_rule","stig_id":"UBTU-16-010600","fix_id":"F-82163r1_fix","cci":["CCI-002165","CCI-002235"],"nist":["AC-3 (4)","AC-6 (10)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75535\" do\n  title \"Pam_Apparmor must be configured to allow system administrators to pass\ninformation to any other Ubuntu operating system administrator or user, change\nsecurity attributes, and to confine all non-privileged users from executing\nfunctions to include disabling, circumventing, or altering implemented security\nsafeguards/countermeasures.\"\n  desc  \"Discretionary Access Control (DAC) is based on the notion that\nindividual users are \\\"owners\\\" of objects and therefore have discretion over\nwho should be authorized to access the object and in which mode (e.g., read or\nwrite). Ownership is usually acquired as a consequence of creating the object\nor via specified ownership assignment. DAC allows the owner to determine who\nwill have access to objects they control. An example of DAC includes\nuser-controlled file permissions.\n\n    When discretionary access control policies are implemented, subjects are\nnot constrained with regard to what actions they can take with information for\nwhich they have already been granted access. Thus, subjects that have been\ngranted access to information are not prevented from passing (i.e., the\nsubjects have the discretion to pass) the information to other subjects or\nobjects. A subject that is constrained in its operation by Mandatory Access\nControl policies is still able to operate under the less rigorous constraints\nof this requirement. Thus, while Mandatory Access Control imposes constraints\npreventing a subject from passing information to another subject operating at a\ndifferent sensitivity level, this requirement permits the subject to pass the\ninformation to any subject at the same sensitivity level. The policy is bounded\nby the information system boundary. Once the information is passed outside the\ncontrol of the information system, additional means may be required to ensure\nthe constraints remain in effect. While the older, more traditional definitions\nof discretionary access control require identity-based access control, that\nlimitation is not required for this use of discretionary access control.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000312-GPOS-00122\"\n  tag \"satisfies\": [\"SRG-OS-000312-GPOS-00122\", \"SRG-OS-000312-GPOS-00123\",\n\"SRG-OS-000312-GPOS-00124\", \"SRG-OS-000324-GPOS-00125\"]\n  tag \"gid\": \"V-75535\"\n  tag \"rid\": \"SV-90215r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010600\"\n  tag \"fix_id\": \"F-82163r1_fix\"\n  tag \"cci\": [\"CCI-002165\", \"CCI-002235\"]\n  tag \"nist\": [\"AC-3 (4)\", \"AC-6 (10)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is configured to allow\nsystem administrators to pass information to any other Ubuntu operating system\nadministrator or user.\n\nCheck that \\\"Pam_Apparmor\\\" is installed on the system with the following\ncommand:\n\n# sudo apt list libpam-apparmor\n\nlibpam-apparmor/xenial-updates,now 2.10.95-0ubuntu2.7 amd64 [installed]\n\nIf the \\\"Pam_Apparmor\\\" package is not installed, this is a finding.\n\nCheck that Pam_Apparmor has properly configured profiles\n\n# sudo apparmor_status\n\napparmor module is loaded.\n13 profiles are loaded.\n13 profiles are in enforce mode.\n   /sbin/dhclient\n   ...\n   lxc-container-default-with-nesting\n0 profiles are in complain mode.\n\nIf all loaded profiles are not in \\\"enforce\\\" mode, or there are any profiles\nin \\\"complain\\\" mode, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to allow system\nadministrators to pass information to any other Ubuntu operating system\nadministrator or user.\n\nInstall \\\"Pam_Apparmor\\\" (if it is not installed) with the following command:\n\n# sudo apt-get install libpam-apparmor\n\nEnable/Activate \\\"Apparmor\\\" (if it is not already active) with the following\ncommand:\n\n# sudo systemctl enable apparmor.service\n\nStart \\\"Apparmor\\\" with the following command:\n\n# sudo systemctl start apparmor.service\n\nNote: Pam_Apparmor must have properly configured profiles. All configurations\nwill be based on the actual system setup and organization. See the\n\\\"Pam_Apparmor\\\" documentation for more information on configuring profiles.\"\n\n  describe package('libpam-apparmor') do\n    it { should be_installed }\n  end\n\n  num_loaded_profiles = inspec.command('sudo apparmor_status | grep \"profiles are loaded.\" | cut -f 1 -d \" \"').stdout\n  num_enforced_profiles = inspec.command('sudo apparmor_status | grep \"profiles are in enforce mode.\" | cut -f 1 -d \" \"').stdout\n\n  describe 'AppArmor Profiles' do\n    it 'loaded and enforced' do\n     # Remove `nil`s from the list and count remaining\n      expect(num_loaded_profiles).to eq(num_enforced_profiles)\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75535.rb"},"results":[{"status":"failed","code_desc":"System Package libpam-apparmor should be installed","run_time":0.016,"start_time":"2019-08-06T11:13:30-04:00","message":"expected that `System Package libpam-apparmor` is installed"},{"status":"passed","code_desc":"AppArmor Profiles loaded and enforced","run_time":8.1e-05,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75475","title":"Passwords must be prohibited from reuse for a minimum of five\ngenerations.","desc":"Password complexity, or strength, is a measure of the effectiveness of\na password in resisting attempts at guessing and brute-force attacks. If the\ninformation system or application allows the user to consecutively reuse their\npassword when that password has exceeded its defined lifetime, the end result\nis a password that is not changed as per policy requirements.","descriptions":[{"label":"default","data":"Password complexity, or strength, is a measure of the effectiveness of\na password in resisting attempts at guessing and brute-force attacks. If the\ninformation system or application allows the user to consecutively reuse their\npassword when that password has exceeded its defined lifetime, the end result\nis a password that is not changed as per policy requirements."},{"label":"check","data":"Verify that the Ubuntu operating system prevents passwords from\nbeing reused for a minimum of five generations by running the following command:\n\n# grep -i remember /etc/pam.d/common-password\n\npassword [success=1 default=ignore]      pam_unix.so obscure sha512 remember=5\nrounds=5000\n\nIf the \"remember\" parameter value is not greater than or equal to \"5\", is\ncommented out, or is not set at all this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system prevents passwords from\nbeing reused for a minimum of five generations.\n\nAdd or modify the \"remember\" parameter value to the following line in\n\"/etc/pam.d/common-password\" file:\n\npassword [success=1 default=ignore]      pam_unix.so obscure sha512 remember=5\nrounds=5000"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000077-GPOS-00045","gid":"V-75475","rid":"SV-90155r2_rule","stig_id":"UBTU-16-010230","fix_id":"F-82103r2_fix","cci":["CCI-000200"],"nist":["IA-5 (1) (e)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75475\" do\n  title \"Passwords must be prohibited from reuse for a minimum of five\ngenerations.\"\n  desc  \"Password complexity, or strength, is a measure of the effectiveness of\na password in resisting attempts at guessing and brute-force attacks. If the\ninformation system or application allows the user to consecutively reuse their\npassword when that password has exceeded its defined lifetime, the end result\nis a password that is not changed as per policy requirements.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000077-GPOS-00045\"\n  tag \"gid\": \"V-75475\"\n  tag \"rid\": \"SV-90155r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010230\"\n  tag \"fix_id\": \"F-82103r2_fix\"\n  tag \"cci\": [\"CCI-000200\"]\n  tag \"nist\": [\"IA-5 (1) (e)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system prevents passwords from\nbeing reused for a minimum of five generations by running the following command:\n\n# grep -i remember /etc/pam.d/common-password\n\npassword [success=1 default=ignore]      pam_unix.so obscure sha512 remember=5\nrounds=5000\n\nIf the \\\"remember\\\" parameter value is not greater than or equal to \\\"5\\\", is\ncommented out, or is not set at all this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system prevents passwords from\nbeing reused for a minimum of five generations.\n\nAdd or modify the \\\"remember\\\" parameter value to the following line in\n\\\"/etc/pam.d/common-password\\\" file:\n\npassword [success=1 default=ignore]      pam_unix.so obscure sha512 remember=5\nrounds=5000\"\n\n  min_num_password_generations = input('min_num_password_generations')\n\n  describe file(\"/etc/pam.d/common-password\") do\n    it { should exist }\n  end\n\n  describe command(\"grep -i remember /etc/pam.d/common-password | sed 's/.*remember=\\\\([^ ]*\\\\).*/\\\\1/'\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should cmp min_num_password_generations }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75475.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/common-password should exist","run_time":8.3e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Command: `grep -i remember /etc/pam.d/common-password | sed 's/.*remember=\\([^ ]*\\).*/\\1/'` exit_status should eq 0","run_time":0.011251,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"failed","code_desc":"Command: `grep -i remember /etc/pam.d/common-password | sed 's/.*remember=\\([^ ]*\\).*/\\1/'` stdout.strip should cmp == 5","run_time":0.000223,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: 5\n     got: \"\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75389","title":"The Ubuntu operating system must be a vendor supported release.","desc":"An Ubuntu operating system release is considered \"supported\" if the\nvendor continues to provide security patches for the product. With an\nunsupported release, it will not be possible to resolve security issues\ndiscovered in the system software.","descriptions":[{"label":"default","data":"An Ubuntu operating system release is considered \"supported\" if the\nvendor continues to provide security patches for the product. With an\nunsupported release, it will not be possible to resolve security issues\ndiscovered in the system software."},{"label":"check","data":"Verify the version of the Ubuntu operating system is vendor\nsupported.\n\nCheck the version of the Ubuntu operating system with the following command:\n\n# cat /etc/lsb-release\n\nDISTRIB_RELEASE=16.04\nDISTRIB_CODENAME=xenial\nDISTRIB_DESCRIPTION=\"Ubuntu 16.04.1 LTS\"\n\nCurrent End of Life for Ubuntu 16.04 LTS is April 2021.\n\nIf the release is not supported by the vendor, this is a finding."},{"label":"fix","data":"Upgrade to a supported version of the Ubuntu operating system."}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75389","rid":"SV-90069r1_rule","stig_id":"UBTU-16-010000","fix_id":"F-82017r1_fix","cci":["CCI-001230"],"nist":["SI-2 d","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75389\" do\n  title \"The Ubuntu operating system must be a vendor supported release.\"\n  desc  \"An Ubuntu operating system release is considered \\\"supported\\\" if the\nvendor continues to provide security patches for the product. With an\nunsupported release, it will not be possible to resolve security issues\ndiscovered in the system software.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75389\"\n  tag \"rid\": \"SV-90069r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010000\"\n  tag \"fix_id\": \"F-82017r1_fix\"\n  tag \"cci\": [\"CCI-001230\"]\n  tag \"nist\": [\"SI-2 d\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the version of the Ubuntu operating system is vendor\nsupported.\n\nCheck the version of the Ubuntu operating system with the following command:\n\n# cat /etc/lsb-release\n\nDISTRIB_RELEASE=16.04\nDISTRIB_CODENAME=xenial\nDISTRIB_DESCRIPTION=\\\"Ubuntu 16.04.1 LTS\\\"\n\nCurrent End of Life for Ubuntu 16.04 LTS is April 2021.\n\nIf the release is not supported by the vendor, this is a finding.\"\n  desc \"fix\", \"Upgrade to a supported version of the Ubuntu operating system.\"\n\n  platform_name = input('platform_name')\n  platform_release = input('platform_release')\n  supported_until = input('supported_until')\n    describe platform.name do\n    it { should cmp platform_name }\n  end\n\n  describe platform.release do\n    it { should cmp platform_release }\n  end\n\n  describe \"The current system is still within its End of Life of #{supported_until}\" do\n    subject { Date.today <= Date.parse(supported_until) }\n    it { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75389.rb"},"results":[{"status":"passed","code_desc":"ubuntu should cmp == \"ubuntu\"","run_time":0.00013,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"16.04 should cmp == 16.04","run_time":0.00013,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"The current system is still within its End of Life of 2021-04-30 should equal true","run_time":0.000395,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75465","title":"The pam_unix.so module must use a FIPS 140-2 approved cryptographic\nhashing algorithm for system authentication.","desc":"Unapproved mechanisms that are used for authentication to the\ncryptographic module are not verified and therefore cannot be relied upon to\nprovide confidentiality or integrity, and DoD data may be compromised.\n\n    Ubuntu operating systems utilizing encryption are required to use\nFIPS-compliant mechanisms for authenticating to cryptographic modules.\n\n    FIPS 140-2 is the current standard for validating that mechanisms used to\naccess cryptographic modules utilize authentication that meets DoD\nrequirements. This allows for Security Levels 1, 2, 3, or 4 for use on a\ngeneral purpose computing system.","descriptions":[{"label":"default","data":"Unapproved mechanisms that are used for authentication to the\ncryptographic module are not verified and therefore cannot be relied upon to\nprovide confidentiality or integrity, and DoD data may be compromised.\n\n    Ubuntu operating systems utilizing encryption are required to use\nFIPS-compliant mechanisms for authenticating to cryptographic modules.\n\n    FIPS 140-2 is the current standard for validating that mechanisms used to\naccess cryptographic modules utilize authentication that meets DoD\nrequirements. This allows for Security Levels 1, 2, 3, or 4 for use on a\ngeneral purpose computing system."},{"label":"check","data":"Verify that pam_unix.so auth is configured to use sha512.\n\nCheck that pam_unix.so auth is configured to use sha512 with the following\ncommand:\n\n# grep password /etc/pam.d/common-password | grep pam_unix\n\npassword        [success=1 default=ignore]      pam_unix.so obscure sha512\n\nIf \"sha512\" is not an option of the output, or is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to use a FIPS 140-2\napproved cryptographic hashing algorithm for system authentication.\n\nEdit/modify the following line in the file \"/etc/pam.d/common-password\" file\nto include the sha512 option for pam_unix.so:\n\npassword        [success=1 default=ignore]      pam_unix.so obscure sha512\nshadow remember=5"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000120-GPOS-00061","gid":"V-75465","rid":"SV-90145r2_rule","stig_id":"UBTU-16-010180","fix_id":"F-82093r2_fix","cci":["CCI-000803"],"nist":["IA-7","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75465\" do\n  title \"The pam_unix.so module must use a FIPS 140-2 approved cryptographic\nhashing algorithm for system authentication.\"\n  desc  \"Unapproved mechanisms that are used for authentication to the\ncryptographic module are not verified and therefore cannot be relied upon to\nprovide confidentiality or integrity, and DoD data may be compromised.\n\n    Ubuntu operating systems utilizing encryption are required to use\nFIPS-compliant mechanisms for authenticating to cryptographic modules.\n\n    FIPS 140-2 is the current standard for validating that mechanisms used to\naccess cryptographic modules utilize authentication that meets DoD\nrequirements. This allows for Security Levels 1, 2, 3, or 4 for use on a\ngeneral purpose computing system.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000120-GPOS-00061\"\n  tag \"gid\": \"V-75465\"\n  tag \"rid\": \"SV-90145r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010180\"\n  tag \"fix_id\": \"F-82093r2_fix\"\n  tag \"cci\": [\"CCI-000803\"]\n  tag \"nist\": [\"IA-7\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that pam_unix.so auth is configured to use sha512.\n\nCheck that pam_unix.so auth is configured to use sha512 with the following\ncommand:\n\n# grep password /etc/pam.d/common-password | grep pam_unix\n\npassword        [success=1 default=ignore]      pam_unix.so obscure sha512\n\nIf \\\"sha512\\\" is not an option of the output, or is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to use a FIPS 140-2\napproved cryptographic hashing algorithm for system authentication.\n\nEdit/modify the following line in the file \\\"/etc/pam.d/common-password\\\" file\nto include the sha512 option for pam_unix.so:\n\npassword        [success=1 default=ignore]      pam_unix.so obscure sha512\nshadow remember=5\"\n\n  describe file(\"/etc/pam.d/common-password\") do\n    it { should exist }\n  end\n\n  describe command(\"grep rounds /etc/pam.d/common-password\") do\n    its('exit_status') { should eq 0 }\n    its('stdout') { should match /^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+sha512($|\\s+.*$)/ }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75465.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/common-password should exist","run_time":8.3e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"failed","code_desc":"Command: `grep rounds /etc/pam.d/common-password` exit_status should eq 0","run_time":0.000123,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: 0\n     got: 1\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Command: `grep rounds /etc/pam.d/common-password` stdout should match /^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+sha512($|\\s+.*$)/","run_time":0.000257,"start_time":"2019-08-06T11:13:30-04:00","message":"expected \"\" to match /^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+sha512($|\\s+.*$)/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\s*password\\s+\\[\\s*success=1\\s+default=ignore\\s*\\].*\\s+sha512($|\\s+.*$)/\n+\"\"\n"}]},{"id":"V-75525","title":"The Ubuntu operating system must use cryptographic mechanisms to\nprotect the integrity of audit tools.","desc":"Protecting the integrity of the tools used for auditing purposes is a\ncritical step toward ensuring the integrity of audit information. Audit\ninformation includes all information (e.g., audit records, audit settings, and\naudit reports) needed to successfully audit information system activity.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n    It is not uncommon for attackers to replace the audit tools or inject code\ninto the existing tools with the purpose of providing the capability to hide or\nerase system activity from the audit logs.\n\n    To address this risk, audit tools must be cryptographically signed in order\nto provide the capability to identify when the audit tools have been modified,\nmanipulated, or replaced. An example is a checksum hash of the file or files.","descriptions":[{"label":"default","data":"Protecting the integrity of the tools used for auditing purposes is a\ncritical step toward ensuring the integrity of audit information. Audit\ninformation includes all information (e.g., audit records, audit settings, and\naudit reports) needed to successfully audit information system activity.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n    It is not uncommon for attackers to replace the audit tools or inject code\ninto the existing tools with the purpose of providing the capability to hide or\nerase system activity from the audit logs.\n\n    To address this risk, audit tools must be cryptographically signed in order\nto provide the capability to identify when the audit tools have been modified,\nmanipulated, or replaced. An example is a checksum hash of the file or files."},{"label":"check","data":"Verify that Advanced Intrusion Detection Environment (AIDE) to\nproperly configured to use cryptographic mechanisms to protect the integrity of\naudit tools.\n\nCheck the selection lines that aide is configured to add/check with the\nfollowing command:\n\n# egrep '(\\/usr\\/sbin\\/(audit|au))' /etc/aide/aide.conf\n\n/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/audispd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattr+sha512\n\nIf any of the seven audit tools does not have an appropriate selection line,\nthis is a finding."},{"label":"fix","data":"Add or update the following selection lines to\n\"/etc/aide/aide.conf\", in order to protect the integrity of the audit tools.\n\n# Audit Tools\n/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/audispd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattr+sha512"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000278-GPOS-00108","gid":"V-75525","rid":"SV-90205r2_rule","stig_id":"UBTU-16-010550","fix_id":"F-82153r1_fix","cci":["CCI-001496"],"nist":["AU-9 (3)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75525\" do\n  title \"The Ubuntu operating system must use cryptographic mechanisms to\nprotect the integrity of audit tools.\"\n  desc  \"Protecting the integrity of the tools used for auditing purposes is a\ncritical step toward ensuring the integrity of audit information. Audit\ninformation includes all information (e.g., audit records, audit settings, and\naudit reports) needed to successfully audit information system activity.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n    It is not uncommon for attackers to replace the audit tools or inject code\ninto the existing tools with the purpose of providing the capability to hide or\nerase system activity from the audit logs.\n\n    To address this risk, audit tools must be cryptographically signed in order\nto provide the capability to identify when the audit tools have been modified,\nmanipulated, or replaced. An example is a checksum hash of the file or files.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000278-GPOS-00108\"\n  tag \"gid\": \"V-75525\"\n  tag \"rid\": \"SV-90205r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010550\"\n  tag \"fix_id\": \"F-82153r1_fix\"\n  tag \"cci\": [\"CCI-001496\"]\n  tag \"nist\": [\"AU-9 (3)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Advanced Intrusion Detection Environment (AIDE) to\nproperly configured to use cryptographic mechanisms to protect the integrity of\naudit tools.\n\nCheck the selection lines that aide is configured to add/check with the\nfollowing command:\n\n# egrep '(\\\\/usr\\\\/sbin\\\\/(audit|au))' /etc/aide/aide.conf\n\n/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/audispd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattr+sha512\n\nIf any of the seven audit tools does not have an appropriate selection line,\nthis is a finding.\"\n  desc \"fix\", \"Add or update the following selection lines to\n\\\"/etc/aide/aide.conf\\\", in order to protect the integrity of the audit tools.\n\n# Audit Tools\n/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/audispd p+i+n+u+g+s+b+acl+xattr+sha512\n/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattr+sha512\"\n\n  aide_conf_exists = aide_conf.exist?\n\n  if aide_conf_exists\n    describe aide_conf.where { selection_line == '/usr/sbin/auditctl' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  \n    describe aide_conf.where { selection_line == '/usr/sbin/auditd' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  \n    describe aide_conf.where { selection_line == '/usr/sbin/ausearch' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  \n    describe aide_conf.where { selection_line == '/usr/sbin/aureport' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  \n    describe aide_conf.where { selection_line == '/usr/sbin/autrace' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  \n    describe aide_conf.where { selection_line == '/usr/sbin/audispd' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  \n    describe aide_conf.where { selection_line == '/usr/sbin/augenrules' } do\n      its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattr' 'sha512'] }\n    end\n  else\n    describe \"aide.conf file exists\" do\n      subject { aide_conf_exists }\n      it { should be true }\n    end\n  end\n\n  \nend\n","source_location":{"line":1,"ref":"./controls/V-75525.rb"},"results":[{"status":"failed","code_desc":"aide.conf file exists should equal true","run_time":0.000108,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75855","title":"An application firewall must protect against or limit the effects of\nDenial of Service (DoS) attacks by ensuring the Ubuntu operating system is\nimplementing rate-limiting measures on impacted network interfaces.","desc":"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n    This requirement addresses the configuration of the Ubuntu operating system\nto mitigate the impact of DoS attacks that have occurred or are ongoing on\nsystem availability. For each system, known and potential DoS attacks must be\nidentified and solutions for each type implemented. A variety of technologies\nexist to limit or, in some cases, eliminate the effects of DoS attacks (e.g.,\nlimiting processes or establishing memory partitions). Employing increased\ncapacity and bandwidth, combined with service redundancy, may reduce the\nsusceptibility to some DoS attacks.","descriptions":[{"label":"default","data":"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n    This requirement addresses the configuration of the Ubuntu operating system\nto mitigate the impact of DoS attacks that have occurred or are ongoing on\nsystem availability. For each system, known and potential DoS attacks must be\nidentified and solutions for each type implemented. A variety of technologies\nexist to limit or, in some cases, eliminate the effects of DoS attacks (e.g.,\nlimiting processes or establishing memory partitions). Employing increased\ncapacity and bandwidth, combined with service redundancy, may reduce the\nsusceptibility to some DoS attacks."},{"label":"check","data":"Verify an application firewall is configured to rate limit any\nconnection to the system.\n\nCheck that the Uncomplicated Firewall is configured to rate limit any\nconnection to the system with the following command:\n\n# sudo ufw show raw\n\nChain ufw-user-input (1 references)\npkts bytes target prot opt in out source destination\n0 0 ufw-user-limit all -- eth0 * 0.0.0.0/0 0.0.0.0/0\nctstate NEW recent: UPDATE seconds: 30 hit_count: 6 name: DEFAULT side:\nsource mask: 255.255.255.255\n\n0 0 ufw-user-limit-accept all -- eth0 * 0.0.0.0/0 0.0.0.0/0\n\n\nIf any service is not rate limited by the Uncomplicated Firewall, this is a\nfinding."},{"label":"fix","data":"Configure the application firewall to protect against or limit\nthe effects of Denial of Service (DoS) attacks by ensuring the Ubuntu operating\nsystem is implementing rate-limiting measures on impacted network interfaces.\n\nRun the following command replacing \"[service]\" with the service that needs\nto be rate limited.\n\n# sudo ufw limit [service]\n\nOr rate-limiting can be done on an interface. An example of adding a rate-limit\non the eth0 interface:\n\n# sudo ufw limit in on eth0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000420-GPOS-00186","gid":"V-75855","rid":"SV-90535r1_rule","stig_id":"UBTU-16-030410","fix_id":"F-82485r1_fix","cci":["CCI-002385"],"nist":["SC-5","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75855\" do\n  title \"An application firewall must protect against or limit the effects of\nDenial of Service (DoS) attacks by ensuring the Ubuntu operating system is\nimplementing rate-limiting measures on impacted network interfaces.\"\n  desc  \"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n    This requirement addresses the configuration of the Ubuntu operating system\nto mitigate the impact of DoS attacks that have occurred or are ongoing on\nsystem availability. For each system, known and potential DoS attacks must be\nidentified and solutions for each type implemented. A variety of technologies\nexist to limit or, in some cases, eliminate the effects of DoS attacks (e.g.,\nlimiting processes or establishing memory partitions). Employing increased\ncapacity and bandwidth, combined with service redundancy, may reduce the\nsusceptibility to some DoS attacks.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000420-GPOS-00186\"\n  tag \"gid\": \"V-75855\"\n  tag \"rid\": \"SV-90535r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030410\"\n  tag \"fix_id\": \"F-82485r1_fix\"\n  tag \"cci\": [\"CCI-002385\"]\n  tag \"nist\": [\"SC-5\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify an application firewall is configured to rate limit any\nconnection to the system.\n\nCheck that the Uncomplicated Firewall is configured to rate limit any\nconnection to the system with the following command:\n\n# sudo ufw show raw\n\nChain ufw-user-input (1 references)\npkts bytes target prot opt in out source destination\n0 0 ufw-user-limit all -- eth0 * 0.0.0.0/0 0.0.0.0/0\nctstate NEW recent: UPDATE seconds: 30 hit_count: 6 name: DEFAULT side:\nsource mask: 255.255.255.255\n\n0 0 ufw-user-limit-accept all -- eth0 * 0.0.0.0/0 0.0.0.0/0\n\n\nIf any service is not rate limited by the Uncomplicated Firewall, this is a\nfinding.\"\n  desc \"fix\", \"Configure the application firewall to protect against or limit\nthe effects of Denial of Service (DoS) attacks by ensuring the Ubuntu operating\nsystem is implementing rate-limiting measures on impacted network interfaces.\n\nRun the following command replacing \\\"[service]\\\" with the service that needs\nto be rate limited.\n\n# sudo ufw limit [service]\n\nOr rate-limiting can be done on an interface. An example of adding a rate-limit\non the eth0 interface:\n\n# sudo ufw limit in on eth0\"\n\n  ufw_status_output = command('ufw status').stdout.strip\n  is_ufw_active = !ufw_status_output.lines.first.include?('inactive')\n\n  if is_ufw_active\n    describe ufw_status_output do\n      it { should match %r((LIMIT)) }\n    end\n  else\n    describe \"UFW status is active\" do\n      subject { is_ufw_active }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75855.rb"},"results":[{"status":"failed","code_desc":"UFW status is active should equal true","run_time":9.3e-05,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75587","title":"A separate file system must be used for user home directories (such as\n/home or an equivalent).","desc":"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing."},{"label":"check","data":"Verify that a separate file system/partition has been created\nfor non-privileged local interactive user home directories.\n\nCheck the home directory assignment for all non-privileged users, users with a\nUser Identifier (UID) greater than 1000, on the system with the following\ncommand:\n\n# awk -F: '($3>=1000)&&($1!=\"nobody\"){print $1,$3,$6}' /etc/passwd\n\nadamsj 1001  /home/adamsj\njacksonm 1002 /home/jacksonm\nsmithj  1003 /home/smithj\n\nThe output of the command will give the directory/partition that contains the\nhome directories for the non-privileged users on the system (in this example,\n\"/home\") and users’ shell. All accounts with a valid shell (such as\n/bin/bash) are considered interactive users.\n\nCheck that a file system/partition has been created for the non-privileged\ninteractive users with the following command:\n\nNote: The partition of \"/home\" is used in the example.\n\n# grep /home /etc/fstab\nUUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\n\nIf a separate entry for the file system/partition that contains the\nnon-privileged interactive users' home directories does not exist, this is a\nfinding."},{"label":"fix","data":"Migrate the \"/home\" directory onto a separate file\nsystem/partition."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75587","rid":"SV-90267r2_rule","stig_id":"UBTU-16-010910","fix_id":"F-82215r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75587\" do\n  title \"A separate file system must be used for user home directories (such as\n/home or an equivalent).\"\n  desc  \"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75587\"\n  tag \"rid\": \"SV-90267r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010910\"\n  tag \"fix_id\": \"F-82215r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that a separate file system/partition has been created\nfor non-privileged local interactive user home directories.\n\nCheck the home directory assignment for all non-privileged users, users with a\nUser Identifier (UID) greater than 1000, on the system with the following\ncommand:\n\n# awk -F: '($3>=1000)&&($1!=\\\"nobody\\\"){print $1,$3,$6}' /etc/passwd\n\nadamsj 1001  /home/adamsj\njacksonm 1002 /home/jacksonm\nsmithj  1003 /home/smithj\n\nThe output of the command will give the directory/partition that contains the\nhome directories for the non-privileged users on the system (in this example,\n\\\"/home\\\") and users’ shell. All accounts with a valid shell (such as\n/bin/bash) are considered interactive users.\n\nCheck that a file system/partition has been created for the non-privileged\ninteractive users with the following command:\n\nNote: The partition of \\\"/home\\\" is used in the example.\n\n# grep /home /etc/fstab\nUUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\n\nIf a separate entry for the file system/partition that contains the\nnon-privileged interactive users' home directories does not exist, this is a\nfinding.\"\n  desc \"fix\", \"Migrate the \\\"/home\\\" directory onto a separate file\nsystem/partition.\"\n\n  non_interactive_shells = input('non_interactive_shells')\n  exempt_home_users = input('exempt_home_users')\n  ignore_shells = non_interactive_shells.join('|')\n\n  # excluding root because its home directory is usually \"/root\" (mountpoint \"/\")\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000)}.entries.each do |user_info|\n    next if exempt_home_users.include?(\"#{user_info.username}\")\n\n    home_mount = command(%(df #{user_info.home} --output=target | tail -1)).stdout.strip\n    describe user_info.username do\n      context 'with mountpoint' do\n        context home_mount do\n          it { should_not be_empty }\n          it { should_not match(%r(^/$)) }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75587.rb"},"results":[{"status":"passed","code_desc":"vagrant with mountpoint / should not be empty","run_time":0.000108,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"failed","code_desc":"vagrant with mountpoint / should not match /^\\/$/","run_time":0.000181,"start_time":"2019-08-06T11:13:30-04:00","message":"expected \"/\" not to match /^\\/$/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\/$/\n+\"/\"\n"}]},{"id":"V-75707","title":"Successful/unsuccessful uses of the ssh-keysign command must generate\nan audit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged ssh commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged ssh commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"ssh-keysign\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep ssh-keysign /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"ssh-keysign\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75707","rid":"SV-90387r3_rule","stig_id":"UBTU-16-020410","fix_id":"F-82335r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75707\" do\n  title \"Successful/unsuccessful uses of the ssh-keysign command must generate\nan audit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged ssh commands. The organization must maintain audit trails in\nsufficient detail to reconstruct events to determine the cause and impact of\ncompromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75707\"\n  tag \"rid\": \"SV-90387r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020410\"\n  tag \"fix_id\": \"F-82335r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep ssh-keysign /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"ssh-keysign\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/lib/openssh/ssh-keysign'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      its('action.uniq') { should eq ['always'] }\n      its('list.uniq') { should eq ['exit'] }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75707.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/lib/openssh/ssh-keysign exist should equal true","run_time":0.0001,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75647","title":"The Ubuntu operating system must allow only the Information System\nSecurity Manager (ISSM) (or individuals or roles appointed by the ISSM) to\nselect which auditable events are to be audited.","desc":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events. Misconfigured audits may degrade the system's\nperformance by overwhelming the audit log. Misconfigured audits may also make\nit more difficult to establish, correlate, and investigate the events relating\nto an incident or identify those responsible for one.","descriptions":[{"label":"default","data":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events. Misconfigured audits may degrade the system's\nperformance by overwhelming the audit log. Misconfigured audits may also make\nit more difficult to establish, correlate, and investigate the events relating\nto an incident or identify those responsible for one."},{"label":"check","data":"Verify that the /etc/audit/audit.rule and\n/etc/audit/auditd.conf file have a mode of 0640 or less permissive by using the\nfollowing command:\n\n# sudo ls -la /etc/audit/audit.rules\n\n-rw-r----- 1 root root 1280 Feb 16 17:09 audit.rules\n-rw-r----- 1 root root 621 Sep 22 2014 auditd.conf\n\nIf the \"/etc/audit/audit.rule\" or \"/etc/audit/auditd.conf\" file have a mode\nmore permissive than \"0640\", this is a finding."},{"label":"fix","data":"Configure the /etc/audit/audit.rule and /etc/audit/auditd.conf\nfile to have a mode of 0640 with the following command:\n\n# sudo chmod 0640 /etc/audit/audit.rule\n# sudo chmod 0640 /etc/audit/audit.conf"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000063-GPOS-00032","gid":"V-75647","rid":"SV-90327r1_rule","stig_id":"UBTU-16-020150","fix_id":"F-82275r1_fix","cci":["CCI-000171"],"nist":["AU-12 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75647\" do\n  title \"The Ubuntu operating system must allow only the Information System\nSecurity Manager (ISSM) (or individuals or roles appointed by the ISSM) to\nselect which auditable events are to be audited.\"\n  desc  \"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events. Misconfigured audits may degrade the system's\nperformance by overwhelming the audit log. Misconfigured audits may also make\nit more difficult to establish, correlate, and investigate the events relating\nto an incident or identify those responsible for one.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000063-GPOS-00032\"\n  tag \"gid\": \"V-75647\"\n  tag \"rid\": \"SV-90327r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020150\"\n  tag \"fix_id\": \"F-82275r1_fix\"\n  tag \"cci\": [\"CCI-000171\"]\n  tag \"nist\": [\"AU-12 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the /etc/audit/audit.rule and\n/etc/audit/auditd.conf file have a mode of 0640 or less permissive by using the\nfollowing command:\n\n# sudo ls -la /etc/audit/audit.rules\n\n-rw-r----- 1 root root 1280 Feb 16 17:09 audit.rules\n-rw-r----- 1 root root 621 Sep 22 2014 auditd.conf\n\nIf the \\\"/etc/audit/audit.rule\\\" or \\\"/etc/audit/auditd.conf\\\" file have a mode\nmore permissive than \\\"0640\\\", this is a finding.\"\n  desc \"fix\", \"Configure the /etc/audit/audit.rule and /etc/audit/auditd.conf\nfile to have a mode of 0640 with the following command:\n\n# sudo chmod 0640 /etc/audit/audit.rule\n# sudo chmod 0640 /etc/audit/audit.conf\"\n\n  describe file('/etc/audit/audit.rules') do\n    it { should_not be_more_permissive_than('0640') }\n  end\n  describe file('/etc/audit/auditd.conf') do\n    it { should_not be_more_permissive_than('0640') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75647.rb"},"results":[{"status":"passed","code_desc":"File /etc/audit/audit.rules should not be more permissive than \"0640\"","run_time":0.02073,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /etc/audit/auditd.conf should not be more permissive than \"0640\"","run_time":0.009969,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75791","title":"Successful/unsuccessful uses of the init_module command must generate\nan audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"init_module\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w \"init_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"init_module\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75791","rid":"SV-90471r3_rule","stig_id":"UBTU-16-020830","fix_id":"F-82421r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75791\" do\n  title \"Successful/unsuccessful uses of the init_module command must generate\nan audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75791\"\n  tag \"rid\": \"SV-90471r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020830\"\n  tag \"fix_id\": \"F-82421r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"init_module\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w \\\"init_module\\\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"init_module\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295 -k\nmodule_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"init_module\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75791.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"init_module\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000201,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"init_module\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000127,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75511","title":"All public directories must be owned by root to prevent unauthorized\nand unintended information transferred via shared system resources.","desc":"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n    This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government agencies.\n\n    There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.","descriptions":[{"label":"default","data":"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n    This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government agencies.\n\n    There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components."},{"label":"check","data":"Verify that all public directories are owned by root to prevent\nunauthorized and unintended information transferred via shared system resources.\n\nCheck to see that all public directories have the public sticky bit set by\nrunning the following command:\n\n# sudo find / -type d -perm -0002 -exec ls -lLd {} \\;\n\ndrwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp\n\nIf any of the returned directories are not owned by root, this is a finding."},{"label":"fix","data":"Configure all public directories to be owned by root to prevent\nunauthorized and unintended information transferred via shared system resources.\n\nSet the owner of all public directories as root using the command, replace\n\"[Public Directory]\" with any directory path not owned by root:\n\n# sudo chown root [Public Directory]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000138-GPOS-00069","gid":"V-75511","rid":"SV-90191r1_rule","stig_id":"UBTU-16-010410","fix_id":"F-82139r1_fix","cci":["CCI-001090"],"nist":["SC-4","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75511\" do\n  title \"All public directories must be owned by root to prevent unauthorized\nand unintended information transferred via shared system resources.\"\n  desc  \"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n    This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government agencies.\n\n    There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000138-GPOS-00069\"\n  tag \"gid\": \"V-75511\"\n  tag \"rid\": \"SV-90191r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010410\"\n  tag \"fix_id\": \"F-82139r1_fix\"\n  tag \"cci\": [\"CCI-001090\"]\n  tag \"nist\": [\"SC-4\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that all public directories are owned by root to prevent\nunauthorized and unintended information transferred via shared system resources.\n\nCheck to see that all public directories have the public sticky bit set by\nrunning the following command:\n\n# sudo find / -type d -perm -0002 -exec ls -lLd {} \\\\;\n\ndrwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp\n\nIf any of the returned directories are not owned by root, this is a finding.\"\n  desc \"fix\", \"Configure all public directories to be owned by root to prevent\nunauthorized and unintended information transferred via shared system resources.\n\nSet the owner of all public directories as root using the command, replace\n\\\"[Public Directory]\\\" with any directory path not owned by root:\n\n# sudo chown root [Public Directory]\"\n\n  dir_list = command(\"sudo find / -type d -perm -0002 -exec ls -dL {} \\\\;\").stdout.strip.split(\"\\n\")\n  if (dir_list.count > 0)\n    dir_list.each do |entry|\n      describe directory(entry) do\n        its('owner') { should eq 'root' }\n      end\n    end\n  else\n    describe \"The number of public directories not owned by root\" do\n      subject { dir_list }\n      its('count') { should cmp 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75511.rb"},"results":[{"status":"passed","code_desc":"Directory /dev/mqueue owner should eq \"root\"","run_time":8.7e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /dev/shm owner should eq \"root\"","run_time":7.7e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /var/crash owner should eq \"root\"","run_time":7.5e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /var/tmp owner should eq \"root\"","run_time":7.3e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /var/tmp/systemd-private-188979cdcff74a42b08a82e7a9687f12-systemd-timedated.service-Tcf2zs/tmp owner should eq \"root\"","run_time":0.011175,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /run/lock owner should eq \"root\"","run_time":0.00011,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp owner should eq \"root\"","run_time":8.1e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp/.XIM-unix owner should eq \"root\"","run_time":6.5e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp/.ICE-unix owner should eq \"root\"","run_time":6.2e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp/.font-unix owner should eq \"root\"","run_time":6.2e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp/.X11-unix owner should eq \"root\"","run_time":6.1e-05,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp/systemd-private-188979cdcff74a42b08a82e7a9687f12-systemd-timedated.service-umR4aj/tmp owner should eq \"root\"","run_time":0.010773,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"Directory /tmp/.Test-unix owner should eq \"root\"","run_time":0.000117,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75451","title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one lower-case character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised."},{"label":"check","data":"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one lower-case character be used.\n\nDetermine if the field \"lcredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n# grep -i \"lcredit\" /etc/security/pwquality.conf\nlcredit=-1\n\nIf the \"lcredit\" parameter is not equal to \"-1\", or is commented out, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one lower-case character be used.\n\nAdd or update the following line in the \"/etc/security/pwquality.conf\" file\nto contain the \"lcredit\" parameter:\n\nlcredit=-1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000070-GPOS-00038","gid":"V-75451","rid":"SV-90131r2_rule","stig_id":"UBTU-16-010110","fix_id":"F-82079r1_fix","cci":["CCI-000193"],"nist":["IA-5 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75451\" do\n  title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one lower-case character be used.\"\n  desc  \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000070-GPOS-00038\"\n  tag \"gid\": \"V-75451\"\n  tag \"rid\": \"SV-90131r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010110\"\n  tag \"fix_id\": \"F-82079r1_fix\"\n  tag \"cci\": [\"CCI-000193\"]\n  tag \"nist\": [\"IA-5 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one lower-case character be used.\n\nDetermine if the field \\\"lcredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n# grep -i \\\"lcredit\\\" /etc/security/pwquality.conf\nlcredit=-1\n\nIf the \\\"lcredit\\\" parameter is not equal to \\\"-1\\\", or is commented out, this\nis a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one lower-case character be used.\n\nAdd or update the following line in the \\\"/etc/security/pwquality.conf\\\" file\nto contain the \\\"lcredit\\\" parameter:\n\nlcredit=-1\"\n\n  min_num_lowercase_char = input('min_num_lowercase_char')\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('lcredit') { should cmp min_num_lowercase_char }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75451.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000135,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75733","title":"Successful/unsuccessful uses of the fchownat command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"fchownat\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w fchownat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchownat\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75733","rid":"SV-90413r3_rule","stig_id":"UBTU-16-020540","fix_id":"F-82361r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75733\" do\n  title \"Successful/unsuccessful uses of the fchownat command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75733\"\n  tag \"rid\": \"SV-90413r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020540\"\n  tag \"fix_id\": \"F-82361r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"fchownat\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w fchownat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchownat\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"fchownat\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75733.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchownat\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000145,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchownat\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000122,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75901","title":"An X Windows display manager must not be installed unless approved.","desc":"Internet services that are not required for system or application\nprocesses must not be active to decrease the attack surface of the system. X\nWindows has a long history of security vulnerabilities and will not be used\nunless approved and documented.","descriptions":[{"label":"default","data":"Internet services that are not required for system or application\nprocesses must not be active to decrease the attack surface of the system. X\nWindows has a long history of security vulnerabilities and will not be used\nunless approved and documented."},{"label":"check","data":"Verify that if X Windows is installed it is authorized.\n\nCheck for the X11 package with the following command:\n\n# dpkg -l | grep lightdm\n\nAsk the System Administrator if use of the X Windows system is an operational\nrequirement.\n\nIf the use of X Windows on the system is not documented with the Information\nSystem Security Officer (ISSO), this is a finding."},{"label":"fix","data":"Document the requirement for an X Windows server with the\nInformation System Security Officer (ISSO) or remove the related packages with\nthe following commands:\n\n# sudo apt-get purge lightdm"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75901","rid":"SV-90581r1_rule","stig_id":"UBTU-16-030740","fix_id":"F-82531r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75901\" do\n  title \"An X Windows display manager must not be installed unless approved.\"\n  desc  \"Internet services that are not required for system or application\nprocesses must not be active to decrease the attack surface of the system. X\nWindows has a long history of security vulnerabilities and will not be used\nunless approved and documented.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75901\"\n  tag \"rid\": \"SV-90581r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030740\"\n  tag \"fix_id\": \"F-82531r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that if X Windows is installed it is authorized.\n\nCheck for the X11 package with the following command:\n\n# dpkg -l | grep lightdm\n\nAsk the System Administrator if use of the X Windows system is an operational\nrequirement.\n\nIf the use of X Windows on the system is not documented with the Information\nSystem Security Officer (ISSO), this is a finding.\"\n  desc \"fix\", \"Document the requirement for an X Windows server with the\nInformation System Security Officer (ISSO) or remove the related packages with\nthe following commands:\n\n# sudo apt-get purge lightdm\"\n\n  describe package('lightdm') do\n    it { should_not be_installed }\n  end\n\nend\n","source_location":{"line":1,"ref":"./controls/V-75901.rb"},"results":[{"status":"passed","code_desc":"System Package lightdm should not be installed","run_time":0.017846,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75593","title":"The /var/log directory must be group-owned by syslog.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify the \"/var/log\" directory is group-owned by syslog.\n\nCheck that the \"/var/log\" directory is group owned by syslog with the\nfollowing command:\n\n# ls -lad /var/log | cut -d' ' -f4\n\nsyslog\n\nIf \"syslog\" is not returned as a result, this is a finding."},{"label":"fix","data":"Change the group of the directory \"/var/log\" to \"syslog\" by\nrunning the following command:\n\n# sudo chgrp syslog /var/log"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75593","rid":"SV-90273r2_rule","stig_id":"UBTU-16-010940","fix_id":"F-82221r2_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75593\" do\n  title \"The /var/log directory must be group-owned by syslog.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75593\"\n  tag \"rid\": \"SV-90273r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010940\"\n  tag \"fix_id\": \"F-82221r2_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the \\\"/var/log\\\" directory is group-owned by syslog.\n\nCheck that the \\\"/var/log\\\" directory is group owned by syslog with the\nfollowing command:\n\n# ls -lad /var/log | cut -d' ' -f4\n\nsyslog\n\nIf \\\"syslog\\\" is not returned as a result, this is a finding.\"\n  desc \"fix\", \"Change the group of the directory \\\"/var/log\\\" to \\\"syslog\\\" by\nrunning the following command:\n\n# sudo chgrp syslog /var/log \"\n\n  describe directory('/var/log') do\n    its('group') { should cmp 'syslog'}\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75593.rb"},"results":[{"status":"passed","code_desc":"Directory /var/log group should cmp == \"syslog\"","run_time":0.000172,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75841","title":"The SSH daemon must not allow authentication using known hosts\nauthentication.","desc":"Configuring this setting for the SSH daemon provides additional\nassurance that remote logon via SSH will require a password, even in the event\nof misconfiguration elsewhere.","descriptions":[{"label":"default","data":"Configuring this setting for the SSH daemon provides additional\nassurance that remote logon via SSH will require a password, even in the event\nof misconfiguration elsewhere."},{"label":"check","data":"Verify the SSH daemon does not allow authentication using known\nhosts authentication.\n\nTo determine how the SSH daemon's \"IgnoreUserKnownHosts\" option is set, run\nthe following command:\n\n# grep IgnoreUserKnownHosts /etc/ssh/sshd_config\n\nIgnoreUserKnownHosts yes\n\nIf the value is returned as \"no\", the returned line is commented out, or no\noutput is returned, this is a finding."},{"label":"fix","data":"Configure the SSH daemon to not allow authentication using known\nhosts authentication.\n\nAdd the following line in \"/etc/ssh/sshd_config\", or uncomment the line and\nset the value to \"yes\":\n\nIgnoreUserKnownHosts yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75841","rid":"SV-90521r2_rule","stig_id":"UBTU-16-030300","fix_id":"F-82471r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75841\" do\n  title \"The SSH daemon must not allow authentication using known hosts\nauthentication.\"\n  desc  \"Configuring this setting for the SSH daemon provides additional\nassurance that remote logon via SSH will require a password, even in the event\nof misconfiguration elsewhere.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75841\"\n  tag \"rid\": \"SV-90521r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030300\"\n  tag \"fix_id\": \"F-82471r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH daemon does not allow authentication using known\nhosts authentication.\n\nTo determine how the SSH daemon's \\\"IgnoreUserKnownHosts\\\" option is set, run\nthe following command:\n\n# grep IgnoreUserKnownHosts /etc/ssh/sshd_config\n\nIgnoreUserKnownHosts yes\n\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no\noutput is returned, this is a finding.\"\n  desc \"fix\", \"Configure the SSH daemon to not allow authentication using known\nhosts authentication.\n\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and\nset the value to \\\"yes\\\":\n\nIgnoreUserKnownHosts yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\n\"\n\n  describe sshd_config do\n    its('IgnoreUserKnownHosts') { should cmp 'yes' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75841.rb"},"results":[{"status":"failed","code_desc":"SSHD Configuration IgnoreUserKnownHosts should cmp == \"yes\"","run_time":0.000502,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected: \"yes\"\n     got: nil\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75653","title":"Audit tools must have a mode of 0755 or less permissive.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":[{"label":"default","data":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators."},{"label":"check","data":"Verify the audit tools are protected from unauthorized access,\ndeletion, or modification by checking the permissive mode.\n\nCheck the octal permission of each audit tool by running the following command:\n\n#stat -c \"%a %n\" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace\n/sbin/auditd /sbin/audispd /sbin/augenrules\n\n755 /sbin/augenrules\n\nIf any of the audit tools has a mode more permissive than \"0755\", this is a\nfinding."},{"label":"fix","data":"Configure the audit tools to be protected from unauthorized\naccess by setting the correct permissive mode using the following command:\n\n# sudo chmod 0755 [audit_tool]\n\nReplace \"[audit_tool]\" with the audit tool that does not have the correct\npermissive mode."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000256-GPOS-00097","satisfies":["SRG-OS-000256-GPOS-00097","SRG-OS-000257-GPOS-00098","SRG-OS-000258-GPOS-00099"],"gid":"V-75653","rid":"SV-90333r2_rule","stig_id":"UBTU-16-020180","fix_id":"F-82281r1_fix","cci":["CCI-001493","CCI-001494","CCI-001495"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75653\" do\n  title \"Audit tools must have a mode of 0755 or less permissive.\"\n  desc  \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n    Ubuntu operating systems providing tools to interface with audit\ninformation will leverage user permissions and roles identifying the user\naccessing the tools and the corresponding rights the user enjoys in order to\nmake access decisions regarding the access to audit tools.\n\n    Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000256-GPOS-00097\"\n  tag \"satisfies\": [\"SRG-OS-000256-GPOS-00097\", \"SRG-OS-000257-GPOS-00098\",\n\"SRG-OS-000258-GPOS-00099\"]\n  tag \"gid\": \"V-75653\"\n  tag \"rid\": \"SV-90333r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020180\"\n  tag \"fix_id\": \"F-82281r1_fix\"\n  tag \"cci\": [\"CCI-001493\", \"CCI-001494\", \"CCI-001495\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit tools are protected from unauthorized access,\ndeletion, or modification by checking the permissive mode.\n\nCheck the octal permission of each audit tool by running the following command:\n\n#stat -c \\\"%a %n\\\" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace\n/sbin/auditd /sbin/audispd /sbin/augenrules\n\n755 /sbin/augenrules\n\nIf any of the audit tools has a mode more permissive than \\\"0755\\\", this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit tools to be protected from unauthorized\naccess by setting the correct permissive mode using the following command:\n\n# sudo chmod 0755 [audit_tool]\n\nReplace \\\"[audit_tool]\\\" with the audit tool that does not have the correct\npermissive mode.\"\n\n  audit_tools = input('audit_tools')\n\n  audit_tools.each do |tool|\n    describe file(tool) do\n      it { should_not be_more_permissive_than('0755') }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75653.rb"},"results":[{"status":"passed","code_desc":"File /sbin/auditctl should not be more permissive than \"0755\"","run_time":0.008885,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/aureport should not be more permissive than \"0755\"","run_time":0.008905,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/ausearch should not be more permissive than \"0755\"","run_time":0.008495,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/autrace should not be more permissive than \"0755\"","run_time":0.009092,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/auditd should not be more permissive than \"0755\"","run_time":0.011409,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/audispd should not be more permissive than \"0755\"","run_time":0.010373,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"passed","code_desc":"File /sbin/augenrules should not be more permissive than \"0755\"","run_time":0.010033,"start_time":"2019-08-06T11:13:30-04:00"}]},{"id":"V-75713","title":"The audit system must be configured to audit any usage of the modprobe\ncommand.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \"modprobe\", by running the\nfollowing command:\n\n# sudo grep \"/sbin/modprobe\" /etc/audit/audit.rules\n\n-w /sbin/modprobe -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe module management program \"modprobe\", by adding the following line to\n\"/etc/audit/audit.rules\":\n\n-w /sbin/modprobe -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75713","rid":"SV-90393r2_rule","stig_id":"UBTU-16-020440","fix_id":"F-82341r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75713\" do\n  title \"The audit system must be configured to audit any usage of the modprobe\ncommand.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75713\"\n  tag \"rid\": \"SV-90393r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020440\"\n  tag \"fix_id\": \"F-82341r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \\\"modprobe\\\", by running the\nfollowing command:\n\n# sudo grep \\\"/sbin/modprobe\\\" /etc/audit/audit.rules\n\n-w /sbin/modprobe -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe module management program \\\"modprobe\\\", by adding the following line to\n\\\"/etc/audit/audit.rules\\\":\n\n-w /sbin/modprobe -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/sbin/modprobe'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75713.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /sbin/modprobe exist should equal true","run_time":0.00016,"start_time":"2019-08-06T11:13:30-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75531","title":"Automatic mounting of Universal Serial Bus (USB) mass storage driver\nmust be disabled.","desc":"Without authenticating devices, unidentified or unknown devices may be\nintroduced, thereby facilitating malicious activity.\n\n    Peripherals include, but are not limited to, such devices as flash drives,\nexternal storage, and printers.","descriptions":[{"label":"default","data":"Without authenticating devices, unidentified or unknown devices may be\nintroduced, thereby facilitating malicious activity.\n\n    Peripherals include, but are not limited to, such devices as flash drives,\nexternal storage, and printers."},{"label":"check","data":"Verify that automatic mounting of the Universal Serial Bus\n(USB) mass storage driver has been disabled.\n\nCheck that the USB mass storage drive has not been loaded with the following\ncommand:\n\n#lsmod | grep usb-storage\n\nIf a \"usb-storage\" line is returned, this is a finding.\n\nCheck that automatic mounting of the USB mass storage driver has been disabled\nwith the following command:\n\n#sudo modprobe -vn  usb-storage\n\ninstall /bin/true\n\nIf “install /bin/true” is not returned, this is a finding."},{"label":"fix","data":"Disable the mounting of the Universal Serial Bus (USB) mass\nstorage driver by running the following command:\n\n# sudo echo “install usb-storage /bin/true” >> /etc/modprobe.d/DISASTIG.conf"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000378-GPOS-00163","gid":"V-75531","rid":"SV-90211r2_rule","stig_id":"UBTU-16-010580","fix_id":"F-82159r2_fix","cci":["CCI-001958"],"nist":["IA-3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75531\" do\n  title \"Automatic mounting of Universal Serial Bus (USB) mass storage driver\nmust be disabled.\"\n  desc  \"Without authenticating devices, unidentified or unknown devices may be\nintroduced, thereby facilitating malicious activity.\n\n    Peripherals include, but are not limited to, such devices as flash drives,\nexternal storage, and printers.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000378-GPOS-00163\"\n  tag \"gid\": \"V-75531\"\n  tag \"rid\": \"SV-90211r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010580\"\n  tag \"fix_id\": \"F-82159r2_fix\"\n  tag \"cci\": [\"CCI-001958\"]\n  tag \"nist\": [\"IA-3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that automatic mounting of the Universal Serial Bus\n(USB) mass storage driver has been disabled.\n\nCheck that the USB mass storage drive has not been loaded with the following\ncommand:\n\n#lsmod | grep usb-storage\n\nIf a \\\"usb-storage\\\" line is returned, this is a finding.\n\nCheck that automatic mounting of the USB mass storage driver has been disabled\nwith the following command:\n\n#sudo modprobe -vn  usb-storage\n\ninstall /bin/true\n\nIf “install /bin/true” is not returned, this is a finding.\"\n  desc \"fix\", \"Disable the mounting of the Universal Serial Bus (USB) mass\nstorage driver by running the following command:\n\n# sudo echo “install usb-storage /bin/true” >> /etc/modprobe.d/DISASTIG.conf\"\n\n  describe kernel_module('usb-storage') do\n    it { should_not be_loaded }\n    it { should be_disabled }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75531.rb"},"results":[{"status":"passed","code_desc":"Kernel Module usb-storage should not be loaded","run_time":0.010966,"start_time":"2019-08-06T11:13:30-04:00"},{"status":"failed","code_desc":"Kernel Module usb-storage should be disabled","run_time":1.112534,"start_time":"2019-08-06T11:13:30-04:00","message":"expected `Kernel Module usb-storage.disabled?` to return true, got false"}]},{"id":"V-75471","title":"Passwords for new users must have a 24 hours/1 day minimum password\nlifetime restriction.","desc":"Enforcing a minimum password lifetime helps to prevent repeated\npassword changes to defeat the password reuse or history enforcement\nrequirement. If users are allowed to immediately and continually change their\npassword, then the password could be repeatedly changed in a short period of\ntime to defeat the organization's policy regarding password reuse.","descriptions":[{"label":"default","data":"Enforcing a minimum password lifetime helps to prevent repeated\npassword changes to defeat the password reuse or history enforcement\nrequirement. If users are allowed to immediately and continually change their\npassword, then the password could be repeatedly changed in a short period of\ntime to defeat the organization's policy regarding password reuse."},{"label":"check","data":"Verify that the Ubuntu operating system enforces a 24 hours/1\nday minimum password lifetime for new user accounts by running the following\ncommand:\n\n# grep -i pass_min_days /etc/login.defs\n\nPASS_MIN_DAYS    1\n\nIf the \"PASS_MIN_DAYS\" parameter value is less than or equal to \"1\", or\ncommented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce a 24 hours/1 day\nminimum password lifetime.\n\nAdd, or modify the following line in the \"/etc/login.defs\" file:\n\nPASS_MIN_DAYS    1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000075-GPOS-00043","gid":"V-75471","rid":"SV-90151r2_rule","stig_id":"UBTU-16-010210","fix_id":"F-82099r2_fix","cci":["CCI-000198"],"nist":["IA-5 (1) (d)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75471\" do\n  title \"Passwords for new users must have a 24 hours/1 day minimum password\nlifetime restriction.\"\n  desc  \"Enforcing a minimum password lifetime helps to prevent repeated\npassword changes to defeat the password reuse or history enforcement\nrequirement. If users are allowed to immediately and continually change their\npassword, then the password could be repeatedly changed in a short period of\ntime to defeat the organization's policy regarding password reuse.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000075-GPOS-00043\"\n  tag \"gid\": \"V-75471\"\n  tag \"rid\": \"SV-90151r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010210\"\n  tag \"fix_id\": \"F-82099r2_fix\"\n  tag \"cci\": [\"CCI-000198\"]\n  tag \"nist\": [\"IA-5 (1) (d)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the Ubuntu operating system enforces a 24 hours/1\nday minimum password lifetime for new user accounts by running the following\ncommand:\n\n# grep -i pass_min_days /etc/login.defs\n\nPASS_MIN_DAYS    1\n\nIf the \\\"PASS_MIN_DAYS\\\" parameter value is less than or equal to \\\"1\\\", or\ncommented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce a 24 hours/1 day\nminimum password lifetime.\n\nAdd, or modify the following line in the \\\"/etc/login.defs\\\" file:\n\nPASS_MIN_DAYS    1\"\n\n  describe login_defs do\n    its('PASS_MIN_DAYS') { should >= '1' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75471.rb"},"results":[{"status":"passed","code_desc":"login.defs PASS_MIN_DAYS should >= \"1\"","run_time":0.001055,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75727","title":"The audit system must be configured to audit any usage of the\nfremovexattr system call.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \"fremovexattr\" system call, by running the following\ncommand:\n\n# sudo grep -w fremovexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"fremovexattr\" system call by adding the following lines to\n\"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000458-GPOS-00203","SRG-OS-000462-GPOS-00206","SRG-OS-000463-GPOS-00207","SRG-OS-000471-GPOS-00215","SRG-OS-000474-GPOS-00219"],"gid":"V-75727","rid":"SV-90407r3_rule","stig_id":"UBTU-16-020510","fix_id":"F-82355r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75727\" do\n  title \"The audit system must be configured to audit any usage of the\nfremovexattr system call.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000458-GPOS-00203\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000463-GPOS-00207\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000474-GPOS-00219\"]\n  tag \"gid\": \"V-75727\"\n  tag \"rid\": \"SV-90407r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020510\"\n  tag \"fix_id\": \"F-82355r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \\\"fremovexattr\\\" system call, by running the following\ncommand:\n\n# sudo grep -w fremovexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"fremovexattr\\\" system call by adding the following lines to\n\\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"fremovexattr\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75727.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"fremovexattr\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000182,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"fremovexattr\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000133,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75667","title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/shadow.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \"/etc/shadow\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following\ncommand:\n\n# sudo grep /etc/shadow /etc/audit/audit.rules\n\n-w /etc/shadow -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \"/etc/shadow\".\n\nAdd or update the following file system rule to \"/etc/audit/audit.rules\":\n\n-w /etc/shadow -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000304-GPOS-00121","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000470-GPOS-00214","SRG-OS-000471-GPOS-00215"],"gid":"V-75667","rid":"SV-90347r3_rule","stig_id":"UBTU-16-020330","fix_id":"F-82295r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002132","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","AC-2 (4)","MA-4 (1)\n(a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75667\" do\n  title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/shadow.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000304-GPOS-00121\",\n\"SRG-OS-000392-GPOS-00172\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000470-GPOS-00214\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75667\"\n  tag \"rid\": \"SV-90347r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020330\"\n  tag \"fix_id\": \"F-82295r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002132\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"AC-2 (4)\", \"MA-4 (1)\n(a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates audit records for\nall account creations, modifications, disabling, and termination events that\naffect \\\"/etc/shadow\\\".\n\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following\ncommand:\n\n# sudo grep /etc/shadow /etc/audit/audit.rules\n\n-w /etc/shadow -p wa -k audit_rules_usergroup_modification\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to generate audit records\nfor all account creations, modifications, disabling, and termination events\nthat affect \\\"/etc/shadow\\\".\n\nAdd or update the following file system rule to \\\"/etc/audit/audit.rules\\\":\n\n-w /etc/shadow -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/etc/shadow'\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75667.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /etc/shadow exist should equal true","run_time":0.000118,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75875","title":"The Ubuntu operating system must not forward Internet Protocol version\n4 (IPv4) source-routed packets by default.","desc":"Source-routed packets allow the source of the packet to suggest that\nrouters forward the packet along a different path than configured on the\nrouter, which can be used to bypass network security measures. This requirement\napplies only to the forwarding of source-routed traffic, such as when IPv4\nforwarding is enabled and the system is functioning as a router.","descriptions":[{"label":"default","data":"Source-routed packets allow the source of the packet to suggest that\nrouters forward the packet along a different path than configured on the\nrouter, which can be used to bypass network security measures. This requirement\napplies only to the forwarding of source-routed traffic, such as when IPv4\nforwarding is enabled and the system is functioning as a router."},{"label":"check","data":"Verify the Ubuntu operating system does not accept  Internet\nProtocol version 4 (IPv4) source-routed packets by default.\n\nCheck the value of the accept source route variable with the following command:\n\n# sudo sysctl net.ipv4.conf.default.accept_source_route\nnet.ipv4.conf.default.accept_source_route=0\n\nIf the returned line does not have a value of \"0\", a line is not returned, or\nthe returned line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to not forward Internet\nProtocol version 4 (IPv4) source-routed packets by default with the following\ncommand:\n\n# sudo sysctl -w net.ipv4.conf.default.accept_source_route=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.conf.default.accept_source_route=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75875","rid":"SV-90555r3_rule","stig_id":"UBTU-16-030540","fix_id":"F-82505r3_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75875\" do\n  title \"The Ubuntu operating system must not forward Internet Protocol version\n4 (IPv4) source-routed packets by default.\"\n  desc  \"Source-routed packets allow the source of the packet to suggest that\nrouters forward the packet along a different path than configured on the\nrouter, which can be used to bypass network security measures. This requirement\napplies only to the forwarding of source-routed traffic, such as when IPv4\nforwarding is enabled and the system is functioning as a router.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75875\"\n  tag \"rid\": \"SV-90555r3_rule\"\n  tag \"stig_id\": \"UBTU-16-030540\"\n  tag \"fix_id\": \"F-82505r3_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system does not accept  Internet\nProtocol version 4 (IPv4) source-routed packets by default.\n\nCheck the value of the accept source route variable with the following command:\n\n# sudo sysctl net.ipv4.conf.default.accept_source_route\nnet.ipv4.conf.default.accept_source_route=0\n\nIf the returned line does not have a value of \\\"0\\\", a line is not returned, or\nthe returned line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to not forward Internet\nProtocol version 4 (IPv4) source-routed packets by default with the following\ncommand:\n\n# sudo sysctl -w net.ipv4.conf.default.accept_source_route=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.conf.default.accept_source_route=0\"\n\n  describe kernel_parameter('net.ipv4.conf.default.accept_source_route') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75875.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.conf.default.accept_source_route value should eq 0","run_time":0.010157,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75785","title":"Successful/unsuccessful uses of the usermod command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"usermod\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w usermod /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-usermod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"usermod\" command. Add or update the\nfollowing rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-usermod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75785","rid":"SV-90465r3_rule","stig_id":"UBTU-16-020800","fix_id":"F-82415r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75785\" do\n  title \"Successful/unsuccessful uses of the usermod command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75785\"\n  tag \"rid\": \"SV-90465r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020800\"\n  tag \"fix_id\": \"F-82415r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"usermod\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w usermod /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-usermod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"usermod\\\" command. Add or update the\nfollowing rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-usermod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/sbin/usermod'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75785.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/sbin/usermod exist should equal true","run_time":0.000156,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75445","title":"The Ubuntu operating system must prevent direct login into the root\naccount.","desc":"To assure individual accountability and prevent unauthorized access,\norganizational users must be individually identified and authenticated.\n\n    A group authenticator is a generic account used by multiple individuals.\nUse of a group authenticator alone does not uniquely identify individual users.\nExamples of the group authenticator is the UNIX OS \"root\" user account, the\nWindows \"Administrator\" account, the \"sa\" account, or a \"helpdesk\"\naccount.\n\n    For example, the UNIX and Windows operating systems offer a 'switch user'\ncapability allowing users to authenticate with their individual credentials\nand, when needed, 'switch' to the administrator role. This method provides for\nunique individual authentication prior to using a group authenticator.\n\n    Users (and any processes acting on behalf of users) need to be uniquely\nidentified and authenticated for all accesses other than those accesses\nexplicitly identified and documented by the organization, which outlines\nspecific user actions that can be performed on the Ubuntu operating system\nwithout identification or authentication.\n\n    Requiring individuals to be authenticated with an individual authenticator\nprior to using a group authenticator allows for traceability of actions, as\nwell as adding an additional level of protection of the actions that can be\ntaken with group account knowledge.","descriptions":[{"label":"default","data":"To assure individual accountability and prevent unauthorized access,\norganizational users must be individually identified and authenticated.\n\n    A group authenticator is a generic account used by multiple individuals.\nUse of a group authenticator alone does not uniquely identify individual users.\nExamples of the group authenticator is the UNIX OS \"root\" user account, the\nWindows \"Administrator\" account, the \"sa\" account, or a \"helpdesk\"\naccount.\n\n    For example, the UNIX and Windows operating systems offer a 'switch user'\ncapability allowing users to authenticate with their individual credentials\nand, when needed, 'switch' to the administrator role. This method provides for\nunique individual authentication prior to using a group authenticator.\n\n    Users (and any processes acting on behalf of users) need to be uniquely\nidentified and authenticated for all accesses other than those accesses\nexplicitly identified and documented by the organization, which outlines\nspecific user actions that can be performed on the Ubuntu operating system\nwithout identification or authentication.\n\n    Requiring individuals to be authenticated with an individual authenticator\nprior to using a group authenticator allows for traceability of actions, as\nwell as adding an additional level of protection of the actions that can be\ntaken with group account knowledge."},{"label":"check","data":"Verify the Ubuntu operating system prevents direct logins to\nthe root account.\n\nCheck that the Ubuntu operating system prevents direct logins to the root\naccount with the following command:\n\n#  grep root /etc/shadow\n\nroot L 11/11/2017 0 99999 7 -1\n\nIf any output is returned and the second field is not an \"L\", this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to prevent direct logins to\nthe root account.\n\nRun the following command to lock the root account:\n\n# passwd -l root"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000109-GPOS-00056","gid":"V-75445","rid":"SV-90125r3_rule","stig_id":"UBTU-16-010080","fix_id":"F-82073r3_fix","cci":["CCI-000770"],"nist":["IA-2 (5)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75445\" do\n  title \"The Ubuntu operating system must prevent direct login into the root\naccount.\"\n  desc  \"To assure individual accountability and prevent unauthorized access,\norganizational users must be individually identified and authenticated.\n\n    A group authenticator is a generic account used by multiple individuals.\nUse of a group authenticator alone does not uniquely identify individual users.\nExamples of the group authenticator is the UNIX OS \\\"root\\\" user account, the\nWindows \\\"Administrator\\\" account, the \\\"sa\\\" account, or a \\\"helpdesk\\\"\naccount.\n\n    For example, the UNIX and Windows operating systems offer a 'switch user'\ncapability allowing users to authenticate with their individual credentials\nand, when needed, 'switch' to the administrator role. This method provides for\nunique individual authentication prior to using a group authenticator.\n\n    Users (and any processes acting on behalf of users) need to be uniquely\nidentified and authenticated for all accesses other than those accesses\nexplicitly identified and documented by the organization, which outlines\nspecific user actions that can be performed on the Ubuntu operating system\nwithout identification or authentication.\n\n    Requiring individuals to be authenticated with an individual authenticator\nprior to using a group authenticator allows for traceability of actions, as\nwell as adding an additional level of protection of the actions that can be\ntaken with group account knowledge.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000109-GPOS-00056\"\n  tag \"gid\": \"V-75445\"\n  tag \"rid\": \"SV-90125r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010080\"\n  tag \"fix_id\": \"F-82073r3_fix\"\n  tag \"cci\": [\"CCI-000770\"]\n  tag \"nist\": [\"IA-2 (5)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system prevents direct logins to\nthe root account.\n\nCheck that the Ubuntu operating system prevents direct logins to the root\naccount with the following command:\n\n#  grep root /etc/shadow\n\nroot L 11/11/2017 0 99999 7 -1\n\nIf any output is returned and the second field is not an \\\"L\\\", this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to prevent direct logins to\nthe root account.\n\nRun the following command to lock the root account:\n\n# passwd -l root\"\n\n  # Using the shadow resource\n  describe.one do\n    describe shadow.where(user: 'root') do\n      its('passwords') { should include '!' }\n    end\n    describe shadow.where(user: 'root') do\n      its('passwords') { should include '*' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75445.rb"},"results":[{"status":"passed","code_desc":"/etc/shadow with user == \"root\" passwords should include \"!\"","run_time":8.8e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75505","title":"Ubuntu operating systems booted with a BIOS must require\nauthentication upon booting into single-user and maintenance modes.","desc":"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access. Successful authentication must not automatically give\nan entity access to an asset or security boundary. Authorization procedures and\ncontrols must be implemented to ensure each authenticated entity also has a\nvalidated and current authorization. Authorization is the process of\ndetermining whether an entity, once authenticated, is permitted to access a\nspecific asset. Information systems use access control policies and enforcement\nmechanisms to implement this requirement.\n\n    Access control policies include: identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include:\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.","descriptions":[{"label":"default","data":"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access. Successful authentication must not automatically give\nan entity access to an asset or security boundary. Authorization procedures and\ncontrols must be implemented to ensure each authenticated entity also has a\nvalidated and current authorization. Authorization is the process of\ndetermining whether an entity, once authenticated, is permitted to access a\nspecific asset. Information systems use access control policies and enforcement\nmechanisms to implement this requirement.\n\n    Access control policies include: identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include:\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system."},{"label":"check","data":"Verify that an encrypted root password is set. This is only\napplicable on systems that use a basic Input/Output System BIOS.\n\nRun the following command to verify the encrypted password is set:\n\n# grep –i password /boot/grub/grub.cfg\n\npassword_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG\n\nIf the root password entry does not begin with “password_pbkdf2”, this is a\nfinding."},{"label":"fix","data":"Configure the system to require a password for authentication\nupon booting into single-user and maintenance modes.\n\nGenerate an encrypted (grub) password for root with the following command:\n\n# grub-mkpasswd-pbkdf2\nEnter Password:\nReenter Password:\nPBKDF2 hash of your password is\ngrub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG\n\nUsing the hash from the output, modify the \"/etc/grub.d/10_linux\" file with\nthe following command to add a boot password for the root entry:\n\n# cat << EOF > set superusers=\"root\" password_pbkdf2 root\ngrub.pbkdf2.sha512.VeryLongString > EOF\n\nGenerate an updated \"grub.conf\" file with the new password by using the\nfollowing commands:\n\n# grub2-mkconfig --output=/tmp/grub2.cfg\n# mv /tmp/grub2.cfg /boot/grub2/grub.cfg"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000080-GPOS-00048","gid":"V-75505","rid":"SV-90185r2_rule","stig_id":"UBTU-16-010380","fix_id":"F-82133r1_fix","cci":["CCI-000213"],"nist":["AC-3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75505\" do\n  title \"Ubuntu operating systems booted with a BIOS must require\nauthentication upon booting into single-user and maintenance modes.\"\n  desc  \"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access. Successful authentication must not automatically give\nan entity access to an asset or security boundary. Authorization procedures and\ncontrols must be implemented to ensure each authenticated entity also has a\nvalidated and current authorization. Authorization is the process of\ndetermining whether an entity, once authenticated, is permitted to access a\nspecific asset. Information systems use access control policies and enforcement\nmechanisms to implement this requirement.\n\n    Access control policies include: identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include:\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000080-GPOS-00048\"\n  tag \"gid\": \"V-75505\"\n  tag \"rid\": \"SV-90185r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010380\"\n  tag \"fix_id\": \"F-82133r1_fix\"\n  tag \"cci\": [\"CCI-000213\"]\n  tag \"nist\": [\"AC-3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an encrypted root password is set. This is only\napplicable on systems that use a basic Input/Output System BIOS.\n\nRun the following command to verify the encrypted password is set:\n\n# grep –i password /boot/grub/grub.cfg\n\npassword_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG\n\nIf the root password entry does not begin with “password_pbkdf2”, this is a\nfinding.\"\n  desc \"fix\", \"Configure the system to require a password for authentication\nupon booting into single-user and maintenance modes.\n\nGenerate an encrypted (grub) password for root with the following command:\n\n# grub-mkpasswd-pbkdf2\nEnter Password:\nReenter Password:\nPBKDF2 hash of your password is\ngrub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG\n\nUsing the hash from the output, modify the \\\"/etc/grub.d/10_linux\\\" file with\nthe following command to add a boot password for the root entry:\n\n# cat << EOF > set superusers=\\\"root\\\" password_pbkdf2 root\ngrub.pbkdf2.sha512.VeryLongString > EOF\n\nGenerate an updated \\\"grub.conf\\\" file with the new password by using the\nfollowing commands:\n\n# grub2-mkconfig --output=/tmp/grub2.cfg\n# mv /tmp/grub2.cfg /boot/grub2/grub.cfg\"\n\n  describe file('/boot/grub/grub.cfg') do\n    its('content') { should match \"^password_pbkdf2\" }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75505.rb"},"results":[{"status":"failed","code_desc":"File /boot/grub/grub.cfg content should match \"^password_pbkdf2\"","run_time":0.016886,"start_time":"2019-08-06T11:13:31-04:00","message":"expected \"#\\n# DO NOT EDIT THIS FILE\\n#\\n# It is automatically generated by grub-mkconfig using templates\\n# f...  $prefix/custom.cfg ]; then\\n  source $prefix/custom.cfg;\\nfi\\n### END /etc/grub.d/41_custom ###\\n\" to match \"^password_pbkdf2\"\nDiff:\n@@ -1,2 +1,214 @@\n-^password_pbkdf2\n+#\n+# DO NOT EDIT THIS FILE\n+#\n+# It is automatically generated by grub-mkconfig using templates\n+# from /etc/grub.d and settings from /etc/default/grub\n+#\n+\n+### BEGIN /etc/grub.d/00_header ###\n+if [ -s $prefix/grubenv ]; then\n+  set have_grubenv=true\n+  load_env\n+fi\n+if [ \"${next_entry}\" ] ; then\n+   set default=\"${next_entry}\"\n+   set next_entry=\n+   save_env next_entry\n+   set boot_once=true\n+else\n+   set default=\"0\"\n+fi\n+\n+if [ x\"${feature_menuentry_id}\" = xy ]; then\n+  menuentry_id_option=\"--id\"\n+else\n+  menuentry_id_option=\"\"\n+fi\n+\n+export menuentry_id_option\n+\n+if [ \"${prev_saved_entry}\" ]; then\n+  set saved_entry=\"${prev_saved_entry}\"\n+  save_env saved_entry\n+  set prev_saved_entry=\n+  save_env prev_saved_entry\n+  set boot_once=true\n+fi\n+\n+function savedefault {\n+  if [ -z \"${boot_once}\" ]; then\n+    saved_entry=\"${chosen}\"\n+    save_env saved_entry\n+  fi\n+}\n+function recordfail {\n+  set recordfail=1\n+  if [ -n \"${have_grubenv}\" ]; then if [ -z \"${boot_once}\" ]; then save_env recordfail; fi; fi\n+}\n+function load_video {\n+  if [ x$feature_all_video_module = xy ]; then\n+    insmod all_video\n+  else\n+    insmod efi_gop\n+    insmod efi_uga\n+    insmod ieee1275_fb\n+    insmod vbe\n+    insmod vga\n+    insmod video_bochs\n+    insmod video_cirrus\n+  fi\n+}\n+\n+if [ x$feature_default_font_path = xy ] ; then\n+   font=unicode\n+else\n+insmod part_msdos\n+insmod lvm\n+insmod ext2\n+set root='lvmid/dW9vLn-2mwm-174a-rS7o-KjrE-be7X-xiJRy2/YD6Xvu-bQna-TMxq-FI5E-edDk-NXeV-UGcamx'\n+if [ x$feature_platform_search_hint = xy ]; then\n+  search --no-floppy --fs-uuid --set=root --hint='lvmid/dW9vLn-2mwm-174a-rS7o-KjrE-be7X-xiJRy2/YD6Xvu-bQna-TMxq-FI5E-edDk-NXeV-UGcamx'  1971e40b-aab9-42a2-b13b-af3630e7dd7e\n+else\n+  search --no-floppy --fs-uuid --set=root 1971e40b-aab9-42a2-b13b-af3630e7dd7e\n+fi\n+    font=\"/usr/share/grub/unicode.pf2\"\n+fi\n+\n+if loadfont $font ; then\n+  set gfxmode=auto\n+  load_video\n+  insmod gfxterm\n+  set locale_dir=$prefix/locale\n+  set lang=en_US\n+  insmod gettext\n+fi\n+terminal_output gfxterm\n+if [ \"${recordfail}\" = 1 ] ; then\n+  set timeout=30\n+else\n+  if [ x$feature_timeout_style = xy ] ; then\n+    set timeout_style=hidden\n+    set timeout=0\n+  # Fallback hidden-timeout code in case the timeout_style feature is\n+  # unavailable.\n+  elif sleep --interruptible 0 ; then\n+    set timeout=0\n+  fi\n+fi\n+### END /etc/grub.d/00_header ###\n+\n+### BEGIN /etc/grub.d/05_debian_theme ###\n+set menu_color_normal=white/black\n+set menu_color_highlight=black/light-gray\n+### END /etc/grub.d/05_debian_theme ###\n+\n+### BEGIN /etc/grub.d/10_linux ###\n+function gfxmode {\n+\tset gfxpayload=\"${1}\"\n+\tif [ \"${1}\" = \"keep\" ]; then\n+\t\tset vt_handoff=vt.handoff=7\n+\telse\n+\t\tset vt_handoff=\n+\tfi\n+}\n+if [ \"${recordfail}\" != 1 ]; then\n+  if [ -e ${prefix}/gfxblacklist.txt ]; then\n+    if hwmatch ${prefix}/gfxblacklist.txt 3; then\n+      if [ ${match} = 0 ]; then\n+        set linux_gfx_mode=keep\n+      else\n+        set linux_gfx_mode=text\n+      fi\n+    else\n+      set linux_gfx_mode=text\n+    fi\n+  else\n+    set linux_gfx_mode=keep\n+  fi\n+else\n+  set linux_gfx_mode=text\n+fi\n+export linux_gfx_mode\n+menuentry 'Ubuntu' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-1971e40b-aab9-42a2-b13b-af3630e7dd7e' {\n+\trecordfail\n+\tload_video\n+\tgfxmode $linux_gfx_mode\n+\tinsmod gzio\n+\tif [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi\n+\tinsmod part_msdos\n+\tinsmod ext2\n+\tset root='hd0,msdos1'\n+\tif [ x$feature_platform_search_hint = xy ]; then\n+\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos1 --hint-efi=hd0,msdos1 --hint-baremetal=ahci0,msdos1  377a57ee-b128-4940-a795-31581885806c\n+\telse\n+\t  search --no-floppy --fs-uuid --set=root 377a57ee-b128-4940-a795-31581885806c\n+\tfi\n+        linux\t/vmlinuz-4.4.0-131-generic root=/dev/mapper/vagrant--vg-root ro net.ifnames=0 biosdevname=0  quiet\n+\tinitrd\t/initrd.img-4.4.0-131-generic\n+}\n+submenu 'Advanced options for Ubuntu' $menuentry_id_option 'gnulinux-advanced-1971e40b-aab9-42a2-b13b-af3630e7dd7e' {\n+\tmenuentry 'Ubuntu, with Linux 4.4.0-131-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-4.4.0-131-generic-advanced-1971e40b-aab9-42a2-b13b-af3630e7dd7e' {\n+\t\trecordfail\n+\t\tload_video\n+\t\tgfxmode $linux_gfx_mode\n+\t\tinsmod gzio\n+\t\tif [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi\n+\t\tinsmod part_msdos\n+\t\tinsmod ext2\n+\t\tset root='hd0,msdos1'\n+\t\tif [ x$feature_platform_search_hint = xy ]; then\n+\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos1 --hint-efi=hd0,msdos1 --hint-baremetal=ahci0,msdos1  377a57ee-b128-4940-a795-31581885806c\n+\t\telse\n+\t\t  search --no-floppy --fs-uuid --set=root 377a57ee-b128-4940-a795-31581885806c\n+\t\tfi\n+\t\techo\t'Loading Linux 4.4.0-131-generic ...'\n+\t        linux\t/vmlinuz-4.4.0-131-generic root=/dev/mapper/vagrant--vg-root ro net.ifnames=0 biosdevname=0  quiet\n+\t\techo\t'Loading initial ramdisk ...'\n+\t\tinitrd\t/initrd.img-4.4.0-131-generic\n+\t}\n+\tmenuentry 'Ubuntu, with Linux 4.4.0-131-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-4.4.0-131-generic-recovery-1971e40b-aab9-42a2-b13b-af3630e7dd7e' {\n+\t\trecordfail\n+\t\tload_video\n+\t\tinsmod gzio\n+\t\tif [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi\n+\t\tinsmod part_msdos\n+\t\tinsmod ext2\n+\t\tset root='hd0,msdos1'\n+\t\tif [ x$feature_platform_search_hint = xy ]; then\n+\t\t  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos1 --hint-efi=hd0,msdos1 --hint-baremetal=ahci0,msdos1  377a57ee-b128-4940-a795-31581885806c\n+\t\telse\n+\t\t  search --no-floppy --fs-uuid --set=root 377a57ee-b128-4940-a795-31581885806c\n+\t\tfi\n+\t\techo\t'Loading Linux 4.4.0-131-generic ...'\n+\t        linux\t/vmlinuz-4.4.0-131-generic root=/dev/mapper/vagrant--vg-root ro single nomodeset net.ifnames=0 biosdevname=0 \n+\t\techo\t'Loading initial ramdisk ...'\n+\t\tinitrd\t/initrd.img-4.4.0-131-generic\n+\t}\n+}\n+\n+### END /etc/grub.d/10_linux ###\n+\n+### BEGIN /etc/grub.d/20_linux_xen ###\n+\n+### END /etc/grub.d/20_linux_xen ###\n+\n+### BEGIN /etc/grub.d/30_os-prober ###\n+### END /etc/grub.d/30_os-prober ###\n+\n+### BEGIN /etc/grub.d/30_uefi-firmware ###\n+### END /etc/grub.d/30_uefi-firmware ###\n+\n+### BEGIN /etc/grub.d/40_custom ###\n+# This file provides an easy way to add custom menu entries.  Simply type the\n+# menu entries you want to add after this comment.  Be careful not to change\n+# the 'exec tail' line above.\n+### END /etc/grub.d/40_custom ###\n+\n+### BEGIN /etc/grub.d/41_custom ###\n+if [ -f  ${config_directory}/custom.cfg ]; then\n+  source ${config_directory}/custom.cfg\n+elif [ -z \"${config_directory}\" -a -f  $prefix/custom.cfg ]; then\n+  source $prefix/custom.cfg;\n+fi\n+### END /etc/grub.d/41_custom ###\n"}]},{"id":"V-78005","title":"The system must use a DoD-approved virus scan program.","desc":"Virus scanning software can be used to protect a system from\npenetration from computer viruses and to limit their spread through\nintermediate systems.\n\n    The virus scanning software should be configured to perform scans\ndynamically on accessed files. If this capability is not available, the system\nmust be configured to scan, at a minimum, all altered files on the system on a\ndaily basis.\n\n    If the system processes inbound SMTP mail, the virus scanner must be\nconfigured to scan all received mail.","descriptions":[{"label":"default","data":"Virus scanning software can be used to protect a system from\npenetration from computer viruses and to limit their spread through\nintermediate systems.\n\n    The virus scanning software should be configured to perform scans\ndynamically on accessed files. If this capability is not available, the system\nmust be configured to scan, at a minimum, all altered files on the system on a\ndaily basis.\n\n    If the system processes inbound SMTP mail, the virus scanner must be\nconfigured to scan all received mail."},{"label":"check","data":"Verify the system is using a DoD-approved virus scan program.\n\n\nCheck for the presence of \"McAfee VirusScan Enterprise for Linux\" with the\nfollowing command:\n\n\n# systemctl status nails\n\nnails - service for McAfee VirusScan Enterprise for Linux\n\n> Loaded: loaded\n/opt/NAI/package/McAfeeVSEForLinux/McAfeeVSEForLinux-2.0.2.<build_number>;\nenabled)\n\n> Active: active (running) since Mon 2015-09-27 04:11:22 UTC;21 min ago\n\n\nIf the \"nails\" service is not active, check for the presence of \"clamav\" on\nthe system with the following command:\n\n\n# systemctl status clamav-daemon.socket\n\nsystemctl status clamav-daemon.socket\n\nclamav-daemon.socket - Socket for Clam AntiVirus userspace daemon\n\nLoaded: loaded (/lib/systemd/system/clamav-daemon.socket; enabled)\n\nActive: active (running) since Mon 2015-01-12 09:32:59 UTC; 7min ago\n\n\nIf neither of these applications are loaded and active, ask the System\nAdministrator if there is an antivirus package installed and active on the\nsystem.\n\n\nIf no antivirus scan program is active on the system, this is a finding."},{"label":"fix","data":"Install an approved DoD antivirus solution on the system."}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-78005","rid":"SV-92701r1_rule","stig_id":"UBTU-16-030900","fix_id":"F-84715r1_fix","cci":["CCI-001668"],"nist":["SI-3 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-78005\" do\n  title \"The system must use a DoD-approved virus scan program.\"\n  desc  \"Virus scanning software can be used to protect a system from\npenetration from computer viruses and to limit their spread through\nintermediate systems.\n\n    The virus scanning software should be configured to perform scans\ndynamically on accessed files. If this capability is not available, the system\nmust be configured to scan, at a minimum, all altered files on the system on a\ndaily basis.\n\n    If the system processes inbound SMTP mail, the virus scanner must be\nconfigured to scan all received mail.\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-78005\"\n  tag \"rid\": \"SV-92701r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030900\"\n  tag \"fix_id\": \"F-84715r1_fix\"\n  tag \"cci\": [\"CCI-001668\"]\n  tag \"nist\": [\"SI-3 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system is using a DoD-approved virus scan program.\n\n\nCheck for the presence of \\\"McAfee VirusScan Enterprise for Linux\\\" with the\nfollowing command:\n\n\n# systemctl status nails\n\nnails - service for McAfee VirusScan Enterprise for Linux\n\n> Loaded: loaded\n/opt/NAI/package/McAfeeVSEForLinux/McAfeeVSEForLinux-2.0.2.<build_number>;\nenabled)\n\n> Active: active (running) since Mon 2015-09-27 04:11:22 UTC;21 min ago\n\n\nIf the \\\"nails\\\" service is not active, check for the presence of \\\"clamav\\\" on\nthe system with the following command:\n\n\n# systemctl status clamav-daemon.socket\n\nsystemctl status clamav-daemon.socket\n\nclamav-daemon.socket - Socket for Clam AntiVirus userspace daemon\n\nLoaded: loaded (/lib/systemd/system/clamav-daemon.socket; enabled)\n\nActive: active (running) since Mon 2015-01-12 09:32:59 UTC; 7min ago\n\n\nIf neither of these applications are loaded and active, ask the System\nAdministrator if there is an antivirus package installed and active on the\nsystem.\n\n\nIf no antivirus scan program is active on the system, this is a finding.\"\n  desc \"fix\", \"Install an approved DoD antivirus solution on the system.\"\n\n  other_antivirus_loaded_active = input('other_antivirus_loaded_active')\n  org_name = input('org_name')\n  describe.one do\n    describe service('nails') do\n      it { should be_installed }\n      it { should be_enabled }\n      it { should be_running }\n    end\n    describe service('clamav-daemon.service') do\n      it { should be_installed }\n      it { should be_enabled }\n      it { should be_running }\n    end\n    describe (\"System Administrator and/or \" + org_name + \" approved antivirus program loaded, other than McAfee VirusScan Enterprise for Linux or Clam AntiVirus is loaded and activities\") do\n      subject { other_antivirus_loaded_active }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-78005.rb"},"results":[{"status":"failed","code_desc":"Service nails should be installed","run_time":0.000152,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `Service nails` is installed","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Service nails should be enabled","run_time":9.6e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `Service nails` is enabled","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Service nails should be running","run_time":9.3e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `Service nails` is running","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Service clamav-daemon.service should be installed","run_time":9.9e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `Service clamav-daemon.service` is installed","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Service clamav-daemon.service should be enabled","run_time":8.9e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `Service clamav-daemon.service` is enabled","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Service clamav-daemon.service should be running","run_time":8.6e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `Service clamav-daemon.service` is running","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"System Administrator and/or DoD approved antivirus program loaded, other than McAfee VirusScan Enterprise for Linux or Clam AntiVirus is loaded and activities should equal true","run_time":0.000105,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n","exception":"RSpec::Core::MultipleExceptionError"}]},{"id":"V-75515","title":"A file integrity tool must be installed to verify correct operation of\nall security functions in the Ubuntu operating system.","desc":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n    This requirement applies to Ubuntu operating systems performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.","descriptions":[{"label":"default","data":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n    This requirement applies to Ubuntu operating systems performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality."},{"label":"check","data":"Verify that Advanced Intrusion Detection Environment (AIDE) is\ninstalled and verifies the correct operation of all security functions.\n\nCheck that the AIDE package is installed with the following command:\n\n# sudo apt list aide\n\naide/xenial,now 0.16~a2.git20130520-3 amd64 [installed]\n\nIf AIDE is not installed, ask the System Administrator how file integrity\nchecks are performed on the system.\n\nIf there is no application installed to perform integrity checks, this is a\nfinding."},{"label":"fix","data":"Install the AIDE package by running the following command:\n\n# sudo apt-get install aide"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000445-GPOS-00199","gid":"V-75515","rid":"SV-90195r3_rule","stig_id":"UBTU-16-010500","fix_id":"F-82143r1_fix","cci":["CCI-002696"],"nist":["SI-6 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75515\" do\n  title \"A file integrity tool must be installed to verify correct operation of\nall security functions in the Ubuntu operating system.\"\n  desc  \"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n    This requirement applies to Ubuntu operating systems performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000445-GPOS-00199\"\n  tag \"gid\": \"V-75515\"\n  tag \"rid\": \"SV-90195r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010500\"\n  tag \"fix_id\": \"F-82143r1_fix\"\n  tag \"cci\": [\"CCI-002696\"]\n  tag \"nist\": [\"SI-6 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Advanced Intrusion Detection Environment (AIDE) is\ninstalled and verifies the correct operation of all security functions.\n\nCheck that the AIDE package is installed with the following command:\n\n# sudo apt list aide\n\naide/xenial,now 0.16~a2.git20130520-3 amd64 [installed]\n\nIf AIDE is not installed, ask the System Administrator how file integrity\nchecks are performed on the system.\n\nIf there is no application installed to perform integrity checks, this is a\nfinding.\"\n  desc \"fix\", \"Install the AIDE package by running the following command:\n\n# sudo apt-get install aide\"\n\n  describe package('aide') do\n    it { should be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75515.rb"},"results":[{"status":"failed","code_desc":"System Package aide should be installed","run_time":0.017953,"start_time":"2019-08-06T11:13:31-04:00","message":"expected that `System Package aide` is installed"}]},{"id":"V-75455","title":"All passwords must contain at least one special character.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity or strength is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor in determining how long it takes to crack\na password. The more complex the password, the greater the number of possible\ncombinations that need to be tested before the password is compromised.\n\n    Special characters are those characters that are not alphanumeric. Examples\ninclude: ~ ! @ # $ % ^ *.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity or strength is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor in determining how long it takes to crack\na password. The more complex the password, the greater the number of possible\ncombinations that need to be tested before the password is compromised.\n\n    Special characters are those characters that are not alphanumeric. Examples\ninclude: ~ ! @ # $ % ^ *."},{"label":"check","data":"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one special character be used.\n\nDetermine if the field \"ocredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n# grep -i \"ocredit\" /etc/security/pwquality.conf\nocredit=-1\n\nIf the \"ocredit\" parameter is not equal to \"-1\", or is commented out, this\nis a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one special character be used.\n\nAdd or update the following line in the \"/etc/security/pwquality.conf\" file\nto contain the \"ocredit\" parameter:\n\nocredit=-1"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000266-GPOS-00101","gid":"V-75455","rid":"SV-90135r2_rule","stig_id":"UBTU-16-010130","fix_id":"F-82083r2_fix","cci":["CCI-001619"],"nist":["IA-5 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75455\" do\n  title \"All passwords must contain at least one special character.\"\n  desc  \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity or strength is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n    Password complexity is one factor in determining how long it takes to crack\na password. The more complex the password, the greater the number of possible\ncombinations that need to be tested before the password is compromised.\n\n    Special characters are those characters that are not alphanumeric. Examples\ninclude: ~ ! @ # $ % ^ *.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000266-GPOS-00101\"\n  tag \"gid\": \"V-75455\"\n  tag \"rid\": \"SV-90135r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010130\"\n  tag \"fix_id\": \"F-82083r2_fix\"\n  tag \"cci\": [\"CCI-001619\"]\n  tag \"nist\": [\"IA-5 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system enforces password complexity\nby requiring that at least one special character be used.\n\nDetermine if the field \\\"ocredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n# grep -i \\\"ocredit\\\" /etc/security/pwquality.conf\nocredit=-1\n\nIf the \\\"ocredit\\\" parameter is not equal to \\\"-1\\\", or is commented out, this\nis a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce password\ncomplexity by requiring that at least one special character be used.\n\nAdd or update the following line in the \\\"/etc/security/pwquality.conf\\\" file\nto contain the \\\"ocredit\\\" parameter:\n\nocredit=-1\"\n\n  min_num_special_char = input('min_num_special_char')\n  config_file = '/etc/security/pwquality.conf'\n  config_file_exists = file(config_file).exist?\n  \n\n  if config_file_exists\n    describe parse_config_file(config_file) do\n      its('ocredit') { should cmp min_num_special_char }\n    end\n  else\n    describe (config_file + ' exists') do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75455.rb"},"results":[{"status":"failed","code_desc":"/etc/security/pwquality.conf exists should equal true","run_time":0.000144,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75795","title":"Successful/unsuccessful uses of the delete_module command must\ngenerate an audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"delete_module\" command\noccur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w \"delete_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"delete_module\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75795","rid":"SV-90475r3_rule","stig_id":"UBTU-16-020850","fix_id":"F-82425r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75795\" do\n  title \"Successful/unsuccessful uses of the delete_module command must\ngenerate an audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75795\"\n  tag \"rid\": \"SV-90475r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020850\"\n  tag \"fix_id\": \"F-82425r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"delete_module\\\" command\noccur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w \\\"delete_module\\\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"delete_module\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"delete_module\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75795.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"delete_module\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000149,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"delete_module\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000117,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75865","title":"Cron logging must be implemented.","desc":"Cron logging can be used to trace the successful or unsuccessful\nexecution of cron jobs. It can also be used to spot intrusions into the use of\nthe cron facility by unauthorized and malicious users.","descriptions":[{"label":"default","data":"Cron logging can be used to trace the successful or unsuccessful\nexecution of cron jobs. It can also be used to spot intrusions into the use of\nthe cron facility by unauthorized and malicious users."},{"label":"check","data":"Verify that \"rsyslog\" is configured to log cron events.\n\nCheck the configuration of \"/etc/rsyslog.d/50-default.conf\" for the cron\nfacility with the following commands:\n\nNote: If another logging package is used, substitute the utility configuration\nfile for \"/etc/rsyslog.d/50-default.conf\".\n\n# grep cron /etc/rsyslog.d/50-default.conf\n\ncron.*                          /var/log/cron.log\n\nIf the commands do not return a response, check for cron logging all facilities\nby inspecting the \"/etc/rsyslog.d/50-default.con\" file:\n\n# more /etc/rsyslog.conf\n\nLook for the following entry:\n\n*.* /var/log/messages\n\nIf \"rsyslog\" is not logging messages for the cron facility or all facilities,\nthis is a finding."},{"label":"fix","data":"Configure \"rsyslog\" to log all cron messages by adding or\nupdating the following line to \"/etc/rsyslog.d/50-default.conf\":\n\ncron.* /var/log/cron.log\n\nNote: The line must be added before the following entry if it exists in\n\"/etc/rsyslog.d/50-default.conf\":\n\n*.* ~ # discards everything"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75865","rid":"SV-90545r2_rule","stig_id":"UBTU-16-030460","fix_id":"F-82495r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75865\" do\n  title \"Cron logging must be implemented.\"\n  desc  \"Cron logging can be used to trace the successful or unsuccessful\nexecution of cron jobs. It can also be used to spot intrusions into the use of\nthe cron facility by unauthorized and malicious users.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75865\"\n  tag \"rid\": \"SV-90545r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030460\"\n  tag \"fix_id\": \"F-82495r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that \\\"rsyslog\\\" is configured to log cron events.\n\nCheck the configuration of \\\"/etc/rsyslog.d/50-default.conf\\\" for the cron\nfacility with the following commands:\n\nNote: If another logging package is used, substitute the utility configuration\nfile for \\\"/etc/rsyslog.d/50-default.conf\\\".\n\n# grep cron /etc/rsyslog.d/50-default.conf\n\ncron.*                          /var/log/cron.log\n\nIf the commands do not return a response, check for cron logging all facilities\nby inspecting the \\\"/etc/rsyslog.d/50-default.con\\\" file:\n\n# more /etc/rsyslog.conf\n\nLook for the following entry:\n\n*.* /var/log/messages\n\nIf \\\"rsyslog\\\" is not logging messages for the cron facility or all facilities,\nthis is a finding.\"\n  desc \"fix\", \"Configure \\\"rsyslog\\\" to log all cron messages by adding or\nupdating the following line to \\\"/etc/rsyslog.d/50-default.conf\\\":\n\ncron.* /var/log/cron.log\n\nNote: The line must be added before the following entry if it exists in\n\\\"/etc/rsyslog.d/50-default.conf\\\":\n\n*.* ~ # discards everything\"\n\n  describe.one do\n    default_conf_output = command('grep ''^cron.*'' /etc/rsyslog.d/50-default.conf')\n    describe default_conf_output do\n      its('stdout') { should_not be_empty }\n    end\n  \n    messages_output = command('grep ''^*.*'' /etc/rsyslog.conf')\n    describe messages_output do\n      its('stdout') { should_not be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75865.rb"},"results":[{"status":"failed","code_desc":"Command: `grep ^cron.* /etc/rsyslog.d/50-default.conf` stdout should not be empty","run_time":0.000149,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `\"\".empty?` to return false, got true","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"Command: `grep ^*.* /etc/rsyslog.conf` stdout should not be empty","run_time":0.000119,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `\"\".empty?` to return false, got true","exception":"RSpec::Core::MultipleExceptionError"}]},{"id":"V-75737","title":"Successful/unsuccessful uses of the chmod command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"chmod\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w chmod /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chmod\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75737","rid":"SV-90417r3_rule","stig_id":"UBTU-16-020560","fix_id":"F-82365r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75737\" do\n  title \"Successful/unsuccessful uses of the chmod command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75737\"\n  tag \"rid\": \"SV-90417r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020560\"\n  tag \"fix_id\": \"F-82365r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"chmod\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w chmod /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chmod\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"chmod\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75737.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"chmod\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000122,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"chmod\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000112,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75461","title":"The Ubuntu operating system must employ a FIPS 140-2 approved\ncryptographic hashing algorithms for all stored passwords.","desc":"The system must use a strong hashing algorithm to store the password.\nThe system must use a sufficient number of hashing rounds to ensure the\nrequired level of entropy.\n\n    Passwords need to be protected at all times, and encryption is the standard\nmethod for protecting passwords. If passwords are not encrypted, they can be\nplainly read (i.e., clear text) and easily compromised.","descriptions":[{"label":"default","data":"The system must use a strong hashing algorithm to store the password.\nThe system must use a sufficient number of hashing rounds to ensure the\nrequired level of entropy.\n\n    Passwords need to be protected at all times, and encryption is the standard\nmethod for protecting passwords. If passwords are not encrypted, they can be\nplainly read (i.e., clear text) and easily compromised."},{"label":"check","data":"Verify the shadow password suite configuration is set to\nencrypt interactive user passwords using a strong cryptographic hash with the\nfollowing command:\n\nConfirm that the interactive user account passwords are using a strong password\nhash with the following command:\n\n# sudo cut -d: -f2 /etc/shadow\n\n$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/\n\nPassword hashes \"!\" or \"*\" indicate inactive accounts not available for\nlogon and are not evaluated. If any interactive user password hash does not\nbegin with \"$6\", this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to encrypt all stored\npasswords with a strong cryptographic hash.\n\nLock all interactive user accounts not using SHA-512 hashing until the\npasswords can be regenerated."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000073-GPOS-00041","satisfies":["SRG-OS-000073-GPOS-00041","SRG-OS-000120-GPOS-00061"],"gid":"V-75461","rid":"SV-90141r1_rule","stig_id":"UBTU-16-010160","fix_id":"F-82089r1_fix","cci":["CCI-000196","CCI-000803"],"nist":["IA-5 (1) (c)","IA-7","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75461\" do\n  title \"The Ubuntu operating system must employ a FIPS 140-2 approved\ncryptographic hashing algorithms for all stored passwords.\"\n  desc  \"The system must use a strong hashing algorithm to store the password.\nThe system must use a sufficient number of hashing rounds to ensure the\nrequired level of entropy.\n\n    Passwords need to be protected at all times, and encryption is the standard\nmethod for protecting passwords. If passwords are not encrypted, they can be\nplainly read (i.e., clear text) and easily compromised.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000073-GPOS-00041\"\n  tag \"satisfies\": [\"SRG-OS-000073-GPOS-00041\", \"SRG-OS-000120-GPOS-00061\"]\n  tag \"gid\": \"V-75461\"\n  tag \"rid\": \"SV-90141r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010160\"\n  tag \"fix_id\": \"F-82089r1_fix\"\n  tag \"cci\": [\"CCI-000196\", \"CCI-000803\"]\n  tag \"nist\": [\"IA-5 (1) (c)\", \"IA-7\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the shadow password suite configuration is set to\nencrypt interactive user passwords using a strong cryptographic hash with the\nfollowing command:\n\nConfirm that the interactive user account passwords are using a strong password\nhash with the following command:\n\n# sudo cut -d: -f2 /etc/shadow\n\n$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/\n\nPassword hashes \\\"!\\\" or \\\"*\\\" indicate inactive accounts not available for\nlogon and are not evaluated. If any interactive user password hash does not\nbegin with \\\"$6\\\", this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to encrypt all stored\npasswords with a strong cryptographic hash.\n\nLock all interactive user accounts not using SHA-512 hashing until the\npasswords can be regenerated.\"\n\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n  counter = 0\n\n  users.where{ !shell.match(ignore_shells) }.entries.each do |user_info|\n    shadow.where( user: user_info.username ).passwords.each do |user_pwd|\n      pwd_should_be_evaluated = !( user_pwd.casecmp?('!') || user_pwd.casecmp?('*') )\n      if pwd_should_be_evaluated\n        describe (user_info.username + ' - user\\'s password hash') do\n          subject { user_pwd }\n          it { should start_with '$6' }\n        end\n        counter = counter + 1\n      end\n    end\n  end\n  if ( counter == 0 )\n    describe \"Number of interactive users on the system\" do\n      subject { counter }\n      it { should be 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75461.rb"},"results":[{"status":"passed","code_desc":"vagrant - user's password hash should start with \"$6\"","run_time":0.003911,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75521","title":"The file integrity tool must be configured to verify extended\nattributes.","desc":"Extended attributes in file systems are used to contain arbitrary data\nand file metadata with security implications.","descriptions":[{"label":"default","data":"Extended attributes in file systems are used to contain arbitrary data\nand file metadata with security implications."},{"label":"check","data":"Verify the file integrity tool is configured to verify extended\nattributes.\n\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed\nwith the following command:\n\n# dpkg -l |grep aide\n\nii aide 0.16~a2.git20130520-3\nii aide-common 0.16~a2.git20130520-3\n\nIf AIDE is not installed, ask the System Administrator how file integrity\nchecks are performed on the system.\n\nIf there is no application installed to perform integrity checks, this is a\nfinding.\n\nNote: AIDE is highly configurable at install time. These commands assume the\n\"aide.conf\" file is under the \"/etc\" directory.\n\nUse the following command to determine if the file is in another location:\n\n# find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"xattrs\" rule has been added\nto the rule list being applied to the files and directories selection lists\nwith the following command:\n\n# egrep \"[+]?xattrs\" /etc/aide/aide.conf\n\nVarFile = OwnerMode+n+l+X+xattrs\n\nIf the \"xattrs\" rule is not being used on all selection lines in the\n\"/etc/aide.conf\" file, or extended attributes are not being checked by\nanother file integrity tool, this is a finding."},{"label":"fix","data":"Configure the file integrity tool to check file and directory\nextended attributes.\n\nIf AIDE is installed, ensure the \"xattrs\" rule is present on all file and\ndirectory selection lists."}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75521","rid":"SV-90201r1_rule","stig_id":"UBTU-16-010530","fix_id":"F-82149r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75521\" do\n  title \"The file integrity tool must be configured to verify extended\nattributes.\"\n  desc  \"Extended attributes in file systems are used to contain arbitrary data\nand file metadata with security implications.\"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75521\"\n  tag \"rid\": \"SV-90201r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010530\"\n  tag \"fix_id\": \"F-82149r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the file integrity tool is configured to verify extended\nattributes.\n\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed\nwith the following command:\n\n# dpkg -l |grep aide\n\nii aide 0.16~a2.git20130520-3\nii aide-common 0.16~a2.git20130520-3\n\nIf AIDE is not installed, ask the System Administrator how file integrity\nchecks are performed on the system.\n\nIf there is no application installed to perform integrity checks, this is a\nfinding.\n\nNote: AIDE is highly configurable at install time. These commands assume the\n\\\"aide.conf\\\" file is under the \\\"/etc\\\" directory.\n\nUse the following command to determine if the file is in another location:\n\n# find / -name aide.conf\n\nCheck the \\\"aide.conf\\\" file to determine if the \\\"xattrs\\\" rule has been added\nto the rule list being applied to the files and directories selection lists\nwith the following command:\n\n# egrep \\\"[+]?xattrs\\\" /etc/aide/aide.conf\n\nVarFile = OwnerMode+n+l+X+xattrs\n\nIf the \\\"xattrs\\\" rule is not being used on all selection lines in the\n\\\"/etc/aide.conf\\\" file, or extended attributes are not being checked by\nanother file integrity tool, this is a finding.\"\n  desc \"fix\", \"Configure the file integrity tool to check file and directory\nextended attributes.\n\nIf AIDE is installed, ensure the \\\"xattrs\\\" rule is present on all file and\ndirectory selection lists.\"\n\n  describe aide_conf.all_have_rule('xattr') do\n    it { should eq true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75521.rb"},"results":[{"status":"failed","code_desc":"false should eq true","run_time":0.000261,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: true\n     got: false\n\n(compared using ==)\n\nDiff:\n@@ -1,2 +1,2 @@\n-true\n+false\n"}]},{"id":"V-75643","title":"Audit log directory must be owned by root to prevent unauthorized read\naccess.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.","descriptions":[{"label":"default","data":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity."},{"label":"check","data":"Verify the audit log directory is owned by \"root\" to prevent\nunauthorized read access.\n\nDetermine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nDetermine the audit log directory by using the output of the above command (ex:\n\"/var/log/audit/\"). Run the following command with the correct audit log\ndirectory path:\n\n# sudo ls -ld /var/log/audit\ndrwxr-x--- 2 root root 8096 Jun 26 11:56 /var/log/audit\n\nIf the audit log directory is not owned by \"root\", this is a finding."},{"label":"fix","data":"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct owner as \"root\" with the following command:\n\n# sudo chown root [audit_log_directory]\n\nReplace \"[audit_log_directory]\" with the correct audit log directory path, by\ndefault this location is usually \"/var/log/audit\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-75643","rid":"SV-90323r2_rule","stig_id":"UBTU-16-020130","fix_id":"F-82271r2_fix","cci":["CCI-000162","CCI-000163","CCI-000164"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75643\" do\n  title \"Audit log directory must be owned by root to prevent unauthorized read\naccess.\"\n  desc  \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000057-GPOS-00027\"\n  tag \"satisfies\": [\"SRG-OS-000057-GPOS-00027\", \"SRG-OS-000058-GPOS-00028\",\n\"SRG-OS-000059-GPOS-00029\"]\n  tag \"gid\": \"V-75643\"\n  tag \"rid\": \"SV-90323r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020130\"\n  tag \"fix_id\": \"F-82271r2_fix\"\n  tag \"cci\": [\"CCI-000162\", \"CCI-000163\", \"CCI-000164\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit log directory is owned by \\\"root\\\" to prevent\nunauthorized read access.\n\nDetermine where the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nDetermine the audit log directory by using the output of the above command (ex:\n\\\"/var/log/audit/\\\"). Run the following command with the correct audit log\ndirectory path:\n\n# sudo ls -ld /var/log/audit\ndrwxr-x--- 2 root root 8096 Jun 26 11:56 /var/log/audit\n\nIf the audit log directory is not owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct owner as \\\"root\\\" with the following command:\n\n# sudo chown root [audit_log_directory]\n\nReplace \\\"[audit_log_directory]\\\" with the correct audit log directory path, by\ndefault this location is usually \\\"/var/log/audit\\\".\"\n\n  log_file_path = input('log_file_path')\n  log_file_dir = input('log_file_dir')\n\n  describe directory(log_file_dir) do\n    its('owner') { should cmp 'root' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75643.rb"},"results":[{"status":"passed","code_desc":"Directory /var/log/audit/ owner should cmp == \"root\"","run_time":0.000196,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75851","title":"The SSH daemon must not allow compression or must only allow\ncompression after successful authentication.","desc":"If compression is allowed in an SSH connection prior to\nauthentication, vulnerabilities in the compression software could result in\ncompromise of the system from an unauthenticated connection, potentially with\nroot privileges.","descriptions":[{"label":"default","data":"If compression is allowed in an SSH connection prior to\nauthentication, vulnerabilities in the compression software could result in\ncompromise of the system from an unauthenticated connection, potentially with\nroot privileges."},{"label":"check","data":"Verify the SSH daemon performs compression after a user\nsuccessfully authenticates.\n\nCheck that the SSH daemon performs compression after a user successfully\nauthenticates with the following command:\n\n# grep Compression /etc/ssh/sshd_config\nCompression delayed\n\nIf the \"Compression\" keyword is set to \"yes\", is missing, or the returned\nline is commented out, this is a finding."},{"label":"fix","data":"Configure SSH to use compression. Uncomment the \"Compression\"\nkeyword in \"/etc/ssh/sshd_config\" on the system and set the value to\n\"delayed\" or \"no\":\n\nCompression no\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75851","rid":"SV-90531r2_rule","stig_id":"UBTU-16-030350","fix_id":"F-82481r3_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75851\" do\n  title \"The SSH daemon must not allow compression or must only allow\ncompression after successful authentication.\"\n  desc  \"If compression is allowed in an SSH connection prior to\nauthentication, vulnerabilities in the compression software could result in\ncompromise of the system from an unauthenticated connection, potentially with\nroot privileges.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75851\"\n  tag \"rid\": \"SV-90531r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030350\"\n  tag \"fix_id\": \"F-82481r3_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH daemon performs compression after a user\nsuccessfully authenticates.\n\nCheck that the SSH daemon performs compression after a user successfully\nauthenticates with the following command:\n\n# grep Compression /etc/ssh/sshd_config\nCompression delayed\n\nIf the \\\"Compression\\\" keyword is set to \\\"yes\\\", is missing, or the returned\nline is commented out, this is a finding.\"\n  desc \"fix\", \"Configure SSH to use compression. Uncomment the \\\"Compression\\\"\nkeyword in \\\"/etc/ssh/sshd_config\\\" on the system and set the value to\n\\\"delayed\\\" or \\\"no\\\":\n\nCompression no\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe.one do\n    describe sshd_config do\n      its('Compression') { should cmp 'delayed' }\n    end\n    describe sshd_config do\n      its('Compression') { should cmp 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75851.rb"},"results":[{"status":"failed","code_desc":"SSHD Configuration Compression should cmp == \"delayed\"","run_time":0.000166,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: \"delayed\"\n     got: nil\n\n(compared using `cmp` matcher)\n","exception":"RSpec::Core::MultipleExceptionError"},{"status":"failed","code_desc":"SSHD Configuration Compression should cmp == \"no\"","run_time":0.000151,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: \"no\"\n     got: nil\n\n(compared using `cmp` matcher)\n","exception":"RSpec::Core::MultipleExceptionError"}]},{"id":"V-75911","title":"The Ubuntu operating system must implement smart card logins for\nmultifactor authentication for access to accounts.","desc":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST.","descriptions":[{"label":"default","data":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST."},{"label":"check","data":"Verify the Ubuntu operating system uses multifactor\nauthentication for local access to accounts.\n\nCheck that the \"pam_pkcs11.so\" option is configured in the\n\"/etc/pam.d/common-auth\" file with the following command:\n\n# grep pam_pkcs11.so /etc/pam.d/common-auth\nauth [success=2 default=ignore] pam_pkcs11.so\n\nIf \"pam_pkcs11.so\" is not set in \"/etc/pam.d/common-auth\", this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to use multifactor\nauthentication for local access to accounts.\n\nAdd or update \"pam_pkcs11.so\" in \"/etc/pam.d/common-auth\" to match the\nfollowing line:\n\nauth [success=2 default=ignore] pam_pkcs11.so"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000105-GPOS-00052","satisfies":["SRG-OS-000105-GPOS-00052","SRG-OS-000106-GPOS-00053","SRG-OS-000107-GPOS-00054","SRG-OS-000108-GPOS-00055","SRG-OS-000375-GPOS-00162","SRG-OS-000376-GPOS-00161","SRG-OS-000377-GPOS-00162"],"gid":"V-75911","rid":"SV-90591r1_rule","stig_id":"UBTU-16-030840","fix_id":"F-82541r1_fix","cci":["CCI-000765","CCI-000766","CCI-000767","CCI-000768","CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (1)","IA-2 (2)","IA-2 (3)","IA-2 (4)","IA-2 (11)","IA-2 (12)","IA-2 (12)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75911\" do\n  title \"The Ubuntu operating system must implement smart card logins for\nmultifactor authentication for access to accounts.\"\n  desc  \"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n    Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n    Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n    This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n\n    Requires further clarification from NIST.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000105-GPOS-00052\"\n  tag \"satisfies\": [\"SRG-OS-000105-GPOS-00052\", \"SRG-OS-000106-GPOS-00053\",\n\"SRG-OS-000107-GPOS-00054\", \"SRG-OS-000108-GPOS-00055\",\n\"SRG-OS-000375-GPOS-00162\", \"SRG-OS-000376-GPOS-00161\",\n\"SRG-OS-000377-GPOS-00162\"]\n  tag \"gid\": \"V-75911\"\n  tag \"rid\": \"SV-90591r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030840\"\n  tag \"fix_id\": \"F-82541r1_fix\"\n  tag \"cci\": [\"CCI-000765\", \"CCI-000766\", \"CCI-000767\", \"CCI-000768\",\n\"CCI-001948\", \"CCI-001953\", \"CCI-001954\"]\n  tag \"nist\": [\"IA-2 (1)\", \"IA-2 (2)\", \"IA-2 (3)\", \"IA-2 (4)\", \"IA-2 (11)\",\n\"IA-2 (12)\", \"IA-2 (12)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system uses multifactor\nauthentication for local access to accounts.\n\nCheck that the \\\"pam_pkcs11.so\\\" option is configured in the\n\\\"/etc/pam.d/common-auth\\\" file with the following command:\n\n# grep pam_pkcs11.so /etc/pam.d/common-auth\nauth [success=2 default=ignore] pam_pkcs11.so\n\nIf \\\"pam_pkcs11.so\\\" is not set in \\\"/etc/pam.d/common-auth\\\", this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to use multifactor\nauthentication for local access to accounts.\n\nAdd or update \\\"pam_pkcs11.so\\\" in \\\"/etc/pam.d/common-auth\\\" to match the\nfollowing line:\n\nauth [success=2 default=ignore] pam_pkcs11.so\"\n\n  describe command('grep pam_pkcs11.so /etc/pam.d/common-auth') do\n    its('stdout') { should_not be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75911.rb"},"results":[{"status":"failed","code_desc":"Command: `grep pam_pkcs11.so /etc/pam.d/common-auth` stdout should not be empty","run_time":0.009169,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `\"\".empty?` to return false, got true"}]},{"id":"V-75583","title":"All world-writable directories must be group-owned by root, sys, bin,\nor an application group.","desc":"If a world-writable directory has the sticky bit set and is not\ngroup-owned by a privileged Group Identifier (GID), unauthorized users may be\nable to modify files created by others.\n\n    The only authorized public directories are those temporary directories\nsupplied with the system or those designed to be temporary file repositories.\nThe setting is normally reserved for directories used by the system and by\nusers for temporary file storage, (e.g., /tmp), and for directories requiring\nglobal read/write access.","descriptions":[{"label":"default","data":"If a world-writable directory has the sticky bit set and is not\ngroup-owned by a privileged Group Identifier (GID), unauthorized users may be\nable to modify files created by others.\n\n    The only authorized public directories are those temporary directories\nsupplied with the system or those designed to be temporary file repositories.\nThe setting is normally reserved for directories used by the system and by\nusers for temporary file storage, (e.g., /tmp), and for directories requiring\nglobal read/write access."},{"label":"check","data":"Verify all world-writable directories are group-owned by root,\nsys, bin, or an application group.\n\nCheck the system for world-writable directories with the following command:\n\n#  sudo find / -perm -2 -type d ! -group sys ! -group root ! -group bin -exec\nls -lLd {} \\;\ndrwxrwsrwt 2 root whoops 4096 Jun  6 07:44 /var/crash\ndrwxrwsrwt 2 root whoops 4096 Jul 19  2016 /var/metrics\n\nIf any world-writable directories are not owned by root, sys, bin, or an\napplication group associated with the directory, this is a finding."},{"label":"fix","data":"Change the group of the world-writable directories to root with\nthe following command:\n\n# chgrp root <directory>"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75583","rid":"SV-90263r2_rule","stig_id":"UBTU-16-010840","fix_id":"F-82211r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75583\" do\n  title \"All world-writable directories must be group-owned by root, sys, bin,\nor an application group.\"\n  desc  \"If a world-writable directory has the sticky bit set and is not\ngroup-owned by a privileged Group Identifier (GID), unauthorized users may be\nable to modify files created by others.\n\n    The only authorized public directories are those temporary directories\nsupplied with the system or those designed to be temporary file repositories.\nThe setting is normally reserved for directories used by the system and by\nusers for temporary file storage, (e.g., /tmp), and for directories requiring\nglobal read/write access.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75583\"\n  tag \"rid\": \"SV-90263r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010840\"\n  tag \"fix_id\": \"F-82211r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify all world-writable directories are group-owned by root,\nsys, bin, or an application group.\n\nCheck the system for world-writable directories with the following command:\n\n#  sudo find / -perm -2 -type d ! -group sys ! -group root ! -group bin -exec\nls -lLd {} \\\\;\ndrwxrwsrwt 2 root whoops 4096 Jun  6 07:44 /var/crash\ndrwxrwsrwt 2 root whoops 4096 Jul 19  2016 /var/metrics\n\nIf any world-writable directories are not owned by root, sys, bin, or an\napplication group associated with the directory, this is a finding.\"\n  desc \"fix\", \"Change the group of the world-writable directories to root with\nthe following command:\n\n# chgrp root <directory>\"\n\n  application_groups = input('application_groups')\n\n  directories = command(\"sudo find / -perm -2 -type d ! -group sys ! -group root ! -group bin -exec ls -lLd {} \\\\;\").stdout.strip.split(\"\\n\").entries\n  if directories.count > 0\n    directories.each do |entry|\n      describe directory(entry) do\n        its('group') { should be_in ['root','sys', 'bin'] + application_groups}\n      end\n    end\n  else\n    describe \"No world-writable directories found on the system\" do\n      subject { directories }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75583.rb"},"results":[{"status":"passed","code_desc":"No world-writable directories found on the system count should eq 0","run_time":0.000108,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75603","title":"The /var/log/syslog file must have mode 0640 or less permissive.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify that the \"/var/log/syslog\" file has mode \"0640\" or\nless permissive.\n\nCheck that \"/var/log/syslog\" has mode \"0640\" or less permissive with the\nfollowing command:\n\n# stat -c \"%a %n\" /var/log/syslog\n\n640 /var/log/syslog\n\nIf a value of \"640\" or less permissive is not returned, this is a finding."},{"label":"fix","data":"Change the permissions of the file \"/var/log/syslog\" to\n\"0640\" by running the following command:\n\n# sudo chmod 0640 /var/log"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75603","rid":"SV-90283r3_rule","stig_id":"UBTU-16-010990","fix_id":"F-82231r3_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75603\" do\n  title \"The /var/log/syslog file must have mode 0640 or less permissive.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75603\"\n  tag \"rid\": \"SV-90283r3_rule\"\n  tag \"stig_id\": \"UBTU-16-010990\"\n  tag \"fix_id\": \"F-82231r3_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the \\\"/var/log/syslog\\\" file has mode \\\"0640\\\" or\nless permissive.\n\nCheck that \\\"/var/log/syslog\\\" has mode \\\"0640\\\" or less permissive with the\nfollowing command:\n\n# stat -c \\\"%a %n\\\" /var/log/syslog\n\n640 /var/log/syslog\n\nIf a value of \\\"640\\\" or less permissive is not returned, this is a finding.\"\n  desc \"fix\", \"Change the permissions of the file \\\"/var/log/syslog\\\" to\n\\\"0640\\\" by running the following command:\n\n# sudo chmod 0640 /var/log\"\n\n  describe file('/var/log/syslog') do\n    it { should_not be_more_permissive_than('0640') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75603.rb"},"results":[{"status":"passed","code_desc":"File /var/log/syslog should not be more permissive than \"0640\"","run_time":0.010152,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75743","title":"Successful/unsuccessful uses of the open command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"open\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw open /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"open\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75743","rid":"SV-90423r3_rule","stig_id":"UBTU-16-020590","fix_id":"F-82371r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75743\" do\n  title \"Successful/unsuccessful uses of the open command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75743\"\n  tag \"rid\": \"SV-90423r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020590\"\n  tag \"fix_id\": \"F-82371r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"open\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw open /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"open\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"open\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EPERM' }\n  end\n  describe auditd.syscall(\"open\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EACCES' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75743.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"open\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000282,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000195,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open\" arch == \"b64\" exit.uniq should include \"-EPERM\"","run_time":0.000363,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EPERM\""},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.00015,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000129,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open\" arch == \"b64\" exit.uniq should include \"-EACCES\"","run_time":0.000144,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EACCES\""}]},{"id":"V-75811","title":"A sticky bit must be set on all public directories to prevent\nunauthorized and unintended information transferred via shared system\nresources.","desc":"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n    This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government agencies.\n\n    There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.","descriptions":[{"label":"default","data":"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n    This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government agencies.\n\n    There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components."},{"label":"check","data":"Verify that all world writable directories have the sticky bit\nset.\n\nCheck to see that all world writable directories have the sticky bit set by\nrunning the following command:\n\n# sudo find / -type d  \\( -perm -0002 -a ! -perm -1000 \\) -print 2>/dev/null\n\ndrwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp\n\nIf any of the returned directories are world writable and do not have the\nsticky bit set, this is a finding."},{"label":"fix","data":"Configure all world writable directories have the sticky bit set\nto prevent unauthorized and unintended information transferred via shared\nsystem resources.\n\nSet the sticky bit on all world writable directories using the command, replace\n\"[World-Writable Directory]\" with any directory path missing the sticky bit:\n\n# sudo chmod 1777 [World-Writable Directory]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000138-GPOS-00069","gid":"V-75811","rid":"SV-90491r4_rule","stig_id":"UBTU-16-030070","fix_id":"F-82441r2_fix","cci":["CCI-001090"],"nist":["SC-4","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75811\" do\n  title \"A sticky bit must be set on all public directories to prevent\nunauthorized and unintended information transferred via shared system\nresources.\"\n  desc  \"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n    This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government agencies.\n\n    There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000138-GPOS-00069\"\n  tag \"gid\": \"V-75811\"\n  tag \"rid\": \"SV-90491r4_rule\"\n  tag \"stig_id\": \"UBTU-16-030070\"\n  tag \"fix_id\": \"F-82441r2_fix\"\n  tag \"cci\": [\"CCI-001090\"]\n  tag \"nist\": [\"SC-4\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that all world writable directories have the sticky bit\nset.\n\nCheck to see that all world writable directories have the sticky bit set by\nrunning the following command:\n\n# sudo find / -type d  \\\\( -perm -0002 -a ! -perm -1000 \\\\) -print 2>/dev/null\n\ndrwxrwxrwxt 7 root root 4096 Jul 26 11:19 /tmp\n\nIf any of the returned directories are world writable and do not have the\nsticky bit set, this is a finding.\"\n  desc \"fix\", \"Configure all world writable directories have the sticky bit set\nto prevent unauthorized and unintended information transferred via shared\nsystem resources.\n\nSet the sticky bit on all world writable directories using the command, replace\n\\\"[World-Writable Directory]\\\" with any directory path missing the sticky bit:\n\n# sudo chmod 1777 [World-Writable Directory]\"\n\n  lines = command('find / -type d  \\( -perm -0002 -a ! -perm -1000 \\) -print 2>/dev/null').stdout.lines\n  if (lines.count > 0)\n    lines.each do |line|\n      dir = line.strip\n      describe directory(dir) do\n        it { should be_sticky }\n      end\n    end\n  else\n    describe \"Sticky bit has been set on all world writable directories\" do\n      subject { lines }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75811.rb"},"results":[{"status":"passed","code_desc":"Sticky bit has been set on all world writable directories count should eq 0","run_time":8.2e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75483","title":"The passwd command must be configured to prevent the use of dictionary\nwords as passwords.","desc":"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, this increases the chances of password compromise by\nincreasing the opportunity for successful guesses and brute-force attacks.","descriptions":[{"label":"default","data":"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, this increases the chances of password compromise by\nincreasing the opportunity for successful guesses and brute-force attacks."},{"label":"check","data":"Verify the \"passwd\" command uses the common-password settings.\n\nCheck that the \"passwd\" command uses the common-password option with the\nfollowing command:\n\n# grep common-password /etc/pam.d/passwd\n\n@ include common-password\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to prevent the use of\ndictionary words for passwords.\n\nEdit the file \"/etc/pam.d/passwd\" and add the following line:\n\n@ include common-password"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00225","gid":"V-75483","rid":"SV-90163r1_rule","stig_id":"UBTU-16-010270","fix_id":"F-82111r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75483\" do\n  title \"The passwd command must be configured to prevent the use of dictionary\nwords as passwords.\"\n  desc  \"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, this increases the chances of password compromise by\nincreasing the opportunity for successful guesses and brute-force attacks.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00225\"\n  tag \"gid\": \"V-75483\"\n  tag \"rid\": \"SV-90163r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010270\"\n  tag \"fix_id\": \"F-82111r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the \\\"passwd\\\" command uses the common-password settings.\n\nCheck that the \\\"passwd\\\" command uses the common-password option with the\nfollowing command:\n\n# grep common-password /etc/pam.d/passwd\n\n@ include common-password\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to prevent the use of\ndictionary words for passwords.\n\nEdit the file \\\"/etc/pam.d/passwd\\\" and add the following line:\n\n@ include common-password\"\n\n  describe file(\"/etc/pam.d/passwd\") do\n    it { should exist }\n  end\n\n  describe command(\"grep common-password /etc/pam.d/passwd\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should match /^@\\s*include\\s+common-password$/ }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75483.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/passwd should exist","run_time":0.010356,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Command: `grep common-password /etc/pam.d/passwd` exit_status should eq 0","run_time":0.010176,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Command: `grep common-password /etc/pam.d/passwd` stdout.strip should match /^@\\s*include\\s+common-password$/","run_time":0.000127,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75561","title":"All local interactive user accounts, upon creation, must be assigned a\nhome directory.","desc":"If local interactive users are not assigned a valid home directory,\nthere is no place for the storage and control of files they should own.","descriptions":[{"label":"default","data":"If local interactive users are not assigned a valid home directory,\nthere is no place for the storage and control of files they should own."},{"label":"check","data":"Verify all local interactive users on the Ubuntu operating\nsystem are assigned a home directory upon creation.\n\nCheck to see if the system is configured to create home directories for local\ninteractive users with the following command:\n\n# grep -i create_home /etc/login.defs\nCREATE_HOME yes\n\nIf the value for \"CREATE_HOME\" parameter is not set to \"yes\", the line is\nmissing, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to assign home directories\nto all new local interactive users by setting the \"CREATE_HOME\" parameter in\n\"/etc/login.defs\" to \"yes\" as follows.\n\nCREATE_HOME yes"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75561","rid":"SV-90241r1_rule","stig_id":"UBTU-16-010730","fix_id":"F-82189r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75561\" do\n  title \"All local interactive user accounts, upon creation, must be assigned a\nhome directory.\"\n  desc  \"If local interactive users are not assigned a valid home directory,\nthere is no place for the storage and control of files they should own.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75561\"\n  tag \"rid\": \"SV-90241r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010730\"\n  tag \"fix_id\": \"F-82189r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify all local interactive users on the Ubuntu operating\nsystem are assigned a home directory upon creation.\n\nCheck to see if the system is configured to create home directories for local\ninteractive users with the following command:\n\n# grep -i create_home /etc/login.defs\nCREATE_HOME yes\n\nIf the value for \\\"CREATE_HOME\\\" parameter is not set to \\\"yes\\\", the line is\nmissing, or the line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to assign home directories\nto all new local interactive users by setting the \\\"CREATE_HOME\\\" parameter in\n\\\"/etc/login.defs\\\" to \\\"yes\\\" as follows.\n\nCREATE_HOME yes\"\n\ndescribe login_defs do\n  its('CREATE_HOME') { should match %r{yes} }\nend\nend\n","source_location":{"line":1,"ref":"./controls/V-75561.rb"},"results":[{"status":"failed","code_desc":"login.defs CREATE_HOME should match /yes/","run_time":0.000789,"start_time":"2019-08-06T11:13:31-04:00","message":"expected nil to match /yes/"}]},{"id":"V-75825","title":"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local or remote access to the system\nvia a ssh logon and the user must acknowledge the usage conditions and take\nexplicit actions to log on for further access.","desc":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \"I've read and consent to terms in IS user agreem't.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \"I've read and consent to terms in IS user agreem't.\""},{"label":"check","data":"Verify the Ubuntu operating system displays the Standard\nMandatory DoD Notice and Consent Banner before granting access to the Ubuntu\noperating system via a ssh logon.\n\nCheck that the Ubuntu operating system displays the Standard Mandatory DoD\nNotice and Consent Banner before granting access to the Ubuntu operating system\nvia a ssh logon with the following command:\n\n# grep -i banner /etc/ssh/sshd_config\n\nBanner=/etc/issue.net\n\nThe command will return the banner option along with the name of the file that\ncontains the ssh banner. If the line is commented out this is a finding.\n\nCheck the specified banner file to check that it matches the Standard Mandatory\nDoD Notice and Consent Banner exactly:\n\n“You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.”\n\nIf the banner text does not match the Standard Mandatory DoD Notice and Consent\nBanner exactly, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the system\nvia SSH logon.\n\nEdit the SSH daemon configuration \"/etc/ssh/sshd_config\" file. Uncomment the\nbanner keyword and configure it to point to the file that contains the correct\nbanner. An example of this configure is below:\n\nBanner=/etc/issue.net\n\nEither create the file containing the banner, or replace the text in the file\nwith the Standard Mandatory DoD Notice and Consent Banner. The DoD required\ntext is:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000023-GPOS-00006","gid":"V-75825","rid":"SV-90505r3_rule","stig_id":"UBTU-16-030210","fix_id":"F-82455r2_fix","cci":["CCI-000048"],"nist":["AC-8 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75825\" do\n  title \"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local or remote access to the system\nvia a ssh logon and the user must acknowledge the usage conditions and take\nexplicit actions to log on for further access.\"\n  desc  \"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \\\"I've read and consent to terms in IS user agreem't.\\\"\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000023-GPOS-00006\"\n  tag \"gid\": \"V-75825\"\n  tag \"rid\": \"SV-90505r3_rule\"\n  tag \"stig_id\": \"UBTU-16-030210\"\n  tag \"fix_id\": \"F-82455r2_fix\"\n  tag \"cci\": [\"CCI-000048\"]\n  tag \"nist\": [\"AC-8 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system displays the Standard\nMandatory DoD Notice and Consent Banner before granting access to the Ubuntu\noperating system via a ssh logon.\n\nCheck that the Ubuntu operating system displays the Standard Mandatory DoD\nNotice and Consent Banner before granting access to the Ubuntu operating system\nvia a ssh logon with the following command:\n\n# grep -i banner /etc/ssh/sshd_config\n\nBanner=/etc/issue.net\n\nThe command will return the banner option along with the name of the file that\ncontains the ssh banner. If the line is commented out this is a finding.\n\nCheck the specified banner file to check that it matches the Standard Mandatory\nDoD Notice and Consent Banner exactly:\n\n“You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.”\n\nIf the banner text does not match the Standard Mandatory DoD Notice and Consent\nBanner exactly, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the system\nvia SSH logon.\n\nEdit the SSH daemon configuration \\\"/etc/ssh/sshd_config\\\" file. Uncomment the\nbanner keyword and configure it to point to the file that contains the correct\nbanner. An example of this configure is below:\n\nBanner=/etc/issue.net\n\nEither create the file containing the banner, or replace the text in the file\nwith the Standard Mandatory DoD Notice and Consent Banner. The DoD required\ntext is:\n\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  banner_text = input('banner_text')\n  #When Banner is commented, not found, disabled, or the specified file does not exist, this is a finding.\n  banner_files = [sshd_config.banner].flatten\n\n  banner_files.each do |banner_file|\n    \n    #Banner property is commented out.\n    describe \"The SSHD Banner is not set\" do \n      subject { banner_file.nil? }\n      it { should be false }\n    end if banner_file.nil?\n    \n    #Banner property is set to \"none\"\n    describe \"The SSHD Banner is disabled\" do\n      subject { banner_file.match(/none/i).nil? }\n      it { should be true }\n    end if !banner_file.nil? && !banner_file.match(/none/i).nil?\n    \n    #Banner property provides a path to a file, however, it does not exist.\n    describe \"The SSHD Banner is set, but, the file does not exist\" do\n      subject { file(banner_file).exist? }\n      it { should be true }\n    end if !banner_file.nil? && banner_file.match(/none/i).nil? && !file(banner_file).exist?\n    \n    #Banner property provides a path to a file and it exists.\n    describe \"The SSHD Banner is set to the standard banner and has the correct text\" do\n        clean_banner = banner_text.gsub(%r{[\\r\\n\\s]}, '')\n        subject { banner = file(banner_file).content.gsub(%r{[\\r\\n\\s]}, '') } \n        it { should cmp clean_banner }\n    end if !banner_file.nil? && banner_file.match(/none/i).nil? && file(banner_file).exist?\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75825.rb"},"results":[{"status":"failed","code_desc":"The SSHD Banner is not set should equal false","run_time":0.000128,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected false\n     got true\n"}]},{"id":"V-75777","title":"Successful/unsuccessful uses of the passwd command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"passwd\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w passwd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-passwd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"passwd\" command. Add or update the\nfollowing rule in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75777","rid":"SV-90457r3_rule","stig_id":"UBTU-16-020760","fix_id":"F-82407r4_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75777\" do\n  title \"Successful/unsuccessful uses of the passwd command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75777\"\n  tag \"rid\": \"SV-90457r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020760\"\n  tag \"fix_id\": \"F-82407r4_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"passwd\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w passwd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-passwd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"passwd\\\" command. Add or update the\nfollowing rule in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/passwd'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75777.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/passwd exist should equal true","run_time":0.000103,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75637","title":"Audit log directories must have a mode of 0750 or less permissive to\nprevent unauthorized read access.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.","descriptions":[{"label":"default","data":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity."},{"label":"check","data":"Verify the audit log directories have a mode of \"0750\" or\nless permissive by first determining where the audit logs are stored with the\nfollowing command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log, determine the directory where the audit\nlogs are stored (ex: \"/var/log/audit\"). Run the following command to\ndetermine the permissions for the audit log folder:\n\n# sudo stat -c \"%a %n\" /var/log/audit\n750 /var/log/audit\n\nIf the audit log directory has a mode more permissive than \"0750\", this is a\nfinding."},{"label":"fix","data":"Configure the audit log directory to be protected from\nunauthorized read access by setting the correct permissive mode with the\nfollowing command:\n\n# sudo chmod 0750 [audit_log_directory]\n\nReplace \"[audit_log_directory]\" to the correct audit log directory path, by\ndefault this location is \"/var/log/audit\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-75637","rid":"SV-90317r2_rule","stig_id":"UBTU-16-020100","fix_id":"F-82265r1_fix","cci":["CCI-000162","CCI-000163","CCI-000164"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75637\" do\n  title \"Audit log directories must have a mode of 0750 or less permissive to\nprevent unauthorized read access.\"\n  desc  \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000057-GPOS-00027\"\n  tag \"satisfies\": [\"SRG-OS-000057-GPOS-00027\", \"SRG-OS-000058-GPOS-00028\",\n\"SRG-OS-000059-GPOS-00029\"]\n  tag \"gid\": \"V-75637\"\n  tag \"rid\": \"SV-90317r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020100\"\n  tag \"fix_id\": \"F-82265r1_fix\"\n  tag \"cci\": [\"CCI-000162\", \"CCI-000163\", \"CCI-000164\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit log directories have a mode of \\\"0750\\\" or\nless permissive by first determining where the audit logs are stored with the\nfollowing command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log, determine the directory where the audit\nlogs are stored (ex: \\\"/var/log/audit\\\"). Run the following command to\ndetermine the permissions for the audit log folder:\n\n# sudo stat -c \\\"%a %n\\\" /var/log/audit\n750 /var/log/audit\n\nIf the audit log directory has a mode more permissive than \\\"0750\\\", this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit log directory to be protected from\nunauthorized read access by setting the correct permissive mode with the\nfollowing command:\n\n# sudo chmod 0750 [audit_log_directory]\n\nReplace \\\"[audit_log_directory]\\\" to the correct audit log directory path, by\ndefault this location is \\\"/var/log/audit\\\".\"\n\n  log_file_path = input('log_file_path')\n  log_dir = input('log_file_dir')\n\n  log_file_and_dir_exist = !log_file_path.nil? && !log_dir.nil?\n  if log_file_and_dir_exist\n    describe directory(log_dir) do\n      it { should_not be_more_permissive_than('0750') }\n    end\n  else\n    describe ('Audit log file:'+ log_file_path + ' and/or audit directory:' + log_dir + ' exist') do\n      subject { log_file_and_dir_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75637.rb"},"results":[{"status":"passed","code_desc":"Directory /var/log/audit/ should not be more permissive than \"0750\"","run_time":0.009649,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75887","title":"The Ubuntu operating system must not be performing packet forwarding\nunless the system is a router.","desc":"Routing protocol daemons are typically used on routers to exchange\nnetwork topology information with other routers. If this software is used when\nnot required, system network information may be unnecessarily transmitted\nacross the network.","descriptions":[{"label":"default","data":"Routing protocol daemons are typically used on routers to exchange\nnetwork topology information with other routers. If this software is used when\nnot required, system network information may be unnecessarily transmitted\nacross the network."},{"label":"check","data":"Verify the Ubuntu operating system is not performing packet\nforwarding, unless the system is a router.\n\nCheck to see if IP forwarding is enabled using the following command:\n\n# /sbin/sysctl -a | grep  net.ipv4.ip_forward\nnet.ipv4.ip_forward=0\n\nIf IP forwarding value is \"1\" and is not documented with the Information\nSystem Security Officer (ISSO) as an operational requirement , this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to not allow packet\nforwarding, unless the system is a router with the following command:\n\n# sudo sysctl -w net.ipv4.ip_forward=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.ip_forward=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75887","rid":"SV-90567r2_rule","stig_id":"UBTU-16-030600","fix_id":"F-82517r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75887\" do\n  title \"The Ubuntu operating system must not be performing packet forwarding\nunless the system is a router.\"\n  desc  \"Routing protocol daemons are typically used on routers to exchange\nnetwork topology information with other routers. If this software is used when\nnot required, system network information may be unnecessarily transmitted\nacross the network.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75887\"\n  tag \"rid\": \"SV-90567r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030600\"\n  tag \"fix_id\": \"F-82517r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is not performing packet\nforwarding, unless the system is a router.\n\nCheck to see if IP forwarding is enabled using the following command:\n\n# /sbin/sysctl -a | grep  net.ipv4.ip_forward\nnet.ipv4.ip_forward=0\n\nIf IP forwarding value is \\\"1\\\" and is not documented with the Information\nSystem Security Officer (ISSO) as an operational requirement , this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to not allow packet\nforwarding, unless the system is a router with the following command:\n\n# sudo sysctl -w net.ipv4.ip_forward=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.ip_forward=0\"\n\n  describe kernel_parameter('net.ipv4.ip_forward') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75887.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.ip_forward value should eq 0","run_time":0.010023,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75555","title":"All files and directories must have a valid owner.","desc":"Unowned files and directories may be unintentionally inherited if a\nuser is assigned the same User Identifier \"UID\" as the UID of the un-owned\nfiles.","descriptions":[{"label":"default","data":"Unowned files and directories may be unintentionally inherited if a\nuser is assigned the same User Identifier \"UID\" as the UID of the un-owned\nfiles."},{"label":"check","data":"Verify all files and directories on the Ubuntu operating system\nhave a valid owner.\n\nCheck the owner of all files and directories with the following command:\n\n# sudo find / -nouser\n\nIf any files on the system do not have an assigned owner, this is a finding."},{"label":"fix","data":"Either remove all files and directories from the system that do\nnot have a valid user, or assign a valid user to all unowned files and\ndirectories on the Ubuntu operating system with the \"chown\" command:\n\n# sudo chown <user> <file>"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75555","rid":"SV-90235r1_rule","stig_id":"UBTU-16-010700","fix_id":"F-82183r1_fix","cci":["CCI-002165"],"nist":["AC-3 (4)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75555\" do\n  title \"All files and directories must have a valid owner.\"\n  desc  \"Unowned files and directories may be unintentionally inherited if a\nuser is assigned the same User Identifier \\\"UID\\\" as the UID of the un-owned\nfiles.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75555\"\n  tag \"rid\": \"SV-90235r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010700\"\n  tag \"fix_id\": \"F-82183r1_fix\"\n  tag \"cci\": [\"CCI-002165\"]\n  tag \"nist\": [\"AC-3 (4)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify all files and directories on the Ubuntu operating system\nhave a valid owner.\n\nCheck the owner of all files and directories with the following command:\n\n# sudo find / -nouser\n\nIf any files on the system do not have an assigned owner, this is a finding.\"\n  desc \"fix\", \"Either remove all files and directories from the system that do\nnot have a valid user, or assign a valid user to all unowned files and\ndirectories on the Ubuntu operating system with the \\\"chown\\\" command:\n\n# sudo chown <user> <file>\"\n\n  # non_interactive_shells = input('non_interactive_shells')\n  # ignore_shells = non_interactive_shells.join('|')\n\n  # findings = Set[]\n  # users.where{ !shell.match(ignore_shells) }.entries.each do |user_info|\n  #   findings = findings + command(\"find / -nouser\").stdout.split(\"\\n\")\n  # end\n\n  # describe \"The set of Files and Directories on the Ubuntu operating system without a valid owner\" do\n  #   subject { findings.to_a }\n  #   it { should be_empty }\n  # end\n\n\n\n  dir_list = command(\"find / -nouser\").stdout.strip.split(\"\\n\")\n  if (dir_list.count > 0)\n    dir_list.each do |entry|\n      describe directory(entry) do\n        its('owner') { should_not be_empty }\n      end\n    end\n  else\n    describe \"The number of files and directories without a valid owner\" do\n      subject { dir_list }\n      its('count') { should cmp 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75555.rb"},"results":[{"status":"passed","code_desc":"The number of files and directories without a valid owner count should cmp == 0","run_time":0.00018,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75695","title":"Successful/unsuccessful uses of the mount command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"mount\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w mount /etc/audit/audit.rules\n\n-a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"mount\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75695","rid":"SV-90375r3_rule","stig_id":"UBTU-16-020380","fix_id":"F-82323r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75695\" do\n  title \"Successful/unsuccessful uses of the mount command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75695\"\n  tag \"rid\": \"SV-90375r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020380\"\n  tag \"fix_id\": \"F-82323r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"mount\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w mount /etc/audit/audit.rules\n\n-a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"mount\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/bin/mount -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/bin/mount'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      its('action.uniq') { should eq ['always'] }\n      its('list.uniq') { should eq ['exit'] }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75695.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /bin/mount exist should equal true","run_time":0.000142,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-80957","title":"The x86 Ctrl-Alt-Delete key sequence in the Ubuntu operating system\nmust be disabled if GNOME is installed.","desc":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the GNOME graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.","descriptions":[{"label":"default","data":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the GNOME graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken."},{"label":"check","data":"Verify the Ubuntu operating system is not configured to reboot\nthe system when Ctrl-Alt-Delete is pressed when using GNOME.\n\nCheck that the \"logout\" target is not bound to an action with the following\ncommand:\n\n# grep logout /etc/dconf/db/local.d/*\n\nlogout=''\n\nIf the \"logout\" key is bound to an action, is commented out, or is missing,\nthis is a finding."},{"label":"fix","data":"Configure the system to disable the Ctrl-Alt-Delete sequence when\nusing GNOME by creating or editing the /etc/dconf/db/local.d/00-disable-CAD\nfile.\n\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\n\n[org/gnome/settings-daemon/plugins/media-keys]\nlogout=’’\n\nThen update the dconf settings:\n\n# dconf update"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-80957","rid":"SV-95669r1_rule","stig_id":"UBTU-16-010631","fix_id":"F-87833r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-80957\" do\n  title \"The x86 Ctrl-Alt-Delete key sequence in the Ubuntu operating system\nmust be disabled if GNOME is installed.\"\n  desc  \"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the GNOME graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-80957\"\n  tag \"rid\": \"SV-95669r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010631\"\n  tag \"fix_id\": \"F-87833r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is not configured to reboot\nthe system when Ctrl-Alt-Delete is pressed when using GNOME.\n\nCheck that the \\\"logout\\\" target is not bound to an action with the following\ncommand:\n\n# grep logout /etc/dconf/db/local.d/*\n\nlogout=''\n\nIf the \\\"logout\\\" key is bound to an action, is commented out, or is missing,\nthis is a finding.\"\n  desc \"fix\", \"Configure the system to disable the Ctrl-Alt-Delete sequence when\nusing GNOME by creating or editing the /etc/dconf/db/local.d/00-disable-CAD\nfile.\n\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\n\n[org/gnome/settings-daemon/plugins/media-keys]\nlogout=’’\n\nThen update the dconf settings:\n\n# dconf update\"\n\ngnome_installed = (package('ubuntu-gnome-desktop').installed? || package('ubuntu-desktop').installed?)\n\n  if gnome_installed\n    logout_enabled = command('gsettings get org.gnome.settings-daemon.plugins.media-keys logout')\n    describe logout_enabled do\n      its('stdout') { should cmp '' }\n    end\n  else\n    describe \"Control Not Applicable as GNOME dekstop environment is not installed\" do\n      subject { gnome_installed }\n      it { should be false }\n    end\n  end\nend","source_location":{"line":1,"ref":"./controls/V-80957.rb"},"results":[{"status":"passed","code_desc":"Control Not Applicable as GNOME dekstop environment is not installed should equal false","run_time":7.1e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-80963","title":"The audit log files in the Ubuntu operating system must have mode 0640\nor less permissive.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify that the audit log files have a mode of \"0640\" or less\npermissive.\n\nCheck where the audit logs are stored on the system using the following command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \"[log_path]\" in the\nfollowing command:\n\n# sudo ls -lad [log_file] | cut -d' ' -f1\nls -lad /var/log/audit/audit.log | cut -d' ' -f1\n-rw-r-----\n\nIf the audit log file does not have a mode of \"0640\" or less permissive, this\nis a finding."},{"label":"fix","data":"Configure the octal permission value of the audit log to \"0640\"\nor less permissive.\n\nUse the following command to find where the audit log files are stored on the\nsystem:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \"[log_path]\" in the\nfollowing command:\n\n# sudo chmod 0640 [log_path]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-80963","rid":"SV-95675r1_rule","stig_id":"UBTU-16-020170","fix_id":"F-87823r1_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-80963\" do\n  title \"The audit log files in the Ubuntu operating system must have mode 0640\nor less permissive.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-80963\"\n  tag \"rid\": \"SV-95675r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020170\"\n  tag \"fix_id\": \"F-87823r1_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the audit log files have a mode of \\\"0640\\\" or less\npermissive.\n\nCheck where the audit logs are stored on the system using the following command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \\\"[log_path]\\\" in the\nfollowing command:\n\n# sudo ls -lad [log_file] | cut -d' ' -f1\nls -lad /var/log/audit/audit.log | cut -d' ' -f1\n-rw-r-----\n\nIf the audit log file does not have a mode of \\\"0640\\\" or less permissive, this\nis a finding.\"\n  desc \"fix\", \"Configure the octal permission value of the audit log to \\\"0640\\\"\nor less permissive.\n\nUse the following command to find where the audit log files are stored on the\nsystem:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \\\"[log_path]\\\" in the\nfollowing command:\n\n# sudo chmod 0640 [log_path]\"\n\n  log_file_path = auditd_conf.log_file\n  if log_file_path.nil?\n    describe \"auditd.conf's log_file specification\" do\n      subject { log_file_path }\n      it { should_not be_nil }\n    end\n  else\n    describe file(log_file_path) do\n      it { should exist }\n      it { should_not be_more_permissive_than('0640') }\n    end\n  end\nend","source_location":{"line":1,"ref":"./controls/V-80963.rb"},"results":[{"status":"passed","code_desc":"File /var/log/audit/audit.log should exist","run_time":9.8e-05,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"File /var/log/audit/audit.log should not be more permissive than \"0640\"","run_time":0.000124,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75545","title":"The Ubuntu operating system must not have unnecessary accounts.","desc":"Accounts providing no operational purpose provide additional\nopportunities for system compromise. Unnecessary accounts include user accounts\nfor individuals not requiring access to the system and application accounts for\napplications not installed on the system.","descriptions":[{"label":"default","data":"Accounts providing no operational purpose provide additional\nopportunities for system compromise. Unnecessary accounts include user accounts\nfor individuals not requiring access to the system and application accounts for\napplications not installed on the system."},{"label":"check","data":"Verify all accounts on the system are assigned to an active\nsystem, application, or user account.\n\nObtain the list of authorized system accounts from the Information System\nSecurity Officer (ISSO).\n\nCheck the system accounts on the system with the following command:\n\n# more /etc/passwd\nroot:x:0:0:root:/root:/bin/bash\n...\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\n\nAccounts such as \"games\" and \"gopher\" are not authorized accounts as they\ndo not support authorized system functions.\n\nIf the accounts on the system do not match the provided documentation, or\naccounts that do not support an authorized system function are present, this is\na finding."},{"label":"fix","data":"Configure the system so all accounts on the system are assigned\nto an active system, application, or user account.\n\nRemove accounts that do not support approved system activities or that allow\nfor a normal user to perform administrative-level actions.\n\nDocument all authorized accounts on the system."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75545","rid":"SV-90225r2_rule","stig_id":"UBTU-16-010650","fix_id":"F-82173r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75545\" do\n  title \"The Ubuntu operating system must not have unnecessary accounts.\"\n  desc  \"Accounts providing no operational purpose provide additional\nopportunities for system compromise. Unnecessary accounts include user accounts\nfor individuals not requiring access to the system and application accounts for\napplications not installed on the system.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75545\"\n  tag \"rid\": \"SV-90225r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010650\"\n  tag \"fix_id\": \"F-82173r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify all accounts on the system are assigned to an active\nsystem, application, or user account.\n\nObtain the list of authorized system accounts from the Information System\nSecurity Officer (ISSO).\n\nCheck the system accounts on the system with the following command:\n\n# more /etc/passwd\nroot:x:0:0:root:/root:/bin/bash\n...\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\n\nAccounts such as \\\"games\\\" and \\\"gopher\\\" are not authorized accounts as they\ndo not support authorized system functions.\n\nIf the accounts on the system do not match the provided documentation, or\naccounts that do not support an authorized system function are present, this is\na finding.\"\n  desc \"fix\", \"Configure the system so all accounts on the system are assigned\nto an active system, application, or user account.\n\nRemove accounts that do not support approved system activities or that allow\nfor a normal user to perform administrative-level actions.\n\nDocument all authorized accounts on the system.\"\n\n  known_system_accounts = input('known_system_accounts')\n  disallowed_accounts = input('disallowed_accounts')\n  user_accounts = input('user_accounts')\n  allowed_accounts = (known_system_accounts + user_accounts).uniq\n\n  describe \"The active system users\" do\n    subject { passwd }\n    its('users') { should be_in allowed_accounts }\n    its('users') { should_not be_in disallowed_accounts }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75545.rb"},"results":[{"status":"failed","code_desc":"The active system users users should be in \"root\", \"bin\", \"daemon\", \"adm\", \"lp\", \"sync\", \"shutdown\", \"halt\", \"mail\", \"operator\", \"nobody\", \"systemd-bus-proxy\", \"systemd-network\", \"dbus\", \"polkitd\", \"tss\", \"postfix\", \"chrony\", \"sshd\", \"sssd\", \"rpc\", \"ntp\", \"vboxadd\", \"nfsnobody\", \"vagrant\", \"rpcuser\", \"sys\", \"man\", \"news\", \"uucp\", \"proxy\", \"www-data\", \"backup\", \"list\", \"irc\", \"gnats\", \"systemd-timesync\", \"systemd-resolve\", \"syslog\", \"_apt\", \"lxd\", \"messagebus\", \"uuidd\", \"dnsmasq\", and \"statd\"","run_time":0.000641,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `[\"root\", \"daemon\", \"bin\", \"sys\", \"sync\", \"games\", \"man\", \"lp\", \"mail\", \"news\", \"uucp\", \"proxy\", \"www-data\", \"backup\", \"list\", \"irc\", \"gnats\", \"nobody\", \"systemd-timesync\", \"systemd-network\", \"systemd-resolve\", \"systemd-bus-proxy\", \"syslog\", \"_apt\", \"lxd\", \"messagebus\", \"uuidd\", \"dnsmasq\", \"statd\", \"sshd\", \"vagrant\", \"vboxadd\"]` to be in the list: `[\"root\", \"bin\", \"daemon\", \"adm\", \"lp\", \"sync\", \"shutdown\", \"halt\", \"mail\", \"operator\", \"nobody\", \"systemd-bus-proxy\", \"systemd-network\", \"dbus\", \"polkitd\", \"tss\", \"postfix\", \"chrony\", \"sshd\", \"sssd\", \"rpc\", \"ntp\", \"vboxadd\", \"nfsnobody\", \"vagrant\", \"rpcuser\", \"sys\", \"man\", \"news\", \"uucp\", \"proxy\", \"www-data\", \"backup\", \"list\", \"irc\", \"gnats\", \"systemd-timesync\", \"systemd-resolve\", \"syslog\", \"_apt\", \"lxd\", \"messagebus\", \"uuidd\", \"dnsmasq\", \"statd\"]` \nDiff:\n [\"games\"]"},{"status":"failed","code_desc":"The active system users users should not be in \"games\", \"gopher\", and \"ftp\"","run_time":0.000327,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `[\"root\", \"daemon\", \"bin\", \"sys\", \"sync\", \"games\", \"man\", \"lp\", \"mail\", \"news\", \"uucp\", \"proxy\", \"www-data\", \"backup\", \"list\", \"irc\", \"gnats\", \"nobody\", \"systemd-timesync\", \"systemd-network\", \"systemd-resolve\", \"systemd-bus-proxy\", \"syslog\", \"_apt\", \"lxd\", \"messagebus\", \"uuidd\", \"dnsmasq\", \"statd\", \"sshd\", \"vagrant\", \"vboxadd\"]` not to be in the list: `[\"games\", \"gopher\", \"ftp\"]` \nComm:\n [\"games\"]"}]},{"id":"V-75897","title":"The Trivial File Transfer Protocol (TFTP) server package must not be\ninstalled if not required for operational support.","desc":"If TFTP is required for operational support (such as the transmission\nof router configurations) its use must be documented with the Information\nSystem Security Officer (ISSO), restricted to only authorized personnel, and\nhave access control rules established.","descriptions":[{"label":"default","data":"If TFTP is required for operational support (such as the transmission\nof router configurations) its use must be documented with the Information\nSystem Security Officer (ISSO), restricted to only authorized personnel, and\nhave access control rules established."},{"label":"check","data":"Verify a Trivial File Transfer Protocol (TFTP) server has not\nbeen installed.\n\nCheck to see if a TFTP server has been installed with the following command:\n\n# dpkg -l | grep tftpd-hpa\nii tftpd-hpa 5.2+20150808-1Ubuntu1.16.04.1\n\nIf TFTP is installed and the requirement for TFTP is not documented with the\nInformation System Security Officer (ISSO), this is a finding."},{"label":"fix","data":"Remove the Trivial File Transfer Protocol (TFTP) package from the\nsystem with the following command:\n\n# sudo apt-get remove tftpd-hpa"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75897","rid":"SV-90577r2_rule","stig_id":"UBTU-16-030720","fix_id":"F-82527r1_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75897\" do\n  title \"The Trivial File Transfer Protocol (TFTP) server package must not be\ninstalled if not required for operational support.\"\n  desc  \"If TFTP is required for operational support (such as the transmission\nof router configurations) its use must be documented with the Information\nSystem Security Officer (ISSO), restricted to only authorized personnel, and\nhave access control rules established.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75897\"\n  tag \"rid\": \"SV-90577r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030720\"\n  tag \"fix_id\": \"F-82527r1_fix\"\n  tag \"cci\": [\"CCI-000318\", \"CCI-000368\", \"CCI-001812\", \"CCI-001813\",\n\"CCI-001814\"]\n  tag \"nist\": [\"CM-3 f\", \"CM-6 c\", \"CM-11 (2)\", \"CM-5 (1)\", \"CM-5 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify a Trivial File Transfer Protocol (TFTP) server has not\nbeen installed.\n\nCheck to see if a TFTP server has been installed with the following command:\n\n# dpkg -l | grep tftpd-hpa\nii tftpd-hpa 5.2+20150808-1Ubuntu1.16.04.1\n\nIf TFTP is installed and the requirement for TFTP is not documented with the\nInformation System Security Officer (ISSO), this is a finding.\"\n  desc \"fix\", \"Remove the Trivial File Transfer Protocol (TFTP) package from the\nsystem with the following command:\n\n# sudo apt-get remove tftpd-hpa\"\n\n  describe package('tftpd-hpa') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75897.rb"},"results":[{"status":"passed","code_desc":"System Package tftpd-hpa should not be installed","run_time":0.00013,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75627","title":"The System Administrator (SA) and Information System Security Officer\n(ISSO) (at a minimum) must be alerted when the audit storage volume is full.","desc":"It is critical that when the Ubuntu operating system is at risk of\nfailing to process audit logs as required, it takes action to mitigate the\nfailure. Audit processing failures include: software/hardware errors; failures\nin the audit capturing mechanisms; and audit storage capacity being reached or\nexceeded. Responses to audit failure depend upon the nature of the failure mode.\n\n    When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n    1) If the failure was caused by the lack of audit record storage capacity,\nthe Ubuntu operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n    2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the Ubuntu\noperating system must queue audit records locally until communication is\nrestored or until the audit records are retrieved manually. Upon restoration of\nthe connection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.","descriptions":[{"label":"default","data":"It is critical that when the Ubuntu operating system is at risk of\nfailing to process audit logs as required, it takes action to mitigate the\nfailure. Audit processing failures include: software/hardware errors; failures\nin the audit capturing mechanisms; and audit storage capacity being reached or\nexceeded. Responses to audit failure depend upon the nature of the failure mode.\n\n    When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n    1) If the failure was caused by the lack of audit record storage capacity,\nthe Ubuntu operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n    2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the Ubuntu\noperating system must queue audit records locally until communication is\nrestored or until the audit records are retrieved manually. Upon restoration of\nthe connection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server."},{"label":"check","data":"Verify that the System Administrator (SA) and Information\nSystem Security Officer (ISSO) (at a minimum) are notified when the audit\nstorage volume is full.\n\nCheck which action the Ubuntu operating system takes when the audit storage\nvolume is full with the following command:\n\n# sudo grep max_log_file_action /etc/audit/auditd.conf\n\nmax_log_file_action=syslog\n\nIf the value of the \"max_log_file_action\" option is set to \"ignore\",\n\"rotate\", or \"suspend\", or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to notify the System\nAdministrator (SA) and Information System Security Officer (ISSO) when the\naudit storage volume is full by configuring the \"max_log_file_action\"\nparameter in the \"/etc/audit/auditd.conf\" file with the a value of \"syslog\"\nor \"keep_logs\":\n\nmax_log_file_action=syslog"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000047-GPOS-00023","gid":"V-75627","rid":"SV-90307r1_rule","stig_id":"UBTU-16-020050","fix_id":"F-82255r1_fix","cci":["CCI-000140"],"nist":["AU-5 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75627\" do\n  title \"The System Administrator (SA) and Information System Security Officer\n(ISSO) (at a minimum) must be alerted when the audit storage volume is full.\"\n  desc  \"It is critical that when the Ubuntu operating system is at risk of\nfailing to process audit logs as required, it takes action to mitigate the\nfailure. Audit processing failures include: software/hardware errors; failures\nin the audit capturing mechanisms; and audit storage capacity being reached or\nexceeded. Responses to audit failure depend upon the nature of the failure mode.\n\n    When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n    1) If the failure was caused by the lack of audit record storage capacity,\nthe Ubuntu operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n    2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the Ubuntu\noperating system must queue audit records locally until communication is\nrestored or until the audit records are retrieved manually. Upon restoration of\nthe connection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000047-GPOS-00023\"\n  tag \"gid\": \"V-75627\"\n  tag \"rid\": \"SV-90307r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020050\"\n  tag \"fix_id\": \"F-82255r1_fix\"\n  tag \"cci\": [\"CCI-000140\"]\n  tag \"nist\": [\"AU-5 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the System Administrator (SA) and Information\nSystem Security Officer (ISSO) (at a minimum) are notified when the audit\nstorage volume is full.\n\nCheck which action the Ubuntu operating system takes when the audit storage\nvolume is full with the following command:\n\n# sudo grep max_log_file_action /etc/audit/auditd.conf\n\nmax_log_file_action=syslog\n\nIf the value of the \\\"max_log_file_action\\\" option is set to \\\"ignore\\\",\n\\\"rotate\\\", or \\\"suspend\\\", or the line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to notify the System\nAdministrator (SA) and Information System Security Officer (ISSO) when the\naudit storage volume is full by configuring the \\\"max_log_file_action\\\"\nparameter in the \\\"/etc/audit/auditd.conf\\\" file with the a value of \\\"syslog\\\"\nor \\\"keep_logs\\\":\n\nmax_log_file_action=syslog\"\n\n  describe auditd_conf do\n    its('max_log_file_action') { should_not be_empty }\n    its('max_log_file_action') { should_not cmp %r((?:ignore|rotate|suspend))i }\n    its('max_log_file_action') { should cmp %r((?:syslog|keep_logs))i }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75627.rb"},"results":[{"status":"passed","code_desc":"Audit Daemon Config max_log_file_action should not be empty","run_time":0.000247,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"failed","code_desc":"Audit Daemon Config max_log_file_action should not cmp == /(?:ignore|rotate|suspend)/i","run_time":0.000168,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected it not to be == /(?:ignore|rotate|suspend)/i\n     got: \"ROTATE\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"Audit Daemon Config max_log_file_action should cmp == /(?:syslog|keep_logs)/i","run_time":0.000149,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: /(?:syslog|keep_logs)/i\n     got: \"ROTATE\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75767","title":"Successful/unsuccessful uses of the setfacl command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"setfacl\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w setfacl /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"setfacl\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75767","rid":"SV-90447r3_rule","stig_id":"UBTU-16-020710","fix_id":"F-82395r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75767\" do\n  title \"Successful/unsuccessful uses of the setfacl command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75767\"\n  tag \"rid\": \"SV-90447r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020710\"\n  tag \"fix_id\": \"F-82395r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"setfacl\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w setfacl /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"setfacl\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/setfacl'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end  \n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75767.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/setfacl exist should equal true","run_time":0.000108,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75835","title":"The system must display the date and time of the last successful\naccount logon upon an SSH logon.","desc":"Providing users with feedback on when account accesses via SSH last\noccurred facilitates user recognition and reporting of unauthorized account\nuse.","descriptions":[{"label":"default","data":"Providing users with feedback on when account accesses via SSH last\noccurred facilitates user recognition and reporting of unauthorized account\nuse."},{"label":"check","data":"Verify SSH provides users with feedback on when account\naccesses last occurred.\n\nCheck that \"PrintLastLog\" keyword in the sshd daemon configuration file is\nused and set to \"yes\" with the following command:\n\n# grep PrintLastLog /etc/ssh/sshd_config\nPrintLastLog yes\n\nIf the \"PrintLastLog\" keyword is set to \"no\", is missing, or is commented\nout, this is a finding."},{"label":"fix","data":"Add or edit the following lines in the \"/etc/ssh/sshd_config\"\nfile:\n\nPrintLastLog yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75835","rid":"SV-90515r2_rule","stig_id":"UBTU-16-030260","fix_id":"F-82465r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75835\" do\n  title \"The system must display the date and time of the last successful\naccount logon upon an SSH logon.\"\n  desc  \"Providing users with feedback on when account accesses via SSH last\noccurred facilitates user recognition and reporting of unauthorized account\nuse.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75835\"\n  tag \"rid\": \"SV-90515r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030260\"\n  tag \"fix_id\": \"F-82465r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify SSH provides users with feedback on when account\naccesses last occurred.\n\nCheck that \\\"PrintLastLog\\\" keyword in the sshd daemon configuration file is\nused and set to \\\"yes\\\" with the following command:\n\n# grep PrintLastLog /etc/ssh/sshd_config\nPrintLastLog yes\n\nIf the \\\"PrintLastLog\\\" keyword is set to \\\"no\\\", is missing, or is commented\nout, this is a finding.\"\n  desc \"fix\", \"Add or edit the following lines in the \\\"/etc/ssh/sshd_config\\\"\nfile:\n\nPrintLastLog yes\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  describe sshd_config do\n    its('PrintLastLog') { should cmp 'yes' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75835.rb"},"results":[{"status":"passed","code_desc":"SSHD Configuration PrintLastLog should cmp == \"yes\"","run_time":0.000468,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75571","title":"All local interactive user initialization files executable search\npaths must contain only paths that resolve to the system default or the users\nhome directory.","desc":"The executable search path (typically the PATH environment variable)\ncontains a list of directories for the shell to search to find executables. If\nthis path includes the current working directory executables in these\ndirectories may be executed instead of system commands. This variable is\nformatted as a colon-separated list of directories. If there is an empty entry,\nsuch as a leading or trailing colon or two consecutive colons, this is\ninterpreted as the current working directory. If deviations from the default\nsystem search path for the local interactive user are required, they must be\ndocumented with the Information System Security Officer (ISSO).","descriptions":[{"label":"default","data":"The executable search path (typically the PATH environment variable)\ncontains a list of directories for the shell to search to find executables. If\nthis path includes the current working directory executables in these\ndirectories may be executed instead of system commands. This variable is\nformatted as a colon-separated list of directories. If there is an empty entry,\nsuch as a leading or trailing colon or two consecutive colons, this is\ninterpreted as the current working directory. If deviations from the default\nsystem search path for the local interactive user are required, they must be\ndocumented with the Information System Security Officer (ISSO)."},{"label":"check","data":"Verify that all local interactive user initialization files'\nexecutable search path statements do not contain statements that will reference\na working directory other than the users’ home directory or the system default.\n\nCheck the executable search path statement for all local interactive user\ninitialization files in the users' home directory with the following commands:\n\nNote: The example will be for the smithj user, which has a home directory of\n\"/home/smithj\".\n\n# grep -i path /home/smithj/.*\n/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\n/home/smithj/.bash_profile:export PATH\n\nIf any local interactive user initialization files have executable search path\nstatements that include directories outside of their home directory, and the\nadditional path statements are not documented with the Information System\nSecurity Officer (ISSO) as an operational requirement, this is a finding."},{"label":"fix","data":"Edit the local interactive user initialization files to change\nany PATH variable statements for executables that reference directories other\nthan their home directory or the system default. If a local interactive user\nrequires path variables to reference a directory owned by the application, it\nmust be documented with the Information System Security Officer (ISSO)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75571","rid":"SV-90251r1_rule","stig_id":"UBTU-16-010780","fix_id":"F-82199r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75571\" do\n  title \"All local interactive user initialization files executable search\npaths must contain only paths that resolve to the system default or the users\nhome directory.\"\n  desc  \"The executable search path (typically the PATH environment variable)\ncontains a list of directories for the shell to search to find executables. If\nthis path includes the current working directory executables in these\ndirectories may be executed instead of system commands. This variable is\nformatted as a colon-separated list of directories. If there is an empty entry,\nsuch as a leading or trailing colon or two consecutive colons, this is\ninterpreted as the current working directory. If deviations from the default\nsystem search path for the local interactive user are required, they must be\ndocumented with the Information System Security Officer (ISSO).\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75571\"\n  tag \"rid\": \"SV-90251r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010780\"\n  tag \"fix_id\": \"F-82199r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that all local interactive user initialization files'\nexecutable search path statements do not contain statements that will reference\na working directory other than the users’ home directory or the system default.\n\nCheck the executable search path statement for all local interactive user\ninitialization files in the users' home directory with the following commands:\n\nNote: The example will be for the smithj user, which has a home directory of\n\\\"/home/smithj\\\".\n\n# grep -i path /home/smithj/.*\n/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\n/home/smithj/.bash_profile:export PATH\n\nIf any local interactive user initialization files have executable search path\nstatements that include directories outside of their home directory, and the\nadditional path statements are not documented with the Information System\nSecurity Officer (ISSO) as an operational requirement, this is a finding.\"\n  desc \"fix\", \"Edit the local interactive user initialization files to change\nany PATH variable statements for executables that reference directories other\nthan their home directory or the system default. If a local interactive user\nrequires path variables to reference a directory owned by the application, it\nmust be documented with the Information System Security Officer (ISSO).\"\n\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n\n  findings = Set[]\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries.each do |user_info|\n    next if exempt_home_users.include?(\"#{user_info.username}\")\n    grep_results =  command(\"grep -i path --exclude=\\\".bash_history\\\" #{user_info.home}/.*\").stdout.split(\"\\\\n\")\n    grep_results.each do |result|\n      result.slice! \"PATH=\"\n      # Case when last value in exec search path is :\n      if result[-1] == \":\" then\n        result = result + \" \"\n      end\n      result.slice! \"$PATH:\"\n      result.slice! \"$PATH\\\"\\n\"\n      result.gsub! '$HOME', \"#{user_info.home}\"\n      result.gsub! '~', \"#{user_info.home}\"\n      line_arr = result.split(\":\")\n      line_arr.delete_at(0)\n      line_arr.each do |line|\n        line.slice! \"\\\"\"\n        # Don't run test on line that exports PATH and is not commented out\n        if !line.start_with?('export') && !line.start_with?('#') then\n          # Case when :: found in exec search path or : found at beginning\n          if line.strip.empty? then\n            curr_work_dir = command(\"pwd\").stdout.gsub(\"\\n\", \"\")\n            if curr_work_dir.start_with?(\"#{user_info.home}\") then\n              line = curr_work_dir\n            end\n          end          \n          # This will fail if non-home directory found in path\n          if !line.start_with?(user_info.home)\n            findings.add(line)\n          end\n        end\n      end\n    end\n  end\n  describe \"Initialization files that include executable search paths that include directories outside their home directories\" do\n    subject { findings.to_a } \n    it { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75571.rb"},"results":[{"status":"passed","code_desc":"Initialization files that include executable search paths that include directories outside their home directories should be empty","run_time":9.2e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75801","title":"The rsh-server package must not be installed.","desc":"It is detrimental for Ubuntu operating systems to provide, or install\nby default, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services, provided by\ndefault, may not be necessary to support essential organizational operations\n(e.g., key missions, functions).\n\n    The rsh-server service provides an unencrypted remote access service that\ndoes not provide for the confidentiality and integrity of user passwords or the\nremote session and has very weak authentication.\n\n    If a privileged user were to log on using this service, the privileged user\npassword could be compromised.","descriptions":[{"label":"default","data":"It is detrimental for Ubuntu operating systems to provide, or install\nby default, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services, provided by\ndefault, may not be necessary to support essential organizational operations\n(e.g., key missions, functions).\n\n    The rsh-server service provides an unencrypted remote access service that\ndoes not provide for the confidentiality and integrity of user passwords or the\nremote session and has very weak authentication.\n\n    If a privileged user were to log on using this service, the privileged user\npassword could be compromised."},{"label":"check","data":"Verify that the rsh-server package is not installed on the\nUbuntu operating system.\n\nCheck to see if the rsh-server package is installed with the following command:\n\n# sudo apt list rsh-server\n\nIf the rsh-server package is installed, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to disable non-essential\ncapabilities by removing the rsh-server package from the system with the\nfollowing command:\n\n# sudo apt-get remove rsh-server"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000095-GPOS-00049","gid":"V-75801","rid":"SV-90481r2_rule","stig_id":"UBTU-16-030020","fix_id":"F-82431r1_fix","cci":["CCI-000381"],"nist":["CM-7 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75801\" do\n  title \"The rsh-server package must not be installed.\"\n  desc  \"It is detrimental for Ubuntu operating systems to provide, or install\nby default, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n    Ubuntu operating systems are capable of providing a wide variety of\nfunctions and services. Some of the functions and services, provided by\ndefault, may not be necessary to support essential organizational operations\n(e.g., key missions, functions).\n\n    The rsh-server service provides an unencrypted remote access service that\ndoes not provide for the confidentiality and integrity of user passwords or the\nremote session and has very weak authentication.\n\n    If a privileged user were to log on using this service, the privileged user\npassword could be compromised.\n  \"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000095-GPOS-00049\"\n  tag \"gid\": \"V-75801\"\n  tag \"rid\": \"SV-90481r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030020\"\n  tag \"fix_id\": \"F-82431r1_fix\"\n  tag \"cci\": [\"CCI-000381\"]\n  tag \"nist\": [\"CM-7 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the rsh-server package is not installed on the\nUbuntu operating system.\n\nCheck to see if the rsh-server package is installed with the following command:\n\n# sudo apt list rsh-server\n\nIf the rsh-server package is installed, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to disable non-essential\ncapabilities by removing the rsh-server package from the system with the\nfollowing command:\n\n# sudo apt-get remove rsh-server\"\n\n  describe package('rsh-server') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75801.rb"},"results":[{"status":"passed","code_desc":"System Package rsh-server should not be installed","run_time":0.018648,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75493","title":"The Ubuntu operating system must enforce a delay of at least 4 seconds\nbetween logon prompts following a failed logon attempt.","desc":"Limiting the number of logon attempts over a certain time interval\nreduces the chances that an unauthorized user may gain access to an account.","descriptions":[{"label":"default","data":"Limiting the number of logon attempts over a certain time interval\nreduces the chances that an unauthorized user may gain access to an account."},{"label":"check","data":"Verify the Ubuntu operating system enforces a delay of at least\n4 seconds between logon prompts following a failed logon attempt.\n\nCheck that the Ubuntu operating system enforces a delay of at least 4 seconds\nbetween logon prompts with the following command:\n\n# grep pam_faildelay /etc/pam.d/common-auth*\n\nauth required pam_faildelay.so delay=4000000\n\nIf the line is not present, or is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to enforce a delay of at\nleast 4 seconds between logon prompts following a failed logon attempt.\n\nEdit the file \"/etc/pam.d/common-auth\" and set the parameter\n\"pam_faildelay\" to a value of 4000000 or greater:\n\nauth required pam_faildelay.so delay=4000000"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00226","gid":"V-75493","rid":"SV-90173r1_rule","stig_id":"UBTU-16-010320","fix_id":"F-82121r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75493\" do\n  title \"The Ubuntu operating system must enforce a delay of at least 4 seconds\nbetween logon prompts following a failed logon attempt.\"\n  desc  \"Limiting the number of logon attempts over a certain time interval\nreduces the chances that an unauthorized user may gain access to an account.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00226\"\n  tag \"gid\": \"V-75493\"\n  tag \"rid\": \"SV-90173r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010320\"\n  tag \"fix_id\": \"F-82121r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system enforces a delay of at least\n4 seconds between logon prompts following a failed logon attempt.\n\nCheck that the Ubuntu operating system enforces a delay of at least 4 seconds\nbetween logon prompts with the following command:\n\n# grep pam_faildelay /etc/pam.d/common-auth*\n\nauth required pam_faildelay.so delay=4000000\n\nIf the line is not present, or is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to enforce a delay of at\nleast 4 seconds between logon prompts following a failed logon attempt.\n\nEdit the file \\\"/etc/pam.d/common-auth\\\" and set the parameter\n\\\"pam_faildelay\\\" to a value of 4000000 or greater:\n\nauth required pam_faildelay.so delay=4000000\"\n\n  describe file(\"/etc/pam.d/common-auth\") do\n    it { should exist }\n  end\n\n  describe command(\"grep pam_faildelay /etc/pam.d/common-auth\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should match /^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=([4-9][\\d]{6,}|[1-9][\\d]{7,}).*$/ }\n  end\n\n  file(\"/etc/pam.d/common-auth\").content.to_s.scan(/^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=(\\d+).*$/).flatten.each do |entry|\n    describe entry do\n      it { should cmp > 4000000 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75493.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/common-auth should exist","run_time":0.009384,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"failed","code_desc":"Command: `grep pam_faildelay /etc/pam.d/common-auth` exit_status should eq 0","run_time":0.015465,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: 0\n     got: 1\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Command: `grep pam_faildelay /etc/pam.d/common-auth` stdout.strip should match /^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=([4-9][\\d]{6,}|[1-9][\\d]{7,}).*$/","run_time":0.0003,"start_time":"2019-08-06T11:13:31-04:00","message":"expected \"\" to match /^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=([4-9][\\d]{6,}|[1-9][\\d]{7,}).*$/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=([4-9][\\d]{6,}|[1-9][\\d]{7,}).*$/\n+\"\"\n"}]},{"id":"V-75753","title":"Successful/unsuccessful uses of the open_by_handle_at command must\ngenerate an audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"open_by_handle_at\" command\noccur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw open_by_handle_at /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000\n-F auid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"open_by_handle_at\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000\n-F auid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75753","rid":"SV-90433r3_rule","stig_id":"UBTU-16-020640","fix_id":"F-82381r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75753\" do\n  title \"Successful/unsuccessful uses of the open_by_handle_at command must\ngenerate an audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75753\"\n  tag \"rid\": \"SV-90433r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020640\"\n  tag \"fix_id\": \"F-82381r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" command\noccur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw open_by_handle_at /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000\n-F auid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"open_by_handle_at\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000\n-F auid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"open_by_handle_at\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EPERM' }\n  end\n  describe auditd.syscall(\"open_by_handle_at\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EACCES' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75753.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"open_by_handle_at\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000138,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open_by_handle_at\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000112,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open_by_handle_at\" arch == \"b64\" exit.uniq should include \"-EPERM\"","run_time":0.000183,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EPERM\""},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open_by_handle_at\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000172,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open_by_handle_at\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.00016,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"open_by_handle_at\" arch == \"b64\" exit.uniq should include \"-EACCES\"","run_time":0.000184,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EACCES\""}]},{"id":"V-75613","title":"System commands must be owned by root.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":[{"label":"default","data":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications."},{"label":"check","data":"Verify the system commands contained in the following\ndirectories are owned by \"root\".\n\nCheck that the system command files contained in the following directories are\nowned by \"root\" with the following command:\n\n# sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root | xargs ls -la\n\nIf any system commands are returned, this is a finding."},{"label":"fix","data":"Configure the system commands to be protected from unauthorized\naccess.\n\nRun the following command, replacing \"[FILE]\" with any system command file\nnot owned by \"root\".\n\n# sudo chown root [FILE]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-75613","rid":"SV-90293r2_rule","stig_id":"UBTU-16-011040","fix_id":"F-82241r2_fix","cci":["CCI-001499"],"nist":["CM-5 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75613\" do\n  title \"System commands must be owned by root.\"\n  desc  \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000259-GPOS-00100\"\n  tag \"gid\": \"V-75613\"\n  tag \"rid\": \"SV-90293r2_rule\"\n  tag \"stig_id\": \"UBTU-16-011040\"\n  tag \"fix_id\": \"F-82241r2_fix\"\n  tag \"cci\": [\"CCI-001499\"]\n  tag \"nist\": [\"CM-5 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system commands contained in the following\ndirectories are owned by \\\"root\\\".\n\nCheck that the system command files contained in the following directories are\nowned by \\\"root\\\" with the following command:\n\n# sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root | xargs ls -la\n\nIf any system commands are returned, this is a finding.\"\n  desc \"fix\", \"Configure the system commands to be protected from unauthorized\naccess.\n\nRun the following command, replacing \\\"[FILE]\\\" with any system command file\nnot owned by \\\"root\\\".\n\n# sudo chown root [FILE]\"\n\n  system_commands = command('find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root').stdout.strip.split(\"\\n\").entries\n  valid_system_commands = Set[]\n\n  if system_commands.count > 0\n    system_commands.each do |sys_cmd|\n      if file(sys_cmd).exist?\n        valid_system_commands = valid_system_commands << sys_cmd\n      end\n    end\n  end\n\n  if valid_system_commands.count > 0\n    valid_system_commands.each do |val_sys_cmd|\n      describe file(val_sys_cmd) do\n        its('owner') { should cmp 'root' }\n      end\n    end\n  else\n    describe \"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are NOT owned by root\" do\n      subject { valid_system_commands }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75613.rb"},"results":[{"status":"failed","code_desc":"File /usr/bin/at owner should cmp == \"root\"","run_time":0.000242,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: \"root\"\n     got: \"daemon\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75773","title":"Successful/unsuccessful modifications to the faillog file must\ngenerate an audit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful modifications to the \"faillog\" file occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w faillog /etc/audit/audit.rules\n\n-w /var/log/faillog -p wa -k logins\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \"faillog\" file occur.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-w /var/log/faillog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215","SRG-OS-000473-GPOS-00218"],"gid":"V-75773","rid":"SV-90453r3_rule","stig_id":"UBTU-16-020740","fix_id":"F-82401r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75773\" do\n  title \"Successful/unsuccessful modifications to the faillog file must\ngenerate an audit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000473-GPOS-00218\"]\n  tag \"gid\": \"V-75773\"\n  tag \"rid\": \"SV-90453r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020740\"\n  tag \"fix_id\": \"F-82401r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful modifications to the \\\"faillog\\\" file occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w faillog /etc/audit/audit.rules\n\n-w /var/log/faillog -p wa -k logins\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \\\"faillog\\\" file occur.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-w /var/log/faillog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/var/log/faillog'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'w' }\n        it { should include 'a' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75773.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /var/log/faillog exist should equal true","run_time":0.000146,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75633","title":"Off-loading audit records to another system must be authenticated.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity."},{"label":"check","data":"Verify the audit system authenticates off-loading audit records\nto a different system.\n\nCheck that the off-loading of audit records to a different system is\nauthenticated with the following command:\n\n# sudo grep enable /etc/audisp/audisp-remote.conf\n\nenable_krb5 = yes\n\nIf “enable_krb5” option is not set to \"yes\" or the line is commented out,\nthis is a finding."},{"label":"fix","data":"Configure the audit system to authenticate off-loading audit\nrecords to a different system.\n\nUncomment the \"enable_krb5\" option in \"/etc/audisp/audisp-remote.conf\" and\nset it to \"yes\". See the example below.\n\nenable_krb5 = yes"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000479-GPOS-00224","gid":"V-75633","rid":"SV-90313r1_rule","stig_id":"UBTU-16-020080","fix_id":"F-82261r1_fix","cci":["CCI-001851"],"nist":["AU-4 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75633\" do\n  title \"Off-loading audit records to another system must be authenticated.\"\n  desc  \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000479-GPOS-00224\"\n  tag \"gid\": \"V-75633\"\n  tag \"rid\": \"SV-90313r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020080\"\n  tag \"fix_id\": \"F-82261r1_fix\"\n  tag \"cci\": [\"CCI-001851\"]\n  tag \"nist\": [\"AU-4 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit system authenticates off-loading audit records\nto a different system.\n\nCheck that the off-loading of audit records to a different system is\nauthenticated with the following command:\n\n# sudo grep enable /etc/audisp/audisp-remote.conf\n\nenable_krb5 = yes\n\nIf “enable_krb5” option is not set to \\\"yes\\\" or the line is commented out,\nthis is a finding.\"\n  desc \"fix\", \"Configure the audit system to authenticate off-loading audit\nrecords to a different system.\n\nUncomment the \\\"enable_krb5\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and\nset it to \\\"yes\\\". See the example below.\n\nenable_krb5 = yes\"\n\n  config_file_exists = file('/etc/audisp/audisp-remote.conf').exist?\n\n  if config_file_exists\n    describe auditd_conf('/etc/audisp/audisp-remote.conf') do\n      its('enable_krb5') { should_not be_empty }\n      its('enable_krb5') { should cmp 'yes' }\n    end\n  else\n    describe \"/etc/audisp/audisp-remote.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75633.rb"},"results":[{"status":"failed","code_desc":"/etc/audisp/audisp-remote.conf exists should equal true","run_time":0.000126,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75821","title":"The Ubuntu operating system must implement address space layout\nrandomization to protect its memory from unauthorized code execution.","desc":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n    Examples of attacks are buffer overflow attacks.","descriptions":[{"label":"default","data":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n    Examples of attacks are buffer overflow attacks."},{"label":"check","data":"Verify the Ubuntu operating system implements address space\nlayout randomization (ASLR).\n\nCheck that ASLR is configured on the system with the following command:\n\n# sudo sysctl kernel.randomize_va_space\n\nkernel.randomize_va_space = 2\n\nIf nothing is returned; we must verify the kernel parameter\n\"randomize_va_space\" is set to \"2\" with the following command:\n\n# kernel.randomize_va_space\" /etc/sysctl.conf /etc/sysctl.d/*\n\nkernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" is not set to \"2\", this is a finding."},{"label":"fix","data":"Configure the operating system implement virtual address space\nrandomization.\n\nSet the system to the required kernel parameter by adding the following line to\n\"/etc/sysctl.conf\" (or modify the line to have the required value):\n\nkernel.randomize_va_space=2"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000433-GPOS-00193","gid":"V-75821","rid":"SV-90501r2_rule","stig_id":"UBTU-16-030140","fix_id":"F-82451r2_fix","cci":["CCI-002824"],"nist":["SI-16","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75821\" do\n  title \"The Ubuntu operating system must implement address space layout\nrandomization to protect its memory from unauthorized code execution.\"\n  desc  \"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n    Examples of attacks are buffer overflow attacks.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000433-GPOS-00193\"\n  tag \"gid\": \"V-75821\"\n  tag \"rid\": \"SV-90501r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030140\"\n  tag \"fix_id\": \"F-82451r2_fix\"\n  tag \"cci\": [\"CCI-002824\"]\n  tag \"nist\": [\"SI-16\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system implements address space\nlayout randomization (ASLR).\n\nCheck that ASLR is configured on the system with the following command:\n\n# sudo sysctl kernel.randomize_va_space\n\nkernel.randomize_va_space = 2\n\nIf nothing is returned; we must verify the kernel parameter\n\\\"randomize_va_space\\\" is set to \\\"2\\\" with the following command:\n\n# kernel.randomize_va_space\\\" /etc/sysctl.conf /etc/sysctl.d/*\n\nkernel.randomize_va_space = 2\n\nIf \\\"kernel.randomize_va_space\\\" is not set to \\\"2\\\", this is a finding.\"\n  desc \"fix\", \"Configure the operating system implement virtual address space\nrandomization.\n\nSet the system to the required kernel parameter by adding the following line to\n\\\"/etc/sysctl.conf\\\" (or modify the line to have the required value):\n\nkernel.randomize_va_space=2\"\n\n  describe kernel_parameter('kernel.randomize_va_space') do\n    its('value') { should cmp 2 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75821.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter kernel.randomize_va_space value should cmp == 2","run_time":0.017496,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75691","title":"Successful/unsuccessful uses of the su command must generate an audit\nrecord.","desc":"Without establishing what type of events occurred, it would be\ndifficult to establish, correlate, and investigate the events leading up to an\noutage or attack.\n\n    Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n    Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack; recognizing resource\nutilization or capacity thresholds; or identifying an improperly configured\nUbuntu operating system.","descriptions":[{"label":"default","data":"Without establishing what type of events occurred, it would be\ndifficult to establish, correlate, and investigate the events leading up to an\noutage or attack.\n\n    Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n    Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack; recognizing resource\nutilization or capacity thresholds; or identifying an improperly configured\nUbuntu operating system."},{"label":"check","data":"Verify the Ubuntu operating system generates audit records when\nsuccessful/unsuccessful attempts to use the \"su\" command occur.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw /bin/su /etc/audit/audit.rules\n\n-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k\nprivileged-priv_change\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to generate audit records\nwhen successful/unsuccessful attempts to use the \"su\" command occur.\n\nAdd or update the following rule in \"/etc/audit/audit.rules\":\n\n-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k\nprivileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000064-GPOS-0003","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75691","rid":"SV-90371r3_rule","stig_id":"UBTU-16-020360","fix_id":"F-82319r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75691\" do\n  title \"Successful/unsuccessful uses of the su command must generate an audit\nrecord.\"\n  desc  \"Without establishing what type of events occurred, it would be\ndifficult to establish, correlate, and investigate the events leading up to an\noutage or attack.\n\n    Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n    Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack; recognizing resource\nutilization or capacity thresholds; or identifying an improperly configured\nUbuntu operating system.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000064-GPOS-0003\",\n\"SRG-OS-000392-GPOS-00172\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75691\"\n  tag \"rid\": \"SV-90371r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020360\"\n  tag \"fix_id\": \"F-82319r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates audit records when\nsuccessful/unsuccessful attempts to use the \\\"su\\\" command occur.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw /bin/su /etc/audit/audit.rules\n\n-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k\nprivileged-priv_change\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to generate audit records\nwhen successful/unsuccessful attempts to use the \\\"su\\\" command occur.\n\nAdd or update the following rule in \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k\nprivileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/bin/su'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      its('action.uniq') { should eq ['always'] }\n      its('list.uniq') { should eq ['exit'] }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75691.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /bin/su exist should equal true","run_time":0.000223,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75883","title":"The Ubuntu operating system must not allow interfaces to perform\nInternet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP)\nredirects by default.","desc":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages contain information from the system's route table,\npossibly revealing portions of the network topology.","descriptions":[{"label":"default","data":"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages contain information from the system's route table,\npossibly revealing portions of the network topology."},{"label":"check","data":"Verify the Ubuntu operating system does not allow interfaces to\nperform Internet Protocol version 4 (IPv4) Internet Control Message Protocol\n(ICMP) redirects by default.\n\nCheck the value of the \"default send_redirects\" variables with the following\ncommand:\n\n# sudo sysctl net.ipv4.conf.default.send_redirects\n\nnet.ipv4.conf.default.send_redirects=0\n\nIf the returned line does not have a value of \"0\", or a line is not returned,\nthis is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to not allow interfaces to\nperform Internet Protocol version 4 (IPv4) Internet Control Message Protocol\n(ICMP) redirects by default with the following command:\n\n# sudo sysctl -w net.ipv4.conf.default.send_redirects=0\n\nIf \"0\" is not the system's default value then add or update the following\nline in \"/etc/sysctl.conf\" or in the appropriate file under \"/etc/sysctl.d\":\n\nnet.ipv4.conf.default.send_redirects=0"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75883","rid":"SV-90563r2_rule","stig_id":"UBTU-16-030580","fix_id":"F-82513r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75883\" do\n  title \"The Ubuntu operating system must not allow interfaces to perform\nInternet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP)\nredirects by default.\"\n  desc  \"Internet Control Message Protocol (ICMP) redirect messages are used by\nrouters to inform hosts that a more direct route exists for a particular\ndestination. These messages contain information from the system's route table,\npossibly revealing portions of the network topology.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75883\"\n  tag \"rid\": \"SV-90563r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030580\"\n  tag \"fix_id\": \"F-82513r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system does not allow interfaces to\nperform Internet Protocol version 4 (IPv4) Internet Control Message Protocol\n(ICMP) redirects by default.\n\nCheck the value of the \\\"default send_redirects\\\" variables with the following\ncommand:\n\n# sudo sysctl net.ipv4.conf.default.send_redirects\n\nnet.ipv4.conf.default.send_redirects=0\n\nIf the returned line does not have a value of \\\"0\\\", or a line is not returned,\nthis is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to not allow interfaces to\nperform Internet Protocol version 4 (IPv4) Internet Control Message Protocol\n(ICMP) redirects by default with the following command:\n\n# sudo sysctl -w net.ipv4.conf.default.send_redirects=0\n\nIf \\\"0\\\" is not the system's default value then add or update the following\nline in \\\"/etc/sysctl.conf\\\" or in the appropriate file under \\\"/etc/sysctl.d\\\":\n\nnet.ipv4.conf.default.send_redirects=0\"\n\n  describe kernel_parameter('net.ipv4.conf.default.send_redirects') do\n    its('value') { should eq 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75883.rb"},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv4.conf.default.send_redirects value should eq 0","run_time":0.010458,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75551","title":"User accounts with temporary passwords, must require an immediate\nchange to a permanent password after login.","desc":"Without providing this capability, an account may be created without a\npassword. Non-repudiation cannot be guaranteed once an account is created if a\nuser is not forced to change the temporary password upon initial logon.\n\n    Temporary passwords are typically used to allow access when new accounts\nare created or passwords are changed. It is common practice for administrators\nto create temporary passwords for user accounts which allow the users to log\non, yet force them to change the password once they have successfully\nauthenticated.","descriptions":[{"label":"default","data":"Without providing this capability, an account may be created without a\npassword. Non-repudiation cannot be guaranteed once an account is created if a\nuser is not forced to change the temporary password upon initial logon.\n\n    Temporary passwords are typically used to allow access when new accounts\nare created or passwords are changed. It is common practice for administrators\nto create temporary passwords for user accounts which allow the users to log\non, yet force them to change the password once they have successfully\nauthenticated."},{"label":"check","data":"Verify a policy exists that ensures when a user account is\ncreated, it is created using a method that forces a user to change their\npassword upon their next login.\n\nIf a policy does not exist, this is a finding."},{"label":"fix","data":"Create a policy that ensures when a user is created, it is\ncreated using a method that forces a user to change their password upon their\nnext login.\n\nBelow are two examples of how to create a user account that requires the user\nto change their password upon their next login.\n\n# chage -d 0 [UserName]\n\nor\n\n# passwd -e [UserName]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000380-GPOS-00165","gid":"V-75551","rid":"SV-90231r1_rule","stig_id":"UBTU-16-010680","fix_id":"F-82179r1_fix","cci":["CCI-002041"],"nist":["IA-5 (1) (f)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75551\" do\n  title \"User accounts with temporary passwords, must require an immediate\nchange to a permanent password after login.\"\n  desc  \"Without providing this capability, an account may be created without a\npassword. Non-repudiation cannot be guaranteed once an account is created if a\nuser is not forced to change the temporary password upon initial logon.\n\n    Temporary passwords are typically used to allow access when new accounts\nare created or passwords are changed. It is common practice for administrators\nto create temporary passwords for user accounts which allow the users to log\non, yet force them to change the password once they have successfully\nauthenticated.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000380-GPOS-00165\"\n  tag \"gid\": \"V-75551\"\n  tag \"rid\": \"SV-90231r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010680\"\n  tag \"fix_id\": \"F-82179r1_fix\"\n  tag \"cci\": [\"CCI-002041\"]\n  tag \"nist\": [\"IA-5 (1) (f)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify a policy exists that ensures when a user account is\ncreated, it is created using a method that forces a user to change their\npassword upon their next login.\n\nIf a policy does not exist, this is a finding.\"\n  desc \"fix\", \"Create a policy that ensures when a user is created, it is\ncreated using a method that forces a user to change their password upon their\nnext login.\n\nBelow are two examples of how to create a user account that requires the user\nto change their password upon their next login.\n\n# chage -d 0 [UserName]\n\nor\n\n# passwd -e [UserName]\"\n\n  describe \"Manual verification required\" do\n    skip \"Manually verify if a policy exists to ensure that a method exists to force temporary users to change their password upon next login\"\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75551.rb"},"results":[{"status":"skipped","code_desc":"Manual verification required","run_time":7.0e-06,"start_time":"2019-08-06T11:13:31-04:00","resource":"","skip_message":"Manually verify if a policy exists to ensure that a method exists to force temporary users to change their password upon next login"}]},{"id":"V-75487","title":"The Ubuntu operating system must automatically lock an account until\nthe locked account is released by an administrator when three unsuccessful\nlogon attempts.","desc":"By limiting the number of failed logon attempts, the risk of\nunauthorized system access via user password guessing, otherwise known as\nbrute-forcing, is reduced. Limits are imposed by locking the account.","descriptions":[{"label":"default","data":"By limiting the number of failed logon attempts, the risk of\nunauthorized system access via user password guessing, otherwise known as\nbrute-forcing, is reduced. Limits are imposed by locking the account."},{"label":"check","data":"Verify the Ubuntu operating system automatically locks an\naccount until the account lock is released by an administrator when three\nunsuccessful logon attempts are made.\n\nCheck that the Ubuntu operating system automatically locks an account after\nthree unsuccessful attempts with the following command:\n\n# grep pam_tally /etc/pam.d/common-auth\n\nauth required pam_tally2.so onerr=fail deny=3\n\nIf \"onerr=fail deny=3\" is not used in \"/etc/pam.d/common-auth\" or is called\nwith \"unlock_time\", this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to automatically lock an\naccount until the locked account is released by an administrator when three\nunsuccessful logon attempts are made by appending the following line to the\n\"/etc/pam.d/common-auth file\":\n\n\"auth required pam_tally2.so onerr=fail deny=3\""}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000021-GPOS-00005","satisfies":["SRG-OS-000021-GPOS-00005","SRG-OS-000329-GPOS-00128"],"gid":"V-75487","rid":"SV-90167r2_rule","stig_id":"UBTU-16-010290","fix_id":"F-82115r2_fix","cci":["CCI-000044","CCI-002238"],"nist":["AC-7 a","AC-7 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75487\" do\n  title \"The Ubuntu operating system must automatically lock an account until\nthe locked account is released by an administrator when three unsuccessful\nlogon attempts.\"\n  desc  \"By limiting the number of failed logon attempts, the risk of\nunauthorized system access via user password guessing, otherwise known as\nbrute-forcing, is reduced. Limits are imposed by locking the account.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000021-GPOS-00005\"\n  tag \"satisfies\": [\"SRG-OS-000021-GPOS-00005\", \"SRG-OS-000329-GPOS-00128\"]\n  tag \"gid\": \"V-75487\"\n  tag \"rid\": \"SV-90167r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010290\"\n  tag \"fix_id\": \"F-82115r2_fix\"\n  tag \"cci\": [\"CCI-000044\", \"CCI-002238\"]\n  tag \"nist\": [\"AC-7 a\", \"AC-7 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system automatically locks an\naccount until the account lock is released by an administrator when three\nunsuccessful logon attempts are made.\n\nCheck that the Ubuntu operating system automatically locks an account after\nthree unsuccessful attempts with the following command:\n\n# grep pam_tally /etc/pam.d/common-auth\n\nauth required pam_tally2.so onerr=fail deny=3\n\nIf \\\"onerr=fail deny=3\\\" is not used in \\\"/etc/pam.d/common-auth\\\" or is called\nwith \\\"unlock_time\\\", this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to automatically lock an\naccount until the locked account is released by an administrator when three\nunsuccessful logon attempts are made by appending the following line to the\n\\\"/etc/pam.d/common-auth file\\\":\n\n\\\"auth required pam_tally2.so onerr=fail deny=3\\\"\"\n\n  describe file(\"/etc/pam.d/common-auth\") do\n    it { should exist }\n  end\n\n  describe command(\"grep pam_tally /etc/pam.d/common-auth\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3($|\\s+.*$)/ }\n    its('stdout.strip') { should_not match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3\\s+.*unlock_time.*$/ }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75487.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/common-auth should exist","run_time":9.7e-05,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Command: `grep pam_tally /etc/pam.d/common-auth` exit_status should eq 0","run_time":0.008766,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"failed","code_desc":"Command: `grep pam_tally /etc/pam.d/common-auth` stdout.strip should match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3($|\\s+.*$)/","run_time":0.00028,"start_time":"2019-08-06T11:13:31-04:00","message":"expected \"auth\\trequired      pam_tally2.so deny=5 onerr=fail unlock_time=600\" to match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3($|\\s+.*$)/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3($|\\s+.*$)/\n+\"auth\\trequired      pam_tally2.so deny=5 onerr=fail unlock_time=600\"\n"},{"status":"passed","code_desc":"Command: `grep pam_tally /etc/pam.d/common-auth` stdout.strip should not match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3\\s+.*unlock_time.*$/","run_time":7.8e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75815","title":"The Ubuntu operating system must synchronize internal information\nsystem clocks to the authoritative time source when the time difference is\ngreater than one second.","desc":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events.\n\n    Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network. Organizations should consider setting time periods\nfor different types of systems (e.g., financial, legal, or mission-critical\nsystems).\n\n    Organizations should also consider endpoints that may not have regular\naccess to the authoritative time server (e.g., mobile, teleworking, and\ntactical endpoints). This requirement is related to the comparison done every\n24 hours in SRG-OS-000355 because a comparison must be done in order to\ndetermine the time difference.","descriptions":[{"label":"default","data":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events.\n\n    Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network. Organizations should consider setting time periods\nfor different types of systems (e.g., financial, legal, or mission-critical\nsystems).\n\n    Organizations should also consider endpoints that may not have regular\naccess to the authoritative time server (e.g., mobile, teleworking, and\ntactical endpoints). This requirement is related to the comparison done every\n24 hours in SRG-OS-000355 because a comparison must be done in order to\ndetermine the time difference."},{"label":"check","data":"Verify that Network Time Protocol (NTP) is running in\ncontinuous mode.\n\nCheck that NTP is running in continuous mode with the following command:\n\n# grep ntpdate /etc/init.d/ntpd\n\n  if ntpdate -u -s -b -p 4 -t 5 $NTPSERVER ; then\n\nIf the option \"-q\" is present, this is a finding."},{"label":"fix","data":"The Network Time Protocol (NTP) will run in continuous mode by\ndefault. If the query only option (-q) has been added to the ntpdate command in\n/etc/init.d/ntpd it must be removed."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000356-GPOS-00144","gid":"V-75815","rid":"SV-90495r2_rule","stig_id":"UBTU-16-030110","fix_id":"F-82445r2_fix","cci":["CCI-002046"],"nist":["AU-8 (1) (b)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75815\" do\n  title \"The Ubuntu operating system must synchronize internal information\nsystem clocks to the authoritative time source when the time difference is\ngreater than one second.\"\n  desc  \"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events.\n\n    Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network. Organizations should consider setting time periods\nfor different types of systems (e.g., financial, legal, or mission-critical\nsystems).\n\n    Organizations should also consider endpoints that may not have regular\naccess to the authoritative time server (e.g., mobile, teleworking, and\ntactical endpoints). This requirement is related to the comparison done every\n24 hours in SRG-OS-000355 because a comparison must be done in order to\ndetermine the time difference.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000356-GPOS-00144\"\n  tag \"gid\": \"V-75815\"\n  tag \"rid\": \"SV-90495r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030110\"\n  tag \"fix_id\": \"F-82445r2_fix\"\n  tag \"cci\": [\"CCI-002046\"]\n  tag \"nist\": [\"AU-8 (1) (b)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that Network Time Protocol (NTP) is running in\ncontinuous mode.\n\nCheck that NTP is running in continuous mode with the following command:\n\n# grep ntpdate /etc/init.d/ntpd\n\n  if ntpdate -u -s -b -p 4 -t 5 $NTPSERVER ; then\n\nIf the option \\\"-q\\\" is present, this is a finding.\"\n  desc \"fix\", \"The Network Time Protocol (NTP) will run in continuous mode by\ndefault. If the query only option (-q) has been added to the ntpdate command in\n/etc/init.d/ntpd it must be removed.\"\n\n  ntpd_exists = file('/etc/init.d/ntpd').exist?\n\n  if ntpd_exists\n    describe command('grep ntpdate /etc/init.d/ntpd').stdout.strip do\n      it { should_not match %r(.+(-q).+) }\n    end\n  else\n    describe \"The file /etc/init.d/ntpd exists\" do\n      subject { ntpd_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75815.rb"},"results":[{"status":"failed","code_desc":"The file /etc/init.d/ntpd exists should equal true","run_time":0.000102,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75607","title":"Library files must be owned by root.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":[{"label":"default","data":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications."},{"label":"check","data":"Verify the system-wide shared library files are owned by\n\"root\".\n\nCheck that the system-wide shared library files are owned by \"root\" with the\nfollowing command:\n\n# sudo find /lib /usr/lib /lib64 ! -user root | xargs ls -la\n\nIf any system wide shared library file is returned, this is a finding."},{"label":"fix","data":"Configure the system-wide shared library files (/lib, /usr/lib,\n/lib64) to be protected from unauthorized access.\n\nRun the following command, replacing \"[FILE]\" with any library file not owned\nby \"root\".\n\n# sudo chown root [FILE]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-75607","rid":"SV-90287r2_rule","stig_id":"UBTU-16-011010","fix_id":"F-82235r2_fix","cci":["CCI-001499"],"nist":["CM-5 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75607\" do\n  title \"Library files must be owned by root.\"\n  desc  \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000259-GPOS-00100\"\n  tag \"gid\": \"V-75607\"\n  tag \"rid\": \"SV-90287r2_rule\"\n  tag \"stig_id\": \"UBTU-16-011010\"\n  tag \"fix_id\": \"F-82235r2_fix\"\n  tag \"cci\": [\"CCI-001499\"]\n  tag \"nist\": [\"CM-5 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system-wide shared library files are owned by\n\\\"root\\\".\n\nCheck that the system-wide shared library files are owned by \\\"root\\\" with the\nfollowing command:\n\n# sudo find /lib /usr/lib /lib64 ! -user root | xargs ls -la\n\nIf any system wide shared library file is returned, this is a finding.\"\n  desc \"fix\", \"Configure the system-wide shared library files (/lib, /usr/lib,\n/lib64) to be protected from unauthorized access.\n\nRun the following command, replacing \\\"[FILE]\\\" with any library file not owned\nby \\\"root\\\".\n\n# sudo chown root [FILE]\"\n\n  library_files = command('find /lib /usr/lib /lib64 ! \\-user root').stdout.strip.split(\"\\n\").entries\n\n  if library_files.count > 0\n    library_files.each do |lib_file|\n      describe file(lib_file) do\n        its('owner') { should cmp 'root' }\n      end\n    end\n  else\n    describe \"Number of system-wide shared library files found found in /lib, /lib64, or /usr/lib, that are NOT owned by root\" do\n      subject { library_files }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75607.rb"},"results":[{"status":"passed","code_desc":"Number of system-wide shared library files found found in /lib, /lib64, or /usr/lib, that are NOT owned by root count should eq 0","run_time":6.7e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75747","title":"Successful/unsuccessful uses of the ftruncate command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"ftruncate\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw ftruncate /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"ftruncate\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75747","rid":"SV-90427r3_rule","stig_id":"UBTU-16-020610","fix_id":"F-82375r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75747\" do\n  title \"Successful/unsuccessful uses of the ftruncate command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75747\"\n  tag \"rid\": \"SV-90427r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020610\"\n  tag \"fix_id\": \"F-82375r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"ftruncate\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw ftruncate /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"ftruncate\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"ftruncate\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EPERM' }\n  end\n  describe auditd.syscall(\"ftruncate\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EACCES' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75747.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"ftruncate\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000114,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"ftruncate\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000102,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"ftruncate\" arch == \"b64\" exit.uniq should include \"-EPERM\"","run_time":0.00012,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EPERM\""},{"status":"failed","code_desc":"Auditd Rules with syscall == \"ftruncate\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000102,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"ftruncate\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":9.8e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"ftruncate\" arch == \"b64\" exit.uniq should include \"-EACCES\"","run_time":0.000109,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EACCES\""}]},{"id":"V-75565","title":"All local interactive user home directories must have mode 0750 or\nless permissive.","desc":"Excessive permissions on local interactive user home directories may\nallow unauthorized access to user files by other users.","descriptions":[{"label":"default","data":"Excessive permissions on local interactive user home directories may\nallow unauthorized access to user files by other users."},{"label":"check","data":"Verify the assigned home directory of all local interactive\nusers has a mode of \"0750\" or less permissive.\n\nCheck the home directory assignment for all non-privileged users with the\nfollowing command:\n\nNote: This may miss interactive users that have been assigned a privileged User\nIdentifier (UID). Evidence of interactive use may be obtained from a number of\nlog files containing system logon information.\n\n# ls -ld $(awk -F: '($3>=1000)&&($1!=\"nobody\"){print $6}' /etc/passwd)\n\ndrwxr-x--- 2 smithj admin 4096 Jun 5 12:41 smithj\n\nIf home directories referenced in \"/etc/passwd\" do not have a mode of\n\"0750\" or less permissive, this is a finding."},{"label":"fix","data":"Change the mode of interactive user’s home directories to\n\"0750\". To change the mode of a local interactive user’s home directory, use\nthe following command:\n\nNote: The example will be for the user \"smithj\".\n\n# chmod 0750 /home/smithj"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75565","rid":"SV-90245r1_rule","stig_id":"UBTU-16-010750","fix_id":"F-82193r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75565\" do\n  title \"All local interactive user home directories must have mode 0750 or\nless permissive.\"\n  desc  \"Excessive permissions on local interactive user home directories may\nallow unauthorized access to user files by other users.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75565\"\n  tag \"rid\": \"SV-90245r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010750\"\n  tag \"fix_id\": \"F-82193r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the assigned home directory of all local interactive\nusers has a mode of \\\"0750\\\" or less permissive.\n\nCheck the home directory assignment for all non-privileged users with the\nfollowing command:\n\nNote: This may miss interactive users that have been assigned a privileged User\nIdentifier (UID). Evidence of interactive use may be obtained from a number of\nlog files containing system logon information.\n\n# ls -ld $(awk -F: '($3>=1000)&&($1!=\\\"nobody\\\"){print $6}' /etc/passwd)\n\ndrwxr-x--- 2 smithj admin 4096 Jun 5 12:41 smithj\n\nIf home directories referenced in \\\"/etc/passwd\\\" do not have a mode of\n\\\"0750\\\" or less permissive, this is a finding.\"\n  desc \"fix\", \"Change the mode of interactive user’s home directories to\n\\\"0750\\\". To change the mode of a local interactive user’s home directory, use\nthe following command:\n\nNote: The example will be for the user \\\"smithj\\\".\n\n# chmod 0750 /home/smithj\"\n\n  exempt_home_users = input('exempt_home_users')\n  non_interactive_shells = input('non_interactive_shells')\n  ignore_shells = non_interactive_shells.join('|')\n\n  findings = Set[]\n  users.where{ !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)}.entries.each do |user_info|\n    next if exempt_home_users.include?(\"#{user_info.username}\")\n    findings = findings + command(\"find #{user_info.home} -maxdepth 0 -perm /027\").stdout.split(\"\\n\")\n  end\n  describe \"Home directories with excessive permissions\" do\n    subject { findings.to_a }\n    it { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75565.rb"},"results":[{"status":"failed","code_desc":"Home directories with excessive permissions should be empty","run_time":0.000121,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `[\"/home/vagrant\"].empty?` to return true, got false"}]},{"id":"V-75435","title":"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local or remote access to the system\nvia a command line user logon.","desc":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \"I've read and consent to terms in IS user agreem't.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \"I've read and consent to terms in IS user agreem't.\""},{"label":"check","data":"Verify the Ubuntu operating system displays the Standard\nMandatory DoD Notice and Consent Banner before granting access to the Ubuntu\noperating system via a command line user logon.\n\nCheck that the Ubuntu operating system displays a banner at the command line\nlogin screen with the following command:\n\n# cat /etc/issue\n\nIf the banner is set correctly it will return the following text:\n\n“You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.”\n\nIf the banner text does not match the Standard Mandatory DoD Notice and Consent\nBanner exactly, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the system\nvia command line logon.\n\nEdit the \"/etc/issue\" file to replace the default text with the Standard\nMandatory DoD Notice and Consent Banner. The DoD required text is:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests -- not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\""}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000023-GPOS-00006","satisfies":["SRG-OS-000023-GPOS-00006","SRG-OS-000228-GPOS-00088"],"gid":"V-75435","rid":"SV-90115r2_rule","stig_id":"UBTU-16-010030","fix_id":"F-82063r2_fix","cci":["CCI-000048","CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"],"nist":["AC-8 a","AC-8 c 1","AC-8 c 2","AC-8 c 2","AC-8 c 2","AC-8\nc 3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75435\" do\n  title \"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local or remote access to the system\nvia a command line user logon.\"\n  desc  \"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \\\"I've read and consent to terms in IS user agreem't.\\\"\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000023-GPOS-00006\"\n  tag \"satisfies\": [\"SRG-OS-000023-GPOS-00006\", \"SRG-OS-000228-GPOS-00088\"]\n  tag \"gid\": \"V-75435\"\n  tag \"rid\": \"SV-90115r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010030\"\n  tag \"fix_id\": \"F-82063r2_fix\"\n  tag \"cci\": [\"CCI-000048\", \"CCI-001384\", \"CCI-001385\", \"CCI-001386\",\n\"CCI-001387\", \"CCI-001388\"]\n  tag \"nist\": [\"AC-8 a\", \"AC-8 c 1\", \"AC-8 c 2\", \"AC-8 c 2\", \"AC-8 c 2\", \"AC-8\nc 3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system displays the Standard\nMandatory DoD Notice and Consent Banner before granting access to the Ubuntu\noperating system via a command line user logon.\n\nCheck that the Ubuntu operating system displays a banner at the command line\nlogin screen with the following command:\n\n# cat /etc/issue\n\nIf the banner is set correctly it will return the following text:\n\n“You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.”\n\nIf the banner text does not match the Standard Mandatory DoD Notice and Consent\nBanner exactly, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the system\nvia command line logon.\n\nEdit the \\\"/etc/issue\\\" file to replace the default text with the Standard\nMandatory DoD Notice and Consent Banner. The DoD required text is:\n\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent\nto the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject\nto routine monitoring, interception, and search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls)\nto protect USG interests -- not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE\nor CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\"\n\n    banner_text = file('/etc/issue').content.gsub(%r{[\\r\\n\\s]}, '')\n\n    describe \"Banner text\" do\n      subject { banner_text }\n      it { should eq input('banner_text').gsub(%r{[\\r\\n\\s]}, '') }\n    end\nend\n","source_location":{"line":1,"ref":"./controls/V-75435.rb"},"results":[{"status":"failed","code_desc":"Banner text should eq \"YouareaccessingaU.S.Government(USG)InformationSystem(IS)thatisprovidedforUSG-authorizeduseonly.Byusi...eirassistants.Suchcommunicationsandworkproductareprivateandconfidential.SeeUserAgreementfordetails.\"","run_time":0.000317,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: \"YouareaccessingaU.S.Government(USG)InformationSystem(IS)thatisprovidedforUSG-authorizeduseonly.Byusi...eirassistants.Suchcommunicationsandworkproductareprivateandconfidential.SeeUserAgreementfordetails.\"\n     got: \"Ubuntu16.04.5LTS\\\\n\\\\l\"\n\n(compared using ==)\n"}]},{"id":"V-75575","title":"File systems that contain user home directories must be mounted to\nprevent files with the setuid and setguid bit set from being executed.","desc":"The \"nosuid\" mount option causes the system to not execute setuid\nand setgid files with owner privileges. This option must be used for mounting\nany file system not containing approved setuid and setguid files. Executing\nfiles from untrusted file systems increases the opportunity for unprivileged\nusers to attain unauthorized administrative access.","descriptions":[{"label":"default","data":"The \"nosuid\" mount option causes the system to not execute setuid\nand setgid files with owner privileges. This option must be used for mounting\nany file system not containing approved setuid and setguid files. Executing\nfiles from untrusted file systems increases the opportunity for unprivileged\nusers to attain unauthorized administrative access."},{"label":"check","data":"Verify file systems that contain user home directories are\nmounted with the \"nosuid\" option.\n\nNote: If a separate file system has not been created for the user home\ndirectories (user home directories are mounted under \"/\"), this is not a\nfinding as the \"nosuid\" option cannot be used on the \"/\" system.\n\nFind the file system(s) that contain the user home directories with the\nfollowing command:\n\n# awk -F: '($3>=1000)&&($1!=\"nobody\"){print $1,$3,$6}' /etc/passwd\n\nsmithj:1001: /home/smithj\nrobinst:1002: /home/robinst\n\nCheck the file systems that are mounted at boot time with the following command:\n\n# more /etc/fstab\n\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home ext4\nrw,relatime,discard,data=ordered,nosuid 0 2\n\nIf a file system found in \"/etc/fstab\" refers to the user home directory file\nsystem and it does not have the \"nosuid\" option set, this is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"nosuid\" option on file\nsystems that contain user home directories for interactive users."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75575","rid":"SV-90255r2_rule","stig_id":"UBTU-16-010800","fix_id":"F-82203r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75575\" do\n  title \"File systems that contain user home directories must be mounted to\nprevent files with the setuid and setguid bit set from being executed.\"\n  desc  \"The \\\"nosuid\\\" mount option causes the system to not execute setuid\nand setgid files with owner privileges. This option must be used for mounting\nany file system not containing approved setuid and setguid files. Executing\nfiles from untrusted file systems increases the opportunity for unprivileged\nusers to attain unauthorized administrative access.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75575\"\n  tag \"rid\": \"SV-90255r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010800\"\n  tag \"fix_id\": \"F-82203r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify file systems that contain user home directories are\nmounted with the \\\"nosuid\\\" option.\n\nNote: If a separate file system has not been created for the user home\ndirectories (user home directories are mounted under \\\"/\\\"), this is not a\nfinding as the \\\"nosuid\\\" option cannot be used on the \\\"/\\\" system.\n\nFind the file system(s) that contain the user home directories with the\nfollowing command:\n\n# awk -F: '($3>=1000)&&($1!=\\\"nobody\\\"){print $1,$3,$6}' /etc/passwd\n\nsmithj:1001: /home/smithj\nrobinst:1002: /home/robinst\n\nCheck the file systems that are mounted at boot time with the following command:\n\n# more /etc/fstab\n\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home ext4\nrw,relatime,discard,data=ordered,nosuid 0 2\n\nIf a file system found in \\\"/etc/fstab\\\" refers to the user home directory file\nsystem and it does not have the \\\"nosuid\\\" option set, this is a finding.\"\n  desc \"fix\", \"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file\nsystems that contain user home directories for interactive users.\"\n\n  known_system_mount_points = input('known_system_mount_points')\n  fstab_mount_points = etc_fstab.entries.map(&:mount_point)\n  other_mount_points = fstab_mount_points - known_system_mount_points\n\n  if other_mount_points.count > 0\n    other_mount_points.each do |mount_point|\n      describe mount(mount_point) do\n        its('options') { should include 'nosuid' }\n      end\n    end\n  else\n    describe \"Separate file system has not been detected for the user home directories\" do\n      subject { other_mount_points }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75575.rb"},"results":[{"status":"passed","code_desc":"Separate file system has not been detected for the user home directories count should eq 0","run_time":6.9e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75757","title":"Successful/unsuccessful uses of the sudoedit command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"sudoedit\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w sudoedit /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"sudoedit\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75757","rid":"SV-90437r3_rule","stig_id":"UBTU-16-020660","fix_id":"F-82385r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75757\" do\n  title \"Successful/unsuccessful uses of the sudoedit command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75757\"\n  tag \"rid\": \"SV-90437r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020660\"\n  tag \"fix_id\": \"F-82385r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"sudoedit\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w sudoedit /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"sudoedit\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/sudoedit'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  \n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75757.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/sudoedit exist should equal true","run_time":9.0e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75617","title":"Audit records must contain information to establish what type of\nevents occurred, the source of events, where events occurred, and the outcome\nof events.","desc":"Without establishing what type of events occurred, the source of\nevents, where events occurred, and the outcome of events, it would be difficult\nto establish, correlate, and investigate the events leading up to an outage or\nattack.\n\n    Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n    Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack, recognizing resource\nutilization or capacity thresholds, or identifying an improperly configured\nUbuntu operating system.","descriptions":[{"label":"default","data":"Without establishing what type of events occurred, the source of\nevents, where events occurred, and the outcome of events, it would be difficult\nto establish, correlate, and investigate the events leading up to an outage or\nattack.\n\n    Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n    Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack, recognizing resource\nutilization or capacity thresholds, or identifying an improperly configured\nUbuntu operating system."},{"label":"check","data":"Verify the audit service is configured to produce audit\nrecords.\n\nCheck that the audit service is installed properly with the following command:\n\n# dpkg -l | grep auditd\n\nIf the \"auditd\" package is not installed, this is a finding.\n\nCheck that the audit service is properly running and active on the system with\nthe following command:\n\n# systemctl is-active auditd.service\nactive\n\nIf the command above returns \"inactive\", this is a finding."},{"label":"fix","data":"Configure the audit service to produce audit records containing\nthe information needed to establish when (date and time) an event occurred.\n\nInstall the audit service (if the audit service is not already installed) with\nthe following command:\n\n# sudo apt-get install auditd\n\nEnable the audit service with the following command:\n\n# sudo systemctl enable auditd.service\n\nRestart the audit service with the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000038-GPOS-00016","SRG-OS-000039-GPOS-00017","SRG-OS-000040-GPOS-00018","SRG-OS-000041-GPOS-00019","SRG-OS-000042-GPOS-00021","SRG-OS-000051-GPOS-00024","SRG-OS-000054-GPOS-00025","SRG-OS-000122-GPOS-00063","SRG-OS-000254-GPOS-00095","SRG-OS-000255-GPOS-00096","SRG-OS-000337-GPOS-00129","SRG-OS-000348-GPOS-00136","SRG-OS-000349-GPOS-00137","SRG-OS-000350-GPOS-00138","SRG-OS-000351-GPOS-00139","SRG-OS-000352-GPOS-00140","SRG-OS-000353-GPOS-00141","SRG-OS-000354-GPOS-00142","SRG-OS-000358-GPOS-00145","SRG-OS-000365-GPOS-00152","SRG-OS-000392-GPOS-00172","SRG-OS-000475-GPOS-00220"],"gid":"V-75617","rid":"SV-90297r1_rule","stig_id":"UBTU-16-020000","fix_id":"F-82245r1_fix","cci":["CCI-000130","CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-000135","CCI-000154","CCI-000158","CCI-000172","CCI-001464","CCI-001487","CCI-001814","CCI-001875","CCI-001876","CCI-001877","CCI-001878","CCI-001880","CCI-001914","CCI-002884"],"nist":["AU-3","AU-3","AU-3","AU-3","AU-3","AU-3 (1)","AU-6 (4)","AU-7 (1)","AU-12 c","AU-14 (1)","AU-3","CM-5 (1)","AU-7 a","AU-7 a","AU-7 a","AU-7 a","AU-7 a","AU-12 (3)","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75617\" do\n  title \"Audit records must contain information to establish what type of\nevents occurred, the source of events, where events occurred, and the outcome\nof events.\"\n  desc  \"Without establishing what type of events occurred, the source of\nevents, where events occurred, and the outcome of events, it would be difficult\nto establish, correlate, and investigate the events leading up to an outage or\nattack.\n\n    Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n    Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack, recognizing resource\nutilization or capacity thresholds, or identifying an improperly configured\nUbuntu operating system.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000038-GPOS-00016\",\n\"SRG-OS-000039-GPOS-00017\", \"SRG-OS-000040-GPOS-00018\",\n\"SRG-OS-000041-GPOS-00019\", \"SRG-OS-000042-GPOS-00021\",\n\"SRG-OS-000051-GPOS-00024\", \"SRG-OS-000054-GPOS-00025\",\n\"SRG-OS-000122-GPOS-00063\", \"SRG-OS-000254-GPOS-00095\",\n\"SRG-OS-000255-GPOS-00096\", \"SRG-OS-000337-GPOS-00129\",\n\"SRG-OS-000348-GPOS-00136\", \"SRG-OS-000349-GPOS-00137\",\n\"SRG-OS-000350-GPOS-00138\", \"SRG-OS-000351-GPOS-00139\",\n\"SRG-OS-000352-GPOS-00140\", \"SRG-OS-000353-GPOS-00141\",\n\"SRG-OS-000354-GPOS-00142\", \"SRG-OS-000358-GPOS-00145\",\n\"SRG-OS-000365-GPOS-00152\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000475-GPOS-00220\"]\n  tag \"gid\": \"V-75617\"\n  tag \"rid\": \"SV-90297r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020000\"\n  tag \"fix_id\": \"F-82245r1_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000131\", \"CCI-000132\", \"CCI-000133\",\n\"CCI-000134\", \"CCI-000135\", \"CCI-000154\", \"CCI-000158\", \"CCI-000172\",\n\"CCI-001464\", \"CCI-001487\", \"CCI-001814\", \"CCI-001875\", \"CCI-001876\",\n\"CCI-001877\", \"CCI-001878\", \"CCI-001880\", \"CCI-001914\", \"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3\", \"AU-3\", \"AU-3\", \"AU-3\", \"AU-3 (1)\", \"AU-6 (4)\",\n\"AU-7 (1)\", \"AU-12 c\", \"AU-14 (1)\", \"AU-3\", \"CM-5 (1)\", \"AU-7 a\", \"AU-7 a\",\n\"AU-7 a\", \"AU-7 a\", \"AU-7 a\", \"AU-12 (3)\", \"MA-4 (1) (a)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit service is configured to produce audit\nrecords.\n\nCheck that the audit service is installed properly with the following command:\n\n# dpkg -l | grep auditd\n\nIf the \\\"auditd\\\" package is not installed, this is a finding.\n\nCheck that the audit service is properly running and active on the system with\nthe following command:\n\n# systemctl is-active auditd.service\nactive\n\nIf the command above returns \\\"inactive\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit service to produce audit records containing\nthe information needed to establish when (date and time) an event occurred.\n\nInstall the audit service (if the audit service is not already installed) with\nthe following command:\n\n# sudo apt-get install auditd\n\nEnable the audit service with the following command:\n\n# sudo systemctl enable auditd.service\n\nRestart the audit service with the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe package('auditd') do\n    it { should be_installed }\n  end\n  describe service('auditd') do\n    it { should be_installed }\n    it { should be_enabled }\n    it { should be_running }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75617.rb"},"results":[{"status":"passed","code_desc":"System Package auditd should be installed","run_time":0.015832,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Service auditd should be installed","run_time":0.032747,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Service auditd should be enabled","run_time":0.000129,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Service auditd should be running","run_time":8.2e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75497","title":"The Ubuntu operating system must display the date and time of the last\nsuccessful account logon upon logon.","desc":"Providing users with feedback on when account accesses last occurred\nfacilitates user recognition and reporting of unauthorized account use.","descriptions":[{"label":"default","data":"Providing users with feedback on when account accesses last occurred\nfacilitates user recognition and reporting of unauthorized account use."},{"label":"check","data":"Verify users are provided with feedback on when account\naccesses last occurred.\n\nCheck that \"pam_lastlog\" is used and not silent with the following command:\n\n# grep pam_lastlog /etc/pam.d/login\n\nsession required pam_lastlog.so showfailed\n\nIf \"pam_lastlog\" is missing from \"/etc/pam.d/login\" file, or the \"silent\"\noption is present, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to provide users with\nfeedback on when account accesses last occurred by setting the required\nconfiguration options in \"/etc/pam.d/postlogin-ac\".\n\nAdd the following line to the top of \"/etc/pam.d/login\":\n\nsession required pam_lastlog.so showfailed"}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75497","rid":"SV-90177r1_rule","stig_id":"UBTU-16-010340","fix_id":"F-82125r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75497\" do\n  title \"The Ubuntu operating system must display the date and time of the last\nsuccessful account logon upon logon.\"\n  desc  \"Providing users with feedback on when account accesses last occurred\nfacilitates user recognition and reporting of unauthorized account use.\"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75497\"\n  tag \"rid\": \"SV-90177r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010340\"\n  tag \"fix_id\": \"F-82125r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify users are provided with feedback on when account\naccesses last occurred.\n\nCheck that \\\"pam_lastlog\\\" is used and not silent with the following command:\n\n# grep pam_lastlog /etc/pam.d/login\n\nsession required pam_lastlog.so showfailed\n\nIf \\\"pam_lastlog\\\" is missing from \\\"/etc/pam.d/login\\\" file, or the \\\"silent\\\"\noption is present, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to provide users with\nfeedback on when account accesses last occurred by setting the required\nconfiguration options in \\\"/etc/pam.d/postlogin-ac\\\".\n\nAdd the following line to the top of \\\"/etc/pam.d/login\\\":\n\nsession required pam_lastlog.so showfailed\"\n\n  describe file(\"/etc/pam.d/login\") do\n    it { should exist }\n  end\n\n  describe command(\"grep pam_lastlog /etc/pam.d/login\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should match /^\\s*session\\s+required\\s+pam_lastlog.so/ }\n    its('stdout.strip') { should_not match /^\\s*session\\s+required\\s+pam_lastlog.so[\\s\\w\\d\\=]+.*silent/ }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75497.rb"},"results":[{"status":"passed","code_desc":"File /etc/pam.d/login should exist","run_time":0.009195,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Command: `grep pam_lastlog /etc/pam.d/login` exit_status should eq 0","run_time":0.012928,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"failed","code_desc":"Command: `grep pam_lastlog /etc/pam.d/login` stdout.strip should match /^\\s*session\\s+required\\s+pam_lastlog.so/","run_time":0.00034,"start_time":"2019-08-06T11:13:31-04:00","message":"expected \"session    optional   pam_lastlog.so\" to match /^\\s*session\\s+required\\s+pam_lastlog.so/\nDiff:\n@@ -1,2 +1,2 @@\n-/^\\s*session\\s+required\\s+pam_lastlog.so/\n+\"session    optional   pam_lastlog.so\"\n"},{"status":"passed","code_desc":"Command: `grep pam_lastlog /etc/pam.d/login` stdout.strip should not match /^\\s*session\\s+required\\s+pam_lastlog.so[\\s\\w\\d\\=]+.*silent/","run_time":9.4e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75805","title":"An application firewall must be enabled on the system.","desc":"Firewalls protect computers from network attacks by blocking or\nlimiting access to open network ports. Application firewalls limit which\napplications are allowed to communicate over the network.","descriptions":[{"label":"default","data":"Firewalls protect computers from network attacks by blocking or\nlimiting access to open network ports. Application firewalls limit which\napplications are allowed to communicate over the network."},{"label":"check","data":"Verify the Uncomplicated Firewall is enabled on the system by\nrunning the following command:\n\n# sudo systemctl is-enabled ufw\n\nenabled\n\nIf the above command returns the status as \"disabled\", this is a finding.\n\nIf the Uncomplicated Firewall is not installed, ask the System Administrator if\nanother application firewall is installed. If no application firewall is\ninstalled this is a finding."},{"label":"fix","data":"Enable the Uncomplicated Firewall by using the following commands:\n\n# sudo systemctl start ufw\n\n# sudo systemctl enable ufw"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00232","gid":"V-75805","rid":"SV-90485r2_rule","stig_id":"UBTU-16-030040","fix_id":"F-82435r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75805\" do\n  title \"An application firewall must be enabled on the system.\"\n  desc  \"Firewalls protect computers from network attacks by blocking or\nlimiting access to open network ports. Application firewalls limit which\napplications are allowed to communicate over the network.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00232\"\n  tag \"gid\": \"V-75805\"\n  tag \"rid\": \"SV-90485r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030040\"\n  tag \"fix_id\": \"F-82435r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Uncomplicated Firewall is enabled on the system by\nrunning the following command:\n\n# sudo systemctl is-enabled ufw\n\nenabled\n\nIf the above command returns the status as \\\"disabled\\\", this is a finding.\n\nIf the Uncomplicated Firewall is not installed, ask the System Administrator if\nanother application firewall is installed. If no application firewall is\ninstalled this is a finding.\"\n  desc \"fix\", \"Enable the Uncomplicated Firewall by using the following commands:\n\n# sudo systemctl start ufw\n\n# sudo systemctl enable ufw\n\"\n\n  describe service('ufw') do\n    it { should be_installed }\n    it { should be_enabled }\n    it { should be_running }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75805.rb"},"results":[{"status":"passed","code_desc":"Service ufw should be installed","run_time":0.037592,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Service ufw should be enabled","run_time":0.000131,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Service ufw should be running","run_time":8.4e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75541","title":"The x86 Ctrl-Alt-Delete key sequence must be disabled.","desc":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the GNOME graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.","descriptions":[{"label":"default","data":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the GNOME graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken."},{"label":"check","data":"Verify the Ubuntu operating system is not configured to reboot\nthe system when Ctrl-Alt-Delete is pressed.\n\nCheck that the \"ctrl-alt-del.target\" (otherwise also known as reboot.target)\nis not active with the following command:\n\n# systemctl status ctrl-alt-del.target\nreboot.target - Reboot\n   Loaded: loaded (/usr/lib/systemd/system/reboot.target; disabled)\n   Active: inactive (dead)\n     Docs: man:systemd.special(7)\n\nIf the \"ctrl-alt-del.target\" is active, this is a finding."},{"label":"fix","data":"Configure the system to disable the Ctrl-Alt-Delete sequence for\nthe command line with the following command:\n\n# sudo systemctl mask ctrl-alt-del.target\n\nAnd reload the daemon to take effect\n\n# sudo systemctl daemon-reload\n\nIf GNOME is active on the system, create a database to contain the system-wide\nsetting (if it does not already exist) with the following command:\n\n# cat /etc/dconf/db/local.d/00-disable-CAD\n\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\n\n[org/gnome/settings-daemon/plugins/media-keys]\nlogout=’’"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75541","rid":"SV-90221r2_rule","stig_id":"UBTU-16-010630","fix_id":"F-82169r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75541\" do\n  title \"The x86 Ctrl-Alt-Delete key sequence must be disabled.\"\n  desc  \"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the GNOME graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75541\"\n  tag \"rid\": \"SV-90221r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010630\"\n  tag \"fix_id\": \"F-82169r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system is not configured to reboot\nthe system when Ctrl-Alt-Delete is pressed.\n\nCheck that the \\\"ctrl-alt-del.target\\\" (otherwise also known as reboot.target)\nis not active with the following command:\n\n# systemctl status ctrl-alt-del.target\nreboot.target - Reboot\n   Loaded: loaded (/usr/lib/systemd/system/reboot.target; disabled)\n   Active: inactive (dead)\n     Docs: man:systemd.special(7)\n\nIf the \\\"ctrl-alt-del.target\\\" is active, this is a finding.\"\n  desc \"fix\", \"Configure the system to disable the Ctrl-Alt-Delete sequence for\nthe command line with the following command:\n\n# sudo systemctl mask ctrl-alt-del.target\n\nAnd reload the daemon to take effect\n\n# sudo systemctl daemon-reload\n\nIf GNOME is active on the system, create a database to contain the system-wide\nsetting (if it does not already exist) with the following command:\n\n# cat /etc/dconf/db/local.d/00-disable-CAD\n\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\n\n[org/gnome/settings-daemon/plugins/media-keys]\nlogout=’’\"\n\n  describe service('ctrl-alt-del.target') do\n    it { should_not be_running }\n    it { should_not be_enabled }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75541.rb"},"results":[{"status":"passed","code_desc":"Service ctrl-alt-del.target should not be running","run_time":0.041874,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Service ctrl-alt-del.target should not be enabled","run_time":0.000133,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75893","title":"The Information System Security Officer (ISSO) and System\nAdministrator (SA) (at a minimum) must have mail aliases to be notified of an\naudit processing failure.","desc":"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n    Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n    This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.","descriptions":[{"label":"default","data":"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n    Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n    This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both."},{"label":"check","data":"Verify that the administrators are notified in the event of an\naudit processing failure.\n\nNote: If postfix is not installed, this is Not Applicable.\n\nCheck that the \"/etc/aliases\" file has a defined value for \"root\".\n\n# sudo grep \"postmaster: *root$\" /etc/aliases\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to notify administrators in\nthe event of an audit processing failure.\n\nAdd/update the following line in \"/etc/aliases\":\n\npostmaster: root"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000046-GPOS-00022","gid":"V-75893","rid":"SV-90573r2_rule","stig_id":"UBTU-16-030700","fix_id":"F-82523r1_fix","cci":["CCI-000139"],"nist":["AU-5 a","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75893\" do\n  title \"The Information System Security Officer (ISSO) and System\nAdministrator (SA) (at a minimum) must have mail aliases to be notified of an\naudit processing failure.\"\n  desc  \"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n    Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n    This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000046-GPOS-00022\"\n  tag \"gid\": \"V-75893\"\n  tag \"rid\": \"SV-90573r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030700\"\n  tag \"fix_id\": \"F-82523r1_fix\"\n  tag \"cci\": [\"CCI-000139\"]\n  tag \"nist\": [\"AU-5 a\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that the administrators are notified in the event of an\naudit processing failure.\n\nNote: If postfix is not installed, this is Not Applicable.\n\nCheck that the \\\"/etc/aliases\\\" file has a defined value for \\\"root\\\".\n\n# sudo grep \\\"postmaster: *root$\\\" /etc/aliases\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to notify administrators in\nthe event of an audit processing failure.\n\nAdd/update the following line in \\\"/etc/aliases\\\":\n\npostmaster: root\"\n\n  is_postfix_installed = package('postfix').installed?\n\n  if is_postfix_installed\n    describe command('grep \"postmaster: *root$\" /etc/aliases') do\n      its('stdout') { should_not be_empty }\n    end\n  else\n    describe \"Control Not Applicable as postfix is not installed\" do\n      subject { is_postfix_installed }\n      it { should be false }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75893.rb"},"results":[{"status":"passed","code_desc":"Control Not Applicable as postfix is not installed should equal false","run_time":9.6e-05,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75831","title":"The SSH daemon must be configured to only use Message Authentication\nCodes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.","desc":"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n    Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless.\n\n    Cryptographic mechanisms used for protecting the integrity of information\ninclude, for example, signed hash functions using asymmetric cryptography\nenabling distribution of the public key to verify the hash information while\nmaintaining the confidentiality of the secret key used to generate the hash.","descriptions":[{"label":"default","data":"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n    Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless.\n\n    Cryptographic mechanisms used for protecting the integrity of information\ninclude, for example, signed hash functions using asymmetric cryptography\nenabling distribution of the public key to verify the hash information while\nmaintaining the confidentiality of the secret key used to generate the hash."},{"label":"check","data":"Verify the SSH daemon is configured to only use Message\nAuthentication Codes (MACs) that employ FIPS 140-2 approved ciphers.\n\nCheck that the SSH daemon is configured to only use MACs that employ FIPS 140-2\napproved ciphers with the following command:\n\n# sudo grep -i macs /etc/ssh/sshd_config\nMACs hmac-sha2-256,hmac-sha2-512\n\nIf any ciphers other than \"hmac-sha2-256\" or \"hmac-sha2-512\" are listed, or\nthe retuned line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to allow the SSH daemon to\nonly use Message Authentication Codes (MACs) that employ FIPS 140-2 approved\nciphers.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the\n\"MACs\" keyword and set its value to \"hmac-sha2-256\" and/or\n\"hmac-sha2-512\":\n\nMACs hmac-sha2-256,hmac-sha2-512\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000250-GPOS-00093","satisfies":["SRG-OS-000250-GPOS-00093","SRG-OS-000393-GPOS-00173","SRG-OS-000394-GPOS-00174"],"gid":"V-75831","rid":"SV-90511r2_rule","stig_id":"UBTU-16-030240","fix_id":"F-82461r2_fix","cci":["CCI-001453","CCI-002890","CCI-003123"],"nist":["AC-17 (2)","MA-4 (6)","MA-4 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75831\" do\n  title \"The SSH daemon must be configured to only use Message Authentication\nCodes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.\"\n  desc  \"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n    Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless.\n\n    Cryptographic mechanisms used for protecting the integrity of information\ninclude, for example, signed hash functions using asymmetric cryptography\nenabling distribution of the public key to verify the hash information while\nmaintaining the confidentiality of the secret key used to generate the hash.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000250-GPOS-00093\"\n  tag \"satisfies\": [\"SRG-OS-000250-GPOS-00093\", \"SRG-OS-000393-GPOS-00173\",\n\"SRG-OS-000394-GPOS-00174\"]\n  tag \"gid\": \"V-75831\"\n  tag \"rid\": \"SV-90511r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030240\"\n  tag \"fix_id\": \"F-82461r2_fix\"\n  tag \"cci\": [\"CCI-001453\", \"CCI-002890\", \"CCI-003123\"]\n  tag \"nist\": [\"AC-17 (2)\", \"MA-4 (6)\", \"MA-4 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the SSH daemon is configured to only use Message\nAuthentication Codes (MACs) that employ FIPS 140-2 approved ciphers.\n\nCheck that the SSH daemon is configured to only use MACs that employ FIPS 140-2\napproved ciphers with the following command:\n\n# sudo grep -i macs /etc/ssh/sshd_config\nMACs hmac-sha2-256,hmac-sha2-512\n\nIf any ciphers other than \\\"hmac-sha2-256\\\" or \\\"hmac-sha2-512\\\" are listed, or\nthe retuned line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to allow the SSH daemon to\nonly use Message Authentication Codes (MACs) that employ FIPS 140-2 approved\nciphers.\n\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the\n\\\"MACs\\\" keyword and set its value to \\\"hmac-sha2-256\\\" and/or\n\\\"hmac-sha2-512\\\":\n\nMACs hmac-sha2-256,hmac-sha2-512\n\nThe SSH daemon must be restarted for the changes to take effect. To restart the\nSSH daemon, run the following command:\n\n# sudo systemctl restart sshd.service\"\n\n  @macs_array = inspec.sshd_config.params['macs']\n\n  unless @macs_array.nil?\n    @macs_array = @macs_array.first.split(\",\")\n  end\n\n  describe @macs_array do\n    it { should be_in ['hmac-sha2-256','hmac-sha2-512'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75831.rb"},"results":[{"status":"failed","code_desc":"should be in \"hmac-sha2-256\" and \"hmac-sha2-512\"","run_time":0.000146,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `` to be in the list: `[\"hmac-sha2-256\", \"hmac-sha2-512\"]`"}]},{"id":"V-75623","title":"The Ubuntu operating system must notify the System Administrator (SA)\nand Information System Security Officer (ISSO) (at a minimum) via email when\nallocated audit record storage volume reaches 75% of the repository maximum\naudit record storage capacity.","desc":"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.","descriptions":[{"label":"default","data":"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion."},{"label":"check","data":"Verify the Ubuntu operating system notifies the System\nAdministrator (SA) and Information System Security Officer (ISSO) (at a\nminimum) via email when allocated audit record storage volume reaches 75% of\nthe repository maximum audit record storage capacity.\n\nCheck that the Ubuntu operating system notifies the SA and ISSO (at a minimum)\nvia email when allocated audit record storage volume reaches 75% of the\nrepository maximum audit record storage capacity with the following commands:\n\n#sudo grep space_left_action /etc/audit/auditd.conf\n\nspace_left_action email\n\nIf the space_left_action is set to \"email\" check the value of the\n\"action_mail_acct\" parameter with the following command:\n\n#sudo grep action_mail_acct parameter /etc/audit/auditd.conf\n\naction_mail_acct parameter root@localhost\n\nIf the space_left_action or the action_mail_accnt parameters are set to blanks,\nthis is a finding.\n\nIf the space_left_action is set to \"syslog\", the system logs the event, this\nis not a finding.\n\nIf the space_left_action is set to \"exec\", the system executes a designated\nscript. If this script informs the SA of the event, this is not a finding.\n\nThe action_mail_acct parameter, if missing, defaults to \"root\". If the\n\"action_mail_acct parameter\" is not set to the e-mail address of the system\nadministrator(s) and/or ISSO, this is a finding.\n\nNote: If the email address of the system administrator is on a remote system a\nmail package must be available."},{"label":"fix","data":"Configure the operating system to immediately notify the SA and\nISSO (at a minimum) via email when allocated audit record storage volume\nreaches 75% of the repository maximum audit record storage capacity.\n\nEdit \"/etc/audit/auditd.conf\" and set the \"space_left_action\" parameter to\n\"exec\", \"email\", or \"syslog\". If the \"space_left_action\" parameter is\nset to \"email\" set the \"action_mail_acct\" parameter to an e-mail address\nfor the System Administrator (SA) and Information System Security Officer\n(ISSO)."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000343-GPOS-00134","gid":"V-75623","rid":"SV-90303r2_rule","stig_id":"UBTU-16-020030","fix_id":"F-82251r2_fix","cci":["CCI-001855"],"nist":["AU-5 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75623\" do\n  title \"The Ubuntu operating system must notify the System Administrator (SA)\nand Information System Security Officer (ISSO) (at a minimum) via email when\nallocated audit record storage volume reaches 75% of the repository maximum\naudit record storage capacity.\"\n  desc  \"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000343-GPOS-00134\"\n  tag \"gid\": \"V-75623\"\n  tag \"rid\": \"SV-90303r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020030\"\n  tag \"fix_id\": \"F-82251r2_fix\"\n  tag \"cci\": [\"CCI-001855\"]\n  tag \"nist\": [\"AU-5 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system notifies the System\nAdministrator (SA) and Information System Security Officer (ISSO) (at a\nminimum) via email when allocated audit record storage volume reaches 75% of\nthe repository maximum audit record storage capacity.\n\nCheck that the Ubuntu operating system notifies the SA and ISSO (at a minimum)\nvia email when allocated audit record storage volume reaches 75% of the\nrepository maximum audit record storage capacity with the following commands:\n\n#sudo grep space_left_action /etc/audit/auditd.conf\n\nspace_left_action email\n\nIf the space_left_action is set to \\\"email\\\" check the value of the\n\\\"action_mail_acct\\\" parameter with the following command:\n\n#sudo grep action_mail_acct parameter /etc/audit/auditd.conf\n\naction_mail_acct parameter root@localhost\n\nIf the space_left_action or the action_mail_accnt parameters are set to blanks,\nthis is a finding.\n\nIf the space_left_action is set to \\\"syslog\\\", the system logs the event, this\nis not a finding.\n\nIf the space_left_action is set to \\\"exec\\\", the system executes a designated\nscript. If this script informs the SA of the event, this is not a finding.\n\nThe action_mail_acct parameter, if missing, defaults to \\\"root\\\". If the\n\\\"action_mail_acct parameter\\\" is not set to the e-mail address of the system\nadministrator(s) and/or ISSO, this is a finding.\n\nNote: If the email address of the system administrator is on a remote system a\nmail package must be available.\"\n  desc \"fix\", \"Configure the operating system to immediately notify the SA and\nISSO (at a minimum) via email when allocated audit record storage volume\nreaches 75% of the repository maximum audit record storage capacity.\n\nEdit \\\"/etc/audit/auditd.conf\\\" and set the \\\"space_left_action\\\" parameter to\n\\\"exec\\\", \\\"email\\\", or \\\"syslog\\\". If the \\\"space_left_action\\\" parameter is\nset to \\\"email\\\" set the \\\"action_mail_acct\\\" parameter to an e-mail address\nfor the System Administrator (SA) and Information System Security Officer\n(ISSO).\"\n\n  space_left_action = auditd_conf.space_left_action\n  if space_left_action.casecmp?('email')\n    action_mail_acct = input('action_mail_acct')\n    describe auditd_conf do\n      its('action_mail_acct') { should cmp action_mail_acct}\n    end\n  else (space_left_action.casecmp?('syslog') || space_left_action.casecmp?('exec') )\n    describe.one do\n      describe auditd_conf do\n        its('space_left_action') { should cmp 'syslog'}\n      end\n      describe auditd_conf do\n        its('space_left_action') { should cmp 'exec'}\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75623.rb"},"results":[{"status":"passed","code_desc":"Audit Daemon Config space_left_action should cmp == \"syslog\"","run_time":0.000123,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75393","title":"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local or remote access to the system\nvia a graphical user logon.","desc":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \"I've read and consent to terms in IS user agreem't.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \"I've read and consent to terms in IS user agreem't.\""},{"label":"check","data":"Verify the Ubuntu operating system security patches and updates\nare installed and up to date. Updates are required to be applied with a\nfrequency determined by the site or Program Management Office (PMO).\n\nObtain the list of available package security updates from Ubuntu. The URL for\nupdates is https://www.Ubuntu.com/usn/. It is important to note that updates\nprovided by Ubuntu may not be present on the system if the underlying packages\nare not installed.\n\nCheck that the available package security updates have been installed on the\nsystem with the following command:\n\n# /usr/lib/update-notifier/apt-check --human-readable\n\n246 packages can be updated.\n0 updates are security updates.\n\nIf security package updates have not been performed on the system within the\ntimeframe that the site/program documentation requires, this is a finding.\n\nTypical update frequency may be overridden by Information Assurance\nVulnerability Alert (IAVA) notifications from JFHQ-DoDIN.\n\nIf the Ubuntu operating system is in non-compliance with the Information\nAssurance Vulnerability Management (IAVM) process, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the system.\n\nCreate a database that will contain the system wide graphical user logon\nsettings (if it does not already exist) with the following command:\n\n# sudo touch /etc/dconf/db/local.d/01-banner-message\n\nAdd the following line to the \"[org/gnome/login-screen]\" section of the\n\"/etc/dconf/db/local.d/01-banner-message\" file:\n\n[org/gnome/login-screen]\nbanner-message-enable=true"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000023-GPOS-00006","satisfies":["SRG-OS-000023-GPOS-00006","SRG-OS-000228-GPOS-00088"],"gid":"V-75393","rid":"SV-90073r2_rule","stig_id":"UBTU-16-010020","fix_id":"F-82021r1_fix","cci":["CCI-000048","CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"],"nist":["AC-8 a","AC-8 c 1","AC-8 c 2","AC-8 c 2","AC-8 c 2","AC-8\nc 3","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75393\" do\n  title \"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local or remote access to the system\nvia a graphical user logon.\"\n  desc  \"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n    System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n    The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for Ubuntu operating systems that can accommodate\nbanners of 1300 characters:\n\n    \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n    By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n    -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n    -At any time, the USG may inspect and seize data stored on this IS.\n\n    -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n    -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n    -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n    Use the following verbiage for Ubuntu operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n    \\\"I've read and consent to terms in IS user agreem't.\\\"\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000023-GPOS-00006\"\n  tag \"satisfies\": [\"SRG-OS-000023-GPOS-00006\", \"SRG-OS-000228-GPOS-00088\"]\n  tag \"gid\": \"V-75393\"\n  tag \"rid\": \"SV-90073r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010020\"\n  tag \"fix_id\": \"F-82021r1_fix\"\n  tag \"cci\": [\"CCI-000048\", \"CCI-001384\", \"CCI-001385\", \"CCI-001386\",\n\"CCI-001387\", \"CCI-001388\"]\n  tag \"nist\": [\"AC-8 a\", \"AC-8 c 1\", \"AC-8 c 2\", \"AC-8 c 2\", \"AC-8 c 2\", \"AC-8\nc 3\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system security patches and updates\nare installed and up to date. Updates are required to be applied with a\nfrequency determined by the site or Program Management Office (PMO).\n\nObtain the list of available package security updates from Ubuntu. The URL for\nupdates is https://www.Ubuntu.com/usn/. It is important to note that updates\nprovided by Ubuntu may not be present on the system if the underlying packages\nare not installed.\n\nCheck that the available package security updates have been installed on the\nsystem with the following command:\n\n# /usr/lib/update-notifier/apt-check --human-readable\n\n246 packages can be updated.\n0 updates are security updates.\n\nIf security package updates have not been performed on the system within the\ntimeframe that the site/program documentation requires, this is a finding.\n\nTypical update frequency may be overridden by Information Assurance\nVulnerability Alert (IAVA) notifications from JFHQ-DoDIN.\n\nIf the Ubuntu operating system is in non-compliance with the Information\nAssurance Vulnerability Management (IAVM) process, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the system.\n\nCreate a database that will contain the system wide graphical user logon\nsettings (if it does not already exist) with the following command:\n\n# sudo touch /etc/dconf/db/local.d/01-banner-message\n\nAdd the following line to the \\\"[org/gnome/login-screen]\\\" section of the\n\\\"/etc/dconf/db/local.d/01-banner-message\\\" file:\n\n[org/gnome/login-screen]\nbanner-message-enable=true\"\n\n  describe command('/usr/lib/update-notifier/apt-check --human-readable') do\n    its('exit_status') { should cmp 0 }\n    its('stdout') { should match '^0 updates are security updates.$' }\n  end\n\n  describe 'banner-message-enable must be set to true' do\n    subject { command('grep banner-message-enable /etc/dconf/db/local.d/*') }\n    its('stdout') { should match %r((banner-message-enable).+=.+(true)) }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75393.rb"},"results":[{"status":"passed","code_desc":"Command: `/usr/lib/update-notifier/apt-check --human-readable` exit_status should cmp == 0","run_time":0.000125,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Command: `/usr/lib/update-notifier/apt-check --human-readable` stdout should match \"^0 updates are security updates.$\"","run_time":9.7e-05,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"failed","code_desc":"banner-message-enable must be set to true stdout should match /(banner-message-enable).+=.+(true)/","run_time":0.009634,"start_time":"2019-08-06T11:13:31-04:00","message":"expected \"\" to match /(banner-message-enable).+=.+(true)/\nDiff:\n@@ -1,2 +1,2 @@\n-/(banner-message-enable).+=.+(true)/\n+\"\"\n"}]},{"id":"V-75729","title":"Successful/unsuccessful uses of the chown command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"chown\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w chown /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chown\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75729","rid":"SV-90409r3_rule","stig_id":"UBTU-16-020520","fix_id":"F-82357r3_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75729\" do\n  title \"Successful/unsuccessful uses of the chown command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75729\"\n  tag \"rid\": \"SV-90409r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020520\"\n  tag \"fix_id\": \"F-82357r3_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"chown\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w chown /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chown\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"chown\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75729.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"chown\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000143,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"chown\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000103,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75739","title":"Successful/unsuccessful uses of the fchmod command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"fchmod\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w fchmod /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchmod\" command by adding the following\nline to \"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75739","rid":"SV-90419r3_rule","stig_id":"UBTU-16-020570","fix_id":"F-82367r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75739\" do\n  title \"Successful/unsuccessful uses of the fchmod command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75739\"\n  tag \"rid\": \"SV-90419r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020570\"\n  tag \"fix_id\": \"F-82367r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"fchmod\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w fchmod /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchmod\\\" command by adding the following\nline to \\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"fchmod\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75739.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchmod\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000103,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"fchmod\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":9.8e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75599","title":"The /var/log/syslog file must be group-owned by adm.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify the \"/var/log/syslog\" file is group-owned by \"adm\".\n\nCheck that \"/var/log/syslog\" is group-owned by \"adm\" with the following\ncommand:\n\n# ls -la /var/log/syslog | cut -d' ' -f4\n\nadm\n\nIf \"adm\" is not returned as a result, this is a finding."},{"label":"fix","data":"Change the group of the file \"/var/log/syslog\" to \"adm\" by\nrunning the following command:\n\n# sudo chgrp adm /var/log/syslog"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75599","rid":"SV-90279r2_rule","stig_id":"UBTU-16-010970","fix_id":"F-82227r2_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75599\" do\n  title \"The /var/log/syslog file must be group-owned by adm.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75599\"\n  tag \"rid\": \"SV-90279r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010970\"\n  tag \"fix_id\": \"F-82227r2_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the \\\"/var/log/syslog\\\" file is group-owned by \\\"adm\\\".\n\nCheck that \\\"/var/log/syslog\\\" is group-owned by \\\"adm\\\" with the following\ncommand:\n\n# ls -la /var/log/syslog | cut -d' ' -f4\n\nadm\n\nIf \\\"adm\\\" is not returned as a result, this is a finding.\"\n  desc \"fix\", \"Change the group of the file \\\"/var/log/syslog\\\" to \\\"adm\\\" by\nrunning the following command:\n\n# sudo chgrp adm /var/log/syslog\"\n\n  describe file('/var/log/syslog') do\n    its('group') { should cmp 'adm' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75599.rb"},"results":[{"status":"passed","code_desc":"File /var/log/syslog group should cmp == \"adm\"","run_time":0.000123,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75659","title":"The audit event multiplexor must be configured to off-load audit logs\nonto a different system or storage media from the system being audited.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity."},{"label":"check","data":"Verify the audit event multiplexor is configured to off-load\naudit records to a different system or storage media from the system being\naudited.\n\nCheck that the records are being off-loaded to a remote server with the\nfollowing command:\n\n# sudo grep -i active /etc/audisp/plugins.d/au-remote.conf\n\nactive = yes\n\nIf \"active\" is not set to \"yes\", or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit event multiplexor to off-load audit records\nto a different system or storage media from the system being audited.\n\nSet the \"active\" option in \"/etc/audisp/plugins.d/au-remote.conf\" to\n\"yes\":\n\nactive = yes\n\nIn order for the changes to take effect, the audit daemon must be restarted.\nThe audit daemon can be restarted with the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000479-GPOS-00224","gid":"V-75659","rid":"SV-90339r2_rule","stig_id":"UBTU-16-020210","fix_id":"F-82287r2_fix","cci":["CCI-001851"],"nist":["AU-4 (1)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75659\" do\n  title \"The audit event multiplexor must be configured to off-load audit logs\nonto a different system or storage media from the system being audited.\"\n  desc  \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n    Off-loading is a common process in information systems with limited audit\nstorage capacity.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000479-GPOS-00224\"\n  tag \"gid\": \"V-75659\"\n  tag \"rid\": \"SV-90339r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020210\"\n  tag \"fix_id\": \"F-82287r2_fix\"\n  tag \"cci\": [\"CCI-001851\"]\n  tag \"nist\": [\"AU-4 (1)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit event multiplexor is configured to off-load\naudit records to a different system or storage media from the system being\naudited.\n\nCheck that the records are being off-loaded to a remote server with the\nfollowing command:\n\n# sudo grep -i active /etc/audisp/plugins.d/au-remote.conf\n\nactive = yes\n\nIf \\\"active\\\" is not set to \\\"yes\\\", or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit event multiplexor to off-load audit records\nto a different system or storage media from the system being audited.\n\nSet the \\\"active\\\" option in \\\"/etc/audisp/plugins.d/au-remote.conf\\\" to\n\\\"yes\\\":\n\nactive = yes\n\nIn order for the changes to take effect, the audit daemon must be restarted.\nThe audit daemon can be restarted with the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  config_file_exists = file('/etc/audisp/plugins.d/au-remote.conf').exist?\n\n  if config_file_exists\n    describe parse_config_file('/etc/audisp/plugins.d/au-remote.conf') do\n      its('active') { should cmp 'yes' }\n    end\n  else\n    describe \"/etc/audisp/plugins.d/au-remote.conf exists\" do\n      subject { config_file_exists }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75659.rb"},"results":[{"status":"failed","code_desc":"/etc/audisp/plugins.d/au-remote.conf exists should equal true","run_time":9.5e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75719","title":"The audit system must be configured to audit any usage of the\nlsetxattr system call.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \"lsetxattr\" system call, by running the following\ncommand:\n\n# sudo grep -w lsetxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe \"lsetxattr\" system call, by adding the following lines to\n\"/etc/audit/audit.rules\":\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000458-GPOS-00203","SRG-OS-000462-GPOS-00206","SRG-OS-000463-GPOS-00207","SRG-OS-000471-GPOS-00215","SRG-OS-000474-GPOS-00219"],"gid":"V-75719","rid":"SV-90399r2_rule","stig_id":"UBTU-16-020470","fix_id":"F-82347r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75719\" do\n  title \"The audit system must be configured to audit any usage of the\nlsetxattr system call.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000458-GPOS-00203\", \"SRG-OS-000462-GPOS-00206\",\n\"SRG-OS-000463-GPOS-00207\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000474-GPOS-00219\"]\n  tag \"gid\": \"V-75719\"\n  tag \"rid\": \"SV-90399r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020470\"\n  tag \"fix_id\": \"F-82347r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the \\\"lsetxattr\\\" system call, by running the following\ncommand:\n\n# sudo grep -w lsetxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe \\\"lsetxattr\\\" system call, by adding the following lines to\n\\\"/etc/audit/audit.rules\\\":\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"lsetxattr\").where {arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75719.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"lsetxattr\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000103,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"lsetxattr\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":9.5e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"}]},{"id":"V-75709","title":"The audit system must be configured to audit any usage of the insmod\ncommand.","desc":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.","descriptions":[{"label":"default","data":"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions."},{"label":"check","data":"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \"insmod\", by running the\nfollowing command:\n\n# sudo grep \"/sbin/insmod\" /etc/audit/audit.rules\n\n-w /sbin/insmod -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the Ubuntu operating system to audit the execution of\nthe module management program \"insmod\", by adding the following line to\n\"/etc/audit/audit.rules\":\n\n-w /sbin/insmod -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215","SRG-OS-000471-GPOS-00216","SRG-OS-000477-GPOS-00222"],"gid":"V-75709","rid":"SV-90389r2_rule","stig_id":"UBTU-16-020420","fix_id":"F-82337r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75709\" do\n  title \"The audit system must be configured to audit any usage of the insmod\ncommand.\"\n  desc  \"Without the capability to generate audit records, it would be\ndifficult to establish, correlate, and investigate the events relating to an\nincident or identify those responsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n    The list of audited events is the set of events for which audits are to be\ngenerated. This set of events is typically a subset of the list of all events\nfor which the system is capable of generating audit records.\n\n    DoD has defined the list of events for which the Ubuntu operating system\nwill provide an audit record generation capability as the following:\n\n    1) Successful and unsuccessful attempts to access, modify, or delete\nprivileges, security objects, security levels, or categories of information\n(e.g., classification levels);\n\n    2) Access actions, such as successful and unsuccessful logon attempts,\nprivileged activities or other system-level access, starting and ending time\nfor user access to the system, concurrent logons from different workstations,\nsuccessful and unsuccessful accesses to objects, all program initiations, and\nall direct access to the information system;\n\n    3) All account creations, modifications, disabling, and terminations; and\n\n    4) All kernel module load, unload, and restart actions.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\",\n\"SRG-OS-000471-GPOS-00216\", \"SRG-OS-000477-GPOS-00222\"]\n  tag \"gid\": \"V-75709\"\n  tag \"rid\": \"SV-90389r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020420\"\n  tag \"fix_id\": \"F-82337r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify if the Ubuntu operating system is configured to audit\nthe execution of the module management program \\\"insmod\\\", by running the\nfollowing command:\n\n# sudo grep \\\"/sbin/insmod\\\" /etc/audit/audit.rules\n\n-w /sbin/insmod -p x -k modules\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to audit the execution of\nthe module management program \\\"insmod\\\", by adding the following line to\n\\\"/etc/audit/audit.rules\\\":\n\n-w /sbin/insmod -p x -k modules\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/sbin/insmod'\n  \n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n      end\n    \n      # Resource creates data structure including all usages of file\n      @perms = auditd.file(@audit_file).permissions\n    \n      @perms.each do |perm|\n        describe perm do\n          it { should include 'x' }\n        end\n      end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75709.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /sbin/insmod exist should equal true","run_time":8.0e-05,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75649","title":"The audit log files must be owned by root.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":[{"label":"default","data":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements."},{"label":"check","data":"Verify the audit log files are owned by \"root\".\n\nCheck where the audit logs are stored on the system using the following command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \"[log_path]\" in the\nfollowing command:\n\n# sudo ls -la [log_path] | cut -d' ' -f3\nroot\n\nIf the audit logs are not group-owned by \"root\", this is a finding."},{"label":"fix","data":"Change the owner of the audit log file by running the following\ncommand:\n\nUse the following command to get the audit log path:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \"[log_path]\" in the\nfollowing command:\n\n# sudo chown root [log_path]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-75649","rid":"SV-90329r2_rule","stig_id":"UBTU-16-020160","fix_id":"F-82277r2_fix","cci":["CCI-001314"],"nist":["SI-11 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75649\" do\n  title \"The audit log files must be owned by root.\"\n  desc  \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the Ubuntu operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n    The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000206-GPOS-00084\"\n  tag \"gid\": \"V-75649\"\n  tag \"rid\": \"SV-90329r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020160\"\n  tag \"fix_id\": \"F-82277r2_fix\"\n  tag \"cci\": [\"CCI-001314\"]\n  tag \"nist\": [\"SI-11 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit log files are owned by \\\"root\\\".\n\nCheck where the audit logs are stored on the system using the following command:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \\\"[log_path]\\\" in the\nfollowing command:\n\n# sudo ls -la [log_path] | cut -d' ' -f3\nroot\n\nIf the audit logs are not group-owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Change the owner of the audit log file by running the following\ncommand:\n\nUse the following command to get the audit log path:\n\n# sudo grep log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the audit log path from the command above, replace \\\"[log_path]\\\" in the\nfollowing command:\n\n# sudo chown root [log_path]\"\n\n  log_file_path = auditd_conf.log_file\n\n  describe file(log_file_path) do\n    its('owner') { should cmp 'root' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75649.rb"},"results":[{"status":"passed","code_desc":"File /var/log/audit/audit.log owner should cmp == \"root\"","run_time":0.000104,"start_time":"2019-08-06T11:13:31-04:00"}]},{"id":"V-75589","title":"The Ubuntu operating system must use a separate file system for /var.","desc":"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing."},{"label":"check","data":"Verify that a separate file system/partition has been created\nfor \"/var\".\n\nCheck that a file system/partition has been created for \"/var\" with the\nfollowing command:\n\n# grep /var /etc/fstab\nUUID=c274f65f /var ext4 noatime,nobarrier 1 2\n\nIf a separate entry for \"/var\" is not in use, this is a finding."},{"label":"fix","data":"Migrate the \"/var\" path onto a separate file system."}],"impact":0.3,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75589","rid":"SV-90269r1_rule","stig_id":"UBTU-16-010920","fix_id":"F-82217r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75589\" do\n  title \"The Ubuntu operating system must use a separate file system for /var.\"\n  desc  \"The use of separate file systems for different paths can protect the\nsystem from failures resulting from a file system becoming full or failing.\"\n  impact 0.3\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75589\"\n  tag \"rid\": \"SV-90269r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010920\"\n  tag \"fix_id\": \"F-82217r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that a separate file system/partition has been created\nfor \\\"/var\\\".\n\nCheck that a file system/partition has been created for \\\"/var\\\" with the\nfollowing command:\n\n# grep /var /etc/fstab\nUUID=c274f65f /var ext4 noatime,nobarrier 1 2\n\nIf a separate entry for \\\"/var\\\" is not in use, this is a finding.\"\n  desc \"fix\", \"Migrate the \\\"/var\\\" path onto a separate file system.\"\n\n  describe mount('/var') do\n    it { should be_mounted }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75589.rb"},"results":[{"status":"failed","code_desc":"Mount /var should be mounted","run_time":0.010654,"start_time":"2019-08-06T11:13:31-04:00","message":"\nMount /var is not mounted\n"}]},{"id":"V-80969","title":"Successful/unsuccessful uses of the chcon command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w chcon /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chcon\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","gid":"V-80969","rid":"SV-95681r1_rule","stig_id":"UBTU-16-020690","fix_id":"F-87829r1_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-80969\" do\n  title \"Successful/unsuccessful uses of the chcon command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"gid\": \"V-80969\"\n  tag \"rid\": \"SV-95681r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020690\"\n  tag \"fix_id\": \"F-87829r1_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w chcon /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chcon\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/chcon'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-80969.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/chcon exist should equal true","run_time":0.000148,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75609","title":"Library files must be group-owned by root.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":[{"label":"default","data":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications."},{"label":"check","data":"Verify the system-wide shared library files contained in the\nfollowing directories are group-owned by \"root\".\n\nCheck that the system-wide shared library files are group-owned by \"root\"\nwith the following command:\n\n# sudo find /lib /usr/lib /lib64 ! -group root | xargs ls -la\n\nIf any system wide shared library file is returned, this is a finding."},{"label":"fix","data":"Configure the library files to be protected from unauthorized\naccess.\n\nRun the following command, replacing \"[FILE]\" with any library file not\ngroup-owned by root.\n\n# sudo chgrp root [FILE]"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-75609","rid":"SV-90289r2_rule","stig_id":"UBTU-16-011020","fix_id":"F-82237r2_fix","cci":["CCI-001499"],"nist":["CM-5 (6)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75609\" do\n  title \"Library files must be group-owned by root.\"\n  desc  \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n    This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals shall be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000259-GPOS-00100\"\n  tag \"gid\": \"V-75609\"\n  tag \"rid\": \"SV-90289r2_rule\"\n  tag \"stig_id\": \"UBTU-16-011020\"\n  tag \"fix_id\": \"F-82237r2_fix\"\n  tag \"cci\": [\"CCI-001499\"]\n  tag \"nist\": [\"CM-5 (6)\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the system-wide shared library files contained in the\nfollowing directories are group-owned by \\\"root\\\".\n\nCheck that the system-wide shared library files are group-owned by \\\"root\\\"\nwith the following command:\n\n# sudo find /lib /usr/lib /lib64 ! -group root | xargs ls -la\n\nIf any system wide shared library file is returned, this is a finding.\"\n  desc \"fix\", \"Configure the library files to be protected from unauthorized\naccess.\n\nRun the following command, replacing \\\"[FILE]\\\" with any library file not\ngroup-owned by root.\n\n# sudo chgrp root [FILE]\"\n\n  library_files = command('find /lib /usr/lib /lib64 ! \\-group root').stdout.strip.split(\"\\n\").entries\n\n  if library_files.count > 0\n    library_files.each do |lib_file|\n      describe file(lib_file) do\n        its('group') { should cmp 'root' }\n      end\n    end\n  else\n    describe \"Number of system-wide shared library files found found in /lib, /lib64, or /usr/lib, that are NOT group-owned by root\" do\n      subject { library_files }\n      its('count') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75609.rb"},"results":[{"status":"failed","code_desc":"File /usr/lib/dbus-1.0/dbus-daemon-launch-helper group should cmp == \"root\"","run_time":0.009714,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: \"root\"\n     got: \"messagebus\"\n\n(compared using `cmp` matcher)\n"},{"status":"failed","code_desc":"File /usr/lib/x86_64-linux-gnu/utempter/utempter group should cmp == \"root\"","run_time":0.009292,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: \"root\"\n     got: \"utmp\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75749","title":"Successful/unsuccessful uses of the creat command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"creat\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -iw creat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"creat\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75749","rid":"SV-90429r3_rule","stig_id":"UBTU-16-020620","fix_id":"F-82377r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75749\" do\n  title \"Successful/unsuccessful uses of the creat command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75749\"\n  tag \"rid\": \"SV-90429r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020620\"\n  tag \"fix_id\": \"F-82377r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"creat\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -iw creat /etc/audit/audit.rules\n\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"creat\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  describe auditd.syscall(\"creat\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EPERM' }\n  end\n  describe auditd.syscall(\"creat\").where{arch == \"b64\"} do\n    its('action.uniq') { should eq ['always'] }\n    its('list.uniq') { should eq ['exit'] }\n    its('exit.uniq') { should include '-EACCES' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75749.rb"},"results":[{"status":"failed","code_desc":"Auditd Rules with syscall == \"creat\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.00017,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"creat\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000112,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"creat\" arch == \"b64\" exit.uniq should include \"-EPERM\"","run_time":0.000138,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EPERM\""},{"status":"failed","code_desc":"Auditd Rules with syscall == \"creat\" arch == \"b64\" action.uniq should eq [\"always\"]","run_time":0.000109,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"always\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"creat\" arch == \"b64\" list.uniq should eq [\"exit\"]","run_time":0.000104,"start_time":"2019-08-06T11:13:31-04:00","message":"\nexpected: [\"exit\"]\n     got: []\n\n(compared using ==)\n"},{"status":"failed","code_desc":"Auditd Rules with syscall == \"creat\" arch == \"b64\" exit.uniq should include \"-EACCES\"","run_time":0.000116,"start_time":"2019-08-06T11:13:31-04:00","message":"expected [] to include \"-EACCES\""}]},{"id":"V-75489","title":"The Ubuntu operating system must require users to re-authenticate for\nprivilege escalation and changing roles.","desc":"Without re-authentication, users may access resources or perform tasks\nfor which they do not have authorization.\n\n    When Ubuntu operating systems provide the capability to escalate a\nfunctional capability or change security roles, it is critical the user\nre-authenticate.","descriptions":[{"label":"default","data":"Without re-authentication, users may access resources or perform tasks\nfor which they do not have authorization.\n\n    When Ubuntu operating systems provide the capability to escalate a\nfunctional capability or change security roles, it is critical the user\nre-authenticate."},{"label":"check","data":"Verify that \"/etc/sudoers\" has no occurrences of \"NOPASSWD\"\nor \"!authenticate\".\n\nCheck that the \"/etc/sudoers\" file has no occurrences of \"NOPASSWD\" or\n\"!authenticate\" by running the following command:\n\n# sudo egrep -i '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/*\n\n%wheel ALL=(ALL) NOPASSWD: ALL\n\nIf any occurrences of \"NOPASSWD\" or \"!authenticate\" return from the\ncommand, this is a finding."},{"label":"fix","data":"Remove any occurrence of \"NOPASSWD\" or \"!authenticate\" found\nin \"/etc/sudoers\" file or files in the \"/etc/sudoers.d\" directory."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000373-GPOS-00156","satisfies":["SRG-OS-000373-GPOS-00156","SRG-OS-000373-GPOS-00157"],"gid":"V-75489","rid":"SV-90169r2_rule","stig_id":"UBTU-16-010300","fix_id":"F-82117r2_fix","cci":["CCI-002038"],"nist":["IA-11","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75489\" do\n  title \"The Ubuntu operating system must require users to re-authenticate for\nprivilege escalation and changing roles.\"\n  desc  \"Without re-authentication, users may access resources or perform tasks\nfor which they do not have authorization.\n\n    When Ubuntu operating systems provide the capability to escalate a\nfunctional capability or change security roles, it is critical the user\nre-authenticate.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000373-GPOS-00156\"\n  tag \"satisfies\": [\"SRG-OS-000373-GPOS-00156\", \"SRG-OS-000373-GPOS-00157\"]\n  tag \"gid\": \"V-75489\"\n  tag \"rid\": \"SV-90169r2_rule\"\n  tag \"stig_id\": \"UBTU-16-010300\"\n  tag \"fix_id\": \"F-82117r2_fix\"\n  tag \"cci\": [\"CCI-002038\"]\n  tag \"nist\": [\"IA-11\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that \\\"/etc/sudoers\\\" has no occurrences of \\\"NOPASSWD\\\"\nor \\\"!authenticate\\\".\n\nCheck that the \\\"/etc/sudoers\\\" file has no occurrences of \\\"NOPASSWD\\\" or\n\\\"!authenticate\\\" by running the following command:\n\n# sudo egrep -i '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/*\n\n%wheel ALL=(ALL) NOPASSWD: ALL\n\nIf any occurrences of \\\"NOPASSWD\\\" or \\\"!authenticate\\\" return from the\ncommand, this is a finding.\"\n  desc \"fix\", \"Remove any occurrence of \\\"NOPASSWD\\\" or \\\"!authenticate\\\" found\nin \\\"/etc/sudoers\\\" file or files in the \\\"/etc/sudoers.d\\\" directory.\"\n\n  describe command(\"sudo egrep -r -i '(nopasswd|!authenticate)' /etc/sudoers.d/ /etc/sudoers\") do\n    its('stdout.strip') { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75489.rb"},"results":[{"status":"failed","code_desc":"Command: `sudo egrep -r -i '(nopasswd|!authenticate)' /etc/sudoers.d/ /etc/sudoers` stdout.strip should be empty","run_time":0.013876,"start_time":"2019-08-06T11:13:31-04:00","message":"expected `\"/etc/sudoers.d/99_vagrant:vagrant ALL=(ALL) NOPASSWD:ALL\".empty?` to return true, got false"}]},{"id":"V-75499","title":"There must be no .shosts files on the Ubuntu operating system.","desc":"The .shosts files are used to configure host-based authentication for\nindividual users or the system via SSH. Host-based authentication is not\nsufficient for preventing unauthorized access to the system, as it does not\nrequire interactive identification and authentication of a connection request,\nor for the use of two-factor authentication.","descriptions":[{"label":"default","data":"The .shosts files are used to configure host-based authentication for\nindividual users or the system via SSH. Host-based authentication is not\nsufficient for preventing unauthorized access to the system, as it does not\nrequire interactive identification and authentication of a connection request,\nor for the use of two-factor authentication."},{"label":"check","data":"Verify there are no \".shosts\" files on the Ubuntu operating\nsystem.\n\nCheck the system for the existence of these files with the following command:\n\n# sudo find / -name '*.shosts'\n\nIf any \".shosts\" files are found, this is a finding."},{"label":"fix","data":"Remove any found \".shosts\" files from the Ubuntu operating\nsystem.\n\n# rm /[path]/[to]/[file]/.shosts"}],"impact":0.7,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75499","rid":"SV-90179r1_rule","stig_id":"UBTU-16-010350","fix_id":"F-82127r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75499\" do\n  title \"There must be no .shosts files on the Ubuntu operating system.\"\n  desc  \"The .shosts files are used to configure host-based authentication for\nindividual users or the system via SSH. Host-based authentication is not\nsufficient for preventing unauthorized access to the system, as it does not\nrequire interactive identification and authentication of a connection request,\nor for the use of two-factor authentication.\"\n  impact 0.7\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75499\"\n  tag \"rid\": \"SV-90179r1_rule\"\n  tag \"stig_id\": \"UBTU-16-010350\"\n  tag \"fix_id\": \"F-82127r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify there are no \\\".shosts\\\" files on the Ubuntu operating\nsystem.\n\nCheck the system for the existence of these files with the following command:\n\n# sudo find / -name '*.shosts'\n\nIf any \\\".shosts\\\" files are found, this is a finding.\"\n  desc \"fix\", \"Remove any found \\\".shosts\\\" files from the Ubuntu operating\nsystem.\n\n# rm /[path]/[to]/[file]/.shosts\"\n\n  describe command(\"sudo find / -name '*.shosts'\") do\n    its('exit_status') { should eq 0 }\n    its('stdout.strip') { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75499.rb"},"results":[{"status":"passed","code_desc":"Command: `sudo find / -name '*.shosts'` exit_status should eq 0","run_time":0.590306,"start_time":"2019-08-06T11:13:31-04:00"},{"status":"passed","code_desc":"Command: `sudo find / -name '*.shosts'` stdout.strip should be empty","run_time":0.000127,"start_time":"2019-08-06T11:13:32-04:00"}]},{"id":"V-75759","title":"Successful/unsuccessful uses of the chsh command must generate an\naudit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w chsh /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chsh\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75759","rid":"SV-90439r3_rule","stig_id":"UBTU-16-020670","fix_id":"F-82387r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75759\" do\n  title \"Successful/unsuccessful uses of the chsh command must generate an\naudit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75759\"\n  tag \"rid\": \"SV-90439r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020670\"\n  tag \"fix_id\": \"F-82387r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w chsh /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chsh\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/chsh'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75759.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/chsh exist should equal true","run_time":0.000127,"start_time":"2019-08-06T11:13:32-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-80959","title":"The auditd service must be running in the Ubuntu operating system.","desc":"Configuring the Ubuntu operating system to implement organization-wide\nsecurity implementation guides and security checklists ensures compliance with\nfederal standards and establishes a common security baseline across DoD that\nreflects the most restrictive security posture consistent with operational\nrequirements.\n\n    Configuration settings are the set of parameters that can be changed in\nhardware, software, or firmware components of the system that affect the\nsecurity posture and/or functionality of the system. Security-related\nparameters are those parameters impacting the security state of the system,\nincluding the parameters required to satisfy other security control\nrequirements. Security-related parameters include, for example: registry\nsettings; account, file, directory permission settings; and settings for\nfunctions, ports, protocols, services, and remote connections.","descriptions":[{"label":"default","data":"Configuring the Ubuntu operating system to implement organization-wide\nsecurity implementation guides and security checklists ensures compliance with\nfederal standards and establishes a common security baseline across DoD that\nreflects the most restrictive security posture consistent with operational\nrequirements.\n\n    Configuration settings are the set of parameters that can be changed in\nhardware, software, or firmware components of the system that affect the\nsecurity posture and/or functionality of the system. Security-related\nparameters are those parameters impacting the security state of the system,\nincluding the parameters required to satisfy other security control\nrequirements. Security-related parameters include, for example: registry\nsettings; account, file, directory permission settings; and settings for\nfunctions, ports, protocols, services, and remote connections."},{"label":"check","data":"Verify the audit service is active.\n\nCheck that the audit service is active with the following command:\n\n# service auditd status\nActive: active (running)\n\nIf the service is not active this is a finding."},{"label":"fix","data":"Start the auditd service, and enable the auditd service with the\nfollowing commands:\n\nStart the audit service.\n# systemctl start auditd.service\n\nEnable auditd in the targets of the system.\n# systemctl enable auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-80959","rid":"SV-95671r1_rule","stig_id":"UBTU-16-020010","fix_id":"F-87819r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-80959\" do\n  title \"The auditd service must be running in the Ubuntu operating system.\"\n  desc  \"Configuring the Ubuntu operating system to implement organization-wide\nsecurity implementation guides and security checklists ensures compliance with\nfederal standards and establishes a common security baseline across DoD that\nreflects the most restrictive security posture consistent with operational\nrequirements.\n\n    Configuration settings are the set of parameters that can be changed in\nhardware, software, or firmware components of the system that affect the\nsecurity posture and/or functionality of the system. Security-related\nparameters are those parameters impacting the security state of the system,\nincluding the parameters required to satisfy other security control\nrequirements. Security-related parameters include, for example: registry\nsettings; account, file, directory permission settings; and settings for\nfunctions, ports, protocols, services, and remote connections.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-80959\"\n  tag \"rid\": \"SV-95671r1_rule\"\n  tag \"stig_id\": \"UBTU-16-020010\"\n  tag \"fix_id\": \"F-87819r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit service is active.\n\nCheck that the audit service is active with the following command:\n\n# service auditd status\nActive: active (running)\n\nIf the service is not active this is a finding.\"\n  desc \"fix\", \"Start the auditd service, and enable the auditd service with the\nfollowing commands:\n\nStart the audit service.\n# systemctl start auditd.service\n\nEnable auditd in the targets of the system.\n# systemctl enable auditd.service\"\n  describe service('auditd') do\n    it { should be_installed }\n    it { should be_enabled }\n    it { should be_running }\n  end\nend","source_location":{"line":1,"ref":"./controls/V-80959.rb"},"results":[{"status":"passed","code_desc":"Service auditd should be installed","run_time":0.000826,"start_time":"2019-08-06T11:13:32-04:00"},{"status":"passed","code_desc":"Service auditd should be enabled","run_time":8.4e-05,"start_time":"2019-08-06T11:13:32-04:00"},{"status":"passed","code_desc":"Service auditd should be running","run_time":7.6e-05,"start_time":"2019-08-06T11:13:32-04:00"}]},{"id":"V-75889","title":"Network interfaces must not be in promiscuous mode.","desc":"Network interfaces in promiscuous mode allow for the capture of all\nnetwork traffic visible to the system. If unauthorized individuals can access\nthese applications, it may allow then to collect information such as logon IDs,\npasswords, and key exchanges between systems.\n\n    If the system is being used to perform a network troubleshooting function,\nthe use of these tools must be documented with the Information System Security\nOfficer (ISSO) and restricted to only authorized personnel.","descriptions":[{"label":"default","data":"Network interfaces in promiscuous mode allow for the capture of all\nnetwork traffic visible to the system. If unauthorized individuals can access\nthese applications, it may allow then to collect information such as logon IDs,\npasswords, and key exchanges between systems.\n\n    If the system is being used to perform a network troubleshooting function,\nthe use of these tools must be documented with the Information System Security\nOfficer (ISSO) and restricted to only authorized personnel."},{"label":"check","data":"Verify network interfaces are not in promiscuous mode unless\napproved by the Information System Security Officer (ISSO) and documented.\n\nCheck for the status with the following command:\n\n# ip link | grep -i promisc\n\nIf network interfaces are found on the system in promiscuous mode and their use\nhas not been approved by the ISSO and documented, this is a finding."},{"label":"fix","data":"Configure network interfaces to turn off promiscuous mode unless\napproved by the Information System Security Officer (ISSO) and documented.\n\nSet the promiscuous mode of an interface to \"off\" with the following command:\n\n# sudo ip link set dev <devicename> promisc off"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75889","rid":"SV-90569r2_rule","stig_id":"UBTU-16-030610","fix_id":"F-82519r2_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75889\" do\n  title \"Network interfaces must not be in promiscuous mode.\"\n  desc  \"Network interfaces in promiscuous mode allow for the capture of all\nnetwork traffic visible to the system. If unauthorized individuals can access\nthese applications, it may allow then to collect information such as logon IDs,\npasswords, and key exchanges between systems.\n\n    If the system is being used to perform a network troubleshooting function,\nthe use of these tools must be documented with the Information System Security\nOfficer (ISSO) and restricted to only authorized personnel.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75889\"\n  tag \"rid\": \"SV-90569r2_rule\"\n  tag \"stig_id\": \"UBTU-16-030610\"\n  tag \"fix_id\": \"F-82519r2_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify network interfaces are not in promiscuous mode unless\napproved by the Information System Security Officer (ISSO) and documented.\n\nCheck for the status with the following command:\n\n# ip link | grep -i promisc\n\nIf network interfaces are found on the system in promiscuous mode and their use\nhas not been approved by the ISSO and documented, this is a finding.\"\n  desc \"fix\", \"Configure network interfaces to turn off promiscuous mode unless\napproved by the Information System Security Officer (ISSO) and documented.\n\nSet the promiscuous mode of an interface to \\\"off\\\" with the following command:\n\n# sudo ip link set dev <devicename> promisc off\"\n\n  describe command('ip link | grep -i promisc').stdout.strip do\n    it { should be_empty }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75889.rb"},"results":[{"status":"passed","code_desc":"should be empty","run_time":7.0e-05,"start_time":"2019-08-06T11:13:32-04:00"}]},{"id":"V-75779","title":"Successful/unsuccessful uses of the unix_update command must generate\nan audit record.","desc":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise."},{"label":"check","data":"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \"unix_update\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w \"unix_update\" /etc/audit/audit.rules\n\n-a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-unix-update\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"unix_update\" command. Add or update the\nfollowing rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-unix-update\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75779","rid":"SV-90459r3_rule","stig_id":"UBTU-16-020770","fix_id":"F-82409r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75779\" do\n  title \"Successful/unsuccessful uses of the unix_update command must generate\nan audit record.\"\n  desc  \"Reconstruction of harmful events or forensic analysis is not possible\nif audit records do not contain enough information.\n\n    At a minimum, the organization must audit the full-text recording of\nprivileged commands. The organization must maintain audit trails in sufficient\ndetail to reconstruct events to determine the cause and impact of compromise.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75779\"\n  tag \"rid\": \"SV-90459r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020770\"\n  tag \"fix_id\": \"F-82409r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify that an audit event is generated for any\nsuccessful/unsuccessful use of the \\\"unix_update\\\" command.\n\nCheck for the following system call being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w \\\"unix_update\\\" /etc/audit/audit.rules\n\n-a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-unix-update\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"unix_update\\\" command. Add or update the\nfollowing rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-unix-update\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/sbin/unix_update'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75779.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /sbin/unix_update exist should equal true","run_time":8.2e-05,"start_time":"2019-08-06T11:13:32-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75639","title":"Audit logs must be owned by root to prevent unauthorized read access.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.","descriptions":[{"label":"default","data":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity."},{"label":"check","data":"Verify the audit logs are owned by \"root\". First determine\nwhere the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log file, determine if the audit log is owned\nby \"root\" using the following command:\n\n# sudo ls -la /var/log/audit/audit.log\nrw------- 2 root root 8096 Jun 26 11:56 /var/log/audit/audit.log\n\nIf the audit log is not owned by \"root\", this is a finding."},{"label":"fix","data":"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct owner as \"root\" with the following command:\n\n# sudo chown root [audit_log_file]\n\nReplace \"[audit_log_file]\" to the correct audit log path, by default this\nlocation is \"/var/log/audit/audit.log\"."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-75639","rid":"SV-90319r2_rule","stig_id":"UBTU-16-020110","fix_id":"F-82267r2_fix","cci":["CCI-000162","CCI-000163","CCI-000164"],"nist":["AU-9","AU-9","AU-9","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75639\" do\n  title \"Audit logs must be owned by root to prevent unauthorized read access.\"\n  desc  \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n    Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit Ubuntu operating system\nactivity.\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000057-GPOS-00027\"\n  tag \"satisfies\": [\"SRG-OS-000057-GPOS-00027\", \"SRG-OS-000058-GPOS-00028\",\n\"SRG-OS-000059-GPOS-00029\"]\n  tag \"gid\": \"V-75639\"\n  tag \"rid\": \"SV-90319r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020110\"\n  tag \"fix_id\": \"F-82267r2_fix\"\n  tag \"cci\": [\"CCI-000162\", \"CCI-000163\", \"CCI-000164\"]\n  tag \"nist\": [\"AU-9\", \"AU-9\", \"AU-9\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the audit logs are owned by \\\"root\\\". First determine\nwhere the audit logs are stored with the following command:\n\n# sudo grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nUsing the location of the audit log file, determine if the audit log is owned\nby \\\"root\\\" using the following command:\n\n# sudo ls -la /var/log/audit/audit.log\nrw------- 2 root root 8096 Jun 26 11:56 /var/log/audit/audit.log\n\nIf the audit log is not owned by \\\"root\\\", this is a finding.\"\n  desc \"fix\", \"Configure the audit log to be protected from unauthorized read\naccess, by setting the correct owner as \\\"root\\\" with the following command:\n\n# sudo chown root [audit_log_file]\n\nReplace \\\"[audit_log_file]\\\" to the correct audit log path, by default this\nlocation is \\\"/var/log/audit/audit.log\\\".\"\n\n  log_file_path = auditd_conf.log_file\n\n  describe file(log_file_path) do\n    its('owner') { should cmp 'root' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75639.rb"},"results":[{"status":"passed","code_desc":"File /var/log/audit/audit.log owner should cmp == \"root\"","run_time":0.000107,"start_time":"2019-08-06T11:13:32-04:00"}]},{"id":"V-75629","title":"The audit system must take appropriate action when the audit storage\nvolume is full.","desc":"It is critical that when the Ubuntu operating system is at risk of\nfailing to process audit logs as required, it takes action to mitigate the\nfailure. Audit processing failures include: software/hardware errors; failures\nin the audit capturing mechanisms; and audit storage capacity being reached or\nexceeded. Responses to audit failure depend upon the nature of the failure mode.\n\n    When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n    1) If the failure was caused by the lack of audit record storage capacity,\nthe Ubuntu operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n    2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the Ubuntu\noperating system must queue audit records locally until communication is\nrestored or until the audit records are retrieved manually. Upon restoration of\nthe connection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.","descriptions":[{"label":"default","data":"It is critical that when the Ubuntu operating system is at risk of\nfailing to process audit logs as required, it takes action to mitigate the\nfailure. Audit processing failures include: software/hardware errors; failures\nin the audit capturing mechanisms; and audit storage capacity being reached or\nexceeded. Responses to audit failure depend upon the nature of the failure mode.\n\n    When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n    1) If the failure was caused by the lack of audit record storage capacity,\nthe Ubuntu operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n    2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the Ubuntu\noperating system must queue audit records locally until communication is\nrestored or until the audit records are retrieved manually. Upon restoration of\nthe connection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server."},{"label":"check","data":"Verify the Ubuntu operating system takes the appropriate action\nwhen the audit storage volume is full.\n\nCheck that the Ubuntu operating system takes the appropriate action when the\naudit storage volume is full with the following command:\n\n# sudo grep disk_full_action /etc/audit/auditd.conf\n\ndisk_full_action = HALT\n\nIf the value of the \"disk_full_action\" option is not \"SYSLOG\", \"SINGLE\",\nor \"HALT\", or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the Ubuntu operating system to shut down by default\nupon audit failure (unless availability is an overriding concern).\n\nAdd or update the following line (depending on configuration\n\"disk_full_action\" can be set to \"SYSLOG\" or \"SINGLE\" depending on\nconfiguration) in \"/etc/audit/auditd.conf\" file:\n\ndisk_full_action = HALT"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000047-GPOS-00023","gid":"V-75629","rid":"SV-90309r2_rule","stig_id":"UBTU-16-020060","fix_id":"F-82257r2_fix","cci":["CCI-000140"],"nist":["AU-5 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75629\" do\n  title \"The audit system must take appropriate action when the audit storage\nvolume is full.\"\n  desc  \"It is critical that when the Ubuntu operating system is at risk of\nfailing to process audit logs as required, it takes action to mitigate the\nfailure. Audit processing failures include: software/hardware errors; failures\nin the audit capturing mechanisms; and audit storage capacity being reached or\nexceeded. Responses to audit failure depend upon the nature of the failure mode.\n\n    When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n    1) If the failure was caused by the lack of audit record storage capacity,\nthe Ubuntu operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n    2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the Ubuntu\noperating system must queue audit records locally until communication is\nrestored or until the audit records are retrieved manually. Upon restoration of\nthe connection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000047-GPOS-00023\"\n  tag \"gid\": \"V-75629\"\n  tag \"rid\": \"SV-90309r2_rule\"\n  tag \"stig_id\": \"UBTU-16-020060\"\n  tag \"fix_id\": \"F-82257r2_fix\"\n  tag \"cci\": [\"CCI-000140\"]\n  tag \"nist\": [\"AU-5 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system takes the appropriate action\nwhen the audit storage volume is full.\n\nCheck that the Ubuntu operating system takes the appropriate action when the\naudit storage volume is full with the following command:\n\n# sudo grep disk_full_action /etc/audit/auditd.conf\n\ndisk_full_action = HALT\n\nIf the value of the \\\"disk_full_action\\\" option is not \\\"SYSLOG\\\", \\\"SINGLE\\\",\nor \\\"HALT\\\", or the line is commented out, this is a finding.\"\n  desc \"fix\", \"Configure the Ubuntu operating system to shut down by default\nupon audit failure (unless availability is an overriding concern).\n\nAdd or update the following line (depending on configuration\n\\\"disk_full_action\\\" can be set to \\\"SYSLOG\\\" or \\\"SINGLE\\\" depending on\nconfiguration) in \\\"/etc/audit/auditd.conf\\\" file:\n\ndisk_full_action = HALT\"\n\n  describe auditd_conf do\n    its('disk_full_action') { should_not be_empty }\n    its('disk_full_action') { should cmp %r((?:SYSLOG|SINGLE|HALT))i }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75629.rb"},"results":[{"status":"passed","code_desc":"Audit Daemon Config disk_full_action should not be empty","run_time":0.000187,"start_time":"2019-08-06T11:13:32-04:00"},{"status":"failed","code_desc":"Audit Daemon Config disk_full_action should cmp == /(?:SYSLOG|SINGLE|HALT)/i","run_time":0.00012,"start_time":"2019-08-06T11:13:32-04:00","message":"\nexpected: /(?:SYSLOG|SINGLE|HALT)/i\n     got: \"SUSPEND\"\n\n(compared using `cmp` matcher)\n"}]},{"id":"V-75769","title":"Successful/unsuccessful uses of the chacl command must generate an\naudit record.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter)."},{"label":"check","data":"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \"chacl\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \"/etc/audit/audit.rules\":\n\n# sudo grep -w chacl /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding."},{"label":"fix","data":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chacl\" command.\n\nAdd or update the following rules in the \"/etc/audit/audit.rules\" file:\n\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service"}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000062-GPOS-00031","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-75769","rid":"SV-90449r3_rule","stig_id":"UBTU-16-020720","fix_id":"F-82397r2_fix","cci":["CCI-000130","CCI-000135","CCI-000169","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 a","AU-12 c","MA-4 (1) (a)","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75769\" do\n  title \"Successful/unsuccessful uses of the chacl command must generate an\naudit record.\"\n  desc  \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n    Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n  \"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000037-GPOS-00015\"\n  tag \"satisfies\": [\"SRG-OS-000037-GPOS-00015\", \"SRG-OS-000042-GPOS-00020\",\n\"SRG-OS-000062-GPOS-00031\", \"SRG-OS-000392-GPOS-00172\",\n\"SRG-OS-000462-GPOS-00206\", \"SRG-OS-000471-GPOS-00215\"]\n  tag \"gid\": \"V-75769\"\n  tag \"rid\": \"SV-90449r3_rule\"\n  tag \"stig_id\": \"UBTU-16-020720\"\n  tag \"fix_id\": \"F-82397r2_fix\"\n  tag \"cci\": [\"CCI-000130\", \"CCI-000135\", \"CCI-000169\", \"CCI-000172\",\n\"CCI-002884\"]\n  tag \"nist\": [\"AU-3\", \"AU-3 (1)\", \"AU-12 a\", \"AU-12 c\", \"MA-4 (1) (a)\",\n\"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Ubuntu operating system generates an audit record\nwhen successful/unsuccessful attempts to use the \\\"chacl\\\" command occur.\n\nCheck that the following calls are being audited by performing the following\ncommand to check the file system rules in \\\"/etc/audit/audit.rules\\\":\n\n# sudo grep -w chacl /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nIf the command does not return a line, or the line is commented out, this is a\nfinding.\"\n  desc \"fix\", \"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chacl\\\" command.\n\nAdd or update the following rules in the \\\"/etc/audit/audit.rules\\\" file:\n\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\nThe audit daemon must be restarted for the changes to take effect. To restart\nthe audit daemon, run the following command:\n\n# sudo systemctl restart auditd.service\"\n\n  @audit_file = '/usr/bin/chacl'\n\n  audit_lines_exist = !auditd.lines.index{|line| line.include?(@audit_file)}.nil?\n  if audit_lines_exist\n    describe auditd.file(@audit_file) do\n      its('permissions') { should_not cmp [] }\n      its('action') { should_not include 'never' }\n    end\n  \n    # Resource creates data structure including all usages of file\n    @perms = auditd.file(@audit_file).permissions\n  \n    @perms.each do |perm|\n      describe perm do\n        it { should include 'x' }\n      end\n    end\n  else\n    describe ('Audit line(s) for '+ @audit_file + ' exist') do\n      subject { audit_lines_exist }\n      it { should be true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75769.rb"},"results":[{"status":"failed","code_desc":"Audit line(s) for /usr/bin/chacl exist should equal true","run_time":8.2e-05,"start_time":"2019-08-06T11:13:32-04:00","message":"\nexpected true\n     got false\n"}]},{"id":"V-75899","title":"If the Trivial File Transfer Protocol (TFTP) server is required, the\nTFTP daemon must be configured to operate in secure mode.","desc":"Restricting TFTP to a specific directory prevents remote users from\ncopying, transferring, or overwriting system files.","descriptions":[{"label":"default","data":"Restricting TFTP to a specific directory prevents remote users from\ncopying, transferring, or overwriting system files."},{"label":"check","data":"Verify the Trivial File Transfer Protocol (TFTP) daemon is\nconfigured to operate in secure mode.\n\nCheck to see if a TFTP server has been installed with the following commands:\n\n# dpkg -l | grep tftpd-hpa\nii tftpd-hpa 5.2+20150808-1Ubuntu1.16.04.1\nIf a TFTP server is not installed, this is Not Applicable.\n\nIf a TFTP server is installed, check for the server arguments with the\nfollowing command:\n\n# grep TFTP_OPTIONS /etc/default/tftpd-hpa\nTFTP_OPTIONS=\"--secure\"\n\nIf \"--secure\" is not listed in the TFTP_OPTIONS, this is a finding."},{"label":"fix","data":"Configure the Trivial File Transfer Protocol (TFTP) daemon to\noperate in the secure mode by adding the \"--secure\" option to TFTP_OPTIONS in\n/etc/default/tftpd-hpa and restart the tftpd daemon."}],"impact":0.5,"refs":[],"tags":{"gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-75899","rid":"SV-90579r1_rule","stig_id":"UBTU-16-030730","fix_id":"F-82529r1_fix","cci":["CCI-000366"],"nist":["CM-6 b","Rev_4"],"false_negatives":null,"false_positives":null,"documentable":false,"mitigations":null,"severity_override_guidance":false,"potential_impacts":null,"third_party_tools":null,"mitigation_controls":null,"responsibility":null,"ia_controls":null},"code":"control \"V-75899\" do\n  title \"If the Trivial File Transfer Protocol (TFTP) server is required, the\nTFTP daemon must be configured to operate in secure mode.\"\n  desc  \"Restricting TFTP to a specific directory prevents remote users from\ncopying, transferring, or overwriting system files.\"\n  impact 0.5\n  tag \"gtitle\": \"SRG-OS-000480-GPOS-00227\"\n  tag \"gid\": \"V-75899\"\n  tag \"rid\": \"SV-90579r1_rule\"\n  tag \"stig_id\": \"UBTU-16-030730\"\n  tag \"fix_id\": \"F-82529r1_fix\"\n  tag \"cci\": [\"CCI-000366\"]\n  tag \"nist\": [\"CM-6 b\", \"Rev_4\"]\n  tag \"false_negatives\": nil\n  tag \"false_positives\": nil\n  tag \"documentable\": false\n  tag \"mitigations\": nil\n  tag \"severity_override_guidance\": false\n  tag \"potential_impacts\": nil\n  tag \"third_party_tools\": nil\n  tag \"mitigation_controls\": nil\n  tag \"responsibility\": nil\n  tag \"ia_controls\": nil\n  desc \"check\", \"Verify the Trivial File Transfer Protocol (TFTP) daemon is\nconfigured to operate in secure mode.\n\nCheck to see if a TFTP server has been installed with the following commands:\n\n# dpkg -l | grep tftpd-hpa\nii tftpd-hpa 5.2+20150808-1Ubuntu1.16.04.1\nIf a TFTP server is not installed, this is Not Applicable.\n\nIf a TFTP server is installed, check for the server arguments with the\nfollowing command:\n\n# grep TFTP_OPTIONS /etc/default/tftpd-hpa\nTFTP_OPTIONS=\\\"--secure\\\"\n\nIf \\\"--secure\\\" is not listed in the TFTP_OPTIONS, this is a finding.\"\n  desc \"fix\", \"Configure the Trivial File Transfer Protocol (TFTP) daemon to\noperate in the secure mode by adding the \\\"--secure\\\" option to TFTP_OPTIONS in\n/etc/default/tftpd-hpa and restart the tftpd daemon.\"\n\n  is_installed = package('tftpd-hpa').installed?\n  if is_installed\n    tftp_options = command('grep TFTP_OPTIONS /etc/default/tftpd-hpa').stdout.strip\n    describe tftp_options do\n      it { should match %r((--secure)) }\n    end\n  else\n    describe \"No TFTP server is installed\" do\n      skip \"This control is Not Applicable as a TFTP server has not been installed on this server.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/V-75899.rb"},"results":[{"status":"skipped","code_desc":"No TFTP server is installed","run_time":3.0e-06,"start_time":"2019-08-06T11:13:32-04:00","resource":"","skip_message":"This control is Not Applicable as a TFTP server has not been installed on this server."}]}],"status":"loaded"}],"statistics":{"duration":4.947541},"version":"4.10.4"}