{"name":"Canonical_Ubuntu_20-04_LTS_STIG","title":"Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide","maintainer":"Nitin Ravindran","copyright":"Nitin Ravindran","copyright_email":"nravindran@vmware.com","license":"Apache-2.0","summary":"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.","version":"0.1.0","supports":[{"platform-name":"ubuntu","release":"20.04"}],"inputs":[],"controls":[{"title":"The Ubuntu operating system must immediately terminate all network\nconnections associated with SSH traffic at the end of the session or after 10\nminutes of inactivity.","desc":"Terminating an idle session within a short time period reduces the\nwindow of opportunity for unauthorized personnel to take control of a\nmanagement session enabled on the console or console port that has been left\nunattended. In addition, quickly terminating an idle session will also free up\nresources committed by the managed network element.\n\n Terminating network connections associated with communications sessions\nincludes, for example, de-allocating associated TCP/IP address/port pairs at\nthe operating system level, and de-allocating networking assignments at the\napplication level if multiple application sessions are using a single operating\nsystem-level network connection. This does not mean that the operating system\nterminates all sessions or network access; it only ends the inactive session\nand releases the resources associated with that session.","descriptions":{"default":"Terminating an idle session within a short time period reduces the\nwindow of opportunity for unauthorized personnel to take control of a\nmanagement session enabled on the console or console port that has been left\nunattended. In addition, quickly terminating an idle session will also free up\nresources committed by the managed network element.\n\n Terminating network connections associated with communications sessions\nincludes, for example, de-allocating associated TCP/IP address/port pairs at\nthe operating system level, and de-allocating networking assignments at the\napplication level if multiple application sessions are using a single operating\nsystem-level network connection. This does not mean that the operating system\nterminates all sessions or network access; it only ends the inactive session\nand releases the resources associated with that session.","rationale":"","check":"Verify that all network connections associated with SSH traffic are\nautomatically terminated at the end of the session or after 10 minutes of\ninactivity.\n\n Verify the \"ClientAliveInterval\" variable is set to a value of \"600\" or\nless by performing the following command:\n\n $ sudo grep -i clientalive /etc/ssh/sshd_config\n\n ClientAliveInterval 600\n\n If \"ClientAliveInterval\" does not exist, is not set to a value of \"600\"\nor less in \"/etc/ssh/sshd_config\", or is commented out, this is a finding.","fix":"Configure the Ubuntu operating system to automatically terminate all\nnetwork connections associated with SSH traffic at the end of a session or\nafter a 10-minute period of inactivity.\n\n Modify or append the following line in the \"/etc/ssh/sshd_config\" file\nreplacing \"[Interval]\" with a value of \"600\" or less:\n\n ClientAliveInterval 600\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000163-GPOS-00072","gid":"V-238213","rid":"SV-238213r653814_rule","stig_id":"UBTU-20-010037","fix_id":"F-41382r653813_fix","cci":["CCI-001133"],"legacy":[],"nist":["SC-10"]},"code":"control 'V-238213' do\n title \"The Ubuntu operating system must immediately terminate all network\nconnections associated with SSH traffic at the end of the session or after 10\nminutes of inactivity.\"\n desc \"Terminating an idle session within a short time period reduces the\nwindow of opportunity for unauthorized personnel to take control of a\nmanagement session enabled on the console or console port that has been left\nunattended. In addition, quickly terminating an idle session will also free up\nresources committed by the managed network element.\n\n Terminating network connections associated with communications sessions\nincludes, for example, de-allocating associated TCP/IP address/port pairs at\nthe operating system level, and de-allocating networking assignments at the\napplication level if multiple application sessions are using a single operating\nsystem-level network connection. This does not mean that the operating system\nterminates all sessions or network access; it only ends the inactive session\nand releases the resources associated with that session.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that all network connections associated with SSH traffic are\nautomatically terminated at the end of the session or after 10 minutes of\ninactivity.\n\n Verify the \\\"ClientAliveInterval\\\" variable is set to a value of \\\"600\\\" or\nless by performing the following command:\n\n $ sudo grep -i clientalive /etc/ssh/sshd_config\n\n ClientAliveInterval 600\n\n If \\\"ClientAliveInterval\\\" does not exist, is not set to a value of \\\"600\\\"\nor less in \\\"/etc/ssh/sshd_config\\\", or is commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to automatically terminate all\nnetwork connections associated with SSH traffic at the end of a session or\nafter a 10-minute period of inactivity.\n\n Modify or append the following line in the \\\"/etc/ssh/sshd_config\\\" file\nreplacing \\\"[Interval]\\\" with a value of \\\"600\\\" or less:\n\n ClientAliveInterval 600\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000163-GPOS-00072'\n tag gid: 'V-238213'\n tag rid: 'SV-238213r653814_rule'\n tag stig_id: 'UBTU-20-010037'\n tag fix_id: 'F-41382r653813_fix'\n tag cci: ['CCI-001133']\n tag legacy: []\n tag nist: ['SC-10']\n\n describe sshd_config do\n its('ClientAliveInterval') { should cmp 600 }\n end\nend\n","source_location":{"ref":"./controls/V-238213.rb","line":3},"id":"V-238213"},{"title":"The Ubuntu operating system must be configured to preserve log records\nfrom failure events.","desc":"Failure to a known state can address safety or security in accordance\nwith the mission/business needs of the organization. Failure to a known secure\nstate helps prevent a loss of confidentiality, integrity, or availability in\nthe event of a failure of the information system or a component of the system.\n\n Preserving operating system state information helps to facilitate operating\nsystem restart and return to the operational mode of the organization with\nleast disruption to mission/business processes.","descriptions":{"default":"Failure to a known state can address safety or security in accordance\nwith the mission/business needs of the organization. Failure to a known secure\nstate helps prevent a loss of confidentiality, integrity, or availability in\nthe event of a failure of the information system or a component of the system.\n\n Preserving operating system state information helps to facilitate operating\nsystem restart and return to the operational mode of the organization with\nleast disruption to mission/business processes.","rationale":"","check":"Verify the log service is configured to collect system failure events.\n\n Check that the log service is installed properly with the following\ncommand:\n\n $ dpkg -l | grep rsyslog\n\n ii rsyslog 8.32.0-1ubuntu4\n amd64 reliable system and kernel logging daemon\n\n If the \"rsyslog\" package is not installed, this is a finding.\n\n Check that the log service is enabled with the following command:\n\n $ systemctl is-enabled rsyslog\n\n enabled\n\n If the command above returns \"disabled\", this is a finding.\n\n Check that the log service is properly running and active on the system\nwith the following command:\n\n $ systemctl is-active rsyslog\n\n active\n\n If the command above returns \"inactive\", this is a finding.","fix":"Configure the log service to collect failure events.\n\n Install the log service (if the log service is not already installed) with\nthe following command:\n\n $ sudo apt-get install rsyslog\n\n Enable the log service with the following command:\n\n $ sudo systemctl enable --now rsyslog"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000269-GPOS-00103","gid":"V-238353","rid":"SV-238353r654234_rule","stig_id":"UBTU-20-010432","fix_id":"F-41522r654233_fix","cci":["CCI-001665"],"legacy":[],"nist":["SC-24"]},"code":"control 'V-238353' do\n title \"The Ubuntu operating system must be configured to preserve log records\nfrom failure events.\"\n desc \"Failure to a known state can address safety or security in accordance\nwith the mission/business needs of the organization. Failure to a known secure\nstate helps prevent a loss of confidentiality, integrity, or availability in\nthe event of a failure of the information system or a component of the system.\n\n Preserving operating system state information helps to facilitate operating\nsystem restart and return to the operational mode of the organization with\nleast disruption to mission/business processes.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the log service is configured to collect system failure events.\n\n Check that the log service is installed properly with the following\ncommand:\n\n $ dpkg -l | grep rsyslog\n\n ii rsyslog 8.32.0-1ubuntu4\n amd64 reliable system and kernel logging daemon\n\n If the \\\"rsyslog\\\" package is not installed, this is a finding.\n\n Check that the log service is enabled with the following command:\n\n $ systemctl is-enabled rsyslog\n\n enabled\n\n If the command above returns \\\"disabled\\\", this is a finding.\n\n Check that the log service is properly running and active on the system\nwith the following command:\n\n $ systemctl is-active rsyslog\n\n active\n\n If the command above returns \\\"inactive\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the log service to collect failure events.\n\n Install the log service (if the log service is not already installed) with\nthe following command:\n\n $ sudo apt-get install rsyslog\n\n Enable the log service with the following command:\n\n $ sudo systemctl enable --now rsyslog\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000269-GPOS-00103'\n tag gid: 'V-238353'\n tag rid: 'SV-238353r654234_rule'\n tag stig_id: 'UBTU-20-010432'\n tag fix_id: 'F-41522r654233_fix'\n tag cci: ['CCI-001665']\n tag legacy: []\n tag nist: ['SC-24']\n\n describe service('rsyslog') do\n it { should be_installed }\n it { should be_enabled }\n it { should be_running }\n end\nend\n","source_location":{"ref":"./controls/V-238353.rb","line":3},"id":"V-238353"},{"title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/opasswd.","desc":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","descriptions":{"default":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","rationale":"","check":"Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\"/etc/security/opasswd\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep opasswd\n\n -w /etc/security/opasswd -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\"/etc/security/opasswd\".\n\n Add or update the following rule to \"/etc/audit/rules.d/stig.rules\":\n\n -w /etc/security/opasswd -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","satisfies":["SRG-OS-000004-GPOS-00004","SRG-OS-000239-GPOS-00089","SRG-OS-000240-GPOS-00090","SRG-OS-000241-GPOS-00091","SRG-OS-000303-GPOS-00120","SRG-OS-000458-GPOS-00203","SRG-OS-000476-GPOS-00221"],"gid":"V-238242","rid":"SV-238242r653901_rule","stig_id":"UBTU-20-010104","fix_id":"F-41411r653900_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-001404","CCI-001405","CCI-002130"],"legacy":[],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)","AC-2 (4)","AC-2\n(4)"]},"code":"control 'V-238242' do\n title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/opasswd.\"\n desc \"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\\\"/etc/security/opasswd\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep opasswd\n\n -w /etc/security/opasswd -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\\\"/etc/security/opasswd\\\".\n\n Add or update the following rule to \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -w /etc/security/opasswd -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000004-GPOS-00004'\n tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089',\n'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091',\n'SRG-OS-000303-GPOS-00120', 'SRG-OS-000458-GPOS-00203',\n'SRG-OS-000476-GPOS-00221']\n tag gid: 'V-238242'\n tag rid: 'SV-238242r653901_rule'\n tag stig_id: 'UBTU-20-010104'\n tag fix_id: 'F-41411r653900_fix'\n tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-001404',\n'CCI-001405', 'CCI-002130']\n tag legacy: []\n tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AC-2 (4)', \"AC-2\n(4)\"]\n\n @audit_file = '/etc/security/opasswd'\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238242.rb","line":3},"id":"V-238242"},{"title":"The Ubuntu operating system must configure the audit tools to be\ngroup-owned by root.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":{"default":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","rationale":"","check":"Verify the Ubuntu operating system configures the audit tools to be\ngroup-owned by root to prevent any unauthorized access.\n\n Check the group ownership by running the following command:\n\n $ stat -c \"%n %G\" /sbin/auditctl /sbin/aureport /sbin/ausearch\n/sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules\n\n /sbin/auditctl root\n /sbin/aureport root\n /sbin/ausearch root\n /sbin/autrace root\n /sbin/auditd root\n /sbin/audispd root\n /sbin/augenrules root\n\n If any of the audit tools are not group-owned by root, this is a finding.","fix":"Configure the audit tools on the Ubuntu operating system to be protected\nfrom unauthorized access by setting the file group as root using the following\ncommand:\n\n $ sudo chown :root [audit_tool]\n\n Replace \"[audit_tool]\" with each audit tool not group-owned by root."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000256-GPOS-00097","satisfies":["SRG-OS-000256-GPOS-00097","SRG-OS-000257-GPOS-00098"],"gid":"V-238302","rid":"SV-238302r654081_rule","stig_id":"UBTU-20-010201","fix_id":"F-41471r654080_fix","cci":["CCI-001493","CCI-001494"],"legacy":[],"nist":["AU-9","AU-9"]},"code":"control 'V-238302' do\n title \"The Ubuntu operating system must configure the audit tools to be\ngroup-owned by root.\"\n desc \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system configures the audit tools to be\ngroup-owned by root to prevent any unauthorized access.\n\n Check the group ownership by running the following command:\n\n $ stat -c \\\"%n %G\\\" /sbin/auditctl /sbin/aureport /sbin/ausearch\n/sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules\n\n /sbin/auditctl root\n /sbin/aureport root\n /sbin/ausearch root\n /sbin/autrace root\n /sbin/auditd root\n /sbin/audispd root\n /sbin/augenrules root\n\n If any of the audit tools are not group-owned by root, this is a finding.\n \"\n desc 'fix', \"\n Configure the audit tools on the Ubuntu operating system to be protected\nfrom unauthorized access by setting the file group as root using the following\ncommand:\n\n $ sudo chown :root [audit_tool]\n\n Replace \\\"[audit_tool]\\\" with each audit tool not group-owned by root.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000256-GPOS-00097'\n tag satisfies: ['SRG-OS-000256-GPOS-00097', 'SRG-OS-000257-GPOS-00098']\n tag gid: 'V-238302'\n tag rid: 'SV-238302r654081_rule'\n tag stig_id: 'UBTU-20-010201'\n tag fix_id: 'F-41471r654080_fix'\n tag cci: ['CCI-001493', 'CCI-001494']\n tag legacy: []\n tag nist: ['AU-9', 'AU-9']\n\n audit_tools = input('audit_tools')\n\n audit_tools.each do |tool|\n describe file(tool) do\n its('group') { should cmp 'root' }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238302.rb","line":3},"id":"V-238302"},{"title":"The Ubuntu operating system must deploy Endpoint Security for Linux\nThreat Prevention (ENSLTP).","desc":"Without the use of automated mechanisms to scan for security flaws on\na continuous and/or periodic basis, the operating system or other system\ncomponents may remain vulnerable to the exploits presented by undetected\nsoftware flaws.\n\n To support this requirement, the operating system may have an integrated\nsolution incorporating continuous scanning using HBSS and periodic scanning\nusing other tools, as specified in the requirement.","descriptions":{"default":"Without the use of automated mechanisms to scan for security flaws on\na continuous and/or periodic basis, the operating system or other system\ncomponents may remain vulnerable to the exploits presented by undetected\nsoftware flaws.\n\n To support this requirement, the operating system may have an integrated\nsolution incorporating continuous scanning using HBSS and periodic scanning\nusing other tools, as specified in the requirement.","rationale":"","check":"The Ubuntu operating system is not compliant with this requirement; hence,\nit is a finding. However, the severity level can be mitigated to a CAT III if\nthe ENSLTP module is installed and running.\n\n Check that the \"mfetp\" package has been installed:\n\n # dpkg -l | grep mfetp\n\n If the \"mfetp\" package is not installed, this finding will remain as a\nCAT II.\n\n Check that the daemon is running:\n\n # /opt/McAfee/ens/tp/init/mfetpd-control.sh status\n\n If the daemon is not running, this finding will remain as a CAT II.","fix":"The Ubuntu operating system is not compliant with this requirement;\nhowever, the severity level can be mitigated to a CAT III if the ENSLTP module\nis installed and running.\n\n Configure the Ubuntu operating system to use ENSLTP.\n\n Install the \"mfetp\" package:\n\n # sudo apt-get install mfetp"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000191-GPOS-00080","gid":"V-238336","rid":"SV-238336r654183_rule","stig_id":"UBTU-20-010415","fix_id":"F-41505r654182_fix","cci":["CCI-001233"],"legacy":[],"nist":["SI-2 (2)"]},"code":"control 'V-238336' do\n title \"The Ubuntu operating system must deploy Endpoint Security for Linux\nThreat Prevention (ENSLTP).\"\n desc \"Without the use of automated mechanisms to scan for security flaws on\na continuous and/or periodic basis, the operating system or other system\ncomponents may remain vulnerable to the exploits presented by undetected\nsoftware flaws.\n\n To support this requirement, the operating system may have an integrated\nsolution incorporating continuous scanning using HBSS and periodic scanning\nusing other tools, as specified in the requirement.\n \"\n desc 'rationale', ''\n desc 'check', \"\n The Ubuntu operating system is not compliant with this requirement; hence,\nit is a finding. However, the severity level can be mitigated to a CAT III if\nthe ENSLTP module is installed and running.\n\n Check that the \\\"mfetp\\\" package has been installed:\n\n # dpkg -l | grep mfetp\n\n If the \\\"mfetp\\\" package is not installed, this finding will remain as a\nCAT II.\n\n Check that the daemon is running:\n\n # /opt/McAfee/ens/tp/init/mfetpd-control.sh status\n\n If the daemon is not running, this finding will remain as a CAT II.\n \"\n desc 'fix', \"\n The Ubuntu operating system is not compliant with this requirement;\nhowever, the severity level can be mitigated to a CAT III if the ENSLTP module\nis installed and running.\n\n Configure the Ubuntu operating system to use ENSLTP.\n\n Install the \\\"mfetp\\\" package:\n\n # sudo apt-get install mfetp\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000191-GPOS-00080'\n tag gid: 'V-238336'\n tag rid: 'SV-238336r654183_rule'\n tag stig_id: 'UBTU-20-010415'\n tag fix_id: 'F-41505r654182_fix'\n tag cci: ['CCI-001233']\n tag legacy: []\n tag nist: ['SI-2 (2)']\n\n describe package('mfetp') do\n it { should be_installed }\n end\n\n describe command('/opt/McAfee/ens/tp/init/mfetpd-control.sh status') do\n its('exit_status') { should cmp 0 }\n end\n\nend\n","source_location":{"ref":"./controls/V-238336.rb","line":3},"id":"V-238336"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the open_by_handle_at system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \"open_by_handle_at\" system call.\n\n Check the configured audit rules with the following command:\n\n $ sudo auditctl -l | grep open_by_handle_at\n\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any unsuccessful\nuse of the \"open_by_handle_at\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000474-GPOS-00219"],"gid":"V-238276","rid":"SV-238276r654003_rule","stig_id":"UBTU-20-010160","fix_id":"F-41445r654002_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238276' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the open_by_handle_at system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \\\"open_by_handle_at\\\" system call.\n\n Check the configured audit rules with the following command:\n\n $ sudo auditctl -l | grep open_by_handle_at\n\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any unsuccessful\nuse of the \\\"open_by_handle_at\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F\nauid>=1000 -F auid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000474-GPOS-00219']\n tag gid: 'V-238276'\n tag rid: 'SV-238276r654003_rule'\n tag stig_id: 'UBTU-20-010160'\n tag fix_id: 'F-41445r654002_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('open_by_handle_at').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('open_by_handle_at').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\n end\n describe auditd.syscall('open_by_handle_at').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('open_by_handle_at').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\nend\n","source_location":{"ref":"./controls/V-238276.rb","line":3},"id":"V-238276"},{"title":"The Ubuntu operating system must configure the uncomplicated firewall\nto rate-limit impacted network interfaces.","desc":"Denial of service (DoS) is a condition when a resource is not\navailable for legitimate users. When this occurs, the organization either\ncannot accomplish its mission or must operate at degraded capacity.\n\n This requirement addresses the configuration of the operating system to\nmitigate the impact of DoS attacks that have occurred or are ongoing on system\navailability. For each system, known and potential DoS attacks must be\nidentified and solutions for each type implemented. A variety of technologies\nexist to limit or, in some cases, eliminate the effects of DoS attacks (e.g.,\nlimiting processes or establishing memory partitions). Employing increased\ncapacity and bandwidth, combined with service redundancy, may reduce the\nsusceptibility to some DoS attacks.","descriptions":{"default":"Denial of service (DoS) is a condition when a resource is not\navailable for legitimate users. When this occurs, the organization either\ncannot accomplish its mission or must operate at degraded capacity.\n\n This requirement addresses the configuration of the operating system to\nmitigate the impact of DoS attacks that have occurred or are ongoing on system\navailability. For each system, known and potential DoS attacks must be\nidentified and solutions for each type implemented. A variety of technologies\nexist to limit or, in some cases, eliminate the effects of DoS attacks (e.g.,\nlimiting processes or establishing memory partitions). Employing increased\ncapacity and bandwidth, combined with service redundancy, may reduce the\nsusceptibility to some DoS attacks.","rationale":"","check":"Verify an application firewall is configured to rate limit any connection\nto the system.\n\n Check all the services listening to the ports with the following command:\n\n $ sudo ss -l46ut\n\n Netid State Recv-Q Send-Q\n Local Address:Port Peer\nAddress:Port Process\n tcp LISTEN 0 128\n [::]:ssh\n [::]:*\n\n For each entry, verify that the Uncomplicated Firewall is configured to\nrate limit the service ports with the following command:\n\n $ sudo ufw status\n\n Status: active\n\n To Action From\n -- ------ ----\n 22/tcp LIMIT Anywhere\n 22/tcp (v6) LIMIT Anywhere (v6)\n\n If any port with a state of \"LISTEN\" is not marked with the \"LIMIT\"\naction, this is a finding.","fix":"Configure the application firewall to protect against or limit the effects\nof DoS attacks by ensuring the Ubuntu operating system is implementing\nrate-limiting measures on impacted network interfaces.\n\n Check all the services listening to the ports with the following command:\n\n $ sudo ss -l46ut\n\n Netid State Recv-Q Send-Q\n Local Address:Port Peer\nAddress:Port Process\n tcp LISTEN 0 128\n [::]:ssh\n [::]:*\n\n For each service with a port listening to connections, run the following\ncommand, replacing \"[service]\" with the service that needs to be rate\nlimited.\n\n $ sudo ufw limit [service]\n\n Rate-limiting can also be done on an interface. An example of adding a\nrate-limit on the eth0 interface follows:\n\n $ sudo ufw limit in on eth0"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000420-GPOS-00186","gid":"V-238367","rid":"SV-238367r654276_rule","stig_id":"UBTU-20-010446","fix_id":"F-41536r654275_fix","cci":["CCI-002385"],"legacy":[],"nist":["SC-5"]},"code":"control 'V-238367' do\n title \"The Ubuntu operating system must configure the uncomplicated firewall\nto rate-limit impacted network interfaces.\"\n desc \"Denial of service (DoS) is a condition when a resource is not\navailable for legitimate users. When this occurs, the organization either\ncannot accomplish its mission or must operate at degraded capacity.\n\n This requirement addresses the configuration of the operating system to\nmitigate the impact of DoS attacks that have occurred or are ongoing on system\navailability. For each system, known and potential DoS attacks must be\nidentified and solutions for each type implemented. A variety of technologies\nexist to limit or, in some cases, eliminate the effects of DoS attacks (e.g.,\nlimiting processes or establishing memory partitions). Employing increased\ncapacity and bandwidth, combined with service redundancy, may reduce the\nsusceptibility to some DoS attacks.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify an application firewall is configured to rate limit any connection\nto the system.\n\n Check all the services listening to the ports with the following command:\n\n $ sudo ss -l46ut\n\n Netid State Recv-Q Send-Q\n Local Address:Port Peer\nAddress:Port Process\n tcp LISTEN 0 128\n [::]:ssh\n [::]:*\n\n For each entry, verify that the Uncomplicated Firewall is configured to\nrate limit the service ports with the following command:\n\n $ sudo ufw status\n\n Status: active\n\n To Action From\n -- ------ ----\n 22/tcp LIMIT Anywhere\n 22/tcp (v6) LIMIT Anywhere (v6)\n\n If any port with a state of \\\"LISTEN\\\" is not marked with the \\\"LIMIT\\\"\naction, this is a finding.\n \"\n desc 'fix', \"\n Configure the application firewall to protect against or limit the effects\nof DoS attacks by ensuring the Ubuntu operating system is implementing\nrate-limiting measures on impacted network interfaces.\n\n Check all the services listening to the ports with the following command:\n\n $ sudo ss -l46ut\n\n Netid State Recv-Q Send-Q\n Local Address:Port Peer\nAddress:Port Process\n tcp LISTEN 0 128\n [::]:ssh\n [::]:*\n\n For each service with a port listening to connections, run the following\ncommand, replacing \\\"[service]\\\" with the service that needs to be rate\nlimited.\n\n $ sudo ufw limit [service]\n\n Rate-limiting can also be done on an interface. An example of adding a\nrate-limit on the eth0 interface follows:\n\n $ sudo ufw limit in on eth0\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000420-GPOS-00186'\n tag gid: 'V-238367'\n tag rid: 'SV-238367r654276_rule'\n tag stig_id: 'UBTU-20-010446'\n tag fix_id: 'F-41536r654275_fix'\n tag cci: ['CCI-002385']\n tag legacy: []\n tag nist: ['SC-5']\n\n describe 'Status listings for any allowed services, ports, or applications must be documented with the organization' do\n skip 'Status listings checks must be preformed manually'\n end\nend\n","source_location":{"ref":"./controls/V-238367.rb","line":3},"id":"V-238367"},{"title":"The Ubuntu operating system must prevent the use of dictionary words\nfor passwords.","desc":"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, then this increases the chances of password\ncompromise by increasing the opportunity for successful guesses and brute-force\nattacks.","descriptions":{"default":"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, then this increases the chances of password\ncompromise by increasing the opportunity for successful guesses and brute-force\nattacks.","rationale":"","check":"Verify the Ubuntu operating system uses the \"cracklib\" library to prevent\nthe use of dictionary words with the following command:\n\n $ grep dictcheck /etc/security/pwquality.conf\n\n dictcheck=1\n\n If the \"dictcheck\" parameter is not set to \"1\" or is commented out,\nthis is a finding.","fix":"Configure the Ubuntu operating system to prevent the use of dictionary\nwords for passwords.\n\n Add or update the following line in the \"/etc/security/pwquality.conf\"\nfile to include the \"dictcheck=1\" parameter:\n\n dictcheck=1"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00225","gid":"V-238227","rid":"SV-238227r653856_rule","stig_id":"UBTU-20-010056","fix_id":"F-41396r653855_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238227' do\n title \"The Ubuntu operating system must prevent the use of dictionary words\nfor passwords.\"\n desc \"If the Ubuntu operating system allows the user to select passwords\nbased on dictionary words, then this increases the chances of password\ncompromise by increasing the opportunity for successful guesses and brute-force\nattacks.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system uses the \\\"cracklib\\\" library to prevent\nthe use of dictionary words with the following command:\n\n $ grep dictcheck /etc/security/pwquality.conf\n\n dictcheck=1\n\n If the \\\"dictcheck\\\" parameter is not set to \\\"1\\\" or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to prevent the use of dictionary\nwords for passwords.\n\n Add or update the following line in the \\\"/etc/security/pwquality.conf\\\"\nfile to include the \\\"dictcheck=1\\\" parameter:\n\n dictcheck=1\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000480-GPOS-00225'\n tag gid: 'V-238227'\n tag rid: 'SV-238227r653856_rule'\n tag stig_id: 'UBTU-20-010056'\n tag fix_id: 'F-41396r653855_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('dictcheck') { should cmp 1 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238227.rb","line":3},"id":"V-238227"},{"title":"The Ubuntu operating system must generate audit records for the use\nand modification of the tallylog file.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful modifications to the \"tallylog\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep tallylog\n\n -w /var/log/tallylog -p wa -k logins\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \"tallylog\" file.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/log/tallylog -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000470-GPOS-00214","SRG-OS-000473-GPOS-00218"],"gid":"V-238285","rid":"SV-238285r654030_rule","stig_id":"UBTU-20-010169","fix_id":"F-41454r654029_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238285' do\n title \"The Ubuntu operating system must generate audit records for the use\nand modification of the tallylog file.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful modifications to the \\\"tallylog\\\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep tallylog\n\n -w /var/log/tallylog -p wa -k logins\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \\\"tallylog\\\" file.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/log/tallylog -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000470-GPOS-00214',\n'SRG-OS-000473-GPOS-00218']\n tag gid: 'V-238285'\n tag rid: 'SV-238285r654030_rule'\n tag stig_id: 'UBTU-20-010169'\n tag fix_id: 'F-41454r654029_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/var/log/tallylog'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238285.rb","line":3},"id":"V-238285"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the init_module syscall.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record for any\nsuccessful/unsuccessful attempts to use the \"init_module\" syscall.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w init_module\n\n -a always,exit -F arch=b32 -S init_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n -a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"init_module\" syscall.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S init_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n -a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000471-GPOS-00216"],"gid":"V-238295","rid":"SV-238295r654060_rule","stig_id":"UBTU-20-010179","fix_id":"F-41464r654059_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238295' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the init_module syscall.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record for any\nsuccessful/unsuccessful attempts to use the \\\"init_module\\\" syscall.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w init_module\n\n -a always,exit -F arch=b32 -S init_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n -a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"init_module\\\" syscall.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S init_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n -a always,exit -F arch=b64 -S init_module -F auid>=1000 -F auid!=4294967295\n-k module_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000471-GPOS-00216']\n tag gid: 'V-238295'\n tag rid: 'SV-238295r654060_rule'\n tag stig_id: 'UBTU-20-010179'\n tag fix_id: 'F-41464r654059_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('init_module').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('init_module').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238295.rb","line":3},"id":"V-238295"},{"title":"The Ubuntu operating system must enforce a delay of at least 4 seconds\nbetween logon prompts following a failed logon attempt.","desc":"Limiting the number of logon attempts over a certain time interval\nreduces the chances that an unauthorized user may gain access to an account.","descriptions":{"default":"Limiting the number of logon attempts over a certain time interval\nreduces the chances that an unauthorized user may gain access to an account.","rationale":"","check":"Verify the Ubuntu operating system enforces a delay of at least 4 seconds\nbetween logon prompts following a failed logon attempt with the following\ncommand:\n\n $ grep pam_faildelay /etc/pam.d/common-auth\n\n auth required pam_faildelay.so delay=4000000\n\n If the line is not present or is commented out, this is a finding.","fix":"Configure the Ubuntu operating system to enforce a delay of at least 4\nseconds between logon prompts following a failed logon attempt.\n\n Edit the file \"/etc/pam.d/common-auth\" and set the parameter\n\"pam_faildelay\" to a value of 4000000 or greater:\n\n auth required pam_faildelay.so delay=4000000"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000480-GPOS-00226","gid":"V-238237","rid":"SV-238237r653886_rule","stig_id":"UBTU-20-010075","fix_id":"F-41406r653885_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238237' do\n title \"The Ubuntu operating system must enforce a delay of at least 4 seconds\nbetween logon prompts following a failed logon attempt.\"\n desc \"Limiting the number of logon attempts over a certain time interval\nreduces the chances that an unauthorized user may gain access to an account.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system enforces a delay of at least 4 seconds\nbetween logon prompts following a failed logon attempt with the following\ncommand:\n\n $ grep pam_faildelay /etc/pam.d/common-auth\n\n auth required pam_faildelay.so delay=4000000\n\n If the line is not present or is commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enforce a delay of at least 4\nseconds between logon prompts following a failed logon attempt.\n\n Edit the file \\\"/etc/pam.d/common-auth\\\" and set the parameter\n\\\"pam_faildelay\\\" to a value of 4000000 or greater:\n\n auth required pam_faildelay.so delay=4000000\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000480-GPOS-00226'\n tag gid: 'V-238237'\n tag rid: 'SV-238237r653886_rule'\n tag stig_id: 'UBTU-20-010075'\n tag fix_id: 'F-41406r653885_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe file('/etc/pam.d/common-auth') do\n it { should exist }\n end\n\n describe command('grep pam_faildelay /etc/pam.d/common-auth') do\n its('exit_status') { should eq 0 }\n its('stdout.strip') { should match /^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=([4-9][\\d]{6,}|[1-9][\\d]{7,}).*$/ }\n end\n\n file('/etc/pam.d/common-auth').content.to_s.scan(/^\\s*auth\\s+required\\s+pam_faildelay.so\\s+.*delay=(\\d+).*$/).flatten.each do |entry|\n describe entry do\n it { should cmp >= 4_000_000 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238237.rb","line":3},"id":"V-238237"},{"title":"The Ubuntu operating system must have system commands owned by root.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":{"default":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","rationale":"","check":"Verify the system commands contained in the following directories are owned\nby root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Use the following command for the check:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type f -exec stat -c \"%n %U\" '{}' \\;\n\n If any system commands are returned, this is a finding.","fix":"Configure the system commands and their respective parent directories to be\nprotected from unauthorized access. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type f -exec chown root '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238377","rid":"SV-238377r654306_rule","stig_id":"UBTU-20-010457","fix_id":"F-41546r654305_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238377' do\n title 'The Ubuntu operating system must have system commands owned by root.'\n desc \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system commands contained in the following directories are owned\nby root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Use the following command for the check:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type f -exec stat -c \\\"%n %U\\\" '{}' \\\\;\n\n If any system commands are returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the system commands and their respective parent directories to be\nprotected from unauthorized access. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type f -exec chown root '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238377'\n tag rid: 'SV-238377r654306_rule'\n tag stig_id: 'UBTU-20-010457'\n tag fix_id: 'F-41546r654305_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n system_commands = command(\"find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type f\").stdout.strip.split(\"\\n\").entries\n valid_system_commands = Set[]\n\n if system_commands.count > 0\n system_commands.each do |sys_cmd|\n if file(sys_cmd).exist?\n valid_system_commands = valid_system_commands << sys_cmd\n end\n end\n end\n\n if valid_system_commands.count > 0\n valid_system_commands.each do |val_sys_cmd|\n describe file(val_sys_cmd) do\n its(\"owner\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are NOT owned by root\" do\n subject { valid_system_commands }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238377.rb","line":3},"id":"V-238377"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchownat system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"fchownat\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep fchownat\n\n -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchownat\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238266","rid":"SV-238266r653973_rule","stig_id":"UBTU-20-010150","fix_id":"F-41435r653972_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238266' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchownat system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"fchownat\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep fchownat\n\n -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchownat\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238266'\n tag rid: 'SV-238266r653973_rule'\n tag stig_id: 'UBTU-20-010150'\n tag fix_id: 'F-41435r653972_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('fchownat').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('fchownat').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238266.rb","line":3},"id":"V-238266"},{"title":"The Ubuntu operating system must not have the telnet package\ninstalled.","desc":"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.","descriptions":{"default":"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.","rationale":"","check":"Verify that the telnet package is not installed on the Ubuntu operating\nsystem by running the following command:\n\n $ dpkg -l | grep telnetd\n\n If the package is installed, this is a finding.","fix":"Remove the telnet package from the Ubuntu operating system by running the\nfollowing command:\n\n $ sudo apt-get remove telnetd"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000074-GPOS-00042","gid":"V-238326","rid":"SV-238326r654153_rule","stig_id":"UBTU-20-010405","fix_id":"F-41495r654152_fix","cci":["CCI-000197"],"legacy":[],"nist":["IA-5 (1) (c)"]},"code":"control 'V-238326' do\n title \"The Ubuntu operating system must not have the telnet package\ninstalled.\"\n desc \"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the telnet package is not installed on the Ubuntu operating\nsystem by running the following command:\n\n $ dpkg -l | grep telnetd\n\n If the package is installed, this is a finding.\n \"\n desc 'fix', \"\n Remove the telnet package from the Ubuntu operating system by running the\nfollowing command:\n\n $ sudo apt-get remove telnetd\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000074-GPOS-00042'\n tag gid: 'V-238326'\n tag rid: 'SV-238326r654153_rule'\n tag stig_id: 'UBTU-20-010405'\n tag fix_id: 'F-41495r654152_fix'\n tag cci: ['CCI-000197']\n tag legacy: []\n tag nist: ['IA-5 (1) (c)']\n\n describe package('telnetd') do\n it { should_not be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238326.rb","line":3},"id":"V-238326"},{"title":"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of rename system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of rename system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep rename\n\n -a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of the rename system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b64 -S rename -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000468-GPOS-00212","gid":"V-238312","rid":"SV-238312r654111_rule","stig_id":"UBTU-20-010269","fix_id":"F-41481r654110_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238312' do\n title \"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of rename system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of rename system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep rename\n\n -a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of the rename system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b64 -S rename -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000468-GPOS-00212'\n tag gid: 'V-238312'\n tag rid: 'SV-238312r654111_rule'\n tag stig_id: 'UBTU-20-010269'\n tag fix_id: 'F-41481r654110_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"rename\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"rename\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238312.rb","line":3},"id":"V-238312"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the su command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \"su\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/bin/su'\n\n -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-priv_change\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate audit records when\nsuccessful/unsuccessful attempts to use the \"su\" command occur.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-priv_change\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238252","rid":"SV-238252r653931_rule","stig_id":"UBTU-20-010136","fix_id":"F-41421r653930_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238252' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the su command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \\\"su\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/bin/su'\n\n -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-priv_change\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate audit records when\nsuccessful/unsuccessful attempts to use the \\\"su\\\" command occur.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295\n-k privileged-priv_change\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238252'\n tag rid: 'SV-238252r653931_rule'\n tag stig_id: 'UBTU-20-010136'\n tag fix_id: 'F-41421r653930_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/bin/su'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238252.rb","line":3},"id":"V-238252"},{"title":"The Ubuntu operating system must configure /var/log/syslog file with\nmode 0640 or less permissive.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":{"default":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","rationale":"","check":"Verify that the Ubuntu operating system configures the \"/var/log/syslog\"\nfile with mode 0640 or less permissive by running the following command:\n\n $ sudo stat -c \"%n %a\" /var/log/syslog\n\n /var/log/syslog 640\n\n If a value of \"640\" or less permissive is not returned, this is a finding.","fix":"Configure the Ubuntu operating system to have permissions of 0640 for the\n\"/var/log/syslog\" file by running the following command:\n\n $ sudo chmod 0640 /var/log/syslog"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-238343","rid":"SV-238343r654204_rule","stig_id":"UBTU-20-010422","fix_id":"F-41512r654203_fix","cci":["CCI-001314"],"legacy":[],"nist":["SI-11 b"]},"code":"control 'V-238343' do\n title \"The Ubuntu operating system must configure /var/log/syslog file with\nmode 0640 or less permissive.\"\n desc \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system configures the \\\"/var/log/syslog\\\"\nfile with mode 0640 or less permissive by running the following command:\n\n $ sudo stat -c \\\"%n %a\\\" /var/log/syslog\n\n /var/log/syslog 640\n\n If a value of \\\"640\\\" or less permissive is not returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to have permissions of 0640 for the\n\\\"/var/log/syslog\\\" file by running the following command:\n\n $ sudo chmod 0640 /var/log/syslog\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000206-GPOS-00084'\n tag gid: 'V-238343'\n tag rid: 'SV-238343r654204_rule'\n tag stig_id: 'UBTU-20-010422'\n tag fix_id: 'F-41512r654203_fix'\n tag cci: ['CCI-001314']\n tag legacy: []\n tag nist: ['SI-11 b']\n\n describe file('/var/log/syslog') do\n it { should_not be_more_permissive_than('0640') }\n end\nend\n","source_location":{"ref":"./controls/V-238343.rb","line":3},"id":"V-238343"},{"title":"The Ubuntu operating system must enforce a 60-day maximum password\nlifetime restriction. Passwords for new users must have a 60-day maximum\npassword lifetime restriction.","desc":"Any password, no matter how complex, can eventually be cracked.\nTherefore, passwords need to be changed periodically. If the operating system\ndoes not limit the lifetime of passwords and force users to change their\npasswords, there is the risk that the operating system passwords could be\ncompromised.","descriptions":{"default":"Any password, no matter how complex, can eventually be cracked.\nTherefore, passwords need to be changed periodically. If the operating system\ndoes not limit the lifetime of passwords and force users to change their\npasswords, there is the risk that the operating system passwords could be\ncompromised.","rationale":"","check":"Verify the Ubuntu operating system enforces a 60-day maximum password\nlifetime for new user accounts by running the following command:\n\n $ grep -i ^pass_max_days /etc/login.defs\n PASS_MAX_DAYS 60\n\n If the \"PASS_MAX_DAYS\" parameter value is less than \"60\" or is\ncommented out, this is a finding.","fix":"Configure the Ubuntu operating system to enforce a 60-day maximum password\nlifetime.\n\n Add or modify the following line in the \"/etc/login.defs\" file:\n\n PASS_MAX_DAYS 60"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000076-GPOS-00044","gid":"V-238203","rid":"SV-238203r653784_rule","stig_id":"UBTU-20-010008","fix_id":"F-41372r653783_fix","cci":["CCI-000199"],"legacy":[],"nist":["IA-5 (1) (d)"]},"code":"control 'V-238203' do\n title \"The Ubuntu operating system must enforce a 60-day maximum password\nlifetime restriction. Passwords for new users must have a 60-day maximum\npassword lifetime restriction.\"\n desc \"Any password, no matter how complex, can eventually be cracked.\nTherefore, passwords need to be changed periodically. If the operating system\ndoes not limit the lifetime of passwords and force users to change their\npasswords, there is the risk that the operating system passwords could be\ncompromised.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system enforces a 60-day maximum password\nlifetime for new user accounts by running the following command:\n\n $ grep -i ^pass_max_days /etc/login.defs\n PASS_MAX_DAYS 60\n\n If the \\\"PASS_MAX_DAYS\\\" parameter value is less than \\\"60\\\" or is\ncommented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enforce a 60-day maximum password\nlifetime.\n\n Add or modify the following line in the \\\"/etc/login.defs\\\" file:\n\n PASS_MAX_DAYS 60\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000076-GPOS-00044'\n tag gid: 'V-238203'\n tag rid: 'SV-238203r653784_rule'\n tag stig_id: 'UBTU-20-010008'\n tag fix_id: 'F-41372r653783_fix'\n tag cci: ['CCI-000199']\n tag legacy: []\n tag nist: ['IA-5 (1) (d)']\n\n describe login_defs do\n its('PASS_MAX_DAYS') { should cmp <= 60 }\n end\nend\n","source_location":{"ref":"./controls/V-238203.rb","line":3},"id":"V-238203"},{"title":"The Ubuntu operating system must implement NIST FIPS-validated\ncryptography to protect classified information and for the following: to\nprovision digital signatures, to generate cryptographic hashes, and to protect\nunclassified information requiring confidentiality and cryptographic protection\nin accordance with applicable federal laws, Executive Orders, directives,\npolicies, regulations, and standards.","desc":"Use of weak or untested encryption algorithms undermines the purposes\nof utilizing encryption to protect data. The operating system must implement\ncryptographic modules adhering to the higher standards approved by the federal\ngovernment since this provides assurance they have been tested and validated.","descriptions":{"default":"Use of weak or untested encryption algorithms undermines the purposes\nof utilizing encryption to protect data. The operating system must implement\ncryptographic modules adhering to the higher standards approved by the federal\ngovernment since this provides assurance they have been tested and validated.","rationale":"","check":"Verify the system is configured to run in FIPS mode with the following\ncommand:\n\n $ grep -i 1 /proc/sys/crypto/fips_enabled\n 1\n\n If a value of \"1\" is not returned, this is a finding.","fix":"Configure the system to run in FIPS mode. Add \"fips=1\" to the kernel\nparameter during the Ubuntu operating systems install.\n\n Enabling a FIPS mode on a pre-existing system involves a number of\nmodifications to the Ubuntu operating system. Refer to the Ubuntu Server 18.04\nFIPS 140-2 security policy document for instructions.\n\n A subscription to the \"Ubuntu Advantage\" plan is required in order to\nobtain the FIPS Kernel cryptographic modules and enable FIPS."},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000396-GPOS-00176","satisfies":["SRG-OS-000396-GPOS-00176","SRG-OS-000478-GPOS-00223"],"gid":"V-238363","rid":"SV-238363r654320_rule","stig_id":"UBTU-20-010442","fix_id":"F-41532r654263_fix","cci":["CCI-002450"],"legacy":[],"nist":["SC-13"]},"code":"control 'V-238363' do\n title \"The Ubuntu operating system must implement NIST FIPS-validated\ncryptography to protect classified information and for the following: to\nprovision digital signatures, to generate cryptographic hashes, and to protect\nunclassified information requiring confidentiality and cryptographic protection\nin accordance with applicable federal laws, Executive Orders, directives,\npolicies, regulations, and standards.\"\n desc \"Use of weak or untested encryption algorithms undermines the purposes\nof utilizing encryption to protect data. The operating system must implement\ncryptographic modules adhering to the higher standards approved by the federal\ngovernment since this provides assurance they have been tested and validated.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system is configured to run in FIPS mode with the following\ncommand:\n\n $ grep -i 1 /proc/sys/crypto/fips_enabled\n 1\n\n If a value of \\\"1\\\" is not returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the system to run in FIPS mode. Add \\\"fips=1\\\" to the kernel\nparameter during the Ubuntu operating systems install.\n\n Enabling a FIPS mode on a pre-existing system involves a number of\nmodifications to the Ubuntu operating system. Refer to the Ubuntu Server 18.04\nFIPS 140-2 security policy document for instructions.\n\n A subscription to the \\\"Ubuntu Advantage\\\" plan is required in order to\nobtain the FIPS Kernel cryptographic modules and enable FIPS.\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000396-GPOS-00176'\n tag satisfies: ['SRG-OS-000396-GPOS-00176', 'SRG-OS-000478-GPOS-00223']\n tag gid: 'V-238363'\n tag rid: 'SV-238363r654320_rule'\n tag stig_id: 'UBTU-20-010442'\n tag fix_id: 'F-41532r654263_fix'\n tag cci: ['CCI-002450']\n tag legacy: []\n tag nist: ['SC-13']\n\n config_file = '/proc/sys/crypto/fips_enabled'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe file(config_file) do\n its('content') { should match %r{\\A1\\Z} }\n end\n else\n describe ('FIPS is enabled') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238363.rb","line":3},"id":"V-238363"},{"title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one numeric character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","descriptions":{"default":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","rationale":"","check":"Verify the Ubuntu operating system enforces password complexity by\nrequiring that at least one numeric character be used.\n\n Determine if the field \"dcredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n $ grep -i \"dcredit\" /etc/security/pwquality.conf\n dcredit=-1\n\n If the \"dcredit\" parameter is greater than \"-1\" or is commented out,\nthis is a finding.","fix":"Configure the Ubuntu operating system to enforce password complexity by\nrequiring that at least one numeric character be used.\n\n Add or update the \"/etc/security/pwquality.conf\" file to contain the\n\"dcredit\" parameter:\n\n dcredit=-1"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000071-GPOS-00039","gid":"V-238223","rid":"SV-238223r653844_rule","stig_id":"UBTU-20-010052","fix_id":"F-41392r653843_fix","cci":["CCI-000194"],"legacy":[],"nist":["IA-5 (1) (a)"]},"code":"control 'V-238223' do\n title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one numeric character be used.\"\n desc \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system enforces password complexity by\nrequiring that at least one numeric character be used.\n\n Determine if the field \\\"dcredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n $ grep -i \\\"dcredit\\\" /etc/security/pwquality.conf\n dcredit=-1\n\n If the \\\"dcredit\\\" parameter is greater than \\\"-1\\\" or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enforce password complexity by\nrequiring that at least one numeric character be used.\n\n Add or update the \\\"/etc/security/pwquality.conf\\\" file to contain the\n\\\"dcredit\\\" parameter:\n\n dcredit=-1\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000071-GPOS-00039'\n tag gid: 'V-238223'\n tag rid: 'SV-238223r653844_rule'\n tag stig_id: 'UBTU-20-010052'\n tag fix_id: 'F-41392r653843_fix'\n tag cci: ['CCI-000194']\n tag legacy: []\n tag nist: ['IA-5 (1) (a)']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('dcredit') { should cmp -1 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238223.rb","line":3},"id":"V-238223"},{"title":"The Ubuntu operating system must set a sticky bit on all public\ndirectories to prevent unauthorized and unintended information transferred via\nshared system resources.","desc":"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government\nagencies.\n\n There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.","descriptions":{"default":"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government\nagencies.\n\n There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.","rationale":"","check":"Verify that all public (world-writeable) directories have the public sticky\nbit set.\n\n Find world-writable directories that lack the sticky bit by running the\nfollowing command:\n\n $ sudo find / -type d -perm -002 ! -perm -1000\n\n If any world-writable directories are found missing the sticky bit, this is\na finding.","fix":"Configure all public directories to have the sticky bit set to prevent\nunauthorized and unintended information transferred via shared system\nresources.\n\n Set the sticky bit on all public directories using the following command,\nreplacing \"[Public Directory]\" with any directory path missing the sticky\nbit:\n\n $ sudo chmod +t [Public Directory]"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000138-GPOS-00069","gid":"V-238332","rid":"SV-238332r654171_rule","stig_id":"UBTU-20-010411","fix_id":"F-41501r654170_fix","cci":["CCI-001090"],"legacy":[],"nist":["SC-4"]},"code":"control 'V-238332' do\n title \"The Ubuntu operating system must set a sticky bit on all public\ndirectories to prevent unauthorized and unintended information transferred via\nshared system resources.\"\n desc \"Preventing unauthorized information transfers mitigates the risk of\ninformation, including encrypted representations of information, produced by\nthe actions of prior users/roles (or the actions of processes acting on behalf\nof prior users/roles) from being available to any current users/roles (or\ncurrent processes) that obtain access to shared system resources (e.g.,\nregisters, main memory, hard disks) after those resources have been released\nback to information systems. The control of information in shared resources is\nalso commonly referred to as object reuse and residual information protection.\n\n This requirement generally applies to the design of an information\ntechnology product, but it can also apply to the configuration of particular\ninformation system components that are, or use, such products. This can be\nverified by acceptance/validation processes in DoD or other government\nagencies.\n\n There may be shared resources with configurable protections (e.g., files in\nstorage) that may be assessed on specific information system components.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that all public (world-writeable) directories have the public sticky\nbit set.\n\n Find world-writable directories that lack the sticky bit by running the\nfollowing command:\n\n $ sudo find / -type d -perm -002 ! -perm -1000\n\n If any world-writable directories are found missing the sticky bit, this is\na finding.\n \"\n desc 'fix', \"\n Configure all public directories to have the sticky bit set to prevent\nunauthorized and unintended information transferred via shared system\nresources.\n\n Set the sticky bit on all public directories using the following command,\nreplacing \\\"[Public Directory]\\\" with any directory path missing the sticky\nbit:\n\n $ sudo chmod +t [Public Directory]\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000138-GPOS-00069'\n tag gid: 'V-238332'\n tag rid: 'SV-238332r654171_rule'\n tag stig_id: 'UBTU-20-010411'\n tag fix_id: 'F-41501r654170_fix'\n tag cci: ['CCI-001090']\n tag legacy: []\n tag nist: ['SC-4']\n\n lines = command('find / -xdev -type d \\( -perm -0002 -a ! -perm -1000 \\) -print 2>/dev/null').stdout.strip.split(\"\\n\").entries\n if lines.count > 0\n lines.each do |line|\n dir = line.strip\n describe directory(dir) do\n it { should be_sticky }\n end\n end\n else\n describe 'Sticky bit has been set on all world writable directories' do\n subject { lines }\n its('count') { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238332.rb","line":3},"id":"V-238332"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the truncate system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \"truncate\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep truncate\n -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any unsuccessful\nuse of the \"truncate\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000474-GPOS-00219"],"gid":"V-238272","rid":"SV-238272r653991_rule","stig_id":"UBTU-20-010156","fix_id":"F-41441r653990_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238272' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the truncate system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \\\"truncate\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep truncate\n -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any unsuccessful\nuse of the \\\"truncate\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000474-GPOS-00219']\n tag gid: 'V-238272'\n tag rid: 'SV-238272r653991_rule'\n tag stig_id: 'UBTU-20-010156'\n tag fix_id: 'F-41441r653990_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('truncate').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('truncate').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\n end\n describe auditd.syscall('truncate').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('truncate').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\nend\n","source_location":{"ref":"./controls/V-238272.rb","line":3},"id":"V-238272"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chcon command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"chcon\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep chcon\n\n -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1\n-k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chcon\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238281","rid":"SV-238281r654018_rule","stig_id":"UBTU-20-010165","fix_id":"F-41450r654017_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238281' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chcon command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"chcon\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep chcon\n\n -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1\n-k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chcon\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238281'\n tag rid: 'SV-238281r654018_rule'\n tag stig_id: 'UBTU-20-010165'\n tag fix_id: 'F-41450r654017_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/chcon'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238281.rb","line":3},"id":"V-238281"},{"title":"The Ubuntu operating system must be configured to permit only\nauthorized users ownership of the audit log files.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.","descriptions":{"default":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.","rationale":"","check":"Verify the audit log files are owned by \"root\" account.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\naudit log files are owned by the \"root\" user by using the following command:\n\n $ sudo stat -c \"%n %U\" /var/log/audit/*\n /var/log/audit/audit.log root\n\n If the audit log files are owned by an user other than \"root\", this is a\nfinding.","fix":"Configure the audit log directory and its underlying files to be owned by\n\"root\" user.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log files to be owned by \"root\" user by using the following command:\n\n $ sudo chown root /var/log/audit/*"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-238246","rid":"SV-238246r653913_rule","stig_id":"UBTU-20-010123","fix_id":"F-41415r653912_fix","cci":["CCI-000162"],"legacy":[],"nist":["AU-9"]},"code":"control 'V-238246' do\n title \"The Ubuntu operating system must be configured to permit only\nauthorized users ownership of the audit log files.\"\n desc \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the audit log files are owned by \\\"root\\\" account.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\naudit log files are owned by the \\\"root\\\" user by using the following command:\n\n $ sudo stat -c \\\"%n %U\\\" /var/log/audit/*\n /var/log/audit/audit.log root\n\n If the audit log files are owned by an user other than \\\"root\\\", this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the audit log directory and its underlying files to be owned by\n\\\"root\\\" user.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log files to be owned by \\\"root\\\" user by using the following command:\n\n $ sudo chown root /var/log/audit/*\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000057-GPOS-00027'\n tag satisfies: ['SRG-OS-000057-GPOS-00027', 'SRG-OS-000058-GPOS-00028',\n'SRG-OS-000059-GPOS-00029']\n tag gid: 'V-238246'\n tag rid: 'SV-238246r653913_rule'\n tag stig_id: 'UBTU-20-010123'\n tag fix_id: 'F-41415r653912_fix'\n tag cci: ['CCI-000162']\n tag legacy: []\n tag nist: ['AU-9']\n\n log_file = auditd_conf.log_file\n\n log_file_exists = !log_file.nil?\n if log_file_exists\n describe file(log_file) do\n its('owner') { should cmp 'root' }\n end\n else\n describe ('Audit log file ' + log_file + ' exists') do\n subject { log_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238246.rb","line":3},"id":"V-238246"},{"title":"The Ubuntu operating system audit event multiplexor must be configured\nto off-load audit logs onto a different system or storage media from the system\nbeing audited.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n Off-loading is a common process in information systems with limited audit\nstorage capacity.","descriptions":{"default":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n Off-loading is a common process in information systems with limited audit\nstorage capacity.","rationale":"","check":"Verify the audit event multiplexor is configured to offload audit records\nto a different system or storage media from the system being audited.\n\n Check that audisp-remote plugin is installed:\n\n $ sudo dpkg -s audispd-plugins\n\n If status is \"not installed\", this is a finding.\n\n Check that the records are being offloaded to a remote server with the\nfollowing command:\n\n $ sudo grep -i active /etc/audisp/plugins.d/au-remote.conf\n\n active = yes\n\n If \"active\" is not set to \"yes\", or the line is commented out, this is\na finding.\n\n Check that audisp-remote plugin is configured to send audit logs to a\ndifferent system:\n\n $ sudo grep -i ^remote_server /etc/audisp/audisp-remote.conf\n\n remote_server = 192.168.122.126\n\n If the \"remote_server\" parameter is not set, is set with a local address,\nor is set with an invalid address, this is a finding.","fix":"Configure the audit event multiplexor to offload audit records to a\ndifferent system or storage media from the system being audited.\n\n Install the audisp-remote plugin:\n\n $ sudo apt-get install audispd-plugins -y\n\n Set the audisp-remote plugin as active by editing the\n\"/etc/audisp/plugins.d/au-remote.conf\" file:\n\n $ sudo sed -i -E 's/active\\s*=\\s*no/active = yes/'\n/etc/audisp/plugins.d/au-remote.conf\n\n Set the address of the remote machine by editing the\n\"/etc/audisp/audisp-remote.conf\" file:\n\n $ sudo sed -i -E 's/(remote_server\\s*=).*/\\1 /'\n/etc/audisp/audisp-remote.conf\n\n where must be substituted by the address of the remote server\nreceiving the audit log.\n\n Make the audit service reload its configuration files:\n\n $ sudo systemctl restart auditd.service"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000342-GPOS-00133","satisfies":["SRG-OS-000342-GPOS-00133","SRG-OS-000479-GPOS-00224"],"gid":"V-238306","rid":"SV-238306r654093_rule","stig_id":"UBTU-20-010216","fix_id":"F-41475r654092_fix","cci":["CCI-001851"],"legacy":[],"nist":["AU-4 (1)"]},"code":"control 'V-238306' do\n title \"The Ubuntu operating system audit event multiplexor must be configured\nto off-load audit logs onto a different system or storage media from the system\nbeing audited.\"\n desc \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n Off-loading is a common process in information systems with limited audit\nstorage capacity.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the audit event multiplexor is configured to offload audit records\nto a different system or storage media from the system being audited.\n\n Check that audisp-remote plugin is installed:\n\n $ sudo dpkg -s audispd-plugins\n\n If status is \\\"not installed\\\", this is a finding.\n\n Check that the records are being offloaded to a remote server with the\nfollowing command:\n\n $ sudo grep -i active /etc/audisp/plugins.d/au-remote.conf\n\n active = yes\n\n If \\\"active\\\" is not set to \\\"yes\\\", or the line is commented out, this is\na finding.\n\n Check that audisp-remote plugin is configured to send audit logs to a\ndifferent system:\n\n $ sudo grep -i ^remote_server /etc/audisp/audisp-remote.conf\n\n remote_server = 192.168.122.126\n\n If the \\\"remote_server\\\" parameter is not set, is set with a local address,\nor is set with an invalid address, this is a finding.\n \"\n desc 'fix', \"\n Configure the audit event multiplexor to offload audit records to a\ndifferent system or storage media from the system being audited.\n\n Install the audisp-remote plugin:\n\n $ sudo apt-get install audispd-plugins -y\n\n Set the audisp-remote plugin as active by editing the\n\\\"/etc/audisp/plugins.d/au-remote.conf\\\" file:\n\n $ sudo sed -i -E 's/active\\\\s*=\\\\s*no/active = yes/'\n/etc/audisp/plugins.d/au-remote.conf\n\n Set the address of the remote machine by editing the\n\\\"/etc/audisp/audisp-remote.conf\\\" file:\n\n $ sudo sed -i -E 's/(remote_server\\\\s*=).*/\\\\1 /'\n/etc/audisp/audisp-remote.conf\n\n where must be substituted by the address of the remote server\nreceiving the audit log.\n\n Make the audit service reload its configuration files:\n\n $ sudo systemctl restart auditd.service\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000342-GPOS-00133'\n tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']\n tag gid: 'V-238306'\n tag rid: 'SV-238306r654093_rule'\n tag stig_id: 'UBTU-20-010216'\n tag fix_id: 'F-41475r654092_fix'\n tag cci: ['CCI-001851']\n tag legacy: []\n tag nist: ['AU-4 (1)']\n \n config_file = '/etc/audisp/plugins.d/au-remote.conf'\n config_file_exists = file(config_file).exist?\n audit_sp_remote_server= input(\"audit_sp_remote_server\")\n\n describe package('audispd-plugins') do\n it { should be_installed }\n end\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('active') { should cmp 'yes' }\n its('remote_server') { should cmp audit_sp_remote_server }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238306.rb","line":3},"id":"V-238306"},{"title":"The Ubuntu operating system must configure the SSH daemon to use FIPS\n140-2 approved ciphers to prevent the unauthorized disclosure of information\nand/or detect changes to information during transmission.","desc":"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless.\n\n Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network.\n\n Local maintenance and diagnostic activities are those activities carried\nout by individuals physically present at the information system or information\nsystem component and not communicating across a network connection.\n\n Encrypting information for transmission protects information from\nunauthorized disclosure and modification. Cryptographic mechanisms implemented\nto protect information integrity include, for example, cryptographic hash\nfunctions which have common application in digital signatures, checksums, and\nmessage authentication codes.\n\n By specifying a cipher list with the order of ciphers being in a\n\"strongest to weakest\" orientation, the system will automatically attempt to\nuse the strongest cipher for securing SSH connections.","descriptions":{"default":"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless.\n\n Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network.\n\n Local maintenance and diagnostic activities are those activities carried\nout by individuals physically present at the information system or information\nsystem component and not communicating across a network connection.\n\n Encrypting information for transmission protects information from\nunauthorized disclosure and modification. Cryptographic mechanisms implemented\nto protect information integrity include, for example, cryptographic hash\nfunctions which have common application in digital signatures, checksums, and\nmessage authentication codes.\n\n By specifying a cipher list with the order of ciphers being in a\n\"strongest to weakest\" orientation, the system will automatically attempt to\nuse the strongest cipher for securing SSH connections.","rationale":"","check":"Verify the SSH daemon is configured to only implement FIPS-approved\nalgorithms by running the following command:\n\n $ grep -E 'Ciphers ' /etc/ssh/sshd_config\n\n Ciphers aes256-ctr,aes192-ctr, aes128-ctr\n\n If any ciphers other than \"aes256-ctr\", \"aes192-ctr\", or \"aes128-ctr\"\nare listed, the order differs from the example above, the \"Ciphers\" keyword\nis missing, or the returned line is commented out, this is a finding.","fix":"Configure the Ubuntu operating system to allow the SSH daemon to only\nimplement FIPS-approved algorithms.\n\n Add the following line (or modify the line to have the required value) to\nthe \"/etc/ssh/sshd_config\" file (this file may be named differently or be in\na different location if using a version of SSH that is provided by a\nthird-party vendor):\n\n Ciphers aes256-ctr,aes192-ctr,aes128-ctr\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000424-GPOS-00188","satisfies":["SRG-OS-000424-GPOS-00188","SRG-OS-000033-GPOS-00014","SRG-OS-000394-GPOS-00174"],"gid":"V-238217","rid":"SV-238217r653826_rule","stig_id":"UBTU-20-010044","fix_id":"F-41386r653825_fix","cci":["CCI-000068","CCI-002421","CCI-003123"],"legacy":[],"nist":["AC-17 (2)","SC-8 (1)","MA-4 (6)"]},"code":"control 'V-238217' do\n title \"The Ubuntu operating system must configure the SSH daemon to use FIPS\n140-2 approved ciphers to prevent the unauthorized disclosure of information\nand/or detect changes to information during transmission.\"\n desc \"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless.\n\n Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network.\n\n Local maintenance and diagnostic activities are those activities carried\nout by individuals physically present at the information system or information\nsystem component and not communicating across a network connection.\n\n Encrypting information for transmission protects information from\nunauthorized disclosure and modification. Cryptographic mechanisms implemented\nto protect information integrity include, for example, cryptographic hash\nfunctions which have common application in digital signatures, checksums, and\nmessage authentication codes.\n\n By specifying a cipher list with the order of ciphers being in a\n\\\"strongest to weakest\\\" orientation, the system will automatically attempt to\nuse the strongest cipher for securing SSH connections.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the SSH daemon is configured to only implement FIPS-approved\nalgorithms by running the following command:\n\n $ grep -E 'Ciphers ' /etc/ssh/sshd_config\n\n Ciphers aes256-ctr,aes192-ctr, aes128-ctr\n\n If any ciphers other than \\\"aes256-ctr\\\", \\\"aes192-ctr\\\", or \\\"aes128-ctr\\\"\nare listed, the order differs from the example above, the \\\"Ciphers\\\" keyword\nis missing, or the returned line is commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to allow the SSH daemon to only\nimplement FIPS-approved algorithms.\n\n Add the following line (or modify the line to have the required value) to\nthe \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in\na different location if using a version of SSH that is provided by a\nthird-party vendor):\n\n Ciphers aes256-ctr,aes192-ctr,aes128-ctr\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000424-GPOS-00188'\n tag satisfies: ['SRG-OS-000424-GPOS-00188', 'SRG-OS-000033-GPOS-00014',\n'SRG-OS-000394-GPOS-00174']\n tag gid: 'V-238217'\n tag rid: 'SV-238217r653826_rule'\n tag stig_id: 'UBTU-20-010044'\n tag fix_id: 'F-41386r653825_fix'\n tag cci: ['CCI-000068', 'CCI-002421', 'CCI-003123']\n tag legacy: []\n tag nist: ['AC-17 (2)', 'SC-8 (1)', 'MA-4 (6)']\n\n @ciphers_array = inspec.sshd_config.params['ciphers']\n\n @ciphers_array = @ciphers_array.first.split(',') unless @ciphers_array.nil?\n\n describe @ciphers_array do\n it { should be_in %w[ aes256-ctr aes192-ctr aes128-ctr ] }\n end\nend\n","source_location":{"ref":"./controls/V-238217.rb","line":3},"id":"V-238217"},{"title":"The Ubuntu operating system must synchronize internal information\nsystem clocks to the authoritative time source when the time difference is\ngreater than one second.","desc":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events.\n\n Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network. Organizations should consider setting time periods\nfor different types of systems (e.g., financial, legal, or mission-critical\nsystems).\n\n Organizations should also consider endpoints that may not have regular\naccess to the authoritative time server (e.g., mobile, teleworking, and\ntactical endpoints). This requirement is related to the comparison done every\n24 hours in SRG-OS-000355 because a comparison must be done in order to\ndetermine the time difference.","descriptions":{"default":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events.\n\n Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network. Organizations should consider setting time periods\nfor different types of systems (e.g., financial, legal, or mission-critical\nsystems).\n\n Organizations should also consider endpoints that may not have regular\naccess to the authoritative time server (e.g., mobile, teleworking, and\ntactical endpoints). This requirement is related to the comparison done every\n24 hours in SRG-OS-000355 because a comparison must be done in order to\ndetermine the time difference.","rationale":"","check":"Verify the operating system synchronizes internal system clocks to the\nauthoritative time source when the time difference is greater than one second.\n\n Check the value of \"makestep\" by running the following command:\n\n $ sudo grep makestep /etc/chrony/chrony.conf\n\n makestep 1 -1\n\n If the makestep option is commented out or is not set to \"1 -1\", this is\na finding.","fix":"Configure chrony to synchronize the internal system clocks to the\nauthoritative source when the time difference is greater than one second by\ndoing the following:\n\n Edit the \"/etc/chrony/chrony.conf\" file and add:\n\n makestep 1 -1\n\n Restart the chrony service:\n\n $ sudo systemctl restart chrony.service"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000356-GPOS-00144","gid":"V-238357","rid":"SV-238357r654246_rule","stig_id":"UBTU-20-010436","fix_id":"F-41526r654245_fix","cci":["CCI-002046"],"legacy":[],"nist":["AU-8 (1) (b)"]},"code":"control 'V-238357' do\n title \"The Ubuntu operating system must synchronize internal information\nsystem clocks to the authoritative time source when the time difference is\ngreater than one second.\"\n desc \"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events.\n\n Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network. Organizations should consider setting time periods\nfor different types of systems (e.g., financial, legal, or mission-critical\nsystems).\n\n Organizations should also consider endpoints that may not have regular\naccess to the authoritative time server (e.g., mobile, teleworking, and\ntactical endpoints). This requirement is related to the comparison done every\n24 hours in SRG-OS-000355 because a comparison must be done in order to\ndetermine the time difference.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the operating system synchronizes internal system clocks to the\nauthoritative time source when the time difference is greater than one second.\n\n Check the value of \\\"makestep\\\" by running the following command:\n\n $ sudo grep makestep /etc/chrony/chrony.conf\n\n makestep 1 -1\n\n If the makestep option is commented out or is not set to \\\"1 -1\\\", this is\na finding.\n \"\n desc 'fix', \"\n Configure chrony to synchronize the internal system clocks to the\nauthoritative source when the time difference is greater than one second by\ndoing the following:\n\n Edit the \\\"/etc/chrony/chrony.conf\\\" file and add:\n\n makestep 1 -1\n\n Restart the chrony service:\n\n $ sudo systemctl restart chrony.service\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000356-GPOS-00144'\n tag gid: 'V-238357'\n tag rid: 'SV-238357r654246_rule'\n tag stig_id: 'UBTU-20-010436'\n tag fix_id: 'F-41526r654245_fix'\n tag cci: ['CCI-002046']\n tag legacy: []\n tag nist: ['AU-8 (1) (b)']\n\n chrony_file_path = '/etc/chrony/chrony.conf'\n chrony_file = file('/etc/chrony/chrony.conf')\n\n if chrony_file.exist?\n describe chrony_file do\n subject { chrony_file }\n its('content') { should match %r{^makestep 1 -1} }\n end\n else\n describe (chrony_file_path + ' exists') do\n subject { chrony_file.exist? }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238357.rb","line":3},"id":"V-238357"},{"title":"The Ubuntu operating system library files must have mode 0755 or less\npermissive.","desc":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","descriptions":{"default":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","rationale":"","check":"Verify the system-wide shared library files contained in the directories\n\"/lib\", \"/lib64\", and \"/usr/lib\" have mode 0755 or less permissive with\nthe following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type f -exec stat -c \"%n %a\"\n'{}' \\;\n /usr/lib64/pkcs11-spy.so\n\n If any files are found to be group-writable or world-writable, this is a\nfinding.","fix":"Configure the library files to be protected from unauthorized access. Run\nthe following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type f -exec chmod 755 '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238347","rid":"SV-238347r654216_rule","stig_id":"UBTU-20-010426","fix_id":"F-41516r654215_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238347' do\n title \"The Ubuntu operating system library files must have mode 0755 or less\npermissive.\"\n desc \" If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system-wide shared library files contained in the directories\n\\\"/lib\\\", \\\"/lib64\\\", and \\\"/usr/lib\\\" have mode 0755 or less permissive with\nthe following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type f -exec stat -c \\\"%n %a\\\"\n'{}' \\\\;\n /usr/lib64/pkcs11-spy.so\n\n If any files are found to be group-writable or world-writable, this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the library files to be protected from unauthorized access. Run\nthe following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type f -exec chmod 755 '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238347'\n tag rid: 'SV-238347r654216_rule'\n tag stig_id: 'UBTU-20-010426'\n tag fix_id: 'F-41516r654215_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n if os.arch == 'x86_64'\n library_files = command('find /lib /lib32 lib64 /usr/lib /usr/lib32 -perm /022 -type f').stdout.strip.split(\"\\n\").entries\n else\n library_files = command('find /lib /usr/lib /usr/lib32 /lib32 -perm /022 -type f').stdout.strip.split(\"\\n\").entries\n end\n\n if library_files.count > 0\n library_files.each do |lib_file|\n describe file(lib_file) do\n it { should_not be_more_permissive_than('0755') }\n end\n end\n else\n describe 'Number of system-wide shared library files found that are less permissive than 0755' do\n subject { library_files }\n its('count') { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238347.rb","line":3},"id":"V-238347"},{"title":"The Ubuntu operating system must automatically terminate a user\nsession after inactivity timeouts have expired.","desc":"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n This capability is typically reserved for specific operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.","descriptions":{"default":"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n This capability is typically reserved for specific operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.","rationale":"","check":"Verify the operating system automatically terminates a user session after\ninactivity timeouts have expired.\n\n Check that \"TMOUT\" environment variable is set in the\n\"/etc/bash.bashrc\" file or in any file inside the \"/etc/profile.d/\"\ndirectory by performing the following command:\n\n $ grep -E \"\\bTMOUT=[0-9]+\" /etc/bash.bashrc /etc/profile.d/*\n\n TMOUT=600\n\n If \"TMOUT\" is not set, or if the value is \"0\" or is commented out, this\nis a finding.","fix":"Configure the operating system to automatically terminate a user session\nafter inactivity timeouts have expired or at shutdown.\n\n Create the file \"/etc/profile.d/99-terminal_tmout.sh\" file if it does not\nexist.\n\n Modify or append the following line in the\n\"/etc/profile.d/99-terminal_tmout.sh \" file:\n\n TMOUT=600\n\n This will set a timeout value of 10 minutes for all future sessions.\n\n To set the timeout for the current sessions, execute the following command\nover the terminal session:\n\n $ export TMOUT=600"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000279-GPOS-00109","gid":"V-238207","rid":"SV-238207r653796_rule","stig_id":"UBTU-20-010013","fix_id":"F-41376r653795_fix","cci":["CCI-002361"],"legacy":[],"nist":["AC-12"]},"code":"control 'V-238207' do\n title \"The Ubuntu operating system must automatically terminate a user\nsession after inactivity timeouts have expired.\"\n desc \"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n This capability is typically reserved for specific operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the operating system automatically terminates a user session after\ninactivity timeouts have expired.\n\n Check that \\\"TMOUT\\\" environment variable is set in the\n\\\"/etc/bash.bashrc\\\" file or in any file inside the \\\"/etc/profile.d/\\\"\ndirectory by performing the following command:\n\n $ grep -E \\\"\\\\bTMOUT=[0-9]+\\\" /etc/bash.bashrc /etc/profile.d/*\n\n TMOUT=600\n\n If \\\"TMOUT\\\" is not set, or if the value is \\\"0\\\" or is commented out, this\nis a finding.\n \"\n desc 'fix', \"\n Configure the operating system to automatically terminate a user session\nafter inactivity timeouts have expired or at shutdown.\n\n Create the file \\\"/etc/profile.d/99-terminal_tmout.sh\\\" file if it does not\nexist.\n\n Modify or append the following line in the\n\\\"/etc/profile.d/99-terminal_tmout.sh \\\" file:\n\n TMOUT=600\n\n This will set a timeout value of 10 minutes for all future sessions.\n\n To set the timeout for the current sessions, execute the following command\nover the terminal session:\n\n $ export TMOUT=600\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000279-GPOS-00109'\n tag gid: 'V-238207'\n tag rid: 'SV-238207r653796_rule'\n tag stig_id: 'UBTU-20-010013'\n tag fix_id: 'F-41376r653795_fix'\n tag cci: ['CCI-002361']\n tag legacy: []\n tag nist: ['AC-12']\n\n profile_files=command('find /etc/profile.d/ /etc/bash.bashrc -type f').stdout.strip.split(\"\\n\").entries\n timeout=input(\"tmout\").to_s\n\n describe.one do\n profile_files.each do |pf|\n describe file(pf.strip) do\n its('content') { should match \"^TMOUT=#{timeout}$\" }\n end\n end\n end\nend\n","source_location":{"ref":"./controls/V-238207.rb","line":3},"id":"V-238207"},{"title":"The Ubuntu operating system must provision temporary user accounts\nwith an expiration time of 72 hours or less.","desc":"If temporary user accounts remain active when no longer needed or for\nan excessive period, these accounts may be used to gain unauthorized access. To\nmitigate this risk, automated termination of all temporary accounts must be set\nupon account creation.\n\n Temporary accounts are established as part of normal account activation\nprocedures when there is a need for short-term accounts without the demand for\nimmediacy in account activation.\n\n If temporary accounts are used, the operating system must be configured to\nautomatically terminate these types of accounts after a DoD-defined time period\nof 72 hours.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise-level authentication/access mechanisms that meet or exceed\naccess control policy requirements.","descriptions":{"default":"If temporary user accounts remain active when no longer needed or for\nan excessive period, these accounts may be used to gain unauthorized access. To\nmitigate this risk, automated termination of all temporary accounts must be set\nupon account creation.\n\n Temporary accounts are established as part of normal account activation\nprocedures when there is a need for short-term accounts without the demand for\nimmediacy in account activation.\n\n If temporary accounts are used, the operating system must be configured to\nautomatically terminate these types of accounts after a DoD-defined time period\nof 72 hours.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise-level authentication/access mechanisms that meet or exceed\naccess control policy requirements.","rationale":"","check":"Verify that the Ubuntu operating system expires temporary user accounts\nwithin 72 hours or less.\n\n For every existing temporary account, run the following command to obtain\nits account expiration information:\n\n $ sudo chage -l system_account_name | grep expires\n\n Password expires : Aug 07, 2019\n Account expires : Aug 07, 2019\n\n Verify that each of these accounts has an expiration date set within 72\nhours of account creation.\n\n If any temporary account does not expire within 72 hours of that account's\ncreation, this is a finding.","fix":"If a temporary account must be created, configure the system to terminate\nthe account after a 72-hour time period with the following command to set an\nexpiration date on it.\n\n Substitute \"system_account_name\" with the account to be created.\n\n $ sudo chage -E $(date -d \"+3 days\" +%F) system_account_name"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000002-GPOS-00002","gid":"V-238196","rid":"SV-238196r653763_rule","stig_id":"UBTU-20-010000","fix_id":"F-41365r653762_fix","cci":["CCI-000016"],"legacy":[],"nist":["AC-2 (2)"]},"code":"control 'V-238196' do\n title \"The Ubuntu operating system must provision temporary user accounts\nwith an expiration time of 72 hours or less.\"\n desc \"If temporary user accounts remain active when no longer needed or for\nan excessive period, these accounts may be used to gain unauthorized access. To\nmitigate this risk, automated termination of all temporary accounts must be set\nupon account creation.\n\n Temporary accounts are established as part of normal account activation\nprocedures when there is a need for short-term accounts without the demand for\nimmediacy in account activation.\n\n If temporary accounts are used, the operating system must be configured to\nautomatically terminate these types of accounts after a DoD-defined time period\nof 72 hours.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise-level authentication/access mechanisms that meet or exceed\naccess control policy requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system expires temporary user accounts\nwithin 72 hours or less.\n\n For every existing temporary account, run the following command to obtain\nits account expiration information:\n\n $ sudo chage -l system_account_name | grep expires\n\n Password expires : Aug 07, 2019\n Account expires : Aug 07, 2019\n\n Verify that each of these accounts has an expiration date set within 72\nhours of account creation.\n\n If any temporary account does not expire within 72 hours of that account's\ncreation, this is a finding.\n \"\n desc 'fix', \"\n If a temporary account must be created, configure the system to terminate\nthe account after a 72-hour time period with the following command to set an\nexpiration date on it.\n\n Substitute \\\"system_account_name\\\" with the account to be created.\n\n $ sudo chage -E $(date -d \\\"+3 days\\\" +%F) system_account_name\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000002-GPOS-00002'\n tag gid: 'V-238196'\n tag rid: 'SV-238196r653763_rule'\n tag stig_id: 'UBTU-20-010000'\n tag fix_id: 'F-41365r653762_fix'\n tag cci: ['CCI-000016']\n tag legacy: []\n tag nist: ['AC-2 (2)']\n\n temporary_accounts = input('temporary_accounts')\n\n if temporary_accounts.empty?\n describe 'Temporary accounts' do\n subject { temporary_accounts }\n it { should be_empty }\n end\n else\n temporary_accounts.each do |acct|\n describe command(\"chage -l #{acct} | grep 'Account expires'\") do\n its('stdout.strip') { should_not match /:\\s*never/ }\n end\n end\n end\nend\n","source_location":{"ref":"./controls/V-238196.rb","line":3},"id":"V-238196"},{"title":"The Ubuntu operating system must generate audit records for the\n/var/run/wtmp file.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records showing start\nand stop times for user access to the system via the \"/var/run/wtmp\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep '/var/run/wtmp'\n\n -w /var/run/wtmp -p wa -k logins\n\n If the command does not return a line matching the example or the line is\ncommented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate audit events showing start and stop\ntimes for user access via the \"/var/run/wtmp\" file.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/run/wtmp -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000472-GPOS-00217","gid":"V-238316","rid":"SV-238316r654123_rule","stig_id":"UBTU-20-010278","fix_id":"F-41485r654122_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238316' do\n title \"The Ubuntu operating system must generate audit records for the\n/var/run/wtmp file.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records showing start\nand stop times for user access to the system via the \\\"/var/run/wtmp\\\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep '/var/run/wtmp'\n\n -w /var/run/wtmp -p wa -k logins\n\n If the command does not return a line matching the example or the line is\ncommented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events showing start and stop\ntimes for user access via the \\\"/var/run/wtmp\\\" file.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/run/wtmp -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000472-GPOS-00217'\n tag gid: 'V-238316'\n tag rid: 'SV-238316r654123_rule'\n tag stig_id: 'UBTU-20-010278'\n tag fix_id: 'F-41485r654122_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n \n @audit_file = \"/var/run/wtmp\"\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its(\"permissions\") { should_not cmp [] }\n its(\"action\") { should_not include \"never\" }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include \"w\" }\n it { should include \"a\" }\n end\n end\n else\n describe (\"Audit line(s) for \" + @audit_file + \" exist\") do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238316.rb","line":3},"id":"V-238316"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the ssh-agent command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"ssh-agent\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/ssh-agent'\n\n -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=-1 -k privileged-ssh\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"ssh-agent\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238256","rid":"SV-238256r653943_rule","stig_id":"UBTU-20-010140","fix_id":"F-41425r653942_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238256' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the ssh-agent command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"ssh-agent\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/ssh-agent'\n\n -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=-1 -k privileged-ssh\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"ssh-agent\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-ssh\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238256'\n tag rid: 'SV-238256r653943_rule'\n tag stig_id: 'UBTU-20-010140'\n tag fix_id: 'F-41425r653942_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/ssh-agent'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238256.rb","line":3},"id":"V-238256"},{"title":"The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key\nsequence.","desc":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot.","descriptions":{"default":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot.","rationale":"","check":"Verify the Ubuntu operating system is not configured to reboot the system\nwhen Ctrl-Alt-Delete is pressed.\n\n Check that the \"ctrl-alt-del.target\" (otherwise also known as\nreboot.target) is not active with the following command:\n\n # systemctl status ctrl-alt-del.target\n reboot.target - Reboot\n Loaded: loaded (/usr/lib/systemd/system/reboot.target; disabled)\n Active: inactive (dead)\n Docs: man:systemd.special(7)\n\n If the \"ctrl-alt-del.target\" is active, this is a finding.","fix":"Configure the system to disable the Ctrl-Alt-Delete sequence for the\ncommand line with the following command:\n\n # sudo systemctl mask ctrl-alt-del.target\n\n Reload the daemon to take effect:\n\n # sudo systemctl daemon-reload"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-238380","rid":"SV-238380r654315_rule","stig_id":"UBTU-20-010460","fix_id":"F-41549r654314_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238380' do\n title \"The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key\nsequence.\"\n desc \"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is not configured to reboot the system\nwhen Ctrl-Alt-Delete is pressed.\n\n Check that the \\\"ctrl-alt-del.target\\\" (otherwise also known as\nreboot.target) is not active with the following command:\n\n # systemctl status ctrl-alt-del.target\n reboot.target - Reboot\n Loaded: loaded (/usr/lib/systemd/system/reboot.target; disabled)\n Active: inactive (dead)\n Docs: man:systemd.special(7)\n\n If the \\\"ctrl-alt-del.target\\\" is active, this is a finding.\n \"\n desc 'fix', \"\n Configure the system to disable the Ctrl-Alt-Delete sequence for the\ncommand line with the following command:\n\n # sudo systemctl mask ctrl-alt-del.target\n\n Reload the daemon to take effect:\n\n # sudo systemctl daemon-reload\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000480-GPOS-00227'\n tag gid: 'V-238380'\n tag rid: 'SV-238380r654315_rule'\n tag stig_id: 'UBTU-20-010460'\n tag fix_id: 'F-41549r654314_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe service('ctrl-alt-del.target') do\n it { should_not be_running }\n it { should_not be_enabled }\n end\nend\n","source_location":{"ref":"./controls/V-238380.rb","line":3},"id":"V-238380"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chage command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"chage\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w chage\n\n -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-chage\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"chage\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chage\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238291","rid":"SV-238291r654048_rule","stig_id":"UBTU-20-010175","fix_id":"F-41460r654047_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238291' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chage command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"chage\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w chage\n\n -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-chage\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"chage\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chage\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238291'\n tag rid: 'SV-238291r654048_rule'\n tag stig_id: 'UBTU-20-010175'\n tag fix_id: 'F-41460r654047_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/chage'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238291.rb","line":3},"id":"V-238291"},{"title":"The Ubuntu operating system must generate audit records for any use of\nthe lremovexattr system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify if the Ubuntu operating system is configured to audit the execution\nof the \"lremovexattr\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | lremovexattr\n\n -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"lremovexattr\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206","SRG-OS-000466-GPOS-00210"],"gid":"V-238262","rid":"SV-238262r653961_rule","stig_id":"UBTU-20-010146","fix_id":"F-41431r653960_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238262' do\n title \"The Ubuntu operating system must generate audit records for any use of\nthe lremovexattr system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify if the Ubuntu operating system is configured to audit the execution\nof the \\\"lremovexattr\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | lremovexattr\n\n -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"lremovexattr\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b64 -S lremovexattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206',\n'SRG-OS-000466-GPOS-00210']\n tag gid: 'V-238262'\n tag rid: 'SV-238262r653961_rule'\n tag stig_id: 'UBTU-20-010146'\n tag fix_id: 'F-41431r653960_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"lremovexattr\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"lremovexattr\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238262.rb","line":3},"id":"V-238262"},{"title":"The Ubuntu operating system must generate records for\nsuccessful/unsuccessful uses of delete_module syscall.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system is configured to audit the\n\"delete_module\" syscall by running the following command:\n\n $ sudo auditctl -l | egrep delete_module\n\n -a always,exit -F arch=b64 -S delete_module -F key=modules\n -a always,exit -F arch=b32 -S delete_module -F key=modules\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate an audit event for any\nuse of the \"delete_module\" system call.\n\n Add or update the following rule in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S delete_module -F key=modules\n -a always,exit -F arch=b64 -S delete_module -F key=modules\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000477-GPOS-00222","gid":"V-238322","rid":"SV-238322r654141_rule","stig_id":"UBTU-20-010302","fix_id":"F-41491r654140_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238322' do\n title \"The Ubuntu operating system must generate records for\nsuccessful/unsuccessful uses of delete_module syscall.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to audit the\n\\\"delete_module\\\" syscall by running the following command:\n\n $ sudo auditctl -l | egrep delete_module\n\n -a always,exit -F arch=b64 -S delete_module -F key=modules\n -a always,exit -F arch=b32 -S delete_module -F key=modules\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate an audit event for any\nuse of the \\\"delete_module\\\" system call.\n\n Add or update the following rule in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S delete_module -F key=modules\n -a always,exit -F arch=b64 -S delete_module -F key=modules\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000477-GPOS-00222'\n tag gid: 'V-238322'\n tag rid: 'SV-238322r654141_rule'\n tag stig_id: 'UBTU-20-010302'\n tag fix_id: 'F-41491r654140_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('delete_module').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('delete_module').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238322.rb","line":3},"id":"V-238322"},{"title":"The Ubuntu operating system for PKI-based authentication, must\nimplement a local cache of revocation data in case of the inability to access\nrevocation information via the network.","desc":"Without configuring a local cache of revocation data, there is the\npotential to allow access to users who are no longer authorized (users with\nrevoked certificates).","descriptions":{"default":"Without configuring a local cache of revocation data, there is the\npotential to allow access to users who are no longer authorized (users with\nrevoked certificates).","rationale":"","check":"Verify the Ubuntu operating system, for PKI-based authentication, uses\nlocal revocation data when unable to access it from the network.\n\n Verify that \"crl_offline\" or \"crl_auto\" is part of the \"cert_policy\"\ndefinition in \"/etc/pam_pkcs11/pam_pkcs11.conf\" using the following command:\n\n # sudo grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -E --\n'crl_auto|crl_offline'\n\n cert_policy = ca,signature,ocsp_on,crl_auto;\n\n If \"cert_policy\" is not set to include \"crl_auto\" or \"crl_offline\",\nthis is a finding.","fix":"Configure the Ubuntu operating system, for PKI-based authentication, to use\nlocal revocation data when unable to access the network to obtain it remotely.\n\n Add or update the \"cert_policy\" option in\n\"/etc/pam/_pkcs11/pam_pkcs11.conf\" to include \"crl_auto\" or\n\"crl_offline\".\n\n cert_policy = ca,signature,ocsp_on, crl_auto;\n\n If the system is missing an \"/etc/pam_pkcs11/\" directory and an\n\"/etc/pam_pkcs11/pam_pkcs11.conf\", find an example to copy into place and\nmodify accordingly at\n\"/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz\"."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000384-GPOS-00167","gid":"V-238233","rid":"SV-238233r653874_rule","stig_id":"UBTU-20-010066","fix_id":"F-41402r653873_fix","cci":["CCI-001991"],"legacy":[],"nist":["IA-5 (2) (d)"]},"code":"control 'V-238233' do\n title \"The Ubuntu operating system for PKI-based authentication, must\nimplement a local cache of revocation data in case of the inability to access\nrevocation information via the network.\"\n desc \"Without configuring a local cache of revocation data, there is the\npotential to allow access to users who are no longer authorized (users with\nrevoked certificates).\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system, for PKI-based authentication, uses\nlocal revocation data when unable to access it from the network.\n\n Verify that \\\"crl_offline\\\" or \\\"crl_auto\\\" is part of the \\\"cert_policy\\\"\ndefinition in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" using the following command:\n\n # sudo grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -E --\n'crl_auto|crl_offline'\n\n cert_policy = ca,signature,ocsp_on,crl_auto;\n\n If \\\"cert_policy\\\" is not set to include \\\"crl_auto\\\" or \\\"crl_offline\\\",\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system, for PKI-based authentication, to use\nlocal revocation data when unable to access the network to obtain it remotely.\n\n Add or update the \\\"cert_policy\\\" option in\n\\\"/etc/pam/_pkcs11/pam_pkcs11.conf\\\" to include \\\"crl_auto\\\" or\n\\\"crl_offline\\\".\n\n cert_policy = ca,signature,ocsp_on, crl_auto;\n\n If the system is missing an \\\"/etc/pam_pkcs11/\\\" directory and an\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\", find an example to copy into place and\nmodify accordingly at\n\\\"/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz\\\".\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000384-GPOS-00167'\n tag gid: 'V-238233'\n tag rid: 'SV-238233r653874_rule'\n tag stig_id: 'UBTU-20-010066'\n tag fix_id: 'F-41402r653873_fix'\n tag cci: ['CCI-001991']\n tag legacy: []\n tag nist: ['IA-5 (2) (d)']\n\n config_file_exists = file('/etc/pam_pkcs11/pam_pkcs11.conf').exist?\n if config_file_exists\n describe.one do\n describe parse_config_file('/etc/pam_pkcs11/pam_pkcs11.conf') do\n its('cert_policy') { should include 'crl_auto' }\n end\n describe parse_config_file('/etc/pam_pkcs11/pam_pkcs11.conf') do\n its('cert_policy') { should include 'crl_offline' }\n end\n end\n else\n describe '/etc/pam_pkcs11/pam_pkcs11.conf exists' do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238233.rb","line":3},"id":"V-238233"},{"title":"The Ubuntu operating system must display the date and time of the last\nsuccessful account logon upon logon.","desc":"Configuration settings are the set of parameters that can be changed\nin hardware, software, or firmware components of the system that affect the\nsecurity posture and/or functionality of the system. Security-related\nparameters are those parameters impacting the security state of the system,\nincluding the parameters required to satisfy other security control\nrequirements. Security-related parameters include, for example: registry\nsettings; account, file, directory permission settings; and settings for\nfunctions, ports, protocols, services, and remote connections.","descriptions":{"default":"Configuration settings are the set of parameters that can be changed\nin hardware, software, or firmware components of the system that affect the\nsecurity posture and/or functionality of the system. Security-related\nparameters are those parameters impacting the security state of the system,\nincluding the parameters required to satisfy other security control\nrequirements. Security-related parameters include, for example: registry\nsettings; account, file, directory permission settings; and settings for\nfunctions, ports, protocols, services, and remote connections.","rationale":"","check":"Verify users are provided with feedback on when account accesses last\noccurred.\n\n Check that \"pam_lastlog\" is used and not silent with the following\ncommand:\n\n $ grep pam_lastlog /etc/pam.d/login\n\n session required pam_lastlog.so showfailed\n\n If \"pam_lastlog\" is missing from \"/etc/pam.d/login\" file, is not\n\"required\", or the \"silent\" option is present, this is a finding.","fix":"Configure the Ubuntu operating system to provide users with feedback on\nwhen account accesses last occurred by setting the required configuration\noptions in \"/etc/pam.d/login\".\n\n Add the following line to the top of \"/etc/pam.d/login\":\n\n session required pam_lastlog.so showfailed"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-238373","rid":"SV-238373r654294_rule","stig_id":"UBTU-20-010453","fix_id":"F-41542r654293_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238373' do\n title \"The Ubuntu operating system must display the date and time of the last\nsuccessful account logon upon logon.\"\n desc \"Configuration settings are the set of parameters that can be changed\nin hardware, software, or firmware components of the system that affect the\nsecurity posture and/or functionality of the system. Security-related\nparameters are those parameters impacting the security state of the system,\nincluding the parameters required to satisfy other security control\nrequirements. Security-related parameters include, for example: registry\nsettings; account, file, directory permission settings; and settings for\nfunctions, ports, protocols, services, and remote connections.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify users are provided with feedback on when account accesses last\noccurred.\n\n Check that \\\"pam_lastlog\\\" is used and not silent with the following\ncommand:\n\n $ grep pam_lastlog /etc/pam.d/login\n\n session required pam_lastlog.so showfailed\n\n If \\\"pam_lastlog\\\" is missing from \\\"/etc/pam.d/login\\\" file, is not\n\\\"required\\\", or the \\\"silent\\\" option is present, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to provide users with feedback on\nwhen account accesses last occurred by setting the required configuration\noptions in \\\"/etc/pam.d/login\\\".\n\n Add the following line to the top of \\\"/etc/pam.d/login\\\":\n\n session required pam_lastlog.so showfailed\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000480-GPOS-00227'\n tag gid: 'V-238373'\n tag rid: 'SV-238373r654294_rule'\n tag stig_id: 'UBTU-20-010453'\n tag fix_id: 'F-41542r654293_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe command('grep pam_lastlog /etc/pam.d/login') do\n its('exit_status') { should eq 0 }\n its('stdout.strip') { should match /^\\s*session\\s+required\\s+pam_lastlog.so/ }\n its('stdout.strip') { should_not match /^\\s*session\\s+required\\s+pam_lastlog.so[\\s\\w\\d\\=]+.*silent/ }\n end\nend\n","source_location":{"ref":"./controls/V-238373.rb","line":3},"id":"V-238373"},{"title":"The Ubuntu operating system must be configured such that Pluggable\nAuthentication Module (PAM) prohibits the use of cached authentications after\none day.","desc":"If cached authentication information is out-of-date, the validity of\nthe authentication information may be questionable.","descriptions":{"default":"If cached authentication information is out-of-date, the validity of\nthe authentication information may be questionable.","rationale":"","check":"If smart card authentication is not being used on the system, this s Not\nApplicable.\n\n Verify that PAM prohibits the use of cached authentications after one day\nwith the following command:\n\n $ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf\n/etc/sssd/conf.d/*.conf\n\n offline_credentials_expiration = 1\n\n If \"offline_credentials_expiration\" is not set to a value of \"1\" in\n\"/etc/sssd/sssd.conf\" or in a file with a name ending in .conf in the\n\"/etc/sssd/conf.d/\" directory, this is a finding.","fix":"Configure PAM to prohibit the use of cached authentications after one day.\nAdd or change the following line in \"/etc/sssd/sssd.conf\" just below the line\n\"[pam]\":\n\n offline_credentials_expiration = 1\n\n Note: It is valid for this configuration to be in a file with a name that\nends with \".conf\" and does not begin with a \".\" in the\n\"/etc/sssd/conf.d/\" directory instead of the \"/etc/sssd/sssd.conf\" file."},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000383-GPOS-00166","gid":"V-238362","rid":"SV-238362r654261_rule","stig_id":"UBTU-20-010441","fix_id":"F-41531r654260_fix","cci":["CCI-002007"],"legacy":[],"nist":["IA-5 (13)"]},"code":"control 'V-238362' do\n title \"The Ubuntu operating system must be configured such that Pluggable\nAuthentication Module (PAM) prohibits the use of cached authentications after\none day.\"\n desc \"If cached authentication information is out-of-date, the validity of\nthe authentication information may be questionable.\"\n desc 'rationale', ''\n desc 'check', \"\n If smart card authentication is not being used on the system, this s Not\nApplicable.\n\n Verify that PAM prohibits the use of cached authentications after one day\nwith the following command:\n\n $ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf\n/etc/sssd/conf.d/*.conf\n\n offline_credentials_expiration = 1\n\n If \\\"offline_credentials_expiration\\\" is not set to a value of \\\"1\\\" in\n\\\"/etc/sssd/sssd.conf\\\" or in a file with a name ending in .conf in the\n\\\"/etc/sssd/conf.d/\\\" directory, this is a finding.\n \"\n desc 'fix', \"\n Configure PAM to prohibit the use of cached authentications after one day.\nAdd or change the following line in \\\"/etc/sssd/sssd.conf\\\" just below the line\n\\\"[pam]\\\":\n\n offline_credentials_expiration = 1\n\n Note: It is valid for this configuration to be in a file with a name that\nends with \\\".conf\\\" and does not begin with a \\\".\\\" in the\n\\\"/etc/sssd/conf.d/\\\" directory instead of the \\\"/etc/sssd/sssd.conf\\\" file.\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000383-GPOS-00166'\n tag gid: 'V-238362'\n tag rid: 'SV-238362r654261_rule'\n tag stig_id: 'UBTU-20-010441'\n tag fix_id: 'F-41531r654260_fix'\n tag cci: ['CCI-002007']\n tag legacy: []\n tag nist: ['IA-5 (13)']\n\n config_file = input('sssd_conf_path')\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('offline_credentials_expiration') { should cmp '1' }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238362.rb","line":3},"id":"V-238362"},{"title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one lower-case character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","descriptions":{"default":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","rationale":"","check":"Verify the Ubuntu operating system enforces password complexity by\nrequiring that at least one lower-case character be used.\n\n Determine if the field \"lcredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n $ grep -i \"lcredit\" /etc/security/pwquality.conf\n lcredit=-1\n\n If the \"lcredit\" parameter is greater than \"-1\" or is commented out,\nthis is a finding.","fix":"Add or update the \"/etc/security/pwquality.conf\" file to contain the\n\"lcredit\" parameter:\n\n lcredit=-1"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000070-GPOS-00038","gid":"V-238222","rid":"SV-238222r653841_rule","stig_id":"UBTU-20-010051","fix_id":"F-41391r653840_fix","cci":["CCI-000193"],"legacy":[],"nist":["IA-5 (1) (a)"]},"code":"control 'V-238222' do\n title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one lower-case character be used.\"\n desc \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system enforces password complexity by\nrequiring that at least one lower-case character be used.\n\n Determine if the field \\\"lcredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n $ grep -i \\\"lcredit\\\" /etc/security/pwquality.conf\n lcredit=-1\n\n If the \\\"lcredit\\\" parameter is greater than \\\"-1\\\" or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Add or update the \\\"/etc/security/pwquality.conf\\\" file to contain the\n\\\"lcredit\\\" parameter:\n\n lcredit=-1\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000070-GPOS-00038'\n tag gid: 'V-238222'\n tag rid: 'SV-238222r653841_rule'\n tag stig_id: 'UBTU-20-010051'\n tag fix_id: 'F-41391r653840_fix'\n tag cci: ['CCI-000193']\n tag legacy: []\n tag nist: ['IA-5 (1) (a)']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('lcredit') { should cmp -1 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238222.rb","line":3},"id":"V-238222"},{"title":"The Ubuntu operating system must be configured to use TCP syncookies.","desc":"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n Managing excess capacity ensures that sufficient capacity is available to\ncounter flooding attacks. Employing increased capacity and service redundancy\nmay reduce the susceptibility to some DoS attacks. Managing excess capacity may\ninclude, for example, establishing selected usage priorities, quotas, or\npartitioning.","descriptions":{"default":"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n Managing excess capacity ensures that sufficient capacity is available to\ncounter flooding attacks. Employing increased capacity and service redundancy\nmay reduce the susceptibility to some DoS attacks. Managing excess capacity may\ninclude, for example, establishing selected usage priorities, quotas, or\npartitioning.","rationale":"","check":"Verify the Ubuntu operating system is configured to use TCP syncookies.\n\n Check the value of TCP syncookies with the following command:\n\n $ sysctl net.ipv4.tcp_syncookies\n net.ipv4.tcp_syncookies = 1\n\n If the value is not \"1\", this is a finding.\n\n Check the saved value of TCP syncookies with the following command:\n\n $ sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* |\ngrep -v '#'\n\n If no output is returned, this is a finding.","fix":"Configure the Ubuntu operating system to use TCP syncookies by running the\nfollowing command:\n\n $ sudo sysctl -w net.ipv4.tcp_syncookies=1\n\n If \"1\" is not the system's default value, add or update the following\nline in \"/etc/sysctl.conf\":\n\n net.ipv4.tcp_syncookies = 1"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000142-GPOS-00071","gid":"V-238333","rid":"SV-238333r654174_rule","stig_id":"UBTU-20-010412","fix_id":"F-41502r654173_fix","cci":["CCI-001095"],"legacy":[],"nist":["SC-5 (2)"]},"code":"control 'V-238333' do\n title 'The Ubuntu operating system must be configured to use TCP syncookies.'\n desc \"DoS is a condition when a resource is not available for legitimate\nusers. When this occurs, the organization either cannot accomplish its mission\nor must operate at degraded capacity.\n\n Managing excess capacity ensures that sufficient capacity is available to\ncounter flooding attacks. Employing increased capacity and service redundancy\nmay reduce the susceptibility to some DoS attacks. Managing excess capacity may\ninclude, for example, establishing selected usage priorities, quotas, or\npartitioning.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to use TCP syncookies.\n\n Check the value of TCP syncookies with the following command:\n\n $ sysctl net.ipv4.tcp_syncookies\n net.ipv4.tcp_syncookies = 1\n\n If the value is not \\\"1\\\", this is a finding.\n\n Check the saved value of TCP syncookies with the following command:\n\n $ sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* |\ngrep -v '#'\n\n If no output is returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to use TCP syncookies by running the\nfollowing command:\n\n $ sudo sysctl -w net.ipv4.tcp_syncookies=1\n\n If \\\"1\\\" is not the system's default value, add or update the following\nline in \\\"/etc/sysctl.conf\\\":\n\n net.ipv4.tcp_syncookies = 1\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000142-GPOS-00071'\n tag gid: 'V-238333'\n tag rid: 'SV-238333r654174_rule'\n tag stig_id: 'UBTU-20-010412'\n tag fix_id: 'F-41502r654173_fix'\n tag cci: ['CCI-001095']\n tag legacy: []\n tag nist: ['SC-5 (2)']\n\n describe kernel_parameter('net.ipv4.tcp_syncookies') do\n its('value') { should cmp 1 }\n end\nend\n","source_location":{"ref":"./controls/V-238333.rb","line":3},"id":"V-238333"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the ftruncate system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \"ftruncate\" system call.\n\n Check the configured audit rules with the following command:\n\n $ sudo auditctl -l | grep ftruncate\n\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any unsuccessful\nuse of the \"ftruncate\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000474-GPOS-00219"],"gid":"V-238273","rid":"SV-238273r653994_rule","stig_id":"UBTU-20-010157","fix_id":"F-41442r653993_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238273' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the ftruncate system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \\\"ftruncate\\\" system call.\n\n Check the configured audit rules with the following command:\n\n $ sudo auditctl -l | grep ftruncate\n\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any unsuccessful\nuse of the \\\"ftruncate\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000474-GPOS-00219']\n tag gid: 'V-238273'\n tag rid: 'SV-238273r653994_rule'\n tag stig_id: 'UBTU-20-010157'\n tag fix_id: 'F-41442r653993_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('ftruncate').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('ftruncate').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\n end\n describe auditd.syscall('ftruncate').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('ftruncate').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\nend\n","source_location":{"ref":"./controls/V-238273.rb","line":3},"id":"V-238273"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the newgrp command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"newgrp\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep newgrp\n\n -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1\n-k priv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"newgrp\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238280","rid":"SV-238280r654015_rule","stig_id":"UBTU-20-010164","fix_id":"F-41449r654014_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238280' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the newgrp command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"newgrp\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep newgrp\n\n -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=-1\n-k priv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"newgrp\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238280'\n tag rid: 'SV-238280r654015_rule'\n tag stig_id: 'UBTU-20-010164'\n tag fix_id: 'F-41449r654014_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/newgrp'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238280.rb","line":3},"id":"V-238280"},{"title":"The Ubuntu operating system must permit only authorized groups\nownership of the audit log files.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.","descriptions":{"default":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.","rationale":"","check":"Verify the group owner is set to own newly created audit logs in the audit\nconfiguration file with the following command:\n\n $ sudo grep -iw log_group /etc/audit/auditd.conf\n log_group = adm\n\n If the value of the \"log_group\" parameter is other than \"root\" or\n\"adm\", this is a finding.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\naudit log files are owned by the \"root\" or \"adm\" group by using the\nfollowing command:\n\n $ sudo stat -c \"%n %G\" /var/log/audit/*\n /var/log/audit/audit.log root\n\n If the audit log files are owned by a group other than \"root\" or \"adm\",\nthis is a finding.","fix":"Configure the audit log directory and its underlying files to be owned by\n\"adm\" group.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log files to be owned by \"adm\" group by using the following command:\n\n $ sudo chown :adm /var/log/audit/\n\n Set the \"log_group\" parameter of the audit configuration file to the\n\"adm\" value so that when a new log file is created, its group owner is\nproperly set:\n\n $ sed -i '/^log_group/D' /etc/audit/auditd.conf\n $ sed -i /^log_file/a'log_group = adm' /etc/audit/auditd.conf\n\n Last, signal the audit daemon to reload the configuration file:\n\n $ sudo systemctl kill auditd -s SIGHUP\""},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029"],"gid":"V-238247","rid":"SV-238247r653916_rule","stig_id":"UBTU-20-010124","fix_id":"F-41416r653915_fix","cci":["CCI-000162"],"legacy":[],"nist":["AU-9"]},"code":"control 'V-238247' do\n title \"The Ubuntu operating system must permit only authorized groups\nownership of the audit log files.\"\n desc \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the group owner is set to own newly created audit logs in the audit\nconfiguration file with the following command:\n\n $ sudo grep -iw log_group /etc/audit/auditd.conf\n log_group = adm\n\n If the value of the \\\"log_group\\\" parameter is other than \\\"root\\\" or\n\\\"adm\\\", this is a finding.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\naudit log files are owned by the \\\"root\\\" or \\\"adm\\\" group by using the\nfollowing command:\n\n $ sudo stat -c \\\"%n %G\\\" /var/log/audit/*\n /var/log/audit/audit.log root\n\n If the audit log files are owned by a group other than \\\"root\\\" or \\\"adm\\\",\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the audit log directory and its underlying files to be owned by\n\\\"adm\\\" group.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log files to be owned by \\\"adm\\\" group by using the following command:\n\n $ sudo chown :adm /var/log/audit/\n\n Set the \\\"log_group\\\" parameter of the audit configuration file to the\n\\\"adm\\\" value so that when a new log file is created, its group owner is\nproperly set:\n\n $ sed -i '/^log_group/D' /etc/audit/auditd.conf\n $ sed -i /^log_file/a'log_group = adm' /etc/audit/auditd.conf\n\n Last, signal the audit daemon to reload the configuration file:\n\n $ sudo systemctl kill auditd -s SIGHUP\\\"\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000057-GPOS-00027'\n tag satisfies: ['SRG-OS-000057-GPOS-00027', 'SRG-OS-000058-GPOS-00028',\n'SRG-OS-000059-GPOS-00029']\n tag gid: 'V-238247'\n tag rid: 'SV-238247r653916_rule'\n tag stig_id: 'UBTU-20-010124'\n tag fix_id: 'F-41416r653915_fix'\n tag cci: ['CCI-000162']\n tag legacy: []\n tag nist: ['AU-9']\n\n log_file = auditd_conf.log_file\n\n log_file_exists = !log_file.nil?\n if log_file_exists\n describe file(log_file) do\n its('group') { should cmp 'root' }\n end\n else\n describe ('Audit log file ' + log_file + ' exists') do\n subject { log_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238247.rb","line":3},"id":"V-238247"},{"title":"The Ubuntu operating system must immediately notify the SA and ISSO\n(at a minimum) when allocated audit record storage volume reaches 75% of the\nrepository maximum audit record storage capacity.","desc":"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.","descriptions":{"default":"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.","rationale":"","check":"Verify the Ubuntu operating system notifies the SA and ISSO (at a minimum)\nwhen allocated audit record storage volume reaches 75% of the repository\nmaximum audit record storage capacity with the following command:\n\n $ sudo grep ^space_left_action /etc/audit/auditd.conf\n\n space_left_action email\n\n $ sudo grep ^space_left /etc/audit/auditd.conf\n\n space_left 250000\n\n If the \"space_left\" parameter is missing, set to blanks, or set to a\nvalue less than 25% of the space free in the allocated audit record storage,\nthis is a finding.\n\n If the \"space_left_action\" parameter is missing or set to blanks, this is\na finding.\n\n If the \"space_left_action\" is set to \"syslog\", the system logs the\nevent but does not generate a notification, and this is a finding.\n\n If the \"space_left_action\" is set to \"exec\", the system executes a\ndesignated script. If this script informs the SA of the event, this is not a\nfinding.\n\n If the \"space_left_action\" is set to \"email\", check the value of the\n\"action_mail_acct\" parameter with the following command:\n\n $ sudo grep ^action_mail_acct /etc/audit/auditd.conf\n\n action_mail_acct root@localhost\n\n The \"action_mail_acct\" parameter, if missing, defaults to \"root\". If\nthe \"action_mail_acct parameter\" is not set to the email address of the SA(s)\nand/or ISSO, this is a finding.\n\n Note: If the email address of the System Administrator\n is on a remote system, a mail package must be available.","fix":"Edit \"/etc/audit/auditd.conf\" and set the \"space_left_action\" parameter\nto \"exec\" or \"email\".\n\n If the \"space_left_action\" parameter is set to \"email\", set the\n\"action_mail_acct\" parameter to an email address for the SA and ISSO.\n\n If the \"space_left_action\" parameter is set to \"exec\", ensure the\ncommand being executed notifies the SA and ISSO.\n\n Edit \"/etc/audit/auditd.conf\" and set the \"space_left\" parameter to be\nat least 25% of the repository maximum audit record storage capacity."},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000343-GPOS-00134","gid":"V-238307","rid":"SV-238307r654096_rule","stig_id":"UBTU-20-010217","fix_id":"F-41476r654095_fix","cci":["CCI-001855"],"legacy":[],"nist":["AU-5 (1)"]},"code":"control 'V-238307' do\n title \"The Ubuntu operating system must immediately notify the SA and ISSO\n(at a minimum) when allocated audit record storage volume reaches 75% of the\nrepository maximum audit record storage capacity.\"\n desc \"If security personnel are not notified immediately when storage volume\nreaches 75% utilization, they are unable to plan for audit record storage\ncapacity expansion.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system notifies the SA and ISSO (at a minimum)\nwhen allocated audit record storage volume reaches 75% of the repository\nmaximum audit record storage capacity with the following command:\n\n $ sudo grep ^space_left_action /etc/audit/auditd.conf\n\n space_left_action email\n\n $ sudo grep ^space_left /etc/audit/auditd.conf\n\n space_left 250000\n\n If the \\\"space_left\\\" parameter is missing, set to blanks, or set to a\nvalue less than 25% of the space free in the allocated audit record storage,\nthis is a finding.\n\n If the \\\"space_left_action\\\" parameter is missing or set to blanks, this is\na finding.\n\n If the \\\"space_left_action\\\" is set to \\\"syslog\\\", the system logs the\nevent but does not generate a notification, and this is a finding.\n\n If the \\\"space_left_action\\\" is set to \\\"exec\\\", the system executes a\ndesignated script. If this script informs the SA of the event, this is not a\nfinding.\n\n If the \\\"space_left_action\\\" is set to \\\"email\\\", check the value of the\n\\\"action_mail_acct\\\" parameter with the following command:\n\n $ sudo grep ^action_mail_acct /etc/audit/auditd.conf\n\n action_mail_acct root@localhost\n\n The \\\"action_mail_acct\\\" parameter, if missing, defaults to \\\"root\\\". If\nthe \\\"action_mail_acct parameter\\\" is not set to the email address of the SA(s)\nand/or ISSO, this is a finding.\n\n Note: If the email address of the System Administrator\n is on a remote system, a mail package must be available.\n \"\n desc 'fix', \"\n Edit \\\"/etc/audit/auditd.conf\\\" and set the \\\"space_left_action\\\" parameter\nto \\\"exec\\\" or \\\"email\\\".\n\n If the \\\"space_left_action\\\" parameter is set to \\\"email\\\", set the\n\\\"action_mail_acct\\\" parameter to an email address for the SA and ISSO.\n\n If the \\\"space_left_action\\\" parameter is set to \\\"exec\\\", ensure the\ncommand being executed notifies the SA and ISSO.\n\n Edit \\\"/etc/audit/auditd.conf\\\" and set the \\\"space_left\\\" parameter to be\nat least 25% of the repository maximum audit record storage capacity.\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000343-GPOS-00134'\n tag gid: 'V-238307'\n tag rid: 'SV-238307r654096_rule'\n tag stig_id: 'UBTU-20-010217'\n tag fix_id: 'F-41476r654095_fix'\n tag cci: ['CCI-001855']\n tag legacy: []\n tag nist: ['AU-5 (1)']\n\n log_file = auditd_conf.log_file\n log_dir_exists = !log_file.nil? && !File.dirname(log_file).nil?\n\n if log_dir_exists\n email_to_notify = input('action_mail_acct')\n\n partition_threshold_mb = (filesystem(log_file).size_kb / 1024 * 0.25).to_i\n system_alert_configuration_mb = auditd_conf.space_left.to_i\n\n describe 'The space_left configuration' do\n subject { system_alert_configuration_mb }\n it { should >= partition_threshold_mb }\n end\n describe 'The space_left_action configuration' do\n subject { auditd_conf.space_left_action }\n it { should eq \"email\" }\n end\n\n describe 'The action_mail_acct configuration' do\n subject { auditd_conf.action_mail_acct }\n it { should eq email_to_notify }\n end\n else\n describe ('Audit file/directory for file ' + log_file + ' exists') do\n subject { log_dir_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238307.rb","line":3},"id":"V-238307"},{"title":"The Ubuntu operating system must configure the SSH daemon to use\nMessage Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic\nhashes to prevent the unauthorized disclosure of information and/or detect\nchanges to information during transmission.","desc":"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless. Nonlocal maintenance and\ndiagnostic activities are those activities conducted by individuals\ncommunicating through a network, either an external network (e.g., the\ninternet) or an internal network.\n\n Local maintenance and diagnostic activities are those activities carried\nout by individuals physically present at the information system or information\nsystem component and not communicating across a network connection.\n\n Encrypting information for transmission protects information from\nunauthorized disclosure and modification. Cryptographic mechanisms implemented\nto protect information integrity include, for example, cryptographic hash\nfunctions which have common application in digital signatures, checksums, and\nmessage authentication codes.","descriptions":{"default":"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless. Nonlocal maintenance and\ndiagnostic activities are those activities conducted by individuals\ncommunicating through a network, either an external network (e.g., the\ninternet) or an internal network.\n\n Local maintenance and diagnostic activities are those activities carried\nout by individuals physically present at the information system or information\nsystem component and not communicating across a network connection.\n\n Encrypting information for transmission protects information from\nunauthorized disclosure and modification. Cryptographic mechanisms implemented\nto protect information integrity include, for example, cryptographic hash\nfunctions which have common application in digital signatures, checksums, and\nmessage authentication codes.","rationale":"","check":"Verify the SSH daemon is configured to only use MACs that employ FIPS 140-2\napproved ciphers with the following command:\n\n $ grep -i macs /etc/ssh/sshd_config\n\n MACs hmac-sha2-512,hmac-sha2-256\n\n If any ciphers other than \"hmac-sha2-512\" or \"hmac-sha2-256\" are\nlisted, the order differs from the example above, or the returned line is\ncommented out, this is a finding.","fix":"Configure the Ubuntu operating system to allow the SSH daemon to only use\nMACs that employ FIPS 140-2 approved ciphers.\n\n Add the following line (or modify the line to have the required value) to\nthe \"/etc/ssh/sshd_config\" file (this file may be named differently or be in\na different location if using a version of SSH that is provided by a\nthird-party vendor):\n\n MACs hmac-sha2-512,hmac-sha2-256\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl reload sshd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000424-GPOS-00188","satisfies":["SRG-OS-000424-GPOS-00188","SRG-OS-000250-GPOS-00093","SRG-OS-000393-GPOS-00173"],"gid":"V-238216","rid":"SV-238216r654316_rule","stig_id":"UBTU-20-010043","fix_id":"F-41385r653822_fix","cci":["CCI-001453","CCI-002421","CCI-002890"],"legacy":[],"nist":["AC-17 (2)","SC-8 (1)","MA-4 (6)"]},"code":"control 'V-238216' do\n title \"The Ubuntu operating system must configure the SSH daemon to use\nMessage Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic\nhashes to prevent the unauthorized disclosure of information and/or detect\nchanges to information during transmission.\"\n desc \"Without cryptographic integrity protections, information can be\naltered by unauthorized users without detection.\n\n Remote access (e.g., RDP) is access to DoD nonpublic information systems by\nan authorized user (or an information system) communicating through an\nexternal, non-organization-controlled network. Remote access methods include,\nfor example, dial-up, broadband, and wireless. Nonlocal maintenance and\ndiagnostic activities are those activities conducted by individuals\ncommunicating through a network, either an external network (e.g., the\ninternet) or an internal network.\n\n Local maintenance and diagnostic activities are those activities carried\nout by individuals physically present at the information system or information\nsystem component and not communicating across a network connection.\n\n Encrypting information for transmission protects information from\nunauthorized disclosure and modification. Cryptographic mechanisms implemented\nto protect information integrity include, for example, cryptographic hash\nfunctions which have common application in digital signatures, checksums, and\nmessage authentication codes.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the SSH daemon is configured to only use MACs that employ FIPS 140-2\napproved ciphers with the following command:\n\n $ grep -i macs /etc/ssh/sshd_config\n\n MACs hmac-sha2-512,hmac-sha2-256\n\n If any ciphers other than \\\"hmac-sha2-512\\\" or \\\"hmac-sha2-256\\\" are\nlisted, the order differs from the example above, or the returned line is\ncommented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to allow the SSH daemon to only use\nMACs that employ FIPS 140-2 approved ciphers.\n\n Add the following line (or modify the line to have the required value) to\nthe \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in\na different location if using a version of SSH that is provided by a\nthird-party vendor):\n\n MACs hmac-sha2-512,hmac-sha2-256\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl reload sshd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000424-GPOS-00188'\n tag satisfies: ['SRG-OS-000424-GPOS-00188', 'SRG-OS-000250-GPOS-00093',\n'SRG-OS-000393-GPOS-00173']\n tag gid: 'V-238216'\n tag rid: 'SV-238216r654316_rule'\n tag stig_id: 'UBTU-20-010043'\n tag fix_id: 'F-41385r653822_fix'\n tag cci: ['CCI-001453', 'CCI-002421', 'CCI-002890']\n tag legacy: []\n tag nist: ['AC-17 (2)', 'SC-8 (1)', 'MA-4 (6)']\n\n @macs_array = inspec.sshd_config.params['macs']\n\n @macs_array = @macs_array.first.split(',') unless @macs_array.nil?\n\n describe @macs_array do\n it { should be_in %w[hmac-sha2-256 hmac-sha2-512] }\n end\nend\n","source_location":{"ref":"./controls/V-238216.rb","line":3},"id":"V-238216"},{"title":"The Ubuntu operating system must, for networked systems, compare\ninternal information system clocks at least every 24 hours with a server which\nis synchronized to one of the redundant United States Naval Observatory (USNO)\ntime servers, or a time server designated for the appropriate DoD network\n(NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).","desc":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events. Sources outside the configured acceptable\nallowance (drift) may be inaccurate.\n\n Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network.\n\n Organizations should consider endpoints that may not have regular access to\nthe authoritative time server (e.g., mobile, teleworking, and tactical\nendpoints).","descriptions":{"default":"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events. Sources outside the configured acceptable\nallowance (drift) may be inaccurate.\n\n Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network.\n\n Organizations should consider endpoints that may not have regular access to\nthe authoritative time server (e.g., mobile, teleworking, and tactical\nendpoints).","rationale":"","check":"If the system is not networked, this requirement is Not Applicable.\n\n The system clock must be configured to compare the system clock at least\nevery 24 hours to the authoritative time source.\n\n Check the value of \"maxpoll\" in the \"/etc/chrony/chrony.conf\" file with\nthe following command:\n\n $ sudo grep maxpoll /etc/chrony/chrony.conf\n server tick.usno.navy.mil iburst maxpoll 17\n\n If \"maxpoll\" is not set to \"17\" or does not exist, this is a finding.\n\n Verify that the \"chrony.conf\" file is configured to an authoritative DoD\ntime source by running the following command:\n\n $ grep -i server /etc/chrony/chrony.conf\n server tick.usno.navy.mil iburst maxpoll 17\n server tock.usno.navy.mil iburst maxpoll 17\n server ntp2.usno.navy.mil iburst maxpoll 17\n\n If the parameter \"server\" is not set, is not set to an authoritative DoD\ntime source, or is commented out, this is a finding.","fix":"If the system is not networked, this requirement is Not Applicable.\n\n To configure the system clock to compare the system clock at least every 24\nhours to the authoritative time source, edit the \"/etc/chrony/chrony.conf\"\nfile. Add or correct the following lines, by replacing \"[source]\" in the\nfollowing line with an authoritative DoD time source:\n\n server [source] iburst maxpoll = 17\n\n If the \"chrony\" service was running and the value of \"maxpoll\" or\n\"server\" was updated, the service must be restarted using the following\ncommand:\n\n $ sudo systemctl restart chrony.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000355-GPOS-00143","gid":"V-238356","rid":"SV-238356r654317_rule","stig_id":"UBTU-20-010435","fix_id":"F-41525r654242_fix","cci":["CCI-001891"],"legacy":[],"nist":["AU-8 (1) (a)"]},"code":"control 'V-238356' do\n title \"The Ubuntu operating system must, for networked systems, compare\ninternal information system clocks at least every 24 hours with a server which\nis synchronized to one of the redundant United States Naval Observatory (USNO)\ntime servers, or a time server designated for the appropriate DoD network\n(NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).\"\n desc \"Inaccurate time stamps make it more difficult to correlate events and\ncan lead to an inaccurate analysis. Determining the correct time a particular\nevent occurred on a system is critical when conducting forensic analysis and\ninvestigating system events. Sources outside the configured acceptable\nallowance (drift) may be inaccurate.\n\n Synchronizing internal information system clocks provides uniformity of\ntime stamps for information systems with multiple system clocks and systems\nconnected over a network.\n\n Organizations should consider endpoints that may not have regular access to\nthe authoritative time server (e.g., mobile, teleworking, and tactical\nendpoints).\n \"\n desc 'rationale', ''\n desc 'check', \"\n If the system is not networked, this requirement is Not Applicable.\n\n The system clock must be configured to compare the system clock at least\nevery 24 hours to the authoritative time source.\n\n Check the value of \\\"maxpoll\\\" in the \\\"/etc/chrony/chrony.conf\\\" file with\nthe following command:\n\n $ sudo grep maxpoll /etc/chrony/chrony.conf\n server tick.usno.navy.mil iburst maxpoll 17\n\n If \\\"maxpoll\\\" is not set to \\\"17\\\" or does not exist, this is a finding.\n\n Verify that the \\\"chrony.conf\\\" file is configured to an authoritative DoD\ntime source by running the following command:\n\n $ grep -i server /etc/chrony/chrony.conf\n server tick.usno.navy.mil iburst maxpoll 17\n server tock.usno.navy.mil iburst maxpoll 17\n server ntp2.usno.navy.mil iburst maxpoll 17\n\n If the parameter \\\"server\\\" is not set, is not set to an authoritative DoD\ntime source, or is commented out, this is a finding.\n \"\n desc 'fix', \"\n If the system is not networked, this requirement is Not Applicable.\n\n To configure the system clock to compare the system clock at least every 24\nhours to the authoritative time source, edit the \\\"/etc/chrony/chrony.conf\\\"\nfile. Add or correct the following lines, by replacing \\\"[source]\\\" in the\nfollowing line with an authoritative DoD time source:\n\n server [source] iburst maxpoll = 17\n\n If the \\\"chrony\\\" service was running and the value of \\\"maxpoll\\\" or\n\\\"server\\\" was updated, the service must be restarted using the following\ncommand:\n\n $ sudo systemctl restart chrony.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000355-GPOS-00143'\n tag gid: 'V-238356'\n tag rid: 'SV-238356r654317_rule'\n tag stig_id: 'UBTU-20-010435'\n tag fix_id: 'F-41525r654242_fix'\n tag cci: ['CCI-001891']\n tag legacy: []\n tag nist: ['AU-8 (1) (a)']\n\n is_system_networked = input('is_system_networked')\n \n if is_system_networked\n\n chrony_conf = '/etc/chrony/chrony.conf'\n chrony_conf_exists = file(chrony_conf).exist?\n \n if chrony_conf_exists\n describe \"time sources\" do\n server_entries = command('grep \"^server\" /etc/chrony/chrony.conf').stdout.strip.split(\"\\n\").entries\n\n server_entries.each do |entry|\n describe entry do\n it { should match \"^server\\s+.*\\s+iburst\\s+maxpoll\\s+=\\s+17$\" }\n end\n end\n end\n else\n describe chrony_conf + ' exists' do\n subject { chrony_conf_exists }\n it { should be true }\n end\n end\n else\n describe 'System is not networked' do\n skip 'This control is Not Applicable as the system is not networked'\n end\n end\nend\n","source_location":{"ref":"./controls/V-238356.rb","line":3},"id":"V-238356"},{"title":"The Ubuntu operating system must have directories that contain system\ncommands group-owned by root.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":{"default":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","rationale":"","check":"Verify the system commands directories are group-owned by root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Run the check with the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root -type d -exec stat -c \"%n %G\" '{}' \\;\n\n If any system commands directories are returned that are not Set Group ID\nup on execution (SGID) files and owned by a privileged account, this is a\nfinding.","fix":"Configure the system commands directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root -type d -exec chgrp root '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000258-GPOS-00099","gid":"V-238346","rid":"SV-238346r654213_rule","stig_id":"UBTU-20-010425","fix_id":"F-41515r654212_fix","cci":["CCI-001495"],"legacy":[],"nist":["AU-9"]},"code":"control 'V-238346' do\n title \"The Ubuntu operating system must have directories that contain system\ncommands group-owned by root.\"\n desc \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system commands directories are group-owned by root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Run the check with the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root -type d -exec stat -c \\\"%n %G\\\" '{}' \\\\;\n\n If any system commands directories are returned that are not Set Group ID\nup on execution (SGID) files and owned by a privileged account, this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the system commands directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root -type d -exec chgrp root '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000258-GPOS-00099'\n tag gid: 'V-238346'\n tag rid: 'SV-238346r654213_rule'\n tag stig_id: 'UBTU-20-010425'\n tag fix_id: 'F-41515r654212_fix'\n tag cci: ['CCI-001495']\n tag legacy: []\n tag nist: ['AU-9']\n #CHECK\n system_commands = command(\"find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -type d\").stdout.strip.split(\"\\n\").entries\n valid_system_commands = Set[]\n\n if system_commands.count > 0\n system_commands.each do |sys_cmd|\n if file(sys_cmd).exist?\n valid_system_commands = valid_system_commands << sys_cmd\n end\n end\n end\n\n if valid_system_commands.count > 0\n valid_system_commands.each do |val_sys_cmd|\n describe file(val_sys_cmd) do\n its(\"group\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of directories that contain system commands found in /bin, /sbin, /usr/bin, /usr/sbin,\n /usr/local/bin or /usr/local/sbin, that are NOT group-owned by root\" do\n subject { valid_system_commands }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238346.rb","line":3},"id":"V-238346"},{"title":"The Ubuntu operating system must enable the graphical user logon\nbanner to display the Standard Mandatory DoD Notice and Consent Banner before\ngranting local access to the system via a graphical user logon.","desc":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \"I've read and consent to terms in IS user agreem't.\"","descriptions":{"default":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \"I've read and consent to terms in IS user agreem't.\"","rationale":"","check":"Verify the Ubuntu operating system is configured to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the operating\nsystem via a graphical user logon.\n\n Note: If the system does not have a graphical user interface installed,\nthis requirement is Not Applicable.\n\n Check that the operating banner message for the graphical user logon is\nenabled with the following command:\n\n $ grep ^banner-message-enable /etc/gdm3/greeter.dconf-defaults\n\n banner-message-enable=true\n\n If the line is commented out or set to \"false\", this is a finding.","fix":"Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.\n\n Look for the \"banner-message-enable\" parameter under the\n\"[org/gnome/login-screen]\" section and uncomment it (remove the leading \"#\"\ncharacters):\n\n Note: The lines are all near the bottom of the file but not adjacent to\neach other.\n\n [org/gnome/login-screen]\n\n banner-message-enable=true\n\n Update the GDM with the new configuration:\n\n $ sudo dconf update\n $ sudo systemctl restart gdm3"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000023-GPOS-00006","gid":"V-238197","rid":"SV-238197r653766_rule","stig_id":"UBTU-20-010002","fix_id":"F-41366r653765_fix","cci":["CCI-000048"],"legacy":[],"nist":["AC-8 a"]},"code":"control 'V-238197' do\n title \"The Ubuntu operating system must enable the graphical user logon\nbanner to display the Standard Mandatory DoD Notice and Consent Banner before\ngranting local access to the system via a graphical user logon.\"\n desc \"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \\\"I've read and consent to terms in IS user agreem't.\\\"\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to display the Standard\nMandatory DoD Notice and Consent Banner before granting access to the operating\nsystem via a graphical user logon.\n\n Note: If the system does not have a graphical user interface installed,\nthis requirement is Not Applicable.\n\n Check that the operating banner message for the graphical user logon is\nenabled with the following command:\n\n $ grep ^banner-message-enable /etc/gdm3/greeter.dconf-defaults\n\n banner-message-enable=true\n\n If the line is commented out or set to \\\"false\\\", this is a finding.\n \"\n desc 'fix', \"\n Edit the \\\"/etc/gdm3/greeter.dconf-defaults\\\" file.\n\n Look for the \\\"banner-message-enable\\\" parameter under the\n\\\"[org/gnome/login-screen]\\\" section and uncomment it (remove the leading \\\"#\\\"\ncharacters):\n\n Note: The lines are all near the bottom of the file but not adjacent to\neach other.\n\n [org/gnome/login-screen]\n\n banner-message-enable=true\n\n Update the GDM with the new configuration:\n\n $ sudo dconf update\n $ sudo systemctl restart gdm3\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000023-GPOS-00006'\n tag gid: 'V-238197'\n tag rid: 'SV-238197r653766_rule'\n tag stig_id: 'UBTU-20-010002'\n tag fix_id: 'F-41366r653765_fix'\n tag cci: ['CCI-000048']\n tag legacy: []\n tag nist: ['AC-8 a']\n\n xorg_status = command('which Xorg').exit_status\n if xorg_status == 0\n describe 'banner-message-enable must be set to true' do\n subject { command('grep banner-message-enable /etc/dconf/db/local.d/*') }\n its('stdout') { should match /(banner-message-enable).+=.+(true)/ }\n end\n else\n describe command('which Xorg').exit_status do\n skip(\"GUI not installed.\\nwhich Xorg exit_status: \" + command('which Xorg').exit_status.to_s)\n end\n end\nend\n","source_location":{"ref":"./controls/V-238197.rb","line":3},"id":"V-238197"},{"title":"The Ubuntu operating system must ensure only users who need access to\nsecurity functions are part of sudo group.","desc":"An isolation boundary provides access control and protects the\nintegrity of the hardware, software, and firmware that perform security\nfunctions.\n\n Security functions are the hardware, software, and/or firmware of the\ninformation system responsible for enforcing the system security policy and\nsupporting the isolation of code and data on which the protection is based.\nOperating systems implement code separation (i.e., separation of security\nfunctions from nonsecurity functions) in a number of ways, including through\nthe provision of security kernels via processor rings or processor modes. For\nnon-kernel code, security function isolation is often achieved through file\nsystem protections that serve to protect the code on disk and address space\nprotections that protect executing code.\n\n Developers and implementers can increase the assurance in security\nfunctions by employing well-defined security policy models; structured,\ndisciplined, and rigorous hardware and software development techniques; and\nsound system/security engineering principles. Implementation may include\nisolation of memory space and libraries.\n\n The Ubuntu operating system restricts access to security functions through\nthe use of access control mechanisms and by implementing least privilege\ncapabilities.","descriptions":{"default":"An isolation boundary provides access control and protects the\nintegrity of the hardware, software, and firmware that perform security\nfunctions.\n\n Security functions are the hardware, software, and/or firmware of the\ninformation system responsible for enforcing the system security policy and\nsupporting the isolation of code and data on which the protection is based.\nOperating systems implement code separation (i.e., separation of security\nfunctions from nonsecurity functions) in a number of ways, including through\nthe provision of security kernels via processor rings or processor modes. For\nnon-kernel code, security function isolation is often achieved through file\nsystem protections that serve to protect the code on disk and address space\nprotections that protect executing code.\n\n Developers and implementers can increase the assurance in security\nfunctions by employing well-defined security policy models; structured,\ndisciplined, and rigorous hardware and software development techniques; and\nsound system/security engineering principles. Implementation may include\nisolation of memory space and libraries.\n\n The Ubuntu operating system restricts access to security functions through\nthe use of access control mechanisms and by implementing least privilege\ncapabilities.","rationale":"","check":"Verify the sudo group has only members who should have access to security\nfunctions.\n\n $ grep sudo /etc/group\n\n sudo:x:27:foo\n\n If the sudo group contains users not needing access to security functions,\nthis is a finding.","fix":"Configure the sudo group with only members requiring access to security\nfunctions.\n\n To remove a user from the sudo group, run:\n\n $ sudo gpasswd -d sudo"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000134-GPOS-00068","gid":"V-238206","rid":"SV-238206r653793_rule","stig_id":"UBTU-20-010012","fix_id":"F-41375r653792_fix","cci":["CCI-001084"],"legacy":[],"nist":["SC-3"]},"code":"control 'V-238206' do\n title \"The Ubuntu operating system must ensure only users who need access to\nsecurity functions are part of sudo group.\"\n desc \"An isolation boundary provides access control and protects the\nintegrity of the hardware, software, and firmware that perform security\nfunctions.\n\n Security functions are the hardware, software, and/or firmware of the\ninformation system responsible for enforcing the system security policy and\nsupporting the isolation of code and data on which the protection is based.\nOperating systems implement code separation (i.e., separation of security\nfunctions from nonsecurity functions) in a number of ways, including through\nthe provision of security kernels via processor rings or processor modes. For\nnon-kernel code, security function isolation is often achieved through file\nsystem protections that serve to protect the code on disk and address space\nprotections that protect executing code.\n\n Developers and implementers can increase the assurance in security\nfunctions by employing well-defined security policy models; structured,\ndisciplined, and rigorous hardware and software development techniques; and\nsound system/security engineering principles. Implementation may include\nisolation of memory space and libraries.\n\n The Ubuntu operating system restricts access to security functions through\nthe use of access control mechanisms and by implementing least privilege\ncapabilities.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the sudo group has only members who should have access to security\nfunctions.\n\n $ grep sudo /etc/group\n\n sudo:x:27:foo\n\n If the sudo group contains users not needing access to security functions,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the sudo group with only members requiring access to security\nfunctions.\n\n To remove a user from the sudo group, run:\n\n $ sudo gpasswd -d sudo\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000134-GPOS-00068'\n tag gid: 'V-238206'\n tag rid: 'SV-238206r653793_rule'\n tag stig_id: 'UBTU-20-010012'\n tag fix_id: 'F-41375r653792_fix'\n tag cci: ['CCI-001084']\n tag legacy: []\n tag nist: ['SC-3']\n\n sudo_accounts = input('sudo_accounts')\n\n if sudo_accounts.count > 0\n sudo_accounts.each do |account|\n describe group('sudo') do\n its('members') { should include account }\n end\n end\n else\n describe.one do\n describe group('sudo') do\n its('members') { should be_nil }\n end\n describe group('sudo') do\n its('members') { should be_empty }\n end\n end\n end\nend\n","source_location":{"ref":"./controls/V-238206.rb","line":3},"id":"V-238206"},{"title":"The Ubuntu operating system must generate audit records for the\n/var/log/btmp file.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records showing start\nand stop times for user access to the system via the \"/var/log/btmp\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep '/var/log/btmp'\n\n -w /var/log/btmp -p wa -k logins\n\n If the command does not return a line matching the example or the line is\ncommented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate audit events showing start and stop\ntimes for user access via the \"/var/log/btmp file\".\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/log/btmp -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000472-GPOS-00217","gid":"V-238317","rid":"SV-238317r654126_rule","stig_id":"UBTU-20-010279","fix_id":"F-41486r654125_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238317' do\n title \"The Ubuntu operating system must generate audit records for the\n/var/log/btmp file.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records showing start\nand stop times for user access to the system via the \\\"/var/log/btmp\\\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep '/var/log/btmp'\n\n -w /var/log/btmp -p wa -k logins\n\n If the command does not return a line matching the example or the line is\ncommented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events showing start and stop\ntimes for user access via the \\\"/var/log/btmp file\\\".\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/log/btmp -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000472-GPOS-00217'\n tag gid: 'V-238317'\n tag rid: 'SV-238317r654126_rule'\n tag stig_id: 'UBTU-20-010279'\n tag fix_id: 'F-41486r654125_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = \"/var/log/btmp\"\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its(\"permissions\") { should_not cmp [] }\n its(\"action\") { should_not include \"never\" }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include \"w\" }\n it { should include \"a\" }\n end\n end\n else\n describe (\"Audit line(s) for \" + @audit_file + \" exist\") do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238317.rb","line":3},"id":"V-238317"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the ssh-keysign command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"ssh-keysign\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep ssh-keysign\n\n -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000\n-F auid!=-1 -k privileged-ssh\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"ssh-keysign\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000\n-F auid!=4294967295 -k privileged-ssh\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238257","rid":"SV-238257r653946_rule","stig_id":"UBTU-20-010141","fix_id":"F-41426r653945_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238257' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the ssh-keysign command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep ssh-keysign\n\n -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000\n-F auid!=-1 -k privileged-ssh\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"ssh-keysign\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/lib/openssh/ssh-keysign -F perm=x -F auid>=1000\n-F auid!=4294967295 -k privileged-ssh\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238257'\n tag rid: 'SV-238257r653946_rule'\n tag stig_id: 'UBTU-20-010141'\n tag fix_id: 'F-41426r653945_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/lib/openssh/ssh-keysign'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238257.rb","line":3},"id":"V-238257"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the gpasswd command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"gpasswd\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w gpasswd\n\n -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-gpasswd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"gpasswd\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238290","rid":"SV-238290r654045_rule","stig_id":"UBTU-20-010174","fix_id":"F-41459r654044_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238290' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the gpasswd command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"gpasswd\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w gpasswd\n\n -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-gpasswd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"gpasswd\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-gpasswd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238290'\n tag rid: 'SV-238290r654045_rule'\n tag stig_id: 'UBTU-20-010174'\n tag fix_id: 'F-41459r654044_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/gpasswd'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238290.rb","line":3},"id":"V-238290"},{"title":"The Ubuntu operating system must generate audit records for any use of\nthe fremovexattr system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"fremovexattr\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fremovexattr\n\n -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fremovexattr\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206","SRG-OS-000466-GPOS-00210","SRG-OS-000365-GPOS-00152"],"gid":"V-238263","rid":"SV-238263r653964_rule","stig_id":"UBTU-20-010147","fix_id":"F-41432r653963_fix","cci":["CCI-000172","CCI-001814"],"legacy":[],"nist":["AU-12 c","CM-5 (1)"]},"code":"control 'V-238263' do\n title \"The Ubuntu operating system must generate audit records for any use of\nthe fremovexattr system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"fremovexattr\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fremovexattr\n\n -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fremovexattr\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F\nauid!=4294967295 -k perm_mod\n -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206',\n'SRG-OS-000466-GPOS-00210', 'SRG-OS-000365-GPOS-00152']\n tag gid: 'V-238263'\n tag rid: 'SV-238263r653964_rule'\n tag stig_id: 'UBTU-20-010147'\n tag fix_id: 'F-41432r653963_fix'\n tag cci: ['CCI-000172', 'CCI-001814']\n tag legacy: []\n tag nist: ['AU-12 c', 'CM-5 (1)']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"fremovexattr\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"fremovexattr\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238263.rb","line":3},"id":"V-238263"},{"title":"The Ubuntu operating system must limit the number of concurrent\nsessions to ten for all accounts and/or account types.","desc":"The Ubuntu operating system management includes the ability to control\nthe number of users and user sessions that utilize an operating system.\nLimiting the number of allowed users and sessions per user is helpful in\nreducing the risks related to DoS attacks.\n\n This requirement addresses concurrent sessions for information system\naccounts and does not address concurrent sessions by single users via multiple\nsystem accounts. The maximum number of concurrent sessions should be defined\nbased upon mission needs and the operational environment for each system.","descriptions":{"default":"The Ubuntu operating system management includes the ability to control\nthe number of users and user sessions that utilize an operating system.\nLimiting the number of allowed users and sessions per user is helpful in\nreducing the risks related to DoS attacks.\n\n This requirement addresses concurrent sessions for information system\naccounts and does not address concurrent sessions by single users via multiple\nsystem accounts. The maximum number of concurrent sessions should be defined\nbased upon mission needs and the operational environment for each system.","rationale":"","check":"Verify the Ubuntu operating system limits the number of concurrent sessions\nto 10 for all accounts and/or account types by running the following command:\n\n $ grep maxlogins /etc/security/limits.conf | grep -v '^* hard maxlogins'\n\n The result must contain the following line:\n\n * hard maxlogins 10\n\n If the \"maxlogins\" item is missing or the value is not set to 10 or less\nor is commented out, this is a finding.","fix":"Configure the Ubuntu operating system to limit the number of concurrent\nsessions to 10 for all accounts and/or account types.\n\n Add the following line to the top of the \"/etc/security/limits.conf\"\nfile:\n\n * hard maxlogins 10"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000027-GPOS-00008","gid":"V-238323","rid":"SV-238323r654144_rule","stig_id":"UBTU-20-010400","fix_id":"F-41492r654143_fix","cci":["CCI-000054"],"legacy":[],"nist":["AC-10"]},"code":"control 'V-238323' do\n title \"The Ubuntu operating system must limit the number of concurrent\nsessions to ten for all accounts and/or account types.\"\n desc \"The Ubuntu operating system management includes the ability to control\nthe number of users and user sessions that utilize an operating system.\nLimiting the number of allowed users and sessions per user is helpful in\nreducing the risks related to DoS attacks.\n\n This requirement addresses concurrent sessions for information system\naccounts and does not address concurrent sessions by single users via multiple\nsystem accounts. The maximum number of concurrent sessions should be defined\nbased upon mission needs and the operational environment for each system.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system limits the number of concurrent sessions\nto 10 for all accounts and/or account types by running the following command:\n\n $ grep maxlogins /etc/security/limits.conf | grep -v '^* hard maxlogins'\n\n The result must contain the following line:\n\n * hard maxlogins 10\n\n If the \\\"maxlogins\\\" item is missing or the value is not set to 10 or less\nor is commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to limit the number of concurrent\nsessions to 10 for all accounts and/or account types.\n\n Add the following line to the top of the \\\"/etc/security/limits.conf\\\"\nfile:\n\n * hard maxlogins 10\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000027-GPOS-00008'\n tag gid: 'V-238323'\n tag rid: 'SV-238323r654144_rule'\n tag stig_id: 'UBTU-20-010400'\n tag fix_id: 'F-41492r654143_fix'\n tag cci: ['CCI-000054']\n tag legacy: []\n tag nist: ['AC-10']\n\n describe limits_conf do\n its('*') { should include ['hard', 'maxlogins', input('maxlogins').to_s] }\n end\nend\n","source_location":{"ref":"./controls/V-238323.rb","line":3},"id":"V-238323"},{"title":"The Ubuntu operating system must electronically verify Personal\nIdentity Verification (PIV) credentials.","desc":"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.","descriptions":{"default":"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.","rationale":"","check":"Verify the Ubuntu operating system electronically verifies PIV credentials.\n\n Verify that certificate status checking for multifactor authentication is\nimplemented with the following command:\n\n $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk\n'/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep\ncert_policy | grep ocsp_on\n\n cert_policy = ca,signature,ocsp_on;\n\n If \"cert_policy\" is not set to \"ocsp_on\", or the line is commented out,\nthis is a finding.","fix":"Configure the Ubuntu operating system to do certificate status checking for\nmultifactor authentication.\n\n Modify all of the \"cert_policy\" lines in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\" to include \"ocsp_on\"."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000377-GPOS-00162","gid":"V-238232","rid":"SV-238232r653871_rule","stig_id":"UBTU-20-010065","fix_id":"F-41401r653870_fix","cci":["CCI-001954"],"legacy":[],"nist":["IA-2 (12)"]},"code":"control 'V-238232' do\n title \"The Ubuntu operating system must electronically verify Personal\nIdentity Verification (PIV) credentials.\"\n desc \"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system electronically verifies PIV credentials.\n\n Verify that certificate status checking for multifactor authentication is\nimplemented with the following command:\n\n $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk\n'/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep\ncert_policy | grep ocsp_on\n\n cert_policy = ca,signature,ocsp_on;\n\n If \\\"cert_policy\\\" is not set to \\\"ocsp_on\\\", or the line is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to do certificate status checking for\nmultifactor authentication.\n\n Modify all of the \\\"cert_policy\\\" lines in\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" to include \\\"ocsp_on\\\".\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000377-GPOS-00162'\n tag gid: 'V-238232'\n tag rid: 'SV-238232r653871_rule'\n tag stig_id: 'UBTU-20-010065'\n tag fix_id: 'F-41401r653870_fix'\n tag cci: ['CCI-001954']\n tag legacy: []\n tag nist: ['IA-2 (12)']\n\n config_file_exists = file('/etc/pam_pkcs11/pam_pkcs11.conf').exist?\n if config_file_exists\n describe parse_config_file('/etc/pam_pkcs11/pam_pkcs11.conf') do\n its('cert_policy') { should include 'ocsp_on' }\n end\n else\n describe '/etc/pam_pkcs11/pam_pkcs11.conf exists' do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238232.rb","line":3},"id":"V-238232"},{"title":"The Ubuntu operating system must notify designated personnel if\nbaseline configurations are changed in an unauthorized manner. The file\nintegrity tool must notify the System Administrator when changes to the\nbaseline configuration or anomalies in the operation of any security functions\nare discovered.","desc":"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the Ubuntu\noperating system. Changes to Ubuntu operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO\nand SAs must be notified via email and/or monitoring system trap when there is\nan unauthorized modification of a configuration item.","descriptions":{"default":"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the Ubuntu\noperating system. Changes to Ubuntu operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO\nand SAs must be notified via email and/or monitoring system trap when there is\nan unauthorized modification of a configuration item.","rationale":"","check":"Verify that Advanced Intrusion Detection Environment (AIDE) notifies the\nSystem Administrator\n when anomalies in the operation of any security functions are discovered\nwith the following command:\n\n $ sudo grep SILENTREPORTS /etc/default/aide\n\n SILENTREPORTS=no\n\n If SILENTREPORTS is uncommented and set to \"yes\", this is a finding.","fix":"Configure the Ubuntu operating system to notify designated personnel if\nbaseline configurations are changed in an unauthorized manner.\n\n Modify the \"SILENTREPORTS\" parameter in the \"/etc/default/aide\" file\nwith a value of \"no\" if it does not already exist."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000447-GPOS-00201","gid":"V-238372","rid":"SV-238372r654318_rule","stig_id":"UBTU-20-010451","fix_id":"F-41541r654290_fix","cci":["CCI-002702"],"legacy":[],"nist":["SI-6 d"]},"code":"control 'V-238372' do\n title \"The Ubuntu operating system must notify designated personnel if\nbaseline configurations are changed in an unauthorized manner. The file\nintegrity tool must notify the System Administrator when changes to the\nbaseline configuration or anomalies in the operation of any security functions\nare discovered.\"\n desc \"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the Ubuntu\noperating system. Changes to Ubuntu operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the Ubuntu operating system. The Ubuntu operating system's IMO/ISSO\nand SAs must be notified via email and/or monitoring system trap when there is\nan unauthorized modification of a configuration item.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that Advanced Intrusion Detection Environment (AIDE) notifies the\nSystem Administrator\n when anomalies in the operation of any security functions are discovered\nwith the following command:\n\n $ sudo grep SILENTREPORTS /etc/default/aide\n\n SILENTREPORTS=no\n\n If SILENTREPORTS is uncommented and set to \\\"yes\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to notify designated personnel if\nbaseline configurations are changed in an unauthorized manner.\n\n Modify the \\\"SILENTREPORTS\\\" parameter in the \\\"/etc/default/aide\\\" file\nwith a value of \\\"no\\\" if it does not already exist.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000447-GPOS-00201'\n tag gid: 'V-238372'\n tag rid: 'SV-238372r654318_rule'\n tag stig_id: 'UBTU-20-010451'\n tag fix_id: 'F-41541r654290_fix'\n tag cci: ['CCI-002702']\n tag legacy: []\n tag nist: ['SI-6 d']\n\n describe file('/etc/default/aide') do\n it { should exist }\n its('content') { should match '^SILENTREPORTS=no$' }\n end\nend\n","source_location":{"ref":"./controls/V-238372.rb","line":3},"id":"V-238372"},{"title":"The Ubuntu operating system must immediately terminate all network\nconnections associated with SSH traffic after a period of inactivity.","desc":"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n This capability is typically reserved for specific Ubuntu operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.","descriptions":{"default":"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n This capability is typically reserved for specific Ubuntu operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.","rationale":"","check":"Verify that all network connections associated with SSH traffic\nautomatically terminate after a period of inactivity.\n\n Verify the \"ClientAliveCountMax\" variable is set in the\n\"/etc/ssh/sshd_config\" file by performing the following command:\n\n $ sudo grep -i clientalivecountmax /etc/ssh/sshd_config\n\n ClientAliveCountMax 1\n\n If \"ClientAliveCountMax\" is not set, is not set to \"1\", or is commented\nout, this is a finding.","fix":"Configure the Ubuntu operating system to automatically terminate inactive\nSSH sessions after a period of inactivity.\n\n Modify or append the following line in the \"/etc/ssh/sshd_config\" file,\nreplacing \"[Count]\" with a value of 1:\n\n ClientAliveCountMax 1\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000126-GPOS-00066","gid":"V-238212","rid":"SV-238212r653811_rule","stig_id":"UBTU-20-010036","fix_id":"F-41381r653810_fix","cci":["CCI-000879"],"legacy":[],"nist":["MA-4 e"]},"code":"control 'V-238212' do\n title \"The Ubuntu operating system must immediately terminate all network\nconnections associated with SSH traffic after a period of inactivity.\"\n desc \"Automatic session termination addresses the termination of\nuser-initiated logical sessions in contrast to the termination of network\nconnections that are associated with communications sessions (i.e., network\ndisconnect). A logical session (for local, network, and remote access) is\ninitiated whenever a user (or process acting on behalf of a user) accesses an\norganizational information system. Such user sessions can be terminated (and\nthus terminate user access) without terminating network sessions.\n\n Session termination terminates all processes associated with a user's\nlogical session except those processes that are specifically created by the\nuser (i.e., session owner) to continue after the session is terminated.\n\n Conditions or trigger events requiring automatic session termination can\ninclude, for example, organization-defined periods of user inactivity, targeted\nresponses to certain types of incidents, and time-of-day restrictions on\ninformation system use.\n\n This capability is typically reserved for specific Ubuntu operating system\nfunctionality where the system owner, data owner, or organization requires\nadditional assurance.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that all network connections associated with SSH traffic\nautomatically terminate after a period of inactivity.\n\n Verify the \\\"ClientAliveCountMax\\\" variable is set in the\n\\\"/etc/ssh/sshd_config\\\" file by performing the following command:\n\n $ sudo grep -i clientalivecountmax /etc/ssh/sshd_config\n\n ClientAliveCountMax 1\n\n If \\\"ClientAliveCountMax\\\" is not set, is not set to \\\"1\\\", or is commented\nout, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to automatically terminate inactive\nSSH sessions after a period of inactivity.\n\n Modify or append the following line in the \\\"/etc/ssh/sshd_config\\\" file,\nreplacing \\\"[Count]\\\" with a value of 1:\n\n ClientAliveCountMax 1\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000126-GPOS-00066'\n tag gid: 'V-238212'\n tag rid: 'SV-238212r653811_rule'\n tag stig_id: 'UBTU-20-010036'\n tag fix_id: 'F-41381r653810_fix'\n tag cci: ['CCI-000879']\n tag legacy: []\n tag nist: ['MA-4 e']\n\n describe sshd_config do\n its('ClientAliveCountMax') { should cmp 1 }\n end\nend\n","source_location":{"ref":"./controls/V-238212.rb","line":3},"id":"V-238212"},{"title":"The Ubuntu operating system library directories must be group-owned by\nroot.","desc":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","descriptions":{"default":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","rationale":"","check":"Verify the system-wide library directories \"/lib\", \"/lib64\", and\n\"/usr/lib\" are group-owned by root with the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec stat -c \"%n\n%G\" '{}' \\;\n\n If any system-wide shared library directory is returned, this is a finding.","fix":"Configure the system library directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec chgrp root\n'{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238352","rid":"SV-238352r654231_rule","stig_id":"UBTU-20-010431","fix_id":"F-41521r654230_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238352' do\n title \"The Ubuntu operating system library directories must be group-owned by\nroot.\"\n desc \" If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system-wide library directories \\\"/lib\\\", \\\"/lib64\\\", and\n\\\"/usr/lib\\\" are group-owned by root with the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec stat -c \\\"%n\n%G\\\" '{}' \\\\;\n\n If any system-wide shared library directory is returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the system library directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type d -exec chgrp root\n'{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238352'\n tag rid: 'SV-238352r654231_rule'\n tag stig_id: 'UBTU-20-010431'\n tag fix_id: 'F-41521r654230_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n if os.arch == \"x86_64\"\n library_directories = command('find /lib /usr/lib /usr/lib32 /lib32 /lib64 ! \\-group root \\-type d').stdout.strip.split(\"\\n\").entries\n else\n library_directories = command('find /lib /usr/lib /usr/lib32 /lib32 ! \\-group root \\-type d').stdout.strip.split(\"\\n\").entries\n end\n\n if library_directories.count > 0\n library_directories.each do |lib_file|\n describe file(lib_file) do\n its(\"group\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of system-wide shared library directories found that are NOT group-owned by root\" do\n subject { library_directories }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238352.rb","line":3},"id":"V-238352"},{"title":"The Ubuntu operating system must alert the ISSO and SA (at a minimum)\nin the event of an audit processing failure.","desc":"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.","descriptions":{"default":"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.","rationale":"","check":"Verify that the SA and ISSO (at a minimum) are notified in the event of an\naudit processing failure with the following command:\n\n $ sudo grep '^action_mail_acct = root' /etc/audit/auditd.conf\n\n action_mail_acct = \n\n If the value of the \"action_mail_acct\" keyword is not set to an accounts\nfor security personnel, the \"action_mail_acct\" keyword is missing, or the\nreturned line is commented out, this is a finding.","fix":"Configure \"auditd\" service to notify the SA and ISSO in the event of an\naudit processing failure.\n\n Edit the following line in \"/etc/audit/auditd.conf\" to ensure\nadministrators are notified via email for those situations:\n\n action_mail_acct = \n\n Note: Change \"administrator_account\" to an account for security\npersonnel.\n\n Restart the \"auditd\" service so the changes take effect:\n\n $ sudo systemctl restart auditd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000046-GPOS-00022","gid":"V-238243","rid":"SV-238243r653904_rule","stig_id":"UBTU-20-010117","fix_id":"F-41412r653903_fix","cci":["CCI-000139"],"legacy":[],"nist":["AU-5 a"]},"code":"control 'V-238243' do\n title \"The Ubuntu operating system must alert the ISSO and SA (at a minimum)\nin the event of an audit processing failure.\"\n desc \"It is critical for the appropriate personnel to be aware if a system\nis at risk of failing to process audit logs as required. Without this\nnotification, the security personnel may be unaware of an impending failure of\nthe audit capability, and system operation may be adversely affected.\n\n Audit processing failures include software/hardware errors, failures in the\naudit capturing mechanisms, and audit storage capacity being reached or\nexceeded.\n\n This requirement applies to each audit data storage repository (i.e.,\ndistinct information system component where audit records are stored), the\ncentralized audit storage capacity of organizations (i.e., all audit data\nstorage repositories combined), or both.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the SA and ISSO (at a minimum) are notified in the event of an\naudit processing failure with the following command:\n\n $ sudo grep '^action_mail_acct = root' /etc/audit/auditd.conf\n\n action_mail_acct = \n\n If the value of the \\\"action_mail_acct\\\" keyword is not set to an accounts\nfor security personnel, the \\\"action_mail_acct\\\" keyword is missing, or the\nreturned line is commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure \\\"auditd\\\" service to notify the SA and ISSO in the event of an\naudit processing failure.\n\n Edit the following line in \\\"/etc/audit/auditd.conf\\\" to ensure\nadministrators are notified via email for those situations:\n\n action_mail_acct = \n\n Note: Change \\\"administrator_account\\\" to an account for security\npersonnel.\n\n Restart the \\\"auditd\\\" service so the changes take effect:\n\n $ sudo systemctl restart auditd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000046-GPOS-00022'\n tag gid: 'V-238243'\n tag rid: 'SV-238243r653904_rule'\n tag stig_id: 'UBTU-20-010117'\n tag fix_id: 'F-41412r653903_fix'\n tag cci: ['CCI-000139']\n tag legacy: []\n tag nist: ['AU-5 a']\n\n action_mail_acct = auditd_conf.action_mail_acct\n security_accounts = input('action_mail_acct')\n\n describe 'System Administrator (SA) and Information System Security Officer (ISSO) are notified in the event of an audit processing failure' do\n subject { security_accounts }\n it { should cmp action_mail_acct }\n end\nend\n","source_location":{"ref":"./controls/V-238243.rb","line":3},"id":"V-238243"},{"title":"The Ubuntu operating system must use cryptographic mechanisms to\nprotect the integrity of audit tools.","desc":"Protecting the integrity of the tools used for auditing purposes is a\ncritical step toward ensuring the integrity of audit information. Audit\ninformation includes all information (e.g., audit records, audit settings, and\naudit reports) needed to successfully audit information system activity.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n It is not uncommon for attackers to replace the audit tools or inject code\ninto the existing tools with the purpose of providing the capability to hide or\nerase system activity from the audit logs.\n\n To address this risk, audit tools must be cryptographically signed in order\nto provide the capability to identify when the audit tools have been modified,\nmanipulated, or replaced. An example is a checksum hash of the file or files.","descriptions":{"default":"Protecting the integrity of the tools used for auditing purposes is a\ncritical step toward ensuring the integrity of audit information. Audit\ninformation includes all information (e.g., audit records, audit settings, and\naudit reports) needed to successfully audit information system activity.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n It is not uncommon for attackers to replace the audit tools or inject code\ninto the existing tools with the purpose of providing the capability to hide or\nerase system activity from the audit logs.\n\n To address this risk, audit tools must be cryptographically signed in order\nto provide the capability to identify when the audit tools have been modified,\nmanipulated, or replaced. An example is a checksum hash of the file or files.","rationale":"","check":"Verify that Advanced Intrusion Detection Environment (AIDE) is properly\nconfigured to use cryptographic mechanisms to protect the integrity of audit\ntools.\n\n Check the selection lines that AIDE is configured to add/check with the\nfollowing command:\n\n $ egrep '(\\/sbin\\/(audit|au))' /etc/aide/aide.conf\n\n /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512\n\n If any of the seven audit tools do not have appropriate selection lines,\nthis is a finding.","fix":"Add or update the following selection lines for \"/etc/aide/aide.conf\" to\nprotect the integrity of the audit tools:\n\n # Audit Tools\n /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000278-GPOS-00108","gid":"V-238303","rid":"SV-238303r654084_rule","stig_id":"UBTU-20-010205","fix_id":"F-41472r654083_fix","cci":["CCI-001496"],"legacy":[],"nist":["AU-9 (3)"]},"code":"control 'V-238303' do\n title \"The Ubuntu operating system must use cryptographic mechanisms to\nprotect the integrity of audit tools.\"\n desc \"Protecting the integrity of the tools used for auditing purposes is a\ncritical step toward ensuring the integrity of audit information. Audit\ninformation includes all information (e.g., audit records, audit settings, and\naudit reports) needed to successfully audit information system activity.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n It is not uncommon for attackers to replace the audit tools or inject code\ninto the existing tools with the purpose of providing the capability to hide or\nerase system activity from the audit logs.\n\n To address this risk, audit tools must be cryptographically signed in order\nto provide the capability to identify when the audit tools have been modified,\nmanipulated, or replaced. An example is a checksum hash of the file or files.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that Advanced Intrusion Detection Environment (AIDE) is properly\nconfigured to use cryptographic mechanisms to protect the integrity of audit\ntools.\n\n Check the selection lines that AIDE is configured to add/check with the\nfollowing command:\n\n $ egrep '(\\\\/sbin\\\\/(audit|au))' /etc/aide/aide.conf\n\n /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512\n\n If any of the seven audit tools do not have appropriate selection lines,\nthis is a finding.\n \"\n desc 'fix', \"\n Add or update the following selection lines for \\\"/etc/aide/aide.conf\\\" to\nprotect the integrity of the audit tools:\n\n # Audit Tools\n /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512\n /sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000278-GPOS-00108'\n tag gid: 'V-238303'\n tag rid: 'SV-238303r654084_rule'\n tag stig_id: 'UBTU-20-010205'\n tag fix_id: 'F-41472r654083_fix'\n tag cci: ['CCI-001496']\n tag legacy: []\n tag nist: ['AU-9 (3)']\n\n aide_conf = aide_conf input('aide_conf_path')\n\n aide_conf_exists = aide_conf.exist?\n\n if aide_conf_exists\n describe aide_conf.where { selection_line == '/sbin/auditctl' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n\n describe aide_conf.where { selection_line == '/sbin/auditd' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n\n describe aide_conf.where { selection_line == '/sbin/ausearch' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n\n describe aide_conf.where { selection_line == '/sbin/aureport' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n\n describe aide_conf.where { selection_line == '/sbin/autrace' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n\n describe aide_conf.where { selection_line == '/sbin/audispd' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n\n describe aide_conf.where { selection_line == '/sbin/augenrules' } do\n its('rules') { should include ['p', 'i', 'n', 'u', 'g', 's', 'b', 'acl', 'xattrs', 'sha512'] }\n end\n else\n describe 'aide.conf file exists' do\n subject { aide_conf_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238303.rb","line":3},"id":"V-238303"},{"title":"The Ubuntu operating system must generate error messages that provide\ninformation necessary for corrective actions without revealing information that\ncould be exploited by adversaries.","desc":"Any operating system providing too much information in error messages\nrisks compromising the data and security of the structure, and content of error\nmessages needs to be carefully considered by the organization.\n\n Organizations carefully consider the structure/content of error messages.\nThe extent to which information systems are able to identify and handle error\nconditions is guided by organizational policy and operational requirements.\nInformation that could be exploited by adversaries includes, for example,\nerroneous logon attempts with passwords entered by mistake as the username,\nmission/business information that can be derived from (if not stated explicitly\nby) information recorded, and personal information, such as account numbers,\nsocial security numbers, and credit card numbers.","descriptions":{"default":"Any operating system providing too much information in error messages\nrisks compromising the data and security of the structure, and content of error\nmessages needs to be carefully considered by the organization.\n\n Organizations carefully consider the structure/content of error messages.\nThe extent to which information systems are able to identify and handle error\nconditions is guided by organizational policy and operational requirements.\nInformation that could be exploited by adversaries includes, for example,\nerroneous logon attempts with passwords entered by mistake as the username,\nmission/business information that can be derived from (if not stated explicitly\nby) information recorded, and personal information, such as account numbers,\nsocial security numbers, and credit card numbers.","rationale":"","check":"Verify the Ubuntu operating system has all system log files under the\n\"/var/log\" directory with a permission set to 640 or less permissive by using\nthe following command:\n\n $ sudo find /var/log -perm /137 -type f -exec stat -c \"%n %a\" {} \\;\n\n If the command displays any output, this is a finding.","fix":"Configure the Ubuntu operating system to set permissions of all log files\nunder the \"/var/log\" directory to 640 or more restricted by using the\nfollowing command:\n\n $ sudo find /var/log -perm /137 -type f -exec chmod 640 '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000205-GPOS-00083","gid":"V-238337","rid":"SV-238337r654186_rule","stig_id":"UBTU-20-010416","fix_id":"F-41506r654185_fix","cci":["CCI-001312"],"legacy":[],"nist":["SI-11 a"]},"code":"control 'V-238337' do\n title \"The Ubuntu operating system must generate error messages that provide\ninformation necessary for corrective actions without revealing information that\ncould be exploited by adversaries.\"\n desc \" Any operating system providing too much information in error messages\nrisks compromising the data and security of the structure, and content of error\nmessages needs to be carefully considered by the organization.\n\n Organizations carefully consider the structure/content of error messages.\nThe extent to which information systems are able to identify and handle error\nconditions is guided by organizational policy and operational requirements.\nInformation that could be exploited by adversaries includes, for example,\nerroneous logon attempts with passwords entered by mistake as the username,\nmission/business information that can be derived from (if not stated explicitly\nby) information recorded, and personal information, such as account numbers,\nsocial security numbers, and credit card numbers.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system has all system log files under the\n\\\"/var/log\\\" directory with a permission set to 640 or less permissive by using\nthe following command:\n\n $ sudo find /var/log -perm /137 -type f -exec stat -c \\\"%n %a\\\" {} \\\\;\n\n If the command displays any output, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to set permissions of all log files\nunder the \\\"/var/log\\\" directory to 640 or more restricted by using the\nfollowing command:\n\n $ sudo find /var/log -perm /137 -type f -exec chmod 640 '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000205-GPOS-00083'\n tag gid: 'V-238337'\n tag rid: 'SV-238337r654186_rule'\n tag stig_id: 'UBTU-20-010416'\n tag fix_id: 'F-41506r654185_fix'\n tag cci: ['CCI-001312']\n tag legacy: []\n tag nist: ['SI-11 a']\n\n log_files = command('find /var/log -perm /137 -type f -exec stat -c \"%n %a\" {} \\;').stdout.strip.split(\"\\n\").entries\n\n describe \"Number of log files found with a permission NOT set to 640\" do\n subject { log_files }\n its(\"count\") { should eq 0 }\n end\nend\n","source_location":{"ref":"./controls/V-238337.rb","line":3},"id":"V-238337"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the sudo command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"sudo\" command.\n\n Check the configured audit rules with the following command:\n\n $ sudo auditctl -l | grep /usr/bin/sudo\n\n -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -k\npriv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"sudo\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238277","rid":"SV-238277r654006_rule","stig_id":"UBTU-20-010161","fix_id":"F-41446r654005_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238277' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the sudo command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"sudo\\\" command.\n\n Check the configured audit rules with the following command:\n\n $ sudo auditctl -l | grep /usr/bin/sudo\n\n -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=-1 -k\npriv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"sudo\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238277'\n tag rid: 'SV-238277r654006_rule'\n tag stig_id: 'UBTU-20-010161'\n tag fix_id: 'F-41446r654005_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/sudo'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238277.rb","line":3},"id":"V-238277"},{"title":"Ubuntu operating system must implement cryptographic mechanisms to\nprevent unauthorized disclosure of all information at rest.","desc":"Operating systems handling data requiring \"data at rest\" protections\nmust employ cryptographic mechanisms to prevent unauthorized disclosure and\nmodification of the information at rest.\n\n Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).","descriptions":{"default":"Operating systems handling data requiring \"data at rest\" protections\nmust employ cryptographic mechanisms to prevent unauthorized disclosure and\nmodification of the information at rest.\n\n Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).","rationale":"","check":"If there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\n Verify the Ubuntu operating system prevents unauthorized disclosure or\nmodification of all information requiring at-rest protection by using disk\nencryption.\n\n Determine the partition layout for the system with the following command:\n\n $sudo fdisk -l\n (..)\n Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors\n Units: sectors of 1 * 512 = 512 bytes\n Sector size (logical/physical): 512 bytes / 512 bytes\n I/O size (minimum/optimal): 512 bytes / 512 bytes\n Disklabel type: gpt\n Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB\n\n Device Start End Sectors Size Type\n /dev/vda1 2048 4095 2048 1M BIOS boot\n /dev/vda2 4096 2101247 2097152 1G Linux filesystem\n /dev/vda3 2101248 31455231 29353984 14G Linux filesystem\n (...)\n\n Verify that the system partitions are all encrypted with the following\ncommand:\n\n $ more /etc/crypttab\n\n Every persistent disk partition present must have an entry in the file.\n\n If any partitions other than the boot partition or pseudo file systems\n(such as /proc or /sys) are not listed, this is a finding.","fix":"To encrypt an entire partition, dedicate a partition for encryption in the\npartition layout.\n\n Note: Encrypting a partition in an already-installed system is more\ndifficult because it will need to be resized and existing partitions changed."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000405-GPOS-00184","gid":"V-238366","rid":"SV-238366r654273_rule","stig_id":"UBTU-20-010445","fix_id":"F-41535r654272_fix","cci":["CCI-002476"],"legacy":[],"nist":["SC-28 (1)"]},"code":"control 'V-238366' do\n title \"Ubuntu operating system must implement cryptographic mechanisms to\nprevent unauthorized disclosure of all information at rest.\"\n desc \"Operating systems handling data requiring \\\"data at rest\\\" protections\nmust employ cryptographic mechanisms to prevent unauthorized disclosure and\nmodification of the information at rest.\n\n Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).\n \"\n desc 'rationale', ''\n desc 'check', \"\n If there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\n Verify the Ubuntu operating system prevents unauthorized disclosure or\nmodification of all information requiring at-rest protection by using disk\nencryption.\n\n Determine the partition layout for the system with the following command:\n\n $sudo fdisk -l\n (..)\n Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors\n Units: sectors of 1 * 512 = 512 bytes\n Sector size (logical/physical): 512 bytes / 512 bytes\n I/O size (minimum/optimal): 512 bytes / 512 bytes\n Disklabel type: gpt\n Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB\n\n Device Start End Sectors Size Type\n /dev/vda1 2048 4095 2048 1M BIOS boot\n /dev/vda2 4096 2101247 2097152 1G Linux filesystem\n /dev/vda3 2101248 31455231 29353984 14G Linux filesystem\n (...)\n\n Verify that the system partitions are all encrypted with the following\ncommand:\n\n $ more /etc/crypttab\n\n Every persistent disk partition present must have an entry in the file.\n\n If any partitions other than the boot partition or pseudo file systems\n(such as /proc or /sys) are not listed, this is a finding.\n \"\n desc 'fix', \"\n To encrypt an entire partition, dedicate a partition for encryption in the\npartition layout.\n\n Note: Encrypting a partition in an already-installed system is more\ndifficult because it will need to be resized and existing partitions changed.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000405-GPOS-00184'\n tag gid: 'V-238366'\n tag rid: 'SV-238366r654273_rule'\n tag stig_id: 'UBTU-20-010445'\n tag fix_id: 'F-41535r654272_fix'\n tag cci: ['CCI-002476']\n tag legacy: []\n tag nist: ['SC-28 (1)']\n\n describe 'Not Applicable' do\n skip 'Encryption of data at rest is handled by the IaaS'\n end\nend\n","source_location":{"ref":"./controls/V-238366.rb","line":3},"id":"V-238366"},{"title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one special character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity or strength is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor in determining how long it takes to crack\na password. The more complex the password, the greater the number of possible\ncombinations that need to be tested before the password is compromised.\n\n Special characters are those characters that are not alphanumeric. Examples\ninclude: ~ ! @ # $ % ^ *.","descriptions":{"default":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity or strength is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor in determining how long it takes to crack\na password. The more complex the password, the greater the number of possible\ncombinations that need to be tested before the password is compromised.\n\n Special characters are those characters that are not alphanumeric. Examples\ninclude: ~ ! @ # $ % ^ *.","rationale":"","check":"Determine if the field \"ocredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n $ grep -i \"ocredit\" /etc/security/pwquality.conf\n ocredit=-1\n\n If the \"ocredit\" parameter is greater than \"-1\" or is commented out,\nthis is a finding.","fix":"Configure the Ubuntu operating system to enforce password complexity by\nrequiring that at least one special character be used.\n\n Add or update the following line in the \"/etc/security/pwquality.conf\"\nfile to include the \"ocredit=-1\" parameter:\n\n ocredit=-1"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000266-GPOS-00101","gid":"V-238226","rid":"SV-238226r653853_rule","stig_id":"UBTU-20-010055","fix_id":"F-41395r653852_fix","cci":["CCI-001619"],"legacy":[],"nist":["IA-5 (1) (a)"]},"code":"control 'V-238226' do\n title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one special character be used.\"\n desc \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity or strength is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor in determining how long it takes to crack\na password. The more complex the password, the greater the number of possible\ncombinations that need to be tested before the password is compromised.\n\n Special characters are those characters that are not alphanumeric. Examples\ninclude: ~ ! @ # $ % ^ *.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Determine if the field \\\"ocredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n $ grep -i \\\"ocredit\\\" /etc/security/pwquality.conf\n ocredit=-1\n\n If the \\\"ocredit\\\" parameter is greater than \\\"-1\\\" or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enforce password complexity by\nrequiring that at least one special character be used.\n\n Add or update the following line in the \\\"/etc/security/pwquality.conf\\\"\nfile to include the \\\"ocredit=-1\\\" parameter:\n\n ocredit=-1\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000266-GPOS-00101'\n tag gid: 'V-238226'\n tag rid: 'SV-238226r653853_rule'\n tag stig_id: 'UBTU-20-010055'\n tag fix_id: 'F-41395r653852_fix'\n tag cci: ['CCI-001619']\n tag legacy: []\n tag nist: ['IA-5 (1) (a)']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('ocredit') { should cmp -1 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238226.rb","line":3},"id":"V-238226"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chacl command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"chacl\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo audtctl -l | grep chacl\n\n -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1\n-k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chacl\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238284","rid":"SV-238284r654027_rule","stig_id":"UBTU-20-010168","fix_id":"F-41453r654026_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238284' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chacl command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"chacl\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo audtctl -l | grep chacl\n\n -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1\n-k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chacl\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238284'\n tag rid: 'SV-238284r654027_rule'\n tag stig_id: 'UBTU-20-010168'\n tag fix_id: 'F-41453r654026_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/chacl'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238284.rb","line":3},"id":"V-238284"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the pam_timestamp_check command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"pam_timestamp_check\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w pam_timestamp_check\n\n -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F\nauid>=1000 -F auid!=-1 -k privileged-pam_timestamp_check\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"pam_timestamp_check\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F\nauid>=1000 -F auid!=4294967295 -k privileged-pam_timestamp_check\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238294","rid":"SV-238294r654057_rule","stig_id":"UBTU-20-010178","fix_id":"F-41463r654056_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238294' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the pam_timestamp_check command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"pam_timestamp_check\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w pam_timestamp_check\n\n -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F\nauid>=1000 -F auid!=-1 -k privileged-pam_timestamp_check\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"pam_timestamp_check\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F\nauid>=1000 -F auid!=4294967295 -k privileged-pam_timestamp_check\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238294'\n tag rid: 'SV-238294r654057_rule'\n tag stig_id: 'UBTU-20-010178'\n tag fix_id: 'F-41463r654056_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/sbin/pam_timestamp_check'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238294.rb","line":3},"id":"V-238294"},{"title":"The Ubuntu operating system must be configured so that the script\nwhich runs each 30 days or less to check file integrity is the default one.","desc":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n Notifications provided by information systems include, for example,\nelectronic alerts to System Administrators, messages to local computer\nconsoles, and/or hardware indications, such as lights.\n\n This requirement applies to the Ubuntu operating system performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.","descriptions":{"default":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n Notifications provided by information systems include, for example,\nelectronic alerts to System Administrators, messages to local computer\nconsoles, and/or hardware indications, such as lights.\n\n This requirement applies to the Ubuntu operating system performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.","rationale":"","check":"Verify that the Advanced Intrusion Detection Environment (AIDE) default\nscript used to check file integrity each 30 days or less is unchanged.\n\n Download the original aide-common package in the /tmp directory:\n\n $ cd /tmp; apt download aide-common\n\n Fetch the SHA1 of the original script file:\n\n $ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | tar -xO\n./usr/share/aide/config/cron.daily/aide | sha1sum\n 32958374f18871e3f7dda27a58d721f471843e26 -\n\n Compare with the SHA1 of the file in the daily or monthly cron directory:\n\n $ sha1sum /etc/cron.{daily,monthly}/aide 2>/dev/null\n 32958374f18871e3f7dda27a58d721f471843e26 /etc/cron.daily/aide\n\n If there is no AIDE script file in the cron directories, or the SHA1 value\nof at least one file in the daily or monthly cron directory does not match the\nSHA1 of the original, this is a finding.","fix":"The cron file for AIDE is fairly complex as it creates the report. This\nfile is installed with the \"aide-common\" package, and the default can be\nrestored by copying it from the package:\n\n Download the original package to the /tmp dir:\n\n $ cd /tmp; apt download aide-common\n\n Extract the aide script to its original place:\n\n $ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | sudo tar -x\n./usr/share/aide/config/cron.daily/aide -C /\n\n Copy it to the cron.daily directory:\n\n $ sudo cp -f /usr/share/aide/config/cron.daily/aide /etc/cron.daily/aide"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000446-GPOS-00200","gid":"V-238236","rid":"SV-238236r653883_rule","stig_id":"UBTU-20-010074","fix_id":"F-41405r653882_fix","cci":["CCI-002699"],"legacy":[],"nist":["SI-6 b"]},"code":"control 'V-238236' do\n title \"The Ubuntu operating system must be configured so that the script\nwhich runs each 30 days or less to check file integrity is the default one.\"\n desc \"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n Notifications provided by information systems include, for example,\nelectronic alerts to System Administrators, messages to local computer\nconsoles, and/or hardware indications, such as lights.\n\n This requirement applies to the Ubuntu operating system performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Advanced Intrusion Detection Environment (AIDE) default\nscript used to check file integrity each 30 days or less is unchanged.\n\n Download the original aide-common package in the /tmp directory:\n\n $ cd /tmp; apt download aide-common\n\n Fetch the SHA1 of the original script file:\n\n $ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | tar -xO\n./usr/share/aide/config/cron.daily/aide | sha1sum\n 32958374f18871e3f7dda27a58d721f471843e26 -\n\n Compare with the SHA1 of the file in the daily or monthly cron directory:\n\n $ sha1sum /etc/cron.{daily,monthly}/aide 2>/dev/null\n 32958374f18871e3f7dda27a58d721f471843e26 /etc/cron.daily/aide\n\n If there is no AIDE script file in the cron directories, or the SHA1 value\nof at least one file in the daily or monthly cron directory does not match the\nSHA1 of the original, this is a finding.\n \"\n desc 'fix', \"\n The cron file for AIDE is fairly complex as it creates the report. This\nfile is installed with the \\\"aide-common\\\" package, and the default can be\nrestored by copying it from the package:\n\n Download the original package to the /tmp dir:\n\n $ cd /tmp; apt download aide-common\n\n Extract the aide script to its original place:\n\n $ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | sudo tar -x\n./usr/share/aide/config/cron.daily/aide -C /\n\n Copy it to the cron.daily directory:\n\n $ sudo cp -f /usr/share/aide/config/cron.daily/aide /etc/cron.daily/aide\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000446-GPOS-00200'\n tag gid: 'V-238236'\n tag rid: 'SV-238236r653883_rule'\n tag stig_id: 'UBTU-20-010074'\n tag fix_id: 'F-41405r653882_fix'\n tag cci: ['CCI-002699']\n tag legacy: []\n tag nist: ['SI-6 b']\n\n describe(\"Verify that the Advanced Intrusion Detection Environment (AIDE) default script used to check file integrity each 30 days or less is unchanged.\") do\n skip(\"manual test\")\n end\nend\n","source_location":{"ref":"./controls/V-238236.rb","line":3},"id":"V-238236"},{"title":"The Ubuntu operating system must have system commands set to a mode of\n0755 or less permissive.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":{"default":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","rationale":"","check":"Verify the system commands contained in the following directories have mode\n0755 or less permissive:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Check that the system command files have mode 0755 or less permissive with\nthe following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n-perm /022 -type f -exec stat -c \"%n %a\" '{}' \\;\n\n If any files are found to be group-writable or world-writable, this is a\nfinding.","fix":"Configure the system commands to be protected from unauthorized access. Run\nthe following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n-perm /022 -type f -exec chmod 755 '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238376","rid":"SV-238376r654303_rule","stig_id":"UBTU-20-010456","fix_id":"F-41545r654302_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238376' do\n title \"The Ubuntu operating system must have system commands set to a mode of\n0755 or less permissive.\"\n desc \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system commands contained in the following directories have mode\n0755 or less permissive:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Check that the system command files have mode 0755 or less permissive with\nthe following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n-perm /022 -type f -exec stat -c \\\"%n %a\\\" '{}' \\\\;\n\n If any files are found to be group-writable or world-writable, this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the system commands to be protected from unauthorized access. Run\nthe following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n-perm /022 -type f -exec chmod 755 '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238376'\n tag rid: 'SV-238376r654303_rule'\n tag stig_id: 'UBTU-20-010456'\n tag fix_id: 'F-41545r654302_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n system_commands = command(\"find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type f\").stdout.strip.split(\"\\n\").entries\n valid_system_commands = Set[]\n\n if system_commands.count > 0\n system_commands.each do |sys_cmd|\n if file(sys_cmd).exist?\n valid_system_commands = valid_system_commands << sys_cmd\n end\n end\n end\n\n if valid_system_commands.count > 0\n valid_system_commands.each do |val_sys_cmd|\n describe file(val_sys_cmd) do\n it { should_not be_more_permissive_than(\"0755\") }\n end\n end\n else\n describe \"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are less permissive than 0755\" do\n subject { valid_system_commands }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238376.rb","line":3},"id":"V-238376"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the lchown system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"lchown\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep lchown\n\n -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"lchown\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238267","rid":"SV-238267r653976_rule","stig_id":"UBTU-20-010151","fix_id":"F-41436r653975_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238267' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the lchown system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"lchown\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep lchown\n\n -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"lchown\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238267'\n tag rid: 'SV-238267r653976_rule'\n tag stig_id: 'UBTU-20-010151'\n tag fix_id: 'F-41436r653975_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('lchown').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('lchown').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238267.rb","line":3},"id":"V-238267"},{"title":"The Ubuntu operating system must not have the rsh-server package\ninstalled.","desc":"It is detrimental for operating systems to provide, or install by\ndefault, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n Operating systems are capable of providing a wide variety of functions and\nservices. Some of the functions and services, provided by default, may not be\nnecessary to support essential organizational operations (e.g., key missions,\nfunctions).\n\n Examples of non-essential capabilities include, but are not limited to,\ngames, software packages, tools, and demonstration software, not related to\nrequirements or providing a wide array of functionality not required for every\nmission, but which cannot be disabled.","descriptions":{"default":"It is detrimental for operating systems to provide, or install by\ndefault, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n Operating systems are capable of providing a wide variety of functions and\nservices. Some of the functions and services, provided by default, may not be\nnecessary to support essential organizational operations (e.g., key missions,\nfunctions).\n\n Examples of non-essential capabilities include, but are not limited to,\ngames, software packages, tools, and demonstration software, not related to\nrequirements or providing a wide array of functionality not required for every\nmission, but which cannot be disabled.","rationale":"","check":"Verify the rsh-server package is installed with the following command:\n\n$ dpkg -l | grep rsh-server\n\nIf the rsh-server package is installed, this is a finding.","fix":"Configure the Ubuntu operating system to disable non-essential capabilities\nby removing the rsh-server package from the system with the following command:\n\n $ sudo apt-get remove rsh-server"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000095-GPOS-00049","gid":"V-238327","rid":"SV-238327r654156_rule","stig_id":"UBTU-20-010406","fix_id":"F-41496r654155_fix","cci":["CCI-000381"],"legacy":[],"nist":["CM-7 a"]},"code":"control 'V-238327' do\n title \"The Ubuntu operating system must not have the rsh-server package\ninstalled.\"\n desc \"It is detrimental for operating systems to provide, or install by\ndefault, functionality exceeding requirements or mission objectives. These\nunnecessary capabilities or services are often overlooked and therefore may\nremain unsecured. They increase the risk to the platform by providing\nadditional attack vectors.\n\n Operating systems are capable of providing a wide variety of functions and\nservices. Some of the functions and services, provided by default, may not be\nnecessary to support essential organizational operations (e.g., key missions,\nfunctions).\n\n Examples of non-essential capabilities include, but are not limited to,\ngames, software packages, tools, and demonstration software, not related to\nrequirements or providing a wide array of functionality not required for every\nmission, but which cannot be disabled.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the rsh-server package is installed with the following command:\n\n $ dpkg -l | grep rsh-server\n\n If the rsh-server package is installed, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to disable non-essential capabilities\nby removing the rsh-server package from the system with the following command:\n\n $ sudo apt-get remove rsh-server\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000095-GPOS-00049'\n tag gid: 'V-238327'\n tag rid: 'SV-238327r654156_rule'\n tag stig_id: 'UBTU-20-010406'\n tag fix_id: 'F-41496r654155_fix'\n tag cci: ['CCI-000381']\n tag legacy: []\n tag nist: ['CM-7 a']\n\n describe package('rsh-server') do\n it { should_not be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238327.rb","line":3},"id":"V-238327"},{"title":"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of renameat system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of renameat system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep renameat\n\n -a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of the renameat system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b64 -S renameat -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000468-GPOS-00212","gid":"V-238313","rid":"SV-238313r654114_rule","stig_id":"UBTU-20-010270","fix_id":"F-41482r654113_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238313' do\n title \"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of renameat system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of renameat system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep renameat\n\n -a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of the renameat system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b64 -S renameat -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000468-GPOS-00212'\n tag gid: 'V-238313'\n tag rid: 'SV-238313r654114_rule'\n tag stig_id: 'UBTU-20-010270'\n tag fix_id: 'F-41482r654113_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"renameat\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"renameat\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238313.rb","line":3},"id":"V-238313"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chfn command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \"chfn\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/chfn'\n\n -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=-1 -k\nprivileged-chfn\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"chfn\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chfn\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238253","rid":"SV-238253r653934_rule","stig_id":"UBTU-20-010137","fix_id":"F-41422r653933_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238253' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chfn command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \\\"chfn\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/chfn'\n\n -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=-1 -k\nprivileged-chfn\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"chfn\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-chfn\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238253'\n tag rid: 'SV-238253r653934_rule'\n tag stig_id: 'UBTU-20-010137'\n tag fix_id: 'F-41422r653933_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/chfn'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238253.rb","line":3},"id":"V-238253"},{"title":"The Ubuntu operating system must configure /var/log/syslog file to be\nowned by syslog.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":{"default":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","rationale":"","check":"Verify that the Ubuntu operating system configures the \"/var/log/syslog\"\nfile to be owned by syslog with the following command:\n\n $ sudo stat -c \"%n %U\" /var/log/syslog\n /var/log/syslog syslog\n\n If the \"/var/log/syslog\" file is not owned by syslog, this is a finding.","fix":"Configure the Ubuntu operating system to have syslog own the\n\"/var/log/syslog\" file by running the following command:\n\n $ sudo chown syslog /var/log/syslog"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-238342","rid":"SV-238342r654201_rule","stig_id":"UBTU-20-010421","fix_id":"F-41511r654200_fix","cci":["CCI-001314"],"legacy":[],"nist":["SI-11 b"]},"code":"control 'V-238342' do\n title \"The Ubuntu operating system must configure /var/log/syslog file to be\nowned by syslog.\"\n desc \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system configures the \\\"/var/log/syslog\\\"\nfile to be owned by syslog with the following command:\n\n $ sudo stat -c \\\"%n %U\\\" /var/log/syslog\n /var/log/syslog syslog\n\n If the \\\"/var/log/syslog\\\" file is not owned by syslog, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to have syslog own the\n\\\"/var/log/syslog\\\" file by running the following command:\n\n $ sudo chown syslog /var/log/syslog\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000206-GPOS-00084'\n tag gid: 'V-238342'\n tag rid: 'SV-238342r654201_rule'\n tag stig_id: 'UBTU-20-010421'\n tag fix_id: 'F-41511r654200_fix'\n tag cci: ['CCI-001314']\n tag legacy: []\n tag nist: ['SI-11 b']\n\n describe file('/var/log/syslog') do\n its('owner') { should cmp 'syslog' }\n end\nend\n","source_location":{"ref":"./controls/V-238342.rb","line":3},"id":"V-238342"},{"title":"The Ubuntu operating system must enforce 24 hours/1 day as the minimum\npassword lifetime. Passwords for new users must have a 24 hours/1 day minimum\npassword lifetime restriction.","desc":"Enforcing a minimum password lifetime helps to prevent repeated\npassword changes to defeat the password reuse or history enforcement\nrequirement. If users are allowed to immediately and continually change their\npassword, then the password could be repeatedly changed in a short period of\ntime to defeat the organization's policy regarding password reuse.","descriptions":{"default":"Enforcing a minimum password lifetime helps to prevent repeated\npassword changes to defeat the password reuse or history enforcement\nrequirement. If users are allowed to immediately and continually change their\npassword, then the password could be repeatedly changed in a short period of\ntime to defeat the organization's policy regarding password reuse.","rationale":"","check":"Verify the Ubuntu operating system enforces a 24 hours/1 day minimum\npassword lifetime for new user accounts by running the following command:\n\n $ grep -i ^pass_min_days /etc/login.defs\n\n PASS_MIN_DAYS 1\n\n If the \"PASS_MIN_DAYS\" parameter value is less than \"1\" or is commented\nout, this is a finding.","fix":"Configure the Ubuntu operating system to enforce a 24 hours/1 day minimum\npassword lifetime.\n\n Add or modify the following line in the \"/etc/login.defs\" file:\n\n PASS_MIN_DAYS 1"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000075-GPOS-00043","gid":"V-238202","rid":"SV-238202r653781_rule","stig_id":"UBTU-20-010007","fix_id":"F-41371r653780_fix","cci":["CCI-000198"],"legacy":[],"nist":["IA-5 (1) (d)"]},"code":"control 'V-238202' do\n title \"The Ubuntu operating system must enforce 24 hours/1 day as the minimum\npassword lifetime. Passwords for new users must have a 24 hours/1 day minimum\npassword lifetime restriction.\"\n desc \"Enforcing a minimum password lifetime helps to prevent repeated\npassword changes to defeat the password reuse or history enforcement\nrequirement. If users are allowed to immediately and continually change their\npassword, then the password could be repeatedly changed in a short period of\ntime to defeat the organization's policy regarding password reuse.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system enforces a 24 hours/1 day minimum\npassword lifetime for new user accounts by running the following command:\n\n $ grep -i ^pass_min_days /etc/login.defs\n\n PASS_MIN_DAYS 1\n\n If the \\\"PASS_MIN_DAYS\\\" parameter value is less than \\\"1\\\" or is commented\nout, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enforce a 24 hours/1 day minimum\npassword lifetime.\n\n Add or modify the following line in the \\\"/etc/login.defs\\\" file:\n\n PASS_MIN_DAYS 1\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000075-GPOS-00043'\n tag gid: 'V-238202'\n tag rid: 'SV-238202r653781_rule'\n tag stig_id: 'UBTU-20-010007'\n tag fix_id: 'F-41371r653780_fix'\n tag cci: ['CCI-000198']\n tag legacy: []\n tag nist: ['IA-5 (1) (d)']\n\n describe login_defs do\n its('PASS_MIN_DAYS') { should >= '1' }\n end\nend\n","source_location":{"ref":"./controls/V-238202.rb","line":3},"id":"V-238202"},{"title":"The Ubuntu operating system must be configured so that remote X\nconnections are disabled, unless to fulfill documented and validated mission\nrequirements.","desc":"The security risk of using X11 forwarding is that the client's X11\ndisplay server may be exposed to attack when the SSH client requests\nforwarding. A System Administrator may have a stance in which they want to\nprotect clients that may expose themselves to attack by unwittingly requesting\nX11 forwarding, which can warrant a ''no'' setting.\n\n X11 forwarding should be enabled with caution. Users with the ability to\nbypass file permissions on the remote host (for the user's X11 authorization\ndatabase) can access the local X11 display through the forwarded connection. An\nattacker may then be able to perform activities such as keystroke monitoring if\nthe ForwardX11Trusted option is also enabled.\n\n If X11 services are not required for the system's intended function, they\nshould be disabled or restricted as appropriate to the system’s needs.","descriptions":{"default":"The security risk of using X11 forwarding is that the client's X11\ndisplay server may be exposed to attack when the SSH client requests\nforwarding. A System Administrator may have a stance in which they want to\nprotect clients that may expose themselves to attack by unwittingly requesting\nX11 forwarding, which can warrant a ''no'' setting.\n\n X11 forwarding should be enabled with caution. Users with the ability to\nbypass file permissions on the remote host (for the user's X11 authorization\ndatabase) can access the local X11 display through the forwarded connection. An\nattacker may then be able to perform activities such as keystroke monitoring if\nthe ForwardX11Trusted option is also enabled.\n\n If X11 services are not required for the system's intended function, they\nshould be disabled or restricted as appropriate to the system’s needs.","rationale":"","check":"Verify that X11Forwarding is disabled with the following command:\n\n $ grep -i x11forwarding /etc/ssh/sshd_config | grep -v \"^#\"\n\n X11Forwarding no\n\n If the \"X11Forwarding\" keyword is set to \"yes\" and is not documented\nwith the Information System Security Officer (ISSO) as an operational\nrequirement or is missing, this is a finding.","fix":"Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the\n\"X11Forwarding\" keyword and set its value to \"no\" (this file may be named\ndifferently or be in a different location if using a version of SSH that is\nprovided by a third-party vendor):\n\n X11Forwarding no\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-238219","rid":"SV-238219r653832_rule","stig_id":"UBTU-20-010048","fix_id":"F-41388r653831_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238219' do\n title \"The Ubuntu operating system must be configured so that remote X\nconnections are disabled, unless to fulfill documented and validated mission\nrequirements.\"\n desc \"The security risk of using X11 forwarding is that the client's X11\ndisplay server may be exposed to attack when the SSH client requests\nforwarding. A System Administrator may have a stance in which they want to\nprotect clients that may expose themselves to attack by unwittingly requesting\nX11 forwarding, which can warrant a ''no'' setting.\n\n X11 forwarding should be enabled with caution. Users with the ability to\nbypass file permissions on the remote host (for the user's X11 authorization\ndatabase) can access the local X11 display through the forwarded connection. An\nattacker may then be able to perform activities such as keystroke monitoring if\nthe ForwardX11Trusted option is also enabled.\n\n If X11 services are not required for the system's intended function, they\nshould be disabled or restricted as appropriate to the system’s needs.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that X11Forwarding is disabled with the following command:\n\n $ grep -i x11forwarding /etc/ssh/sshd_config | grep -v \\\"^#\\\"\n\n X11Forwarding no\n\n If the \\\"X11Forwarding\\\" keyword is set to \\\"yes\\\" and is not documented\nwith the Information System Security Officer (ISSO) as an operational\nrequirement or is missing, this is a finding.\n \"\n desc 'fix', \"\n Edit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the\n\\\"X11Forwarding\\\" keyword and set its value to \\\"no\\\" (this file may be named\ndifferently or be in a different location if using a version of SSH that is\nprovided by a third-party vendor):\n\n X11Forwarding no\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000480-GPOS-00227'\n tag gid: 'V-238219'\n tag rid: 'SV-238219r653832_rule'\n tag stig_id: 'UBTU-20-010048'\n tag fix_id: 'F-41388r653831_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe sshd_config do\n its('X11Forwarding') { should cmp 'no' }\n end\nend\n","source_location":{"ref":"./controls/V-238219.rb","line":3},"id":"V-238219"},{"title":"The Ubuntu operating system's Advance Package Tool (APT) must be\nconfigured to prevent the installation of patches, service packs, device\ndrivers, or Ubuntu operating system components without verification they have\nbeen digitally signed using a certificate that is recognized and approved by\nthe organization.","desc":"Changes to any software components can have significant effects on the\noverall security of the operating system. This requirement ensures the software\nhas not been tampered with and that it has been provided by a trusted vendor.\n\n Accordingly, patches, service packs, device drivers, or operating system\ncomponents must be signed with a certificate recognized and approved by the\norganization.\n\n Verifying the authenticity of the software prior to installation validates\nthe integrity of the patch or upgrade received from a vendor. This ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor. Self-signed certificates are disallowed by this requirement. The\noperating system should not have to verify the software again. This requirement\ndoes not mandate DoD certificates for this purpose; however, the certificate\nused to verify the software must be from an approved CA.","descriptions":{"default":"Changes to any software components can have significant effects on the\noverall security of the operating system. This requirement ensures the software\nhas not been tampered with and that it has been provided by a trusted vendor.\n\n Accordingly, patches, service packs, device drivers, or operating system\ncomponents must be signed with a certificate recognized and approved by the\norganization.\n\n Verifying the authenticity of the software prior to installation validates\nthe integrity of the patch or upgrade received from a vendor. This ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor. Self-signed certificates are disallowed by this requirement. The\noperating system should not have to verify the software again. This requirement\ndoes not mandate DoD certificates for this purpose; however, the certificate\nused to verify the software must be from an approved CA.","rationale":"","check":"Verify that APT is configured to prevent the installation of patches,\nservice packs, device drivers, or Ubuntu operating system components without\nverification they have been digitally signed using a certificate that is\nrecognized and approved by the organization.\n\n Check that the \"AllowUnauthenticated\" variable is not set at all or is\nset to \"false\" with the following command:\n\n $ grep AllowUnauthenticated /etc/apt/apt.conf.d/*\n /etc/apt/apt.conf.d/01-vendor-Ubuntu:APT::Get::AllowUnauthenticated\n\"false\";\n\n If any of the files returned from the command with \"AllowUnauthenticated\"\nare set to \"true\", this is a finding.","fix":"Configure APT to prevent the installation of patches, service packs, device\ndrivers, or Ubuntu operating system components without verification they have\nbeen digitally signed using a certificate that is recognized and approved by\nthe organization.\n\n Remove/update any APT configuration files that contain the variable\n\"AllowUnauthenticated\" to \"false\", or remove \"AllowUnauthenticated\"\nentirely from each file. Below is an example of setting the\n\"AllowUnauthenticated\" variable to \"false\":\n\n APT::Get::AllowUnauthenticated \"false\";"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000366-GPOS-00153","gid":"V-238359","rid":"SV-238359r654319_rule","stig_id":"UBTU-20-010438","fix_id":"F-41528r654251_fix","cci":["CCI-001749"],"legacy":[],"nist":["CM-5 (3)"]},"code":"control 'V-238359' do\n title \"The Ubuntu operating system's Advance Package Tool (APT) must be\nconfigured to prevent the installation of patches, service packs, device\ndrivers, or Ubuntu operating system components without verification they have\nbeen digitally signed using a certificate that is recognized and approved by\nthe organization.\"\n desc \"Changes to any software components can have significant effects on the\noverall security of the operating system. This requirement ensures the software\nhas not been tampered with and that it has been provided by a trusted vendor.\n\n Accordingly, patches, service packs, device drivers, or operating system\ncomponents must be signed with a certificate recognized and approved by the\norganization.\n\n Verifying the authenticity of the software prior to installation validates\nthe integrity of the patch or upgrade received from a vendor. This ensures the\nsoftware has not been tampered with and that it has been provided by a trusted\nvendor. Self-signed certificates are disallowed by this requirement. The\noperating system should not have to verify the software again. This requirement\ndoes not mandate DoD certificates for this purpose; however, the certificate\nused to verify the software must be from an approved CA.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that APT is configured to prevent the installation of patches,\nservice packs, device drivers, or Ubuntu operating system components without\nverification they have been digitally signed using a certificate that is\nrecognized and approved by the organization.\n\n Check that the \\\"AllowUnauthenticated\\\" variable is not set at all or is\nset to \\\"false\\\" with the following command:\n\n $ grep AllowUnauthenticated /etc/apt/apt.conf.d/*\n /etc/apt/apt.conf.d/01-vendor-Ubuntu:APT::Get::AllowUnauthenticated\n\\\"false\\\";\n\n If any of the files returned from the command with \\\"AllowUnauthenticated\\\"\nare set to \\\"true\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure APT to prevent the installation of patches, service packs, device\ndrivers, or Ubuntu operating system components without verification they have\nbeen digitally signed using a certificate that is recognized and approved by\nthe organization.\n\n Remove/update any APT configuration files that contain the variable\n\\\"AllowUnauthenticated\\\" to \\\"false\\\", or remove \\\"AllowUnauthenticated\\\"\nentirely from each file. Below is an example of setting the\n\\\"AllowUnauthenticated\\\" variable to \\\"false\\\":\n\n APT::Get::AllowUnauthenticated \\\"false\\\";\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000366-GPOS-00153'\n tag gid: 'V-238359'\n tag rid: 'SV-238359r654319_rule'\n tag stig_id: 'UBTU-20-010438'\n tag fix_id: 'F-41528r654251_fix'\n tag cci: ['CCI-001749']\n tag legacy: []\n tag nist: ['CM-5 (3)']\n\n describe directory('/etc/apt/apt.conf.d') do\n it { should exist }\n end\n\n apt_allowunauth = command('grep -i allowunauth /etc/apt/apt.conf.d/*').stdout.strip.split(\"\\n\")\n if apt_allowunauth.empty?\n describe 'apt conf files do not contain AllowUnauthenticated' do\n subject { apt_allowunauth.empty? }\n it { should be true }\n end\n else\n apt_allowunauth.each do |line|\n describe \"#{line} contains AllowUnauthenctication\" do\n subject { line }\n it { should_not match /.*false.*/ }\n end\n end\n end\nend\n","source_location":{"ref":"./controls/V-238359.rb","line":3},"id":"V-238359"},{"title":"The Ubuntu operating system must be configured so that the audit log\ndirectory is not write-accessible by unauthorized users.","desc":"If audit information were to become compromised, then forensic\nanalysis and discovery of the true source of potentially malicious system\nactivity is impossible to achieve.\n\n To ensure the veracity of audit information, the operating system must\nprotect audit information from unauthorized deletion. This requirement can be\nachieved through multiple methods, which will depend upon system architecture\nand design.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit information system\nactivity.","descriptions":{"default":"If audit information were to become compromised, then forensic\nanalysis and discovery of the true source of potentially malicious system\nactivity is impossible to achieve.\n\n To ensure the veracity of audit information, the operating system must\nprotect audit information from unauthorized deletion. This requirement can be\nachieved through multiple methods, which will depend upon system architecture\nand design.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit information system\nactivity.","rationale":"","check":"Verify that the audit log directory has a mode of \"0750\" or less\npermissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\ndirectory has a mode of \"0750\" or less by using the following command:\n\n $ sudo stat -c \"%n %a\" /var/log/audit /var/log/audit/*\n /var/log/audit 750\n /var/log/audit/audit.log 600\n\n If the audit log directory has a mode more permissive than \"0750\", this\nis a finding.","fix":"Configure the audit log directory to have a mode of \"0750\" or less\npermissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log directory to have a mode of \"0750\" or less permissive by\n using the following command:\n\n $ sudo chmod -R g-w,o-rwx /var/log/audit"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000059-GPOS-00029","gid":"V-238248","rid":"SV-238248r653919_rule","stig_id":"UBTU-20-010128","fix_id":"F-41417r653918_fix","cci":["CCI-000164"],"legacy":[],"nist":["AU-9"]},"code":"control 'V-238248' do\n title \"The Ubuntu operating system must be configured so that the audit log\ndirectory is not write-accessible by unauthorized users.\"\n desc \"If audit information were to become compromised, then forensic\nanalysis and discovery of the true source of potentially malicious system\nactivity is impossible to achieve.\n\n To ensure the veracity of audit information, the operating system must\nprotect audit information from unauthorized deletion. This requirement can be\nachieved through multiple methods, which will depend upon system architecture\nand design.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit information system\nactivity.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the audit log directory has a mode of \\\"0750\\\" or less\npermissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\ndirectory has a mode of \\\"0750\\\" or less by using the following command:\n\n $ sudo stat -c \\\"%n %a\\\" /var/log/audit /var/log/audit/*\n /var/log/audit 750\n /var/log/audit/audit.log 600\n\n If the audit log directory has a mode more permissive than \\\"0750\\\", this\nis a finding.\n \"\n desc 'fix', \"\n Configure the audit log directory to have a mode of \\\"0750\\\" or less\npermissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log directory to have a mode of \\\"0750\\\" or less permissive by\n using the following command:\n\n $ sudo chmod -R g-w,o-rwx /var/log/audit\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000059-GPOS-00029'\n tag gid: 'V-238248'\n tag rid: 'SV-238248r653919_rule'\n tag stig_id: 'UBTU-20-010128'\n tag fix_id: 'F-41417r653918_fix'\n tag cci: ['CCI-000164']\n tag legacy: []\n tag nist: ['AU-9']\n\n log_file = auditd_conf.log_file\n\n log_dir_exists = !log_file.nil? && !File.dirname(log_file).nil?\n if log_dir_exists\n describe directory(File.dirname(log_file)) do\n it { should_not be_more_permissive_than('0750') }\n end\n else\n describe ('Audit directory for file ' + log_file + ' exists') do\n subject { log_dir_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238248.rb","line":3},"id":"V-238248"},{"title":"The Ubuntu operating system must record time stamps for audit records\nthat can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time\n(GMT).","desc":"If time stamps are not consistently applied and there is no common\ntime reference, it is difficult to perform forensic analysis.\n\n Time stamps generated by the operating system include date and time. Time\nis commonly expressed in Coordinated Universal Time (UTC), a modern\ncontinuation of Greenwich Mean Time (GMT), or local time with an offset from\nUTC.","descriptions":{"default":"If time stamps are not consistently applied and there is no common\ntime reference, it is difficult to perform forensic analysis.\n\n Time stamps generated by the operating system include date and time. Time\nis commonly expressed in Coordinated Universal Time (UTC), a modern\ncontinuation of Greenwich Mean Time (GMT), or local time with an offset from\nUTC.","rationale":"","check":"To verify the time zone is configured to use UTC or GMT, run the following\ncommand.\n\n $ timedatectl status | grep -i \"time zone\"\n Timezone: UTC (UTC, +0000)\n\n If \"Timezone\" is not set to UTC or GMT, this is a finding.","fix":"To configure the system time zone to use UTC or GMT, run the following\ncommand, replacing [ZONE] with UTC or GMT:\n\n $ sudo timedatectl set-timezone [ZONE]"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000359-GPOS-00146","gid":"V-238308","rid":"SV-238308r654099_rule","stig_id":"UBTU-20-010230","fix_id":"F-41477r654098_fix","cci":["CCI-001890"],"legacy":[],"nist":["AU-8 b"]},"code":"control 'V-238308' do\n title \"The Ubuntu operating system must record time stamps for audit records\nthat can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time\n(GMT).\"\n desc \"If time stamps are not consistently applied and there is no common\ntime reference, it is difficult to perform forensic analysis.\n\n Time stamps generated by the operating system include date and time. Time\nis commonly expressed in Coordinated Universal Time (UTC), a modern\ncontinuation of Greenwich Mean Time (GMT), or local time with an offset from\nUTC.\n \"\n desc 'rationale', ''\n desc 'check', \"\n To verify the time zone is configured to use UTC or GMT, run the following\ncommand.\n\n $ timedatectl status | grep -i \\\"time zone\\\"\n Timezone: UTC (UTC, +0000)\n\n If \\\"Timezone\\\" is not set to UTC or GMT, this is a finding.\n \"\n desc 'fix', \"\n To configure the system time zone to use UTC or GMT, run the following\ncommand, replacing [ZONE] with UTC or GMT:\n\n $ sudo timedatectl set-timezone [ZONE]\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000359-GPOS-00146'\n tag gid: 'V-238308'\n tag rid: 'SV-238308r654099_rule'\n tag stig_id: 'UBTU-20-010230'\n tag fix_id: 'F-41477r654098_fix'\n tag cci: ['CCI-001890']\n tag legacy: []\n tag nist: ['AU-8 b']\n\n time_zone = command('timedatectl status | grep -i \"time zone\"').stdout.strip\n\n describe time_zone do\n it { should match 'UTC' }\n end\nend\n","source_location":{"ref":"./controls/V-238308.rb","line":3},"id":"V-238308"},{"title":"The Ubuntu operating system must generate audit records when\nsuccessful/unsuccessful attempts to use modprobe command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify if the Ubuntu operating system is configured to audit the execution\nof the module management program \"modprobe\" by running the following command:\n\n $ sudo auditctl -l | grep \"/sbin/modprobe\"\n\n -w /sbin/modprobe -p x -k modules\n\n If the command does not return a line, or the line is commented out, this\nis a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to audit the execution of the module\nmanagement program \"modprobe\".\n\n Add or update the following rule in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /sbin/modprobe -p x -k modules\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000477-GPOS-00222","gid":"V-238318","rid":"SV-238318r654129_rule","stig_id":"UBTU-20-010296","fix_id":"F-41487r654128_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238318' do\n title \"The Ubuntu operating system must generate audit records when\nsuccessful/unsuccessful attempts to use modprobe command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify if the Ubuntu operating system is configured to audit the execution\nof the module management program \\\"modprobe\\\" by running the following command:\n\n $ sudo auditctl -l | grep \\\"/sbin/modprobe\\\"\n\n -w /sbin/modprobe -p x -k modules\n\n If the command does not return a line, or the line is commented out, this\nis a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to audit the execution of the module\nmanagement program \\\"modprobe\\\".\n\n Add or update the following rule in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /sbin/modprobe -p x -k modules\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000477-GPOS-00222'\n tag gid: 'V-238318'\n tag rid: 'SV-238318r654129_rule'\n tag stig_id: 'UBTU-20-010296'\n tag fix_id: 'F-41487r654128_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/sbin/modprobe'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238318.rb","line":3},"id":"V-238318"},{"title":"The Ubuntu operating system must generate audit records for any use of\nthe setxattr system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"setxattr\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep setxattr\n\n -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"setxattr\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238258","rid":"SV-238258r653949_rule","stig_id":"UBTU-20-010142","fix_id":"F-41427r653948_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238258' do\n title \"The Ubuntu operating system must generate audit records for any use of\nthe setxattr system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"setxattr\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep setxattr\n\n -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"setxattr\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k\nperm_mod\n -a always,exit -F arch=b64 -S setxattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238258'\n tag rid: 'SV-238258r653949_rule'\n tag stig_id: 'UBTU-20-010142'\n tag fix_id: 'F-41427r653948_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"setxattr\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"setxattr\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238258.rb","line":3},"id":"V-238258"},{"title":"The Ubuntu operating system library files must be owned by root.","desc":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","descriptions":{"default":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","rationale":"","check":"Verify the system-wide shared library files contained in the directories\n\"/lib\", \"/lib64\", and \"/usr/lib\" are owned by root with the following\ncommand:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type f -exec stat -c \"%n\n%U\" '{}' \\;\n\n If any system-wide library file is returned, this is a finding.","fix":"Configure the system library files to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type f -exec chown root '{}'\n\\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238349","rid":"SV-238349r654222_rule","stig_id":"UBTU-20-010428","fix_id":"F-41518r654221_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238349' do\n title 'The Ubuntu operating system library files must be owned by root.'\n desc \" If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system-wide shared library files contained in the directories\n\\\"/lib\\\", \\\"/lib64\\\", and \\\"/usr/lib\\\" are owned by root with the following\ncommand:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type f -exec stat -c \\\"%n\n%U\\\" '{}' \\\\;\n\n If any system-wide library file is returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the system library files to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type f -exec chown root '{}'\n\\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238349'\n tag rid: 'SV-238349r654222_rule'\n tag stig_id: 'UBTU-20-010428'\n tag fix_id: 'F-41518r654221_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n if os.arch == \"x86_64\"\n library_files = command('find /lib /usr/lib /usr/lib32 /lib32 /lib64 ! \\-user root \\-type f').stdout.strip.split(\"\\n\").entries\n else\n library_files = command('find /lib /usr/lib /usr/lib32 /lib32 ! \\-user root \\-type f').stdout.strip.split(\"\\n\").entries\n end\n\n if library_files.count > 0\n library_files.each do |lib_file|\n describe file(lib_file) do\n its(\"owner\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of system-wide shared library files found that are NOT owned by root\" do\n subject { library_files }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238349.rb","line":3},"id":"V-238349"},{"title":"The Ubuntu operating system default filesystem permissions must be\ndefined in such a way that all authenticated users can read and modify only\ntheir own files.","desc":"Setting the most restrictive default permissions ensures that when new\naccounts are created they do not have unnecessary access.","descriptions":{"default":"Setting the most restrictive default permissions ensures that when new\naccounts are created they do not have unnecessary access.","rationale":"","check":"Verify the Ubuntu operating system defines default permissions for all\nauthenticated users in such a way that the user can read and modify only their\nown files.\n\n Verify the Ubuntu operating system defines default permissions for all\nauthenticated users with the following command:\n\n $ grep -i \"umask\" /etc/login.defs\n\n UMASK 077\n\n If the \"UMASK\" variable is set to \"000\", this is a finding with the\nseverity raised to a CAT I.\n\n If the value of \"UMASK\" is not set to \"077\", is commented out, or is\nmissing completely, this is a finding.","fix":"Configure the system to define the default permissions for all\nauthenticated users in such a way that the user can read and modify only their\nown files.\n\n Edit the \"UMASK\" parameter in the \"/etc/login.defs\" file to match the\nexample below:\n\n UMASK 077"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00228","gid":"V-238209","rid":"SV-238209r653802_rule","stig_id":"UBTU-20-010016","fix_id":"F-41378r653801_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238209' do\n title \"The Ubuntu operating system default filesystem permissions must be\ndefined in such a way that all authenticated users can read and modify only\ntheir own files.\"\n desc \"Setting the most restrictive default permissions ensures that when new\naccounts are created they do not have unnecessary access.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system defines default permissions for all\nauthenticated users in such a way that the user can read and modify only their\nown files.\n\n Verify the Ubuntu operating system defines default permissions for all\nauthenticated users with the following command:\n\n $ grep -i \\\"umask\\\" /etc/login.defs\n\n UMASK 077\n\n If the \\\"UMASK\\\" variable is set to \\\"000\\\", this is a finding with the\nseverity raised to a CAT I.\n\n If the value of \\\"UMASK\\\" is not set to \\\"077\\\", is commented out, or is\nmissing completely, this is a finding.\n \"\n desc 'fix', \"\n Configure the system to define the default permissions for all\nauthenticated users in such a way that the user can read and modify only their\nown files.\n\n Edit the \\\"UMASK\\\" parameter in the \\\"/etc/login.defs\\\" file to match the\nexample below:\n\n UMASK 077\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000480-GPOS-00228'\n tag gid: 'V-238209'\n tag rid: 'SV-238209r653802_rule'\n tag stig_id: 'UBTU-20-010016'\n tag fix_id: 'F-41378r653801_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe login_defs do\n its('UMASK') { should eq '077' }\n end\nend\n","source_location":{"ref":"./controls/V-238209.rb","line":3},"id":"V-238209"},{"title":"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local access to the system via a\ngraphical user logon.","desc":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \"I've read and consent to terms in IS user agreem't.\"","descriptions":{"default":"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \"I've read and consent to terms in IS user agreem't.\"","rationale":"","check":"Verify the Ubuntu operating system displays the Standard Mandatory DoD\nNotice and Consent Banner before granting access to the operating system via a\ngraphical user logon.\n\n Note: If the system does not have a graphical user interface installed,\nthis requirement is Not Applicable.\n\n Verify the operating system displays the exact approved Standard Mandatory\nDoD Notice and Consent Banner text with the command:\n\n $ grep ^banner-message-text /etc/gdm3/greeter.dconf-defaults\n\n banner-message-text=\"You are accessing a U.S. Government \\(USG\\)\nInformation System \\(IS\\) that is provided for USG-authorized use only.\\s+By\nusing this IS \\(which includes any device attached to this IS\\), you consent\nto the following conditions:\\s+-The USG routinely intercepts and monitors\ncommunications on this IS for purposes including, but not limited to,\npenetration testing, COMSEC monitoring, network operations and defense,\npersonnel misconduct \\(PM\\), law enforcement \\(LE\\), and\ncounterintelligence \\(CI\\) investigations.\\s+-At any time, the USG may\ninspect and seize data stored on this IS.\\s+-Communications using, or data\nstored on, this IS are not private, are subject to routine monitoring,\ninterception, and search, and may be disclosed or used for any USG-authorized\npurpose.\\s+-This IS includes security measures \\(e.g., authentication and\naccess controls\\) to protect USG interests--not for your personal benefit or\nprivacy.\\s+-Notwithstanding the above, using this IS does not constitute\nconsent to PM, LE or CI investigative searching or monitoring of the content of\nprivileged communications, or work product, related to personal representation\nor services by attorneys, psychotherapists, or clergy, and their assistants.\nSuch communications and work product are private and confidential. See User\nAgreement for details.\"\n\n If the banner-message-text is missing, commented out, or does not match the\nStandard Mandatory DoD Notice and Consent Banner exactly, this is a finding.","fix":"Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.\n\n Set the \"banner-message-text\" line to contain the appropriate banner\nmessage text as shown below:\n\n banner-message-text='You are accessing a U.S. Government (USG) Information\nSystem (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.'\n\n Update the GDM with the new configuration:\n\n $ sudo dconf update\n $ sudo systemctl restart gdm3"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000023-GPOS-00006","gid":"V-238198","rid":"SV-238198r653769_rule","stig_id":"UBTU-20-010003","fix_id":"F-41367r653768_fix","cci":["CCI-000048"],"legacy":[],"nist":["AC-8 a"]},"code":"control 'V-238198' do\n title \"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting local access to the system via a\ngraphical user logon.\"\n desc \"Display of a standardized and approved use notification before\ngranting access to the Ubuntu operating system ensures privacy and security\nnotification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \\\"I've read and consent to terms in IS user agreem't.\\\"\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system displays the Standard Mandatory DoD\nNotice and Consent Banner before granting access to the operating system via a\ngraphical user logon.\n\n Note: If the system does not have a graphical user interface installed,\nthis requirement is Not Applicable.\n\n Verify the operating system displays the exact approved Standard Mandatory\nDoD Notice and Consent Banner text with the command:\n\n $ grep ^banner-message-text /etc/gdm3/greeter.dconf-defaults\n\n banner-message-text=\\\"You are accessing a U.S. Government \\\\(USG\\\\)\nInformation System \\\\(IS\\\\) that is provided for USG-authorized use only.\\\\s+By\nusing this IS \\\\(which includes any device attached to this IS\\\\), you consent\nto the following conditions:\\\\s+-The USG routinely intercepts and monitors\ncommunications on this IS for purposes including, but not limited to,\npenetration testing, COMSEC monitoring, network operations and defense,\npersonnel misconduct \\\\(PM\\\\), law enforcement \\\\(LE\\\\), and\ncounterintelligence \\\\(CI\\\\) investigations.\\\\s+-At any time, the USG may\ninspect and seize data stored on this IS.\\\\s+-Communications using, or data\nstored on, this IS are not private, are subject to routine monitoring,\ninterception, and search, and may be disclosed or used for any USG-authorized\npurpose.\\\\s+-This IS includes security measures \\\\(e.g., authentication and\naccess controls\\\\) to protect USG interests--not for your personal benefit or\nprivacy.\\\\s+-Notwithstanding the above, using this IS does not constitute\nconsent to PM, LE or CI investigative searching or monitoring of the content of\nprivileged communications, or work product, related to personal representation\nor services by attorneys, psychotherapists, or clergy, and their assistants.\nSuch communications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n If the banner-message-text is missing, commented out, or does not match the\nStandard Mandatory DoD Notice and Consent Banner exactly, this is a finding.\n \"\n desc 'fix', \"\n Edit the \\\"/etc/gdm3/greeter.dconf-defaults\\\" file.\n\n Set the \\\"banner-message-text\\\" line to contain the appropriate banner\nmessage text as shown below:\n\n banner-message-text='You are accessing a U.S. Government (USG) Information\nSystem (IS) that is provided for USG-authorized use only.\\\n \\\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\\\n \\\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\\\n \\\n -At any time, the USG may inspect and seize data stored on this IS.\\\n \\\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\\\n \\\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\\\n \\\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.'\n\n Update the GDM with the new configuration:\n\n $ sudo dconf update\n $ sudo systemctl restart gdm3\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000023-GPOS-00006'\n tag gid: 'V-238198'\n tag rid: 'SV-238198r653769_rule'\n tag stig_id: 'UBTU-20-010003'\n tag fix_id: 'F-41367r653768_fix'\n tag cci: ['CCI-000048']\n tag legacy: []\n tag nist: ['AC-8 a']\n #TOODO\n# banner_text = input('banner_text')\n# clean_banner = banner_text.gsub(/[\\r\\n\\s]/, '')\n# gdm3_defaults_file=\"/etc/gdm3/greeter.dconf-defaults\"\n# describe 'The SSHD Banner is set to the standard banner and has the correct text' do\n# subject { file(gdm3_defaults_file).content.gsub(/[\\r\\n\\s]/, '')}\n# it { should cmp clean_banner }\n# end\nend\n","source_location":{"ref":"./controls/V-238198.rb","line":3},"id":"V-238198"},{"title":"The Ubuntu operating system must implement address space layout\nrandomization to protect its memory from unauthorized code execution.","desc":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n Examples of attacks are buffer overflow attacks.","descriptions":{"default":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n Examples of attacks are buffer overflow attacks.","rationale":"","check":"Verify the Ubuntu operating system implements address space layout\nrandomization (ASLR) with the following command:\n\n $ sudo sysctl kernel.randomize_va_space\n\n kernel.randomize_va_space = 2\n\n If nothing is returned, verify the kernel parameter \"randomize_va_space\"\nis set to \"2\" with the following command:\n\n $ cat /proc/sys/kernel/randomize_va_space\n\n 2\n\n If \"kernel.randomize_va_space\" is not set to \"2\", this is a finding.\n\n Verify that a saved value of the \"kernel.randomize_va_space\" variable is\nnot defined.\n\n $ sudo egrep -R \"^kernel.randomize_va_space=[^2]\" /etc/sysctl.conf\n/etc/sysctl.d\n\n If this returns a result, this is a finding.","fix":"Remove the \"kernel.randomize_va_space\" entry found in the\n\"/etc/sysctl.conf\" file or any file located in the \"/etc/sysctl.d/\"\ndirectory.\n\n After the line has been removed, the kernel settings from all system\nconfiguration files must be reloaded before any of the changes will take\neffect. Run the following command to reload all of the kernel system\nconfiguration files:\n\n $ sudo sysctl --system"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000433-GPOS-00193","gid":"V-238369","rid":"SV-238369r654282_rule","stig_id":"UBTU-20-010448","fix_id":"F-41538r654281_fix","cci":["CCI-002824"],"legacy":[],"nist":["SI-16"]},"code":"control 'V-238369' do\n title \"The Ubuntu operating system must implement address space layout\nrandomization to protect its memory from unauthorized code execution.\"\n desc \"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n Examples of attacks are buffer overflow attacks.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system implements address space layout\nrandomization (ASLR) with the following command:\n\n $ sudo sysctl kernel.randomize_va_space\n\n kernel.randomize_va_space = 2\n\n If nothing is returned, verify the kernel parameter \\\"randomize_va_space\\\"\nis set to \\\"2\\\" with the following command:\n\n $ cat /proc/sys/kernel/randomize_va_space\n\n 2\n\n If \\\"kernel.randomize_va_space\\\" is not set to \\\"2\\\", this is a finding.\n\n Verify that a saved value of the \\\"kernel.randomize_va_space\\\" variable is\nnot defined.\n\n $ sudo egrep -R \\\"^kernel.randomize_va_space=[^2]\\\" /etc/sysctl.conf\n/etc/sysctl.d\n\n If this returns a result, this is a finding.\n \"\n desc 'fix', \"\n Remove the \\\"kernel.randomize_va_space\\\" entry found in the\n\\\"/etc/sysctl.conf\\\" file or any file located in the \\\"/etc/sysctl.d/\\\"\ndirectory.\n\n After the line has been removed, the kernel settings from all system\nconfiguration files must be reloaded before any of the changes will take\neffect. Run the following command to reload all of the kernel system\nconfiguration files:\n\n $ sudo sysctl --system\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000433-GPOS-00193'\n tag gid: 'V-238369'\n tag rid: 'SV-238369r654282_rule'\n tag stig_id: 'UBTU-20-010448'\n tag fix_id: 'F-41538r654281_fix'\n tag cci: ['CCI-002824']\n tag legacy: []\n tag nist: ['SI-16']\n\n describe kernel_parameter('kernel.randomize_va_space') do\n its('value') { should cmp 2 }\n end\nend\n","source_location":{"ref":"./controls/V-238369.rb","line":3},"id":"V-238369"},{"title":"The Ubuntu operating system, for PKI-based authentication, must\nvalidate certificates by constructing a certification path (which includes\nstatus information) to an accepted trust anchor.","desc":"Without path validation, an informed trust decision by the relying\nparty cannot be made when presented with any certificate not already explicitly\ntrusted.\n\n A trust anchor is an authoritative entity represented via a public key and\nassociated data. It is used in the context of public key infrastructures, X.509\ndigital certificates, and DNSSEC.\n\n When there is a chain of trust, usually the top entity to be trusted\nbecomes the trust anchor; it can be, for example, a Certification Authority\n(CA). A certification path starts with the subject certificate and proceeds\nthrough a number of intermediate certificates up to a trusted root certificate,\ntypically issued by a trusted CA.\n\n This requirement verifies that a certification path to an accepted trust\nanchor is used for certificate validation and that the path includes status\ninformation. Path validation is necessary for a relying party to make an\ninformed trust decision when presented with any certificate not already\nexplicitly trusted. Status information for certification paths includes\ncertificate revocation lists or online certificate status protocol responses.\nValidation of the certificate status information is out of scope for this\nrequirement.","descriptions":{"default":"Without path validation, an informed trust decision by the relying\nparty cannot be made when presented with any certificate not already explicitly\ntrusted.\n\n A trust anchor is an authoritative entity represented via a public key and\nassociated data. It is used in the context of public key infrastructures, X.509\ndigital certificates, and DNSSEC.\n\n When there is a chain of trust, usually the top entity to be trusted\nbecomes the trust anchor; it can be, for example, a Certification Authority\n(CA). A certification path starts with the subject certificate and proceeds\nthrough a number of intermediate certificates up to a trusted root certificate,\ntypically issued by a trusted CA.\n\n This requirement verifies that a certification path to an accepted trust\nanchor is used for certificate validation and that the path includes status\ninformation. Path validation is necessary for a relying party to make an\ninformed trust decision when presented with any certificate not already\nexplicitly trusted. Status information for certification paths includes\ncertificate revocation lists or online certificate status protocol responses.\nValidation of the certificate status information is out of scope for this\nrequirement.","rationale":"","check":"Verify the Ubuntu operating system, for PKI-based authentication, has valid\ncertificates by constructing a certification path to an accepted trust anchor.\n\n Determine which pkcs11 module is being used via the \"use_pkcs11_module\"\nin \"/etc/pam_pkcs11/pam_pkcs11.conf\" and then ensure \"ca\" is enabled in\n\"cert_policy\" with the following command:\n\n $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk\n'/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep\ncert_policy | grep ca\n\n cert_policy = ca,signature,ocsp_on;\n\n If \"cert_policy\" is not set to \"ca\" or the line is commented out, this\nis a finding.","fix":"Configure the Ubuntu operating system, for PKI-based authentication, to\nvalidate certificates by constructing a certification path to an accepted trust\nanchor.\n\n Determine which pkcs11 module is being used via the \"use_pkcs11_module\"\nin \"/etc/pam_pkcs11/pam_pkcs11.conf\" and ensure \"ca\" is enabled in\n\"cert_policy\".\n\n Add or update the \"cert_policy\" to ensure \"ca\" is enabled:\n\n cert_policy = ca,signature,ocsp_on;\n\n If the system is missing an \"/etc/pam_pkcs11/\" directory and an\n\"/etc/pam_pkcs11/pam_pkcs11.conf\", find an example to copy into place and\nmodify accordingly at\n\"/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz\"."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000066-GPOS-00034","gid":"V-238229","rid":"SV-238229r653862_rule","stig_id":"UBTU-20-010060","fix_id":"F-41398r653861_fix","cci":["CCI-000185"],"legacy":[],"nist":["IA-5 (2) (a)"]},"code":"control 'V-238229' do\n title \"The Ubuntu operating system, for PKI-based authentication, must\nvalidate certificates by constructing a certification path (which includes\nstatus information) to an accepted trust anchor.\"\n desc \"Without path validation, an informed trust decision by the relying\nparty cannot be made when presented with any certificate not already explicitly\ntrusted.\n\n A trust anchor is an authoritative entity represented via a public key and\nassociated data. It is used in the context of public key infrastructures, X.509\ndigital certificates, and DNSSEC.\n\n When there is a chain of trust, usually the top entity to be trusted\nbecomes the trust anchor; it can be, for example, a Certification Authority\n(CA). A certification path starts with the subject certificate and proceeds\nthrough a number of intermediate certificates up to a trusted root certificate,\ntypically issued by a trusted CA.\n\n This requirement verifies that a certification path to an accepted trust\nanchor is used for certificate validation and that the path includes status\ninformation. Path validation is necessary for a relying party to make an\ninformed trust decision when presented with any certificate not already\nexplicitly trusted. Status information for certification paths includes\ncertificate revocation lists or online certificate status protocol responses.\nValidation of the certificate status information is out of scope for this\nrequirement.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system, for PKI-based authentication, has valid\ncertificates by constructing a certification path to an accepted trust anchor.\n\n Determine which pkcs11 module is being used via the \\\"use_pkcs11_module\\\"\nin \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" and then ensure \\\"ca\\\" is enabled in\n\\\"cert_policy\\\" with the following command:\n\n $ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk\n'/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep\ncert_policy | grep ca\n\n cert_policy = ca,signature,ocsp_on;\n\n If \\\"cert_policy\\\" is not set to \\\"ca\\\" or the line is commented out, this\nis a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system, for PKI-based authentication, to\nvalidate certificates by constructing a certification path to an accepted trust\nanchor.\n\n Determine which pkcs11 module is being used via the \\\"use_pkcs11_module\\\"\nin \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" and ensure \\\"ca\\\" is enabled in\n\\\"cert_policy\\\".\n\n Add or update the \\\"cert_policy\\\" to ensure \\\"ca\\\" is enabled:\n\n cert_policy = ca,signature,ocsp_on;\n\n If the system is missing an \\\"/etc/pam_pkcs11/\\\" directory and an\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\", find an example to copy into place and\nmodify accordingly at\n\\\"/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz\\\".\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000066-GPOS-00034'\n tag gid: 'V-238229'\n tag rid: 'SV-238229r653862_rule'\n tag stig_id: 'UBTU-20-010060'\n tag fix_id: 'F-41398r653861_fix'\n tag cci: ['CCI-000185']\n tag legacy: []\n tag nist: ['IA-5 (2) (a)']\n\n config_file_exists = file('/etc/pam_pkcs11/pam_pkcs11.conf').exist?\n if config_file_exists\n describe parse_config_file('/etc/pam_pkcs11/pam_pkcs11.conf') do\n its('use_pkcs11_module') { should_not be_nil }\n its('cert_policy') { should include 'ca' }\n end\n else\n describe '/etc/pam_pkcs11/pam_pkcs11.conf exists' do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238229.rb","line":3},"id":"V-238229"},{"title":"The Ubuntu operating system must configure the /var/log directory to\nbe group-owned by syslog.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":{"default":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","rationale":"","check":"Verify that the Ubuntu operating system configures the \"/var/log\"\ndirectory to be group-owned by syslog with the following command:\n\n $ sudo stat -c \"%n %G\" /var/log\n /var/log syslog\n\n If the \"/var/log\" directory is not group-owned by syslog, this is a\nfinding.","fix":"Configure the Ubuntu operating system to have syslog group-own the\n\"/var/log\" directory by running the following command:\n\n $ sudo chgrp syslog /var/log"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-238338","rid":"SV-238338r654189_rule","stig_id":"UBTU-20-010417","fix_id":"F-41507r654188_fix","cci":["CCI-001314"],"legacy":[],"nist":["SI-11 b"]},"code":"control 'V-238338' do\n title \"The Ubuntu operating system must configure the /var/log directory to\nbe group-owned by syslog.\"\n desc \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system configures the \\\"/var/log\\\"\ndirectory to be group-owned by syslog with the following command:\n\n $ sudo stat -c \\\"%n %G\\\" /var/log\n /var/log syslog\n\n If the \\\"/var/log\\\" directory is not group-owned by syslog, this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to have syslog group-own the\n\\\"/var/log\\\" directory by running the following command:\n\n $ sudo chgrp syslog /var/log\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000206-GPOS-00084'\n tag gid: 'V-238338'\n tag rid: 'SV-238338r654189_rule'\n tag stig_id: 'UBTU-20-010417'\n tag fix_id: 'F-41507r654188_fix'\n tag cci: ['CCI-001314']\n tag legacy: []\n tag nist: ['SI-11 b']\n\n describe directory('/var/log') do\n its('group') { should cmp 'syslog' }\n end\nend\n","source_location":{"ref":"./controls/V-238338.rb","line":3},"id":"V-238338"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the sudoedit command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"sudoedit\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep /usr/bin/sudoedit\n\n -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=-1 -k priv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"sudoedit\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238278","rid":"SV-238278r654009_rule","stig_id":"UBTU-20-010162","fix_id":"F-41447r654008_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238278' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the sudoedit command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"sudoedit\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep /usr/bin/sudoedit\n\n -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=-1 -k priv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"sudoedit\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238278'\n tag rid: 'SV-238278r654009_rule'\n tag stig_id: 'UBTU-20-010162'\n tag fix_id: 'F-41447r654008_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/sudoedit'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238278.rb","line":3},"id":"V-238278"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chmod system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"chmod\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep chmod\n\n -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chmod\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238268","rid":"SV-238268r653979_rule","stig_id":"UBTU-20-010152","fix_id":"F-41437r653978_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238268' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chmod system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"chmod\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep chmod\n\n -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chmod\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238268'\n tag rid: 'SV-238268r653979_rule'\n tag stig_id: 'UBTU-20-010152'\n tag fix_id: 'F-41437r653978_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('chmod').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('chmod').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238268.rb","line":3},"id":"V-238268"},{"title":"The Ubuntu operating system must be configured to prohibit or restrict\nthe use of functions, ports, protocols, and/or services, as defined in the PPSM\nCAL and vulnerability assessments.","desc":"In order to prevent unauthorized connection of devices, unauthorized\ntransfer of information, or unauthorized tunneling (i.e., embedding of data\ntypes within data types), organizations must disable or restrict unused or\nunnecessary physical and logical ports/protocols on information systems.\n\n Operating systems are capable of providing a wide variety of functions and\nservices. Some of the functions and services provided by default may not be\nnecessary to support essential organizational operations. Additionally, it is\nsometimes convenient to provide multiple services from a single component\n(e.g., VPN and IPS); however, doing so increases risk over limiting the\nservices provided by any one component.\n\n To support the requirements and principles of least functionality, the\noperating system must support the organizational requirements, providing only\nessential capabilities and limiting the use of ports, protocols, and/or\nservices to only those required, authorized, and approved to conduct official\nbusiness or to address authorized quality of life issues.","descriptions":{"default":"In order to prevent unauthorized connection of devices, unauthorized\ntransfer of information, or unauthorized tunneling (i.e., embedding of data\ntypes within data types), organizations must disable or restrict unused or\nunnecessary physical and logical ports/protocols on information systems.\n\n Operating systems are capable of providing a wide variety of functions and\nservices. Some of the functions and services provided by default may not be\nnecessary to support essential organizational operations. Additionally, it is\nsometimes convenient to provide multiple services from a single component\n(e.g., VPN and IPS); however, doing so increases risk over limiting the\nservices provided by any one component.\n\n To support the requirements and principles of least functionality, the\noperating system must support the organizational requirements, providing only\nessential capabilities and limiting the use of ports, protocols, and/or\nservices to only those required, authorized, and approved to conduct official\nbusiness or to address authorized quality of life issues.","rationale":"","check":"Verify the Ubuntu operating system is configured to prohibit or restrict\nthe use of functions, ports, protocols, and/or services as defined in the\nPorts, Protocols, and Services Management (PPSM) Category Assignments List\n(CAL) and vulnerability assessments.\n\n Check the firewall configuration for any unnecessary or prohibited\nfunctions, ports, protocols, and/or services by running the following command:\n\n $ sudo ufw show raw\n\n Chain OUTPUT (policy ACCEPT)\n target prot opt sources destination\n Chain INPUT (policy ACCEPT 1 packets, 40 bytes)\n pkts bytes target prot opt in out source\ndestination\n\n Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)\n pkts bytes target prot opt in out source\ndestination\n\n Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)\n pkts bytes target prot opt in out source\ndestination\n\n Ask the System Administrator\n for the site or program PPSM CLSA. Verify the services allowed by the\nfirewall match the PPSM CLSA.\n\n If there are any additional ports, protocols, or services that are not\nincluded in the PPSM CLSA, this is a finding.\n\n If there are any ports, protocols, or services that are prohibited by the\nPPSM CAL, this is a finding.","fix":"Add all ports, protocols, or services allowed by the PPSM CLSA by using the\nfollowing command:\n\n $ sudo ufw allow \n\n where the direction is \"in\" or \"out\" and the port is the one\ncorresponding to the protocol or service allowed.\n\n To deny access to ports, protocols, or services, use:\n\n $ sudo ufw deny "},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000096-GPOS-00050","gid":"V-238328","rid":"SV-238328r654159_rule","stig_id":"UBTU-20-010407","fix_id":"F-41497r654158_fix","cci":["CCI-000382"],"legacy":[],"nist":["CM-7 b"]},"code":"control 'V-238328' do\n title \"The Ubuntu operating system must be configured to prohibit or restrict\nthe use of functions, ports, protocols, and/or services, as defined in the PPSM\nCAL and vulnerability assessments.\"\n desc \"In order to prevent unauthorized connection of devices, unauthorized\ntransfer of information, or unauthorized tunneling (i.e., embedding of data\ntypes within data types), organizations must disable or restrict unused or\nunnecessary physical and logical ports/protocols on information systems.\n\n Operating systems are capable of providing a wide variety of functions and\nservices. Some of the functions and services provided by default may not be\nnecessary to support essential organizational operations. Additionally, it is\nsometimes convenient to provide multiple services from a single component\n(e.g., VPN and IPS); however, doing so increases risk over limiting the\nservices provided by any one component.\n\n To support the requirements and principles of least functionality, the\noperating system must support the organizational requirements, providing only\nessential capabilities and limiting the use of ports, protocols, and/or\nservices to only those required, authorized, and approved to conduct official\nbusiness or to address authorized quality of life issues.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to prohibit or restrict\nthe use of functions, ports, protocols, and/or services as defined in the\nPorts, Protocols, and Services Management (PPSM) Category Assignments List\n(CAL) and vulnerability assessments.\n\n Check the firewall configuration for any unnecessary or prohibited\nfunctions, ports, protocols, and/or services by running the following command:\n\n $ sudo ufw show raw\n\n Chain OUTPUT (policy ACCEPT)\n target prot opt sources destination\n Chain INPUT (policy ACCEPT 1 packets, 40 bytes)\n pkts bytes target prot opt in out source\ndestination\n\n Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)\n pkts bytes target prot opt in out source\ndestination\n\n Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)\n pkts bytes target prot opt in out source\ndestination\n\n Ask the System Administrator\n for the site or program PPSM CLSA. Verify the services allowed by the\nfirewall match the PPSM CLSA.\n\n If there are any additional ports, protocols, or services that are not\nincluded in the PPSM CLSA, this is a finding.\n\n If there are any ports, protocols, or services that are prohibited by the\nPPSM CAL, this is a finding.\n \"\n desc 'fix', \"\n Add all ports, protocols, or services allowed by the PPSM CLSA by using the\nfollowing command:\n\n $ sudo ufw allow \n\n where the direction is \\\"in\\\" or \\\"out\\\" and the port is the one\ncorresponding to the protocol or service allowed.\n\n To deny access to ports, protocols, or services, use:\n\n $ sudo ufw deny \n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000096-GPOS-00050'\n tag gid: 'V-238328'\n tag rid: 'SV-238328r654159_rule'\n tag stig_id: 'UBTU-20-010407'\n tag fix_id: 'F-41497r654158_fix'\n tag cci: ['CCI-000382']\n tag legacy: []\n tag nist: ['CM-7 b']\n\n ufw_status = command('ufw status').stdout.strip.lines.first\n value = ufw_status.split(':')[1].strip\n\n describe 'UFW status' do\n subject { value }\n it { should cmp 'active' }\n end\n describe 'Status listings for any allowed services, ports, or applications must be documented with the organization' do\n skip 'Status listings checks must be preformed manually'\n end\nend\n","source_location":{"ref":"./controls/V-238328.rb","line":3},"id":"V-238328"},{"title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/group.","desc":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","descriptions":{"default":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","rationale":"","check":"Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\"/etc/group\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep group\n\n -w /etc/group -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\"/etc/group\".\n\n Add or update the following rule to \"/etc/audit/rules.d/stig.rules\":\n\n -w /etc/group -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","satisfies":["SRG-OS-000004-GPOS-00004","SRG-OS-000239-GPOS-00089","SRG-OS-000240-GPOS-00090","SRG-OS-000241-GPOS-00091","SRG-OS-000303-GPOS-00120","SRG-OS-000458-GPOS-00203","SRG-OS-000476-GPOS-00221"],"gid":"V-238239","rid":"SV-238239r653892_rule","stig_id":"UBTU-20-010101","fix_id":"F-41408r653891_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-001404","CCI-001405","CCI-002130"],"legacy":[],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)","AC-2 (4)","AC-2\n(4)"]},"code":"control 'V-238239' do\n title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/group.\"\n desc \"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\\\"/etc/group\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep group\n\n -w /etc/group -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\\\"/etc/group\\\".\n\n Add or update the following rule to \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -w /etc/group -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000004-GPOS-00004'\n tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089',\n'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091',\n'SRG-OS-000303-GPOS-00120', 'SRG-OS-000458-GPOS-00203',\n'SRG-OS-000476-GPOS-00221']\n tag gid: 'V-238239'\n tag rid: 'SV-238239r653892_rule'\n tag stig_id: 'UBTU-20-010101'\n tag fix_id: 'F-41408r653891_fix'\n tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-001404',\n'CCI-001405', 'CCI-002130']\n tag legacy: []\n tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AC-2 (4)', \"AC-2\n(4)\"]\n\n @audit_file = '/etc/group'\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238239.rb","line":3},"id":"V-238239"},{"title":"The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key\nsequence if a graphical user interface is installed.","desc":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.","descriptions":{"default":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.","rationale":"","check":"Verify the Ubuntu operating system is not configured to reboot the system\nwhen Ctrl-Alt-Delete is pressed when using a graphical user interface.\n\n Check that the \"logout\" target is not bound to an action with the\nfollowing command:\n\n # grep logout /etc/dconf/db/local.d/*\n\n logout=''\n\n If the \"logout\" key is bound to an action, is commented out, or is\nmissing, this is a finding.","fix":"Configure the system to disable the Ctrl-Alt-Delete sequence when using a\ngraphical user interface by creating or editing the\n/etc/dconf/db/local.d/00-disable-CAD file.\n\n Add the setting to disable the Ctrl-Alt-Delete sequence for the graphical\nuser interface:\n\n [org/gnome/settings-daemon/plugins/media-keys]\n logout=''\n\n Update the dconf settings:\n\n # dconf update"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-238379","rid":"SV-238379r654312_rule","stig_id":"UBTU-20-010459","fix_id":"F-41548r654311_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238379' do\n title \"The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key\nsequence if a graphical user interface is installed.\"\n desc \"A locally logged-on user who presses Ctrl-Alt-Delete, when at the\nconsole, can reboot the system. If accidentally pressed, as could happen in the\ncase of a mixed OS environment, this can create the risk of short-term loss of\navailability of systems due to unintentional reboot. In the graphical\nenvironment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is\nreduced because the user will be prompted before any action is taken.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is not configured to reboot the system\nwhen Ctrl-Alt-Delete is pressed when using a graphical user interface.\n\n Check that the \\\"logout\\\" target is not bound to an action with the\nfollowing command:\n\n # grep logout /etc/dconf/db/local.d/*\n\n logout=''\n\n If the \\\"logout\\\" key is bound to an action, is commented out, or is\nmissing, this is a finding.\n \"\n desc 'fix', \"\n Configure the system to disable the Ctrl-Alt-Delete sequence when using a\ngraphical user interface by creating or editing the\n/etc/dconf/db/local.d/00-disable-CAD file.\n\n Add the setting to disable the Ctrl-Alt-Delete sequence for the graphical\nuser interface:\n\n [org/gnome/settings-daemon/plugins/media-keys]\n logout=''\n\n Update the dconf settings:\n\n # dconf update\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000480-GPOS-00227'\n tag gid: 'V-238379'\n tag rid: 'SV-238379r654312_rule'\n tag stig_id: 'UBTU-20-010459'\n tag fix_id: 'F-41548r654311_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n xorg_status = command('which Xorg').exit_status\n if xorg_status == 0\n describe command(\"grep -R logout='' /etc/dconf/db/local.d/\").stdout.strip.split(\"\\n\").entries do\n its('count') { should_not eq 0 }\n end\n else\n describe command('which Xorg').exit_status do\n skip(\"GUI not installed.\\nwhich Xorg exit_status: \" + command('which Xorg').exit_status.to_s)\n end\n end\nend\n","source_location":{"ref":"./controls/V-238379.rb","line":3},"id":"V-238379"},{"title":"The Ubuntu operating system must implement non-executable data to\nprotect its memory from unauthorized code execution.","desc":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n Examples of attacks are buffer overflow attacks.","descriptions":{"default":"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n Examples of attacks are buffer overflow attacks.","rationale":"","check":"Verify the NX (no-execution) bit flag is set on the system with the\nfollowing commands:\n\n $ dmesg | grep -i \"execute disable\"\n [ 0.000000] NX (Execute Disable) protection: active\n\n If \"dmesg\" does not show \"NX (Execute Disable) protection: active\",\ncheck the cpuinfo settings with the following command:\n\n $ grep flags /proc/cpuinfo | grep -w nx | sort -u\n flags : fpu vme de pse tsc ms nx rdtscp lm constant_tsc\n\n If \"flags\" does not contain the \"nx\" flag, this is a finding.","fix":"Configure the Ubuntu operating system to enable NX.\n\n If \"nx\" is not showing up in \"/proc/cpuinfo\", and the system's BIOS\nsetup configuration permits toggling the No Execution bit, set it to \"enable\"."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000433-GPOS-00192","gid":"V-238368","rid":"SV-238368r654279_rule","stig_id":"UBTU-20-010447","fix_id":"F-41537r654278_fix","cci":["CCI-002824"],"legacy":[],"nist":["SI-16"]},"code":"control 'V-238368' do\n title \"The Ubuntu operating system must implement non-executable data to\nprotect its memory from unauthorized code execution.\"\n desc \"Some adversaries launch attacks with the intent of executing code in\nnon-executable regions of memory or in memory locations that are prohibited.\nSecurity safeguards employed to protect memory include, for example, data\nexecution prevention and address space layout randomization. Data execution\nprevention safeguards can either be hardware-enforced or software-enforced with\nhardware providing the greater strength of mechanism.\n\n Examples of attacks are buffer overflow attacks.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the NX (no-execution) bit flag is set on the system with the\nfollowing commands:\n\n $ dmesg | grep -i \\\"execute disable\\\"\n [ 0.000000] NX (Execute Disable) protection: active\n\n If \\\"dmesg\\\" does not show \\\"NX (Execute Disable) protection: active\\\",\ncheck the cpuinfo settings with the following command:\n\n $ grep flags /proc/cpuinfo | grep -w nx | sort -u\n flags : fpu vme de pse tsc ms nx rdtscp lm constant_tsc\n\n If \\\"flags\\\" does not contain the \\\"nx\\\" flag, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enable NX.\n\n If \\\"nx\\\" is not showing up in \\\"/proc/cpuinfo\\\", and the system's BIOS\nsetup configuration permits toggling the No Execution bit, set it to \\\"enable\\\".\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000433-GPOS-00192'\n tag gid: 'V-238368'\n tag rid: 'SV-238368r654279_rule'\n tag stig_id: 'UBTU-20-010447'\n tag fix_id: 'F-41537r654278_fix'\n tag cci: ['CCI-002824']\n tag legacy: []\n tag nist: ['SI-16']\n\n options = {\n assignment_regex: /^\\s*([^:]*?)\\s*:\\s*(.*?)\\s*$/\n }\n describe.one do\n describe command('dmesg | grep NX').stdout.strip do\n it { should match /.+(NX \\(Execute Disable\\) protection: active)/ }\n end\n describe parse_config_file('/proc/cpuinfo', options).flags.split(' ') do\n it { should include 'nx' }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238368.rb","line":3},"id":"V-238368"},{"title":"The Ubuntu operating system must be configured so that when passwords\nare changed or new passwords are established, pwquality must be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks. \"pwquality\" enforces complex password construction\nconfiguration and has the ability to limit brute-force attacks on the system.","descriptions":{"default":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks. \"pwquality\" enforces complex password construction\nconfiguration and has the ability to limit brute-force attacks on the system.","rationale":"","check":"Verify the Ubuntu operating system has the \"libpam-pwquality\" package\ninstalled by running the following command:\n\n $ dpkg -l libpam-pwquality\n\n ii libpam-pwquality:amd64 1.4.0-2 amd64\n PAM module to check password strength\n\n If \"libpam-pwquality\" is not installed, this is a finding.\n\n Verify that the operating system uses \"pwquality\" to enforce the password\ncomplexity rules.\n\n Verify the pwquality module is being enforced by the Ubuntu operating\nsystem by running the following command:\n\n $ grep -i enforcing /etc/security/pwquality.conf\n\n enforcing = 1\n\n If the value of \"enforcing\" is not \"1\" or the line is commented out,\nthis is a finding.\n\n Check for the use of \"pwquality\" with the following command:\n\n $ cat /etc/pam.d/common-password | grep requisite | grep pam_pwquality\n\n password requisite pam_pwquality.so retry=3\n\n If no output is returned or the line is commented out, this is a finding.\n\n If the value of \"retry\" is set to \"0\" or greater than \"3\", this is a\nfinding.","fix":"Configure the operating system to use \"pwquality\" to enforce password\ncomplexity rules.\n\n Install the \"pam_pwquality\" package by using the following command:\n\n $ sudo apt-get install libpam-pwquality -y\n\n Add the following line to \"/etc/security/pwquality.conf\" (or modify the\nline to have the required value):\n\n enforcing = 1\n\n Add the following line to \"/etc/pam.d/common-password\" (or modify the\nline to have the required value):\n\n password requisite pam_pwquality.so retry=3\n\n Note: The value of \"retry\" should be between \"1\" and \"3\"."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00225","gid":"V-238228","rid":"SV-238228r653859_rule","stig_id":"UBTU-20-010057","fix_id":"F-41397r653858_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238228' do\n title \"The Ubuntu operating system must be configured so that when passwords\nare changed or new passwords are established, pwquality must be used.\"\n desc \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks. \\\"pwquality\\\" enforces complex password construction\nconfiguration and has the ability to limit brute-force attacks on the system.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system has the \\\"libpam-pwquality\\\" package\ninstalled by running the following command:\n\n $ dpkg -l libpam-pwquality\n\n ii libpam-pwquality:amd64 1.4.0-2 amd64\n PAM module to check password strength\n\n If \\\"libpam-pwquality\\\" is not installed, this is a finding.\n\n Verify that the operating system uses \\\"pwquality\\\" to enforce the password\ncomplexity rules.\n\n Verify the pwquality module is being enforced by the Ubuntu operating\nsystem by running the following command:\n\n $ grep -i enforcing /etc/security/pwquality.conf\n\n enforcing = 1\n\n If the value of \\\"enforcing\\\" is not \\\"1\\\" or the line is commented out,\nthis is a finding.\n\n Check for the use of \\\"pwquality\\\" with the following command:\n\n $ cat /etc/pam.d/common-password | grep requisite | grep pam_pwquality\n\n password requisite pam_pwquality.so retry=3\n\n If no output is returned or the line is commented out, this is a finding.\n\n If the value of \\\"retry\\\" is set to \\\"0\\\" or greater than \\\"3\\\", this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the operating system to use \\\"pwquality\\\" to enforce password\ncomplexity rules.\n\n Install the \\\"pam_pwquality\\\" package by using the following command:\n\n $ sudo apt-get install libpam-pwquality -y\n\n Add the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the\nline to have the required value):\n\n enforcing = 1\n\n Add the following line to \\\"/etc/pam.d/common-password\\\" (or modify the\nline to have the required value):\n\n password requisite pam_pwquality.so retry=3\n\n Note: The value of \\\"retry\\\" should be between \\\"1\\\" and \\\"3\\\".\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000480-GPOS-00225'\n tag gid: 'V-238228'\n tag rid: 'SV-238228r653859_rule'\n tag stig_id: 'UBTU-20-010057'\n tag fix_id: 'F-41397r653858_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe package('libpam-pwquality') do\n it { should be_installed }\n end\n\n describe file('/etc/security/pwquality.conf') do\n its('content') { should match '^enforcing\\s+=\\s+1$' }\n end\n\n describe file('/etc/pam.d/common-password') do\n its('content') { should match '^password\\s+requisite\\s+pam_pwquality.so\\s+retry=3\\s+enforce_for_root$' }\n end\nend\n","source_location":{"ref":"./controls/V-238228.rb","line":3},"id":"V-238228"},{"title":"The Ubuntu operating system must configure the /var/log directory to\nbe owned by root.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":{"default":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","rationale":"","check":"Verify the Ubuntu operating system configures the \"/var/log\" directory to\nbe owned by root with the following command:\n\n $ sudo stat -c \"%n %U\" /var/log\n /var/log root\n\n If the \"/var/log\" directory is not owned by root, this is a finding.","fix":"Configure the Ubuntu operating system to have root own the \"/var/log\"\ndirectory by running the following command:\n\n $ sudo chown root /var/log"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-238339","rid":"SV-238339r654192_rule","stig_id":"UBTU-20-010418","fix_id":"F-41508r654191_fix","cci":["CCI-001314"],"legacy":[],"nist":["SI-11 b"]},"code":"control 'V-238339' do\n title \"The Ubuntu operating system must configure the /var/log directory to\nbe owned by root.\"\n desc \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system configures the \\\"/var/log\\\" directory to\nbe owned by root with the following command:\n\n $ sudo stat -c \\\"%n %U\\\" /var/log\n /var/log root\n\n If the \\\"/var/log\\\" directory is not owned by root, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to have root own the \\\"/var/log\\\"\ndirectory by running the following command:\n\n $ sudo chown root /var/log\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000206-GPOS-00084'\n tag gid: 'V-238339'\n tag rid: 'SV-238339r654192_rule'\n tag stig_id: 'UBTU-20-010418'\n tag fix_id: 'F-41508r654191_fix'\n tag cci: ['CCI-001314']\n tag legacy: []\n tag nist: ['SI-11 b']\n\n describe directory(\"/var/log\") do\n its(\"owner\") { should cmp \"root\" }\n end\nend\n","source_location":{"ref":"./controls/V-238339.rb","line":3},"id":"V-238339"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chsh command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"chsh\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep chsh\n\n -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -k\npriv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chsh\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238279","rid":"SV-238279r654012_rule","stig_id":"UBTU-20-010163","fix_id":"F-41448r654011_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238279' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chsh command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"chsh\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep chsh\n\n -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=-1 -k\npriv_cmd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chsh\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k priv_cmd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238279'\n tag rid: 'SV-238279r654012_rule'\n tag stig_id: 'UBTU-20-010163'\n tag fix_id: 'F-41448r654011_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/chsh'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238279.rb","line":3},"id":"V-238279"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchmod system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"fchmod\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fchmod\n\n -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchmod\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238269","rid":"SV-238269r653982_rule","stig_id":"UBTU-20-010153","fix_id":"F-41438r653981_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238269' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchmod system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"fchmod\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fchmod\n\n -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchmod\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238269'\n tag rid: 'SV-238269r653982_rule'\n tag stig_id: 'UBTU-20-010153'\n tag fix_id: 'F-41438r653981_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('fchmod').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('fchmod').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238269.rb","line":3},"id":"V-238269"},{"title":"The Ubuntu operating system must prevent direct login into the root\naccount.","desc":"To assure individual accountability and prevent unauthorized access,\norganizational users must be individually identified and authenticated.\n\n A group authenticator is a generic account used by multiple individuals.\nUse of a group authenticator alone does not uniquely identify individual users.\nExamples of the group authenticator is the UNIX OS \"root\" user account, the\nWindows \"Administrator\" account, the \"sa\" account, or a \"helpdesk\"\naccount.\n\n For example, the UNIX and Windows operating systems offer a 'switch user'\ncapability allowing users to authenticate with their individual credentials\nand, when needed, 'switch' to the administrator role. This method provides for\nunique individual authentication prior to using a group authenticator.\n\n Users (and any processes acting on behalf of users) need to be uniquely\nidentified and authenticated for all accesses other than those accesses\nexplicitly identified and documented by the organization, which outlines\nspecific user actions that can be performed on the operating system without\nidentification or authentication.\n\n Requiring individuals to be authenticated with an individual authenticator\nprior to using a group authenticator allows for traceability of actions, as\nwell as adding an additional level of protection of the actions that can be\ntaken with group account knowledge.","descriptions":{"default":"To assure individual accountability and prevent unauthorized access,\norganizational users must be individually identified and authenticated.\n\n A group authenticator is a generic account used by multiple individuals.\nUse of a group authenticator alone does not uniquely identify individual users.\nExamples of the group authenticator is the UNIX OS \"root\" user account, the\nWindows \"Administrator\" account, the \"sa\" account, or a \"helpdesk\"\naccount.\n\n For example, the UNIX and Windows operating systems offer a 'switch user'\ncapability allowing users to authenticate with their individual credentials\nand, when needed, 'switch' to the administrator role. This method provides for\nunique individual authentication prior to using a group authenticator.\n\n Users (and any processes acting on behalf of users) need to be uniquely\nidentified and authenticated for all accesses other than those accesses\nexplicitly identified and documented by the organization, which outlines\nspecific user actions that can be performed on the operating system without\nidentification or authentication.\n\n Requiring individuals to be authenticated with an individual authenticator\nprior to using a group authenticator allows for traceability of actions, as\nwell as adding an additional level of protection of the actions that can be\ntaken with group account knowledge.","rationale":"","check":"Verify the Ubuntu operating system prevents direct logins to the root\naccount with the following command:\n\n $ sudo passwd -S root\n\n root L 04/23/2020 0 99999 7 -1\n\n If the output does not contain \"L\" in the second field to indicate the\naccount is locked, this is a finding.","fix":"Configure the Ubuntu operating system to prevent direct logins to the root\naccount by performing the following operations:\n\n $ sudo passwd -l root"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000109-GPOS-00056","gid":"V-238329","rid":"SV-238329r654162_rule","stig_id":"UBTU-20-010408","fix_id":"F-41498r654161_fix","cci":["CCI-000770"],"legacy":[],"nist":["IA-2 (5)"]},"code":"control 'V-238329' do\n title \"The Ubuntu operating system must prevent direct login into the root\naccount.\"\n desc \"To assure individual accountability and prevent unauthorized access,\norganizational users must be individually identified and authenticated.\n\n A group authenticator is a generic account used by multiple individuals.\nUse of a group authenticator alone does not uniquely identify individual users.\nExamples of the group authenticator is the UNIX OS \\\"root\\\" user account, the\nWindows \\\"Administrator\\\" account, the \\\"sa\\\" account, or a \\\"helpdesk\\\"\naccount.\n\n For example, the UNIX and Windows operating systems offer a 'switch user'\ncapability allowing users to authenticate with their individual credentials\nand, when needed, 'switch' to the administrator role. This method provides for\nunique individual authentication prior to using a group authenticator.\n\n Users (and any processes acting on behalf of users) need to be uniquely\nidentified and authenticated for all accesses other than those accesses\nexplicitly identified and documented by the organization, which outlines\nspecific user actions that can be performed on the operating system without\nidentification or authentication.\n\n Requiring individuals to be authenticated with an individual authenticator\nprior to using a group authenticator allows for traceability of actions, as\nwell as adding an additional level of protection of the actions that can be\ntaken with group account knowledge.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system prevents direct logins to the root\naccount with the following command:\n\n $ sudo passwd -S root\n\n root L 04/23/2020 0 99999 7 -1\n\n If the output does not contain \\\"L\\\" in the second field to indicate the\naccount is locked, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to prevent direct logins to the root\naccount by performing the following operations:\n\n $ sudo passwd -l root\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000109-GPOS-00056'\n tag gid: 'V-238329'\n tag rid: 'SV-238329r654162_rule'\n tag stig_id: 'UBTU-20-010408'\n tag fix_id: 'F-41498r654161_fix'\n tag cci: ['CCI-000770']\n tag legacy: []\n tag nist: ['IA-2 (5)']\n\n describe.one do\n describe shadow.where(user: 'root') do\n its('passwords.uniq.first') { should eq '!*' }\n end\n end\n describe command(\"passwd -S root\").stdout.strip do\n it { should match /^root\\s+L\\s+.*$/ }\n end\nend\n","source_location":{"ref":"./controls/V-238329.rb","line":3},"id":"V-238329"},{"title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/passwd.","desc":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","descriptions":{"default":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","rationale":"","check":"Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\"/etc/passwd\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep passwd\n\n -w /etc/passwd -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\"/etc/passwd\".\n\n Add or update the following rule to \"/etc/audit/rules.d/stig.rules\":\n\n -w /etc/passwd -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","satisfies":["SRG-OS-000004-GPOS-00004","SRG-OS-000239-GPOS-00089","SRG-OS-000240-GPOS-00090","SRG-OS-000241-GPOS-00091","SRG-OS-000303-GPOS-00120","SRG-OS-000458-GPOS-00203","SRG-OS-000463-GPOS-00207","SRG-OS-000476-GPOS-00221"],"gid":"V-238238","rid":"SV-238238r653889_rule","stig_id":"UBTU-20-010100","fix_id":"F-41407r653888_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-001404","CCI-001405","CCI-002130"],"legacy":[],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)","AC-2 (4)","AC-2\n(4)"]},"code":"control 'V-238238' do\n title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/passwd.\"\n desc \"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\\\"/etc/passwd\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep passwd\n\n -w /etc/passwd -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\\\"/etc/passwd\\\".\n\n Add or update the following rule to \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -w /etc/passwd -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000004-GPOS-00004'\n tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089',\n'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091',\n'SRG-OS-000303-GPOS-00120', 'SRG-OS-000458-GPOS-00203',\n'SRG-OS-000463-GPOS-00207', 'SRG-OS-000476-GPOS-00221']\n tag gid: 'V-238238'\n tag rid: 'SV-238238r653889_rule'\n tag stig_id: 'UBTU-20-010100'\n tag fix_id: 'F-41407r653888_fix'\n tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-001404',\n'CCI-001405', 'CCI-002130']\n tag legacy: []\n tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AC-2 (4)', \"AC-2\n(4)\"]\n\n @audit_file = '/etc/passwd' \n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238238.rb","line":3},"id":"V-238238"},{"title":"The Ubuntu operating system must have system commands group-owned by\nroot.","desc":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","descriptions":{"default":"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.","rationale":"","check":"Verify the system commands contained in the following directories are\ngroup-owned by root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Run the check with the following command:\n\n $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n! -group root -type f -exec stat -c \"%n %G\" '{}' \\;\n\n If any system commands are returned that are not Set Group ID up on\nexecution (SGID) files and owned by a privileged account, this is a finding.","fix":"Configure the system commands to be protected from unauthorized access. Run\nthe following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root -type f ! -perm /2000 -exec chgrp root '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238378","rid":"SV-238378r654309_rule","stig_id":"UBTU-20-010458","fix_id":"F-41547r654308_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238378' do\n title \"The Ubuntu operating system must have system commands group-owned by\nroot.\"\n desc \"If the Ubuntu operating system were to allow any user to make changes\nto software libraries, then those changes might be implemented without\nundergoing the appropriate testing and approvals that are part of a robust\nchange management process.\n\n This requirement applies to Ubuntu operating systems with software\nlibraries that are accessible and configurable, as in the case of interpreted\nlanguages. Software libraries also include privileged programs which execute\nwith escalated privileges. Only qualified and authorized individuals must be\nallowed to obtain access to information system components for purposes of\ninitiating changes, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system commands contained in the following directories are\ngroup-owned by root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Run the check with the following command:\n\n $ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n! -group root -type f -exec stat -c \\\"%n %G\\\" '{}' \\\\;\n\n If any system commands are returned that are not Set Group ID up on\nexecution (SGID) files and owned by a privileged account, this is a finding.\n \"\n desc 'fix', \"\n Configure the system commands to be protected from unauthorized access. Run\nthe following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-group root -type f ! -perm /2000 -exec chgrp root '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238378'\n tag rid: 'SV-238378r654309_rule'\n tag stig_id: 'UBTU-20-010458'\n tag fix_id: 'F-41547r654308_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n system_commands = command(\"find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -perm /2000 -type f\").stdout.strip.split(\"\\n\").entries\n valid_system_commands = Set[]\n\n if system_commands.count > 0\n system_commands.each do |sys_cmd|\n if file(sys_cmd).exist?\n valid_system_commands = valid_system_commands << sys_cmd\n end\n end\n end\n\n if valid_system_commands.count > 0\n valid_system_commands.each do |val_sys_cmd|\n describe file(val_sys_cmd) do\n it { should_not be_more_permissive_than(\"0755\") }\n end\n end\n else\n describe \"Number of system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or /usr/local/sbin, that are not Set Group ID up on execution (SGID) files and owned by a privileged account\" do\n subject { valid_system_commands }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238378.rb","line":3},"id":"V-238378"},{"title":"The Ubuntu operating system must not allow unattended or automatic\nlogin via SSH.","desc":"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.","descriptions":{"default":"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.","rationale":"","check":"Verify that unattended or automatic login via SSH is disabled with the\nfollowing command:\n\n $ egrep '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config\n\n PermitEmptyPasswords no\n PermitUserEnvironment no\n\n If \"PermitEmptyPasswords\" or \"PermitUserEnvironment\" keywords are not\nset to \"no\", are missing completely, or are commented out, this is a finding.","fix":"Configure the Ubuntu operating system to allow the SSH daemon to not allow\nunattended or automatic login to the system.\n\n Add or edit the following lines in the \"/etc/ssh/sshd_config\" file:\n\n PermitEmptyPasswords no\n PermitUserEnvironment no\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-238218","rid":"SV-238218r653829_rule","stig_id":"UBTU-20-010047","fix_id":"F-41387r653828_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238218' do\n title \"The Ubuntu operating system must not allow unattended or automatic\nlogin via SSH.\"\n desc \"Failure to restrict system access to authenticated users negatively\nimpacts Ubuntu operating system security.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify that unattended or automatic login via SSH is disabled with the\nfollowing command:\n\n $ egrep '(Permit(.*?)(Passwords|Environment))' /etc/ssh/sshd_config\n\n PermitEmptyPasswords no\n PermitUserEnvironment no\n\n If \\\"PermitEmptyPasswords\\\" or \\\"PermitUserEnvironment\\\" keywords are not\nset to \\\"no\\\", are missing completely, or are commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to allow the SSH daemon to not allow\nunattended or automatic login to the system.\n\n Add or edit the following lines in the \\\"/etc/ssh/sshd_config\\\" file:\n\n PermitEmptyPasswords no\n PermitUserEnvironment no\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000480-GPOS-00229'\n tag gid: 'V-238218'\n tag rid: 'SV-238218r653829_rule'\n tag stig_id: 'UBTU-20-010047'\n tag fix_id: 'F-41387r653828_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe sshd_config do\n its('PermitEmptyPasswords') { should cmp 'no' }\n its('PermitUserEnvironment') { should cmp 'no' }\n end\nend\n","source_location":{"ref":"./controls/V-238218.rb","line":3},"id":"V-238218"},{"title":"The Ubuntu operating system must notify designated personnel if\nbaseline configurations are changed in an unauthorized manner. The file\nintegrity tool must notify the System Administrator when changes to the\nbaseline configuration or anomalies in the oper","desc":"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the\noperating system. Changes to operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the operating system. The operating system's IMO/ISSO and SAs must be\nnotified via email and/or monitoring system trap when there is an unauthorized\nmodification of a configuration item.","descriptions":{"default":"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the\noperating system. Changes to operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the operating system. The operating system's IMO/ISSO and SAs must be\nnotified via email and/or monitoring system trap when there is an unauthorized\nmodification of a configuration item.","rationale":"","check":"Verify that Advanced Intrusion Detection Environment (AIDE) notifies the\nSystem Administrator\n when anomalies in the operation of any security functions are discovered\nwith the following command:\n\n $ grep SILENTREPORTS /etc/default/aide\n\n SILENTREPORTS=no\n\n If SILENTREPORTS is commented out, this is a finding.\n\n If SILENTREPORTS is set to \"yes\", this is a finding.\n\n If SILENTREPORTS is not set to \"no\", this is a finding.","fix":"Configure the Ubuntu operating system to notify designated personnel if\nbaseline configurations are changed in an unauthorized manner.\n\n Modify the \"SILENTREPORTS\" parameter in the \"/etc/default/aide\" file\nwith a value of \"no\" if it does not already exist."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000363-GPOS-00150","gid":"V-238358","rid":"SV-238358r654249_rule","stig_id":"UBTU-20-010437","fix_id":"F-41527r654248_fix","cci":["CCI-001744"],"legacy":[],"nist":["CM-3 (5)"]},"code":"control 'V-238358' do\n title \"The Ubuntu operating system must notify designated personnel if\nbaseline configurations are changed in an unauthorized manner. The file\nintegrity tool must notify the System Administrator when changes to the\nbaseline configuration or anomalies in the oper\"\n desc \"Unauthorized changes to the baseline configuration could make the\nsystem vulnerable to various attacks or allow unauthorized access to the\noperating system. Changes to operating system configurations can have\nunintended side effects, some of which may be relevant to security.\n\n Detecting such changes and providing an automated response can help avoid\nunintended, negative consequences that could ultimately affect the security\nstate of the operating system. The operating system's IMO/ISSO and SAs must be\nnotified via email and/or monitoring system trap when there is an unauthorized\nmodification of a configuration item.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that Advanced Intrusion Detection Environment (AIDE) notifies the\nSystem Administrator\n when anomalies in the operation of any security functions are discovered\nwith the following command:\n\n $ grep SILENTREPORTS /etc/default/aide\n\n SILENTREPORTS=no\n\n If SILENTREPORTS is commented out, this is a finding.\n\n If SILENTREPORTS is set to \\\"yes\\\", this is a finding.\n\n If SILENTREPORTS is not set to \\\"no\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to notify designated personnel if\nbaseline configurations are changed in an unauthorized manner.\n\n Modify the \\\"SILENTREPORTS\\\" parameter in the \\\"/etc/default/aide\\\" file\nwith a value of \\\"no\\\" if it does not already exist.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000363-GPOS-00150'\n tag gid: 'V-238358'\n tag rid: 'SV-238358r654249_rule'\n tag stig_id: 'UBTU-20-010437'\n tag fix_id: 'F-41527r654248_fix'\n tag cci: ['CCI-001744']\n tag legacy: []\n tag nist: ['CM-3 (5)']\n\n describe file('/etc/default/aide') do\n it { should exist }\n its('content') { should match '^SILENTREPORTS=no$' }\n end\nend\n","source_location":{"ref":"./controls/V-238358.rb","line":3},"id":"V-238358"},{"title":"The Ubuntu operating system must be configured so that audit\nconfiguration files are not write-accessible by unauthorized users.","desc":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.","descriptions":{"default":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.","rationale":"","check":"Verify that \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\", and\n\"/etc/audit/auditd.conf\" files have a mode of \"0640\" or less permissive by\nusing the following command:\n\n $ sudo ls -al /etc/audit/ /etc/audit/rules.d/\n\n /etc/audit/:\n\n -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf\n\n -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules\n\n -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev\n\n -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d\n\n /etc/audit/rules.d/:\n\n -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules\n\n If \"/etc/audit/audit.rule\",\"/etc/audit/rules.d/*\", or\n\"/etc/audit/auditd.conf\" file have a mode more permissive than \"0640\", this\nis a finding.","fix":"Configure \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\", and\n\"/etc/audit/auditd.conf\" files to have a mode of \"0640\" by using the\nfollowing command:\n\n $ sudo chmod -R 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000063-GPOS-00032","gid":"V-238249","rid":"SV-238249r653922_rule","stig_id":"UBTU-20-010133","fix_id":"F-41418r653921_fix","cci":["CCI-000171"],"legacy":[],"nist":["AU-12 b"]},"code":"control 'V-238249' do\n title \"The Ubuntu operating system must be configured so that audit\nconfiguration files are not write-accessible by unauthorized users.\"\n desc \"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\", and\n\\\"/etc/audit/auditd.conf\\\" files have a mode of \\\"0640\\\" or less permissive by\nusing the following command:\n\n $ sudo ls -al /etc/audit/ /etc/audit/rules.d/\n\n /etc/audit/:\n\n -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf\n\n -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules\n\n -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev\n\n -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d\n\n /etc/audit/rules.d/:\n\n -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules\n\n If \\\"/etc/audit/audit.rule\\\",\\\"/etc/audit/rules.d/*\\\", or\n\\\"/etc/audit/auditd.conf\\\" file have a mode more permissive than \\\"0640\\\", this\nis a finding.\n \"\n desc 'fix', \"\n Configure \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\", and\n\\\"/etc/audit/auditd.conf\\\" files to have a mode of \\\"0640\\\" by using the\nfollowing command:\n\n $ sudo chmod -R 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000063-GPOS-00032'\n tag gid: 'V-238249'\n tag rid: 'SV-238249r653922_rule'\n tag stig_id: 'UBTU-20-010133'\n tag fix_id: 'F-41418r653921_fix'\n tag cci: ['CCI-000171']\n tag legacy: []\n tag nist: ['AU-12 b']\n\n files1 = command('find /etc/audit/ -type f \\( -iname \\*.rules -o -iname \\*.conf \\)').stdout.strip.split(\"\\n\").entries\n files2 = command('find /etc/audit/rules.d/* -type f').stdout.strip.split(\"\\n\").entries\n\n audit_conf_files = files1 + files2\n\n audit_conf_files.each do |conf|\n describe file(conf) do\n it { should_not be_more_permissive_than('0640') }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238249.rb","line":3},"id":"V-238249"},{"title":"The Ubuntu operating system must generate audit records for privileged\nactivities, nonlocal maintenance, diagnostic sessions and other system-level\naccess.","desc":"If events associated with nonlocal administrative access or diagnostic\nsessions are not logged, a major tool for assessing and investigating attacks\nwould not be available.\n\n This requirement addresses auditing-related issues associated with\nmaintenance tools used specifically for diagnostic and repair actions on\norganizational information systems.\n\n Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network. Local maintenance and\ndiagnostic activities are those activities carried out by individuals\nphysically present at the information system or information system component\nand not communicating across a network connection.\n\n This requirement applies to hardware/software diagnostic test equipment or\ntools. This requirement does not cover hardware/software components that may\nsupport information system maintenance, yet are a part of the system, for\nexample, the software implementing \"ping,\" \"ls,\" \"ipconfig,\" or the\nhardware and software implementing the monitoring port of an Ethernet switch.","descriptions":{"default":"If events associated with nonlocal administrative access or diagnostic\nsessions are not logged, a major tool for assessing and investigating attacks\nwould not be available.\n\n This requirement addresses auditing-related issues associated with\nmaintenance tools used specifically for diagnostic and repair actions on\norganizational information systems.\n\n Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network. Local maintenance and\ndiagnostic activities are those activities carried out by individuals\nphysically present at the information system or information system component\nand not communicating across a network connection.\n\n This requirement applies to hardware/software diagnostic test equipment or\ntools. This requirement does not cover hardware/software components that may\nsupport information system maintenance, yet are a part of the system, for\nexample, the software implementing \"ping,\" \"ls,\" \"ipconfig,\" or the\nhardware and software implementing the monitoring port of an Ethernet switch.","rationale":"","check":"Verify the Ubuntu operating system audits activities performed during\nnonlocal maintenance and diagnostic sessions.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep sudo.log\n\n -w /var/log/sudo.log -p wa -k maintenance\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to audit activities performed during\nnonlocal maintenance and diagnostic sessions.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/log/sudo.log -p wa -k maintenance\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-238309","rid":"SV-238309r654102_rule","stig_id":"UBTU-20-010244","fix_id":"F-41478r654101_fix","cci":["CCI-000172","CCI-002884"],"legacy":[],"nist":["AU-12 c","MA-4 (1) (a)"]},"code":"control 'V-238309' do\n title \"The Ubuntu operating system must generate audit records for privileged\nactivities, nonlocal maintenance, diagnostic sessions and other system-level\naccess.\"\n desc \"If events associated with nonlocal administrative access or diagnostic\nsessions are not logged, a major tool for assessing and investigating attacks\nwould not be available.\n\n This requirement addresses auditing-related issues associated with\nmaintenance tools used specifically for diagnostic and repair actions on\norganizational information systems.\n\n Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network. Local maintenance and\ndiagnostic activities are those activities carried out by individuals\nphysically present at the information system or information system component\nand not communicating across a network connection.\n\n This requirement applies to hardware/software diagnostic test equipment or\ntools. This requirement does not cover hardware/software components that may\nsupport information system maintenance, yet are a part of the system, for\nexample, the software implementing \\\"ping,\\\" \\\"ls,\\\" \\\"ipconfig,\\\" or the\nhardware and software implementing the monitoring port of an Ethernet switch.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system audits activities performed during\nnonlocal maintenance and diagnostic sessions.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep sudo.log\n\n -w /var/log/sudo.log -p wa -k maintenance\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to audit activities performed during\nnonlocal maintenance and diagnostic sessions.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/log/sudo.log -p wa -k maintenance\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000392-GPOS-00172'\n tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n tag gid: 'V-238309'\n tag rid: 'SV-238309r654102_rule'\n tag stig_id: 'UBTU-20-010244'\n tag fix_id: 'F-41478r654101_fix'\n tag cci: ['CCI-000172', 'CCI-002884']\n tag legacy: []\n tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n \n @audit_file = \"/var/log/sudo.log\"\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its(\"permissions\") { should_not cmp [] }\n its(\"action\") { should_not include \"never\" }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include \"w\" }\n it { should include \"a\" }\n end\n end\n else\n describe (\"Audit line(s) for \" + @audit_file + \" exist\") do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238309.rb","line":3},"id":"V-238309"},{"title":"The Ubuntu operating system must generate audit records when\nsuccessful/unsuccessful attempts to use the kmod command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system is configured to audit the execution of\nthe module management program \"kmod\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep kmod\n\n -w /bin/kmod -p x -k module\n\n If the command does not return a line, or the line is commented out, this\nis a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to audit the execution of the module\nmanagement program \"kmod\".\n\n Add or update the following rule in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /bin/kmod -p x -k modules\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000477-GPOS-00222","gid":"V-238319","rid":"SV-238319r654132_rule","stig_id":"UBTU-20-010297","fix_id":"F-41488r654131_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238319' do\n title \"The Ubuntu operating system must generate audit records when\nsuccessful/unsuccessful attempts to use the kmod command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to audit the execution of\nthe module management program \\\"kmod\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep kmod\n\n -w /bin/kmod -p x -k module\n\n If the command does not return a line, or the line is commented out, this\nis a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to audit the execution of the module\nmanagement program \\\"kmod\\\".\n\n Add or update the following rule in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /bin/kmod -p x -k modules\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000477-GPOS-00222'\n tag gid: 'V-238319'\n tag rid: 'SV-238319r654132_rule'\n tag stig_id: 'UBTU-20-010297'\n tag fix_id: 'F-41488r654131_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/bin/kmod'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238319.rb","line":3},"id":"V-238319"},{"title":"The Ubuntu operating system must generate audit records for any use of\nthe lsetxattr system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"lsetxattr\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep lsetxattr\n\n -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"lsetxattr\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238259","rid":"SV-238259r653952_rule","stig_id":"UBTU-20-010143","fix_id":"F-41428r653951_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238259' do\n title \"The Ubuntu operating system must generate audit records for any use of\nthe lsetxattr system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"lsetxattr\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep lsetxattr\n\n -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"lsetxattr\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238259'\n tag rid: 'SV-238259r653952_rule'\n tag stig_id: 'UBTU-20-010143'\n tag fix_id: 'F-41428r653951_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"lsetxattr\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"lsetxattr\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238259.rb","line":3},"id":"V-238259"},{"title":"The Ubuntu operating system library directories must have mode 0755 or\nless permissive.","desc":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","descriptions":{"default":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","rationale":"","check":"Verify the system-wide shared library directories \"/lib\", \"/lib64\", and\n\"/usr/lib have mode 0755 or less permissive with the following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type d -exec stat -c \"%n %a\"\n'{}' \\;\n\n If any of the aforementioned directories are found to be group-writable or\nworld-writable, this is a finding.","fix":"Configure the shared library directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type d -exec chmod 755 '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238348","rid":"SV-238348r654219_rule","stig_id":"UBTU-20-010427","fix_id":"F-41517r654218_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238348' do\n title \"The Ubuntu operating system library directories must have mode 0755 or\nless permissive.\"\n desc \" If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system-wide shared library directories \\\"/lib\\\", \\\"/lib64\\\", and\n\\\"/usr/lib have mode 0755 or less permissive with the following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type d -exec stat -c \\\"%n %a\\\"\n'{}' \\\\;\n\n If any of the aforementioned directories are found to be group-writable or\nworld-writable, this is a finding.\n \"\n desc 'fix', \"\n Configure the shared library directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /lib64 /usr/lib -perm /022 -type d -exec chmod 755 '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238348'\n tag rid: 'SV-238348r654219_rule'\n tag stig_id: 'UBTU-20-010427'\n tag fix_id: 'F-41517r654218_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n if os.arch == 'x86_64'\n library_dirs = command('find /lib /lib32 lib64 /usr/lib /usr/lib32 -perm /022 -type d').stdout.strip.split(\"\\n\").entries\n else\n library_dirs = command('find /lib /usr/lib /usr/lib32 /lib32 -perm /022 -type d').stdout.strip.split(\"\\n\").entries\n end\n\n if library_dirs.count > 0\n library_dirs.each do |lib_file|\n describe file(lib_file) do\n it { should_not be_more_permissive_than('0755') }\n end\n end\n else\n describe 'Number of system-wide shared library directories found that are less permissive than 0755' do\n subject { library_dirs }\n its('count') { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238348.rb","line":3},"id":"V-238348"},{"title":"The Ubuntu operating system must retain a user's session lock until\nthat user reestablishes access using established identification and\nauthentication procedures.","desc":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n The session lock is implemented at the point where session activity can be\ndetermined.\n\n Regardless of where the session lock is determined and implemented, once\ninvoked, a session lock of the Ubuntu operating system must remain in place\nuntil the user reauthenticates. No other activity aside from reauthentication\nmust unlock the system.","descriptions":{"default":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n The session lock is implemented at the point where session activity can be\ndetermined.\n\n Regardless of where the session lock is determined and implemented, once\ninvoked, a session lock of the Ubuntu operating system must remain in place\nuntil the user reauthenticates. No other activity aside from reauthentication\nmust unlock the system.","rationale":"","check":"Verify the Ubuntu operation system has a graphical user interface session\nlock enabled.\n\n Note: If the Ubuntu operating system does not have a graphical user\ninterface installed, this requirement is Not Applicable.\n\n Get the \"lock-enabled\" setting to verify the graphical user interface\nsession has the lock enabled with the following command:\n\n $ sudo gsettings get org.gnome.desktop.screensaver lock-enabled\n\n true\n\n If \"lock-enabled\" is not set to \"true\", this is a finding.","fix":"Configure the Ubuntu operating system to allow a user to lock the current\ngraphical user interface session.\n\n Note: If the Ubuntu operating system does not have a graphical user\ninterface installed, this requirement is Not Applicable.\n\n Set the \"lock-enabled\" setting to allow graphical user interface session\nlocks with the following command:\n\n $ sudo gsettings set org.gnome.desktop.screensaver lock-enabled true"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000028-GPOS-00009","satisfies":["SRG-OS-000028-GPOS-00009","SRG-OS-000029-GPOS-00010"],"gid":"V-238199","rid":"SV-238199r653772_rule","stig_id":"UBTU-20-010004","fix_id":"F-41368r653771_fix","cci":["CCI-000056","CCI-000057"],"legacy":[],"nist":["AC-11 b","AC-11 a"]},"code":"control 'V-238199' do\n title \"The Ubuntu operating system must retain a user's session lock until\nthat user reestablishes access using established identification and\nauthentication procedures.\"\n desc \"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n The session lock is implemented at the point where session activity can be\ndetermined.\n\n Regardless of where the session lock is determined and implemented, once\ninvoked, a session lock of the Ubuntu operating system must remain in place\nuntil the user reauthenticates. No other activity aside from reauthentication\nmust unlock the system.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operation system has a graphical user interface session\nlock enabled.\n\n Note: If the Ubuntu operating system does not have a graphical user\ninterface installed, this requirement is Not Applicable.\n\n Get the \\\"lock-enabled\\\" setting to verify the graphical user interface\nsession has the lock enabled with the following command:\n\n $ sudo gsettings get org.gnome.desktop.screensaver lock-enabled\n\n true\n\n If \\\"lock-enabled\\\" is not set to \\\"true\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to allow a user to lock the current\ngraphical user interface session.\n\n Note: If the Ubuntu operating system does not have a graphical user\ninterface installed, this requirement is Not Applicable.\n\n Set the \\\"lock-enabled\\\" setting to allow graphical user interface session\nlocks with the following command:\n\n $ sudo gsettings set org.gnome.desktop.screensaver lock-enabled true\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000028-GPOS-00009'\n tag satisfies: ['SRG-OS-000028-GPOS-00009', 'SRG-OS-000029-GPOS-00010']\n tag gid: 'V-238199'\n tag rid: 'SV-238199r653772_rule'\n tag stig_id: 'UBTU-20-010004'\n tag fix_id: 'F-41368r653771_fix'\n tag cci: ['CCI-000056', 'CCI-000057']\n tag legacy: []\n tag nist: ['AC-11 b', 'AC-11 a']\n\n xorg_status = command('which Xorg').exit_status\n if xorg_status == 0\n describe command('gsettings get org.gnome.desktop.screensaver lock-enabled') do\n its('stdout') { should cmp 'true'}\n end \n else\n describe command('which Xorg').exit_status do\n skip(\"GUI not installed.\\nwhich Xorg exit_status: \" + command('which Xorg').exit_status.to_s)\n end\n end\nend\n","source_location":{"ref":"./controls/V-238199.rb","line":3},"id":"V-238199"},{"title":"The Ubuntu operating system must require users to reauthenticate for\nprivilege escalation or when changing roles.","desc":"Without reauthentication, users may access resources or perform tasks\nfor which they do not have authorization.\n\n When operating systems provide the capability to escalate a functional\ncapability, it is critical the user reauthenticate.","descriptions":{"default":"Without reauthentication, users may access resources or perform tasks\nfor which they do not have authorization.\n\n When operating systems provide the capability to escalate a functional\ncapability, it is critical the user reauthenticate.","rationale":"","check":"Verify the \"/etc/sudoers\" file has no occurrences of \"NOPASSWD\" or\n\"!authenticate\" by running the following command:\n\n $ sudo egrep -i '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/*\n\n If any occurrences of \"NOPASSWD\" or \"!authenticate\" return from the\ncommand, this is a finding.","fix":"Remove any occurrence of \"NOPASSWD\" or \"!authenticate\"\nfound in \"/etc/sudoers\" file or files in the \"/etc/sudoers.d\" directory."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000373-GPOS-00156","satisfies":["SRG-OS-000373-GPOS-00156","SRG-OS-000373-GPOS-00157"],"gid":"V-238208","rid":"SV-238208r653799_rule","stig_id":"UBTU-20-010014","fix_id":"F-41377r653798_fix","cci":["CCI-002038"],"legacy":[],"nist":["IA-11"]},"code":"control 'V-238208' do\n title \"The Ubuntu operating system must require users to reauthenticate for\nprivilege escalation or when changing roles.\"\n desc \"Without reauthentication, users may access resources or perform tasks\nfor which they do not have authorization.\n\n When operating systems provide the capability to escalate a functional\ncapability, it is critical the user reauthenticate.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the \\\"/etc/sudoers\\\" file has no occurrences of \\\"NOPASSWD\\\" or\n\\\"!authenticate\\\" by running the following command:\n\n $ sudo egrep -i '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/*\n\n If any occurrences of \\\"NOPASSWD\\\" or \\\"!authenticate\\\" return from the\ncommand, this is a finding.\n \"\n desc 'fix', \"Remove any occurrence of \\\"NOPASSWD\\\" or \\\"!authenticate\\\"\nfound in \\\"/etc/sudoers\\\" file or files in the \\\"/etc/sudoers.d\\\" directory.\"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000373-GPOS-00156'\n tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157']\n tag gid: 'V-238208'\n tag rid: 'SV-238208r653799_rule'\n tag stig_id: 'UBTU-20-010014'\n tag fix_id: 'F-41377r653798_fix'\n tag cci: ['CCI-002038']\n tag legacy: []\n tag nist: ['IA-11']\n\n describe command(\"egrep -r -i '(nopasswd|!authenticate)' /etc/sudoers.d/ /etc/sudoers\") do\n its('stdout.strip') { should be_empty }\n end\nend\n","source_location":{"ref":"./controls/V-238208.rb","line":3},"id":"V-238208"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the unix_update command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"unix_update\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w unix_update\n\n -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=-1 -k privileged-unix-update\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"unix_update\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-unix-update\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238289","rid":"SV-238289r654042_rule","stig_id":"UBTU-20-010173","fix_id":"F-41458r654041_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238289' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the unix_update command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"unix_update\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w unix_update\n\n -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=-1 -k privileged-unix-update\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"unix_update\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/sbin/unix_update -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-unix-update\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238289'\n tag rid: 'SV-238289r654042_rule'\n tag stig_id: 'UBTU-20-010173'\n tag fix_id: 'F-41458r654041_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/sbin/unix_update'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238289.rb","line":3},"id":"V-238289"},{"title":"The Ubuntu operating system must initiate session audits at system\nstart-up.","desc":"If auditing is enabled late in the start-up process, the actions of\nsome start-up processes may not be audited. Some audit systems also maintain\nstate information only available if auditing is enabled before a given process\nis created.","descriptions":{"default":"If auditing is enabled late in the start-up process, the actions of\nsome start-up processes may not be audited. Some audit systems also maintain\nstate information only available if auditing is enabled before a given process\nis created.","rationale":"","check":"Verify that the Ubuntu operating system enables auditing at system startup.\n\n\n Verify that the auditing is enabled in grub with the following command:\n\n $ sudo grep \"^\\s*linux\" /boot/grub/grub.cfg\n\n linux /boot/vmlinuz-5.4.0-31-generic\nroot=UUID=74d13bcd-6ebd-4493-b5d2-3ebc37d01702 ro audit=1\n linux /boot/vmlinuz-5.4.0-31-generic\nroot=UUID=74d13bcd-6ebd-4493-b5d2-3ebc37d01702 ro recovery nomodeset audit=1\n\n If any linux lines do not contain \"audit=1\", this is a finding.","fix":"Configure the Ubuntu operating system to produce audit records at system\nstartup.\n\n Edit the \"/etc/default/grub\" file and add \"audit=1\" to the\n\"GRUB_CMDLINE_LINUX\" option.\n\n To update the grub config file, run:\n\n $ sudo update-grub"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000254-GPOS-00095","gid":"V-238299","rid":"SV-238299r654072_rule","stig_id":"UBTU-20-010198","fix_id":"F-41468r654071_fix","cci":["CCI-001464"],"legacy":[],"nist":["AU-14 (1)"]},"code":"control 'V-238299' do\n title \"The Ubuntu operating system must initiate session audits at system\nstart-up.\"\n desc \"If auditing is enabled late in the start-up process, the actions of\nsome start-up processes may not be audited. Some audit systems also maintain\nstate information only available if auditing is enabled before a given process\nis created.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system enables auditing at system startup.\n\n\n Verify that the auditing is enabled in grub with the following command:\n\n $ sudo grep \\\"^\\\\s*linux\\\" /boot/grub/grub.cfg\n\n linux /boot/vmlinuz-5.4.0-31-generic\nroot=UUID=74d13bcd-6ebd-4493-b5d2-3ebc37d01702 ro audit=1\n linux /boot/vmlinuz-5.4.0-31-generic\nroot=UUID=74d13bcd-6ebd-4493-b5d2-3ebc37d01702 ro recovery nomodeset audit=1\n\n If any linux lines do not contain \\\"audit=1\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to produce audit records at system\nstartup.\n\n Edit the \\\"/etc/default/grub\\\" file and add \\\"audit=1\\\" to the\n\\\"GRUB_CMDLINE_LINUX\\\" option.\n\n To update the grub config file, run:\n\n $ sudo update-grub\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000254-GPOS-00095'\n tag gid: 'V-238299'\n tag rid: 'SV-238299r654072_rule'\n tag stig_id: 'UBTU-20-010198'\n tag fix_id: 'F-41468r654071_fix'\n tag cci: ['CCI-001464']\n tag legacy: []\n tag nist: ['AU-14 (1)']\n\n grub_entries = command('grep \"^\\s*linux\" /boot/grub/grub.cfg').stdout.strip.split(\"\\n\").entries\n\n grub_entries.each do |entry|\n describe entry do\n it { should include \"audit=1\" }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238299.rb","line":3},"id":"V-238299"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the passwd command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"passwd\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w passwd\n\n -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-passwd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"passwd\" command.\n\n Add or update the following rule in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F\nauid!=4294967295 -k privileged-passwd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238288","rid":"SV-238288r654039_rule","stig_id":"UBTU-20-010172","fix_id":"F-41457r654038_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238288' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the passwd command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"passwd\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w passwd\n\n -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-passwd\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"passwd\\\" command.\n\n Add or update the following rule in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F\nauid!=4294967295 -k privileged-passwd\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238288'\n tag rid: 'SV-238288r654039_rule'\n tag stig_id: 'UBTU-20-010172'\n tag fix_id: 'F-41457r654038_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/passwd'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n \n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238288.rb","line":3},"id":"V-238288"},{"title":"The Ubuntu operating system must produce audit records and reports\ncontaining information to establish when, where, what type, the source, and the\noutcome for all DoD-defined auditable events and actions in near real time.","desc":"Without establishing the when, where, type, source, and outcome of\nevents that occurred, it would be difficult to establish, correlate, and\ninvestigate the events leading up to an outage or attack.\n\n Without the capability to generate audit records, it would be difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.\n\n Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n Reconstruction of harmful events or forensic analysis is not possible if\naudit records do not contain enough information.\n\n Successful incident response and auditing relies on timely, accurate system\ninformation and analysis in order to allow the organization to identify and\nrespond to potential incidents in a proficient manner. If the operating system\ndoes not provide the ability to centrally review the operating system logs,\nforensic analysis is negatively impacted.\n\n Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack; recognizing resource\nutilization or capacity thresholds; or identifying an improperly configured\noperating system.","descriptions":{"default":"Without establishing the when, where, type, source, and outcome of\nevents that occurred, it would be difficult to establish, correlate, and\ninvestigate the events leading up to an outage or attack.\n\n Without the capability to generate audit records, it would be difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.\n\n Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n Reconstruction of harmful events or forensic analysis is not possible if\naudit records do not contain enough information.\n\n Successful incident response and auditing relies on timely, accurate system\ninformation and analysis in order to allow the organization to identify and\nrespond to potential incidents in a proficient manner. If the operating system\ndoes not provide the ability to centrally review the operating system logs,\nforensic analysis is negatively impacted.\n\n Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack; recognizing resource\nutilization or capacity thresholds; or identifying an improperly configured\noperating system.","rationale":"","check":"Verify the audit service is configured to produce audit records with the\nfollowing command:\n\n $ dpkg -l | grep auditd\n\n If the \"auditd\" package is not installed, this is a finding.\n\n Verify the audit service is enabled with the following command:\n\n $ systemctl is-enabled auditd.service\n\n If the command above returns \"disabled\", this is a finding.\n\n Verify the audit service is properly running and active on the system with\nthe following command:\n\n $ systemctl is-active auditd.service\n active\n\n If the command above returns \"inactive\", this is a finding.","fix":"Configure the audit service to produce audit records containing the\ninformation needed to establish when (date and time) an event occurred.\n\n Install the audit service (if the audit service is not already installed)\nwith the following command:\n\n $ sudo apt-get install auditd\n\n Enable the audit service with the following command:\n\n $ sudo systemctl enable auditd.service\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000122-GPOS-00063","satisfies":["SRG-OS-000122-GPOS-00063","SRG-OS-000037-GPOS-00015","SRG-OS-000038-GPOS-00016","SRG-OS-000039-GPOS-00017","SRG-OS-000040-GPOS-00018","SRG-OS-000041-GPOS-00019","SRG-OS-000042-GPOS-00020","SRG-OS-000042-GPOS-00021","SRG-OS-000051-GPOS-00024","SRG-OS-000054-GPOS-00025","SRG-OS-000062-GPOS-00031","SRG-OS-000337-GPOS-00129","SRG-OS-000348-GPOS-00136","SRG-OS-000349-GPOS-00137","SRG-OS-000350-GPOS-00138","SRG-OS-000351-GPOS-00139","SRG-OS-000352-GPOS-00140","SRG-OS-000353-GPOS-00141","SRG-OS-000354-GPOS-00142","SRG-OS-000475-GPOS-00220"],"gid":"V-238298","rid":"SV-238298r654069_rule","stig_id":"UBTU-20-010182","fix_id":"F-41467r654068_fix","cci":["CCI-000130","CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-000135","CCI-000154","CCI-000158","CCI-000169","CCI-000172","CCI-001875","CCI-001876","CCI-001877","CCI-001878","CCI-001879","CCI-001880","CCI-001881","CCI-001882","CCI-001914"],"legacy":[],"nist":["AU-3","AU-3","AU-3","AU-3","AU-3","AU-3 (1)","AU-6 (4)","AU-7 (1)","AU-12 a","AU-12 c","AU-7 a","AU-7 a","AU-7 a","AU-7 a","AU-7\na","AU-7 a","AU-7 b","AU-7 b","AU-12 (3)"]},"code":"control 'V-238298' do\n title \"The Ubuntu operating system must produce audit records and reports\ncontaining information to establish when, where, what type, the source, and the\noutcome for all DoD-defined auditable events and actions in near real time.\"\n desc \"Without establishing the when, where, type, source, and outcome of\nevents that occurred, it would be difficult to establish, correlate, and\ninvestigate the events leading up to an outage or attack.\n\n Without the capability to generate audit records, it would be difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.\n\n Audit record content that may be necessary to satisfy this requirement\nincludes, for example, time stamps, source and destination addresses,\nuser/process identifiers, event descriptions, success/fail indications,\nfilenames involved, and access control or flow control rules invoked.\n\n Reconstruction of harmful events or forensic analysis is not possible if\naudit records do not contain enough information.\n\n Successful incident response and auditing relies on timely, accurate system\ninformation and analysis in order to allow the organization to identify and\nrespond to potential incidents in a proficient manner. If the operating system\ndoes not provide the ability to centrally review the operating system logs,\nforensic analysis is negatively impacted.\n\n Associating event types with detected events in the Ubuntu operating system\naudit logs provides a means of investigating an attack; recognizing resource\nutilization or capacity thresholds; or identifying an improperly configured\noperating system.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the audit service is configured to produce audit records with the\nfollowing command:\n\n $ dpkg -l | grep auditd\n\n If the \\\"auditd\\\" package is not installed, this is a finding.\n\n Verify the audit service is enabled with the following command:\n\n $ systemctl is-enabled auditd.service\n\n If the command above returns \\\"disabled\\\", this is a finding.\n\n Verify the audit service is properly running and active on the system with\nthe following command:\n\n $ systemctl is-active auditd.service\n active\n\n If the command above returns \\\"inactive\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the audit service to produce audit records containing the\ninformation needed to establish when (date and time) an event occurred.\n\n Install the audit service (if the audit service is not already installed)\nwith the following command:\n\n $ sudo apt-get install auditd\n\n Enable the audit service with the following command:\n\n $ sudo systemctl enable auditd.service\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000122-GPOS-00063'\n tag satisfies: ['SRG-OS-000122-GPOS-00063', 'SRG-OS-000037-GPOS-00015',\n'SRG-OS-000038-GPOS-00016', 'SRG-OS-000039-GPOS-00017',\n'SRG-OS-000040-GPOS-00018', 'SRG-OS-000041-GPOS-00019',\n'SRG-OS-000042-GPOS-00020', 'SRG-OS-000042-GPOS-00021',\n'SRG-OS-000051-GPOS-00024', 'SRG-OS-000054-GPOS-00025',\n'SRG-OS-000062-GPOS-00031', 'SRG-OS-000337-GPOS-00129',\n'SRG-OS-000348-GPOS-00136', 'SRG-OS-000349-GPOS-00137',\n'SRG-OS-000350-GPOS-00138', 'SRG-OS-000351-GPOS-00139',\n'SRG-OS-000352-GPOS-00140', 'SRG-OS-000353-GPOS-00141',\n'SRG-OS-000354-GPOS-00142', 'SRG-OS-000475-GPOS-00220']\n tag gid: 'V-238298'\n tag rid: 'SV-238298r654069_rule'\n tag stig_id: 'UBTU-20-010182'\n tag fix_id: 'F-41467r654068_fix'\n tag cci: ['CCI-000130', 'CCI-000131', 'CCI-000132', 'CCI-000133',\n'CCI-000134', 'CCI-000135', 'CCI-000154', 'CCI-000158', 'CCI-000169',\n'CCI-000172', 'CCI-001875', 'CCI-001876', 'CCI-001877', 'CCI-001878',\n'CCI-001879', 'CCI-001880', 'CCI-001881', 'CCI-001882', 'CCI-001914']\n tag legacy: []\n tag nist: ['AU-3', 'AU-3', 'AU-3', 'AU-3', 'AU-3', 'AU-3 (1)', 'AU-6 (4)',\n'AU-7 (1)', 'AU-12 a', 'AU-12 c', 'AU-7 a', 'AU-7 a', 'AU-7 a', 'AU-7 a', \"AU-7\na\", 'AU-7 a', 'AU-7 b', 'AU-7 b', 'AU-12 (3)']\n\ndescribe package('auditd') do\n it { should be_installed }\nend\ndescribe service('auditd') do\n it { should be_installed }\n it { should be_enabled }\n it { should be_running }\nend\nend\n","source_location":{"ref":"./controls/V-238298.rb","line":3},"id":"V-238298"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the setfacl command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"setfacl\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep setfacl\n\n -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1\n-k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"setfacl\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238283","rid":"SV-238283r654024_rule","stig_id":"UBTU-20-010167","fix_id":"F-41452r654023_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238283' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the setfacl command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"setfacl\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep setfacl\n\n -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1\n-k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"setfacl\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238283'\n tag rid: 'SV-238283r654024_rule'\n tag stig_id: 'UBTU-20-010167'\n tag fix_id: 'F-41452r654023_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/setfacl'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238283.rb","line":3},"id":"V-238283"},{"title":"The Ubuntu operating system must disable account identifiers\n(individuals, groups, roles, and devices) after 35 days of inactivity.","desc":"Inactive identifiers pose a risk to systems and applications because\nattackers may exploit an inactive identifier and potentially obtain undetected\naccess to the system. Owners of inactive accounts will not notice if\nunauthorized access to their user account has been obtained.\n\n Operating systems need to track periods of inactivity and disable\napplication identifiers after 35 days of inactivity.","descriptions":{"default":"Inactive identifiers pose a risk to systems and applications because\nattackers may exploit an inactive identifier and potentially obtain undetected\naccess to the system. Owners of inactive accounts will not notice if\nunauthorized access to their user account has been obtained.\n\n Operating systems need to track periods of inactivity and disable\napplication identifiers after 35 days of inactivity.","rationale":"","check":"Verify the account identifiers (individuals, groups, roles, and devices)\nare disabled after 35 days of inactivity with the following command:\n\n Check the account inactivity value by performing the following command:\n\n $ sudo grep INACTIVE /etc/default/useradd\n\n INACTIVE=35\n\n If \"INACTIVE\" is not set to a value 0<[VALUE]<=35, or is commented out,\nthis is a finding.","fix":"Configure the Ubuntu operating system to disable account identifiers after\n35 days of inactivity after the password expiration.\n\n Run the following command to change the configuration for adduser:\n\n $ sudo useradd -D -f 35\n\n Note: DoD recommendation is 35 days, but a lower value is acceptable. The\nvalue \"0\" will disable the account immediately after the password expires."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000118-GPOS-00060","gid":"V-238330","rid":"SV-238330r654165_rule","stig_id":"UBTU-20-010409","fix_id":"F-41499r654164_fix","cci":["CCI-000795"],"legacy":[],"nist":["IA-4 e"]},"code":"control 'V-238330' do\n title \"The Ubuntu operating system must disable account identifiers\n(individuals, groups, roles, and devices) after 35 days of inactivity.\"\n desc \"Inactive identifiers pose a risk to systems and applications because\nattackers may exploit an inactive identifier and potentially obtain undetected\naccess to the system. Owners of inactive accounts will not notice if\nunauthorized access to their user account has been obtained.\n\n Operating systems need to track periods of inactivity and disable\napplication identifiers after 35 days of inactivity.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the account identifiers (individuals, groups, roles, and devices)\nare disabled after 35 days of inactivity with the following command:\n\n Check the account inactivity value by performing the following command:\n\n $ sudo grep INACTIVE /etc/default/useradd\n\n INACTIVE=35\n\n If \\\"INACTIVE\\\" is not set to a value 0<[VALUE]<=35, or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to disable account identifiers after\n35 days of inactivity after the password expiration.\n\n Run the following command to change the configuration for adduser:\n\n $ sudo useradd -D -f 35\n\n Note: DoD recommendation is 35 days, but a lower value is acceptable. The\nvalue \\\"0\\\" will disable the account immediately after the password expires.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000118-GPOS-00060'\n tag gid: 'V-238330'\n tag rid: 'SV-238330r654165_rule'\n tag stig_id: 'UBTU-20-010409'\n tag fix_id: 'F-41499r654164_fix'\n tag cci: ['CCI-000795']\n tag legacy: []\n tag nist: ['IA-4 e']\n\n config_file = '/etc/default/useradd'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('INACTIVE') { should cmp > '0' }\n its('INACTIVE') { should cmp <= 35 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238330.rb","line":3},"id":"V-238330"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchmodat system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"fchmodat\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep fchmodat\n -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchmodat\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238270","rid":"SV-238270r653985_rule","stig_id":"UBTU-20-010154","fix_id":"F-41439r653984_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238270' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchmodat system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"fchmodat\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep fchmodat\n -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k\nperm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchmodat\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238270'\n tag rid: 'SV-238270r653985_rule'\n tag stig_id: 'UBTU-20-010154'\n tag fix_id: 'F-41439r653984_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('fchmodat').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('fchmodat').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238270.rb","line":3},"id":"V-238270"},{"title":"The Ubuntu operating system must allow the use of a temporary password\nfor system logons with an immediate change to a permanent password.","desc":"Without providing this capability, an account may be created without a\npassword. Non-repudiation cannot be guaranteed once an account is created if a\nuser is not forced to change the temporary password upon initial logon.\n\n Temporary passwords are typically used to allow access when new accounts\nare created or passwords are changed. It is common practice for administrators\nto create temporary passwords for user accounts which allow the users to log\non, yet force them to change the password once they have successfully\nauthenticated.","descriptions":{"default":"Without providing this capability, an account may be created without a\npassword. Non-repudiation cannot be guaranteed once an account is created if a\nuser is not forced to change the temporary password upon initial logon.\n\n Temporary passwords are typically used to allow access when new accounts\nare created or passwords are changed. It is common practice for administrators\nto create temporary passwords for user accounts which allow the users to log\non, yet force them to change the password once they have successfully\nauthenticated.","rationale":"","check":"Verify a policy exists that ensures when a user account is created, it is\ncreated using a method that forces a user to change their password upon their\nnext login.\n\n If a policy does not exist, this is a finding.","fix":"Create a policy that ensures when a user is created, it is created using a\nmethod that forces a user to change their password upon their next login.\n\n Below are two examples of how to create a user account that requires the\nuser to change their password upon their next login.\n\n $ sudo chage -d 0 [UserName]\n\n or\n\n $ sudo passwd -e [UserName]"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000380-GPOS-00165","gid":"V-238361","rid":"SV-238361r654258_rule","stig_id":"UBTU-20-010440","fix_id":"F-41530r654257_fix","cci":["CCI-002041"],"legacy":[],"nist":["IA-5 (1) (f)"]},"code":"control 'V-238361' do\n title \"The Ubuntu operating system must allow the use of a temporary password\nfor system logons with an immediate change to a permanent password.\"\n desc \"Without providing this capability, an account may be created without a\npassword. Non-repudiation cannot be guaranteed once an account is created if a\nuser is not forced to change the temporary password upon initial logon.\n\n Temporary passwords are typically used to allow access when new accounts\nare created or passwords are changed. It is common practice for administrators\nto create temporary passwords for user accounts which allow the users to log\non, yet force them to change the password once they have successfully\nauthenticated.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify a policy exists that ensures when a user account is created, it is\ncreated using a method that forces a user to change their password upon their\nnext login.\n\n If a policy does not exist, this is a finding.\n \"\n desc 'fix', \"\n Create a policy that ensures when a user is created, it is created using a\nmethod that forces a user to change their password upon their next login.\n\n Below are two examples of how to create a user account that requires the\nuser to change their password upon their next login.\n\n $ sudo chage -d 0 [UserName]\n\n or\n\n $ sudo passwd -e [UserName]\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000380-GPOS-00165'\n tag gid: 'V-238361'\n tag rid: 'SV-238361r654258_rule'\n tag stig_id: 'UBTU-20-010440'\n tag fix_id: 'F-41530r654257_fix'\n tag cci: ['CCI-002041']\n tag legacy: []\n tag nist: ['IA-5 (1) (f)']\n\n describe 'Manual verification required' do\n skip 'Manually verify if a policy exists to ensure that a method exists to force temporary\n users to change their password upon next login'\n end\nend\n","source_location":{"ref":"./controls/V-238361.rb","line":3},"id":"V-238361"},{"title":"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one upper-case character be used.","desc":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","descriptions":{"default":"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.","rationale":"","check":"Verify the Ubuntu operating system enforces password complexity by\nrequiring that at least one upper-case character be used.\n\n Determine if the field \"ucredit\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n $ grep -i \"ucredit\" /etc/security/pwquality.conf\n ucredit=-1\n\n If the \"ucredit\" parameter is greater than \"-1\" or is commented out,\nthis is a finding.","fix":"Add or update the \"/etc/security/pwquality.conf\" file to contain the\n\"ucredit\" parameter:\n\n ucredit=-1"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000069-GPOS-00037","gid":"V-238221","rid":"SV-238221r653838_rule","stig_id":"UBTU-20-010050","fix_id":"F-41390r653837_fix","cci":["CCI-000192"],"legacy":[],"nist":["IA-5 (1) (a)"]},"code":"control 'V-238221' do\n title \"The Ubuntu operating system must enforce password complexity by\nrequiring that at least one upper-case character be used.\"\n desc \"Use of a complex password helps to increase the time and resources\nrequired to compromise the password. Password complexity, or strength, is a\nmeasure of the effectiveness of a password in resisting attempts at guessing\nand brute-force attacks.\n\n Password complexity is one factor of several that determines how long it\ntakes to crack a password. The more complex the password, the greater the\nnumber of possible combinations that need to be tested before the password is\ncompromised.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system enforces password complexity by\nrequiring that at least one upper-case character be used.\n\n Determine if the field \\\"ucredit\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n $ grep -i \\\"ucredit\\\" /etc/security/pwquality.conf\n ucredit=-1\n\n If the \\\"ucredit\\\" parameter is greater than \\\"-1\\\" or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Add or update the \\\"/etc/security/pwquality.conf\\\" file to contain the\n\\\"ucredit\\\" parameter:\n\n ucredit=-1\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000069-GPOS-00037'\n tag gid: 'V-238221'\n tag rid: 'SV-238221r653838_rule'\n tag stig_id: 'UBTU-20-010050'\n tag fix_id: 'F-41390r653837_fix'\n tag cci: ['CCI-000192']\n tag legacy: []\n tag nist: ['IA-5 (1) (a)']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('ucredit') { should cmp -1 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238221.rb","line":3},"id":"V-238221"},{"title":"The Ubuntu operating system must use SSH to protect the\nconfidentiality and integrity of transmitted information.","desc":"Without protection of the transmitted information, confidentiality and\nintegrity may be compromised because unprotected communications can be\nintercepted and either read or altered.\n\n This requirement applies to both internal and external networks and all\ntypes of information system components from which information can be\ntransmitted (e.g., servers, mobile devices, notebook computers, printers,\ncopiers, scanners, and facsimile machines). Communication paths outside the\nphysical protection of a controlled boundary are exposed to the possibility of\ninterception and modification.\n\n Protecting the confidentiality and integrity of organizational information\ncan be accomplished by physical means (e.g., employing physical distribution\nsystems) or by logical means (e.g., employing cryptographic techniques). If\nphysical means of protection are employed, then logical means (cryptography) do\nnot have to be employed, and vice versa.","descriptions":{"default":"Without protection of the transmitted information, confidentiality and\nintegrity may be compromised because unprotected communications can be\nintercepted and either read or altered.\n\n This requirement applies to both internal and external networks and all\ntypes of information system components from which information can be\ntransmitted (e.g., servers, mobile devices, notebook computers, printers,\ncopiers, scanners, and facsimile machines). Communication paths outside the\nphysical protection of a controlled boundary are exposed to the possibility of\ninterception and modification.\n\n Protecting the confidentiality and integrity of organizational information\ncan be accomplished by physical means (e.g., employing physical distribution\nsystems) or by logical means (e.g., employing cryptographic techniques). If\nphysical means of protection are employed, then logical means (cryptography) do\nnot have to be employed, and vice versa.","rationale":"","check":"Verify the SSH package is installed with the following command:\n\n $ sudo dpkg -l | grep openssh\n ii openssh-client 1:7.6p1-4ubuntu0.1\n amd64 secure shell (SSH) client, for secure access to remote machines\n ii openssh-server 1:7.6p1-4ubuntu0.1\n amd64 secure shell (SSH) server, for secure access from remote machines\n ii openssh-sftp-server 1:7.6p1-4ubuntu0.1\n amd64 secure shell (SSH) sftp server module, for SFTP access from\nremote machines\n\n If the \"openssh\" server package is not installed, this is a finding.\n\n Verify the \"sshd.service\" is loaded and active with the following\ncommand:\n\n $ sudo systemctl status sshd.service | egrep -i \"(active|loaded)\"\n Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset:\nenabled)\n Active: active (running) since Thu 2019-01-24 22:52:58 UTC; 1 weeks 3\ndays ago\n\n If \"sshd.service\" is not active or loaded, this is a finding.","fix":"Install the \"ssh\" meta-package on the system with the following command:\n\n $ sudo apt install ssh\n\n Enable the \"ssh\" service to start automatically on reboot with the\nfollowing command:\n\n $ sudo systemctl enable sshd.service\n\n ensure the \"ssh\" service is running\n\n $ sudo systemctl start sshd.service"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000423-GPOS-00187","satisfies":["SRG-OS-000423-GPOS-00187","SRG-OS-000425-GPOS-00189","SRG-OS-000426-GPOS-00190"],"gid":"V-238215","rid":"SV-238215r653820_rule","stig_id":"UBTU-20-010042","fix_id":"F-41384r653819_fix","cci":["CCI-002418","CCI-002420","CCI-002422"],"legacy":[],"nist":["SC-8","SC-8 (2)","SC-8 (2)"]},"code":"control 'V-238215' do\n title \"The Ubuntu operating system must use SSH to protect the\nconfidentiality and integrity of transmitted information.\"\n desc \"Without protection of the transmitted information, confidentiality and\nintegrity may be compromised because unprotected communications can be\nintercepted and either read or altered.\n\n This requirement applies to both internal and external networks and all\ntypes of information system components from which information can be\ntransmitted (e.g., servers, mobile devices, notebook computers, printers,\ncopiers, scanners, and facsimile machines). Communication paths outside the\nphysical protection of a controlled boundary are exposed to the possibility of\ninterception and modification.\n\n Protecting the confidentiality and integrity of organizational information\ncan be accomplished by physical means (e.g., employing physical distribution\nsystems) or by logical means (e.g., employing cryptographic techniques). If\nphysical means of protection are employed, then logical means (cryptography) do\nnot have to be employed, and vice versa.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the SSH package is installed with the following command:\n\n $ sudo dpkg -l | grep openssh\n ii openssh-client 1:7.6p1-4ubuntu0.1\n amd64 secure shell (SSH) client, for secure access to remote machines\n ii openssh-server 1:7.6p1-4ubuntu0.1\n amd64 secure shell (SSH) server, for secure access from remote machines\n ii openssh-sftp-server 1:7.6p1-4ubuntu0.1\n amd64 secure shell (SSH) sftp server module, for SFTP access from\nremote machines\n\n If the \\\"openssh\\\" server package is not installed, this is a finding.\n\n Verify the \\\"sshd.service\\\" is loaded and active with the following\ncommand:\n\n $ sudo systemctl status sshd.service | egrep -i \\\"(active|loaded)\\\"\n Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset:\nenabled)\n Active: active (running) since Thu 2019-01-24 22:52:58 UTC; 1 weeks 3\ndays ago\n\n If \\\"sshd.service\\\" is not active or loaded, this is a finding.\n \"\n desc 'fix', \"\n Install the \\\"ssh\\\" meta-package on the system with the following command:\n\n $ sudo apt install ssh\n\n Enable the \\\"ssh\\\" service to start automatically on reboot with the\nfollowing command:\n\n $ sudo systemctl enable sshd.service\n\n ensure the \\\"ssh\\\" service is running\n\n $ sudo systemctl start sshd.service\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000423-GPOS-00187'\n tag satisfies: ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000425-GPOS-00189',\n'SRG-OS-000426-GPOS-00190']\n tag gid: 'V-238215'\n tag rid: 'SV-238215r653820_rule'\n tag stig_id: 'UBTU-20-010042'\n tag fix_id: 'F-41384r653819_fix'\n tag cci: ['CCI-002418', 'CCI-002420', 'CCI-002422']\n tag legacy: []\n tag nist: ['SC-8', 'SC-8 (2)', 'SC-8 (2)']\n\n describe package('openssh-client') do\n it { should be_installed }\n end\n \n describe package('openssh-server') do\n it { should be_installed }\n end\n \n describe package('openssh-sftp-server') do\n it { should be_installed }\n end\n \n describe service('sshd') do\n it { should be_enabled }\n it { should be_installed }\n it { should be_running }\n end\nend\n","source_location":{"ref":"./controls/V-238215.rb","line":3},"id":"V-238215"},{"title":"The Ubuntu operating system must enable and run the uncomplicated\nfirewall(ufw).","desc":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated control\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).","descriptions":{"default":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated control\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).","rationale":"","check":"Verify the Uncomplicated Firewall is enabled on the system by running the\nfollowing command:\n\n $ systemctl is-enabled ufw\n\n If the above command returns the status as \"disabled\", this is a finding.\n\n Verify the Uncomplicated Firewall is active on the system by running the\nfollowing command:\n\n $ systemctl is-active ufw\n\n If the above command returns \"inactive\" or any kind of error, this is a\nfinding.\n\n If the Uncomplicated Firewall is not installed, ask the System\nAdministrator if another application firewall is installed.\n\n If no application firewall is installed, this is a finding.","fix":"Enable the Uncomplicated Firewall by using the following command:\n\n$ sudo systemctl enable --now ufw.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000297-GPOS-00115","gid":"V-238355","rid":"SV-238355r654240_rule","stig_id":"UBTU-20-010434","fix_id":"F-41524r654239_fix","cci":["CCI-002314"],"legacy":[],"nist":["AC-17 (1)"]},"code":"control 'V-238355' do\n title \"The Ubuntu operating system must enable and run the uncomplicated\nfirewall(ufw).\"\n desc \"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated control\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Uncomplicated Firewall is enabled on the system by running the\nfollowing command:\n\n $ systemctl is-enabled ufw\n\n If the above command returns the status as \\\"disabled\\\", this is a finding.\n\n Verify the Uncomplicated Firewall is active on the system by running the\nfollowing command:\n\n $ systemctl is-active ufw\n\n If the above command returns \\\"inactive\\\" or any kind of error, this is a\nfinding.\n\n If the Uncomplicated Firewall is not installed, ask the System\nAdministrator if another application firewall is installed.\n\n If no application firewall is installed, this is a finding.\n \"\n desc 'fix', \"\n Enable the Uncomplicated Firewall by using the following command:\n\n $ sudo systemctl enable --now ufw.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000297-GPOS-00115'\n tag gid: 'V-238355'\n tag rid: 'SV-238355r654240_rule'\n tag stig_id: 'UBTU-20-010434'\n tag fix_id: 'F-41524r654239_fix'\n tag cci: ['CCI-002314']\n tag legacy: []\n tag nist: ['AC-17 (1)']\n\n describe service('ufw') do\n it { should be_installed }\n it { should be_enabled }\n it { should be_running }\n end\nend\n","source_location":{"ref":"./controls/V-238355.rb","line":3},"id":"V-238355"},{"title":"The Ubuntu operating system must shut down by default upon audit\nfailure (unless availability is an overriding concern).","desc":"It is critical that when the operating system is at risk of failing to\nprocess audit logs as required, it takes action to mitigate the failure. Audit\nprocessing failures include: software/hardware errors; failures in the audit\ncapturing mechanisms; and audit storage capacity being reached or exceeded.\nResponses to audit failure depend upon the nature of the failure mode.\n\n When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n 1) If the failure was caused by the lack of audit record storage capacity,\nthe operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n 2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the operating\nsystem must queue audit records locally until communication is restored or\nuntil the audit records are retrieved manually. Upon restoration of the\nconnection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.","descriptions":{"default":"It is critical that when the operating system is at risk of failing to\nprocess audit logs as required, it takes action to mitigate the failure. Audit\nprocessing failures include: software/hardware errors; failures in the audit\ncapturing mechanisms; and audit storage capacity being reached or exceeded.\nResponses to audit failure depend upon the nature of the failure mode.\n\n When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n 1) If the failure was caused by the lack of audit record storage capacity,\nthe operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n 2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the operating\nsystem must queue audit records locally until communication is restored or\nuntil the audit records are retrieved manually. Upon restoration of the\nconnection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.","rationale":"","check":"Verify the Ubuntu operating system takes the appropriate action when the\naudit storage volume is full with the following command:\n\n $ sudo grep '^disk_full_action' /etc/audit/auditd.conf\n\n disk_full_action = HALT\n\n If the value of the \"disk_full_action\" option is not \"SYSLOG\",\n\"SINGLE\", or \"HALT\", or the line is commented out, this is a finding.","fix":"Configure the Ubuntu operating system to shut down by default upon audit\nfailure (unless availability is an overriding concern).\n\n Add or update the following line (depending on configuration,\n\"disk_full_action\" can be set to \"SYSLOG\", \"HALT\" or \"SINGLE\") in\n\"/etc/audit/auditd.conf\" file:\n\n disk_full_action = HALT\n\n Restart the \"auditd\" service so the changes take effect:\n\n $ sudo systemctl restart auditd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000047-GPOS-00023","gid":"V-238244","rid":"SV-238244r653907_rule","stig_id":"UBTU-20-010118","fix_id":"F-41413r653906_fix","cci":["CCI-000140"],"legacy":[],"nist":["AU-5 b"]},"code":"control 'V-238244' do\n title \"The Ubuntu operating system must shut down by default upon audit\nfailure (unless availability is an overriding concern).\"\n desc \"It is critical that when the operating system is at risk of failing to\nprocess audit logs as required, it takes action to mitigate the failure. Audit\nprocessing failures include: software/hardware errors; failures in the audit\ncapturing mechanisms; and audit storage capacity being reached or exceeded.\nResponses to audit failure depend upon the nature of the failure mode.\n\n When availability is an overriding concern, other approved actions in\nresponse to an audit failure are as follows:\n\n 1) If the failure was caused by the lack of audit record storage capacity,\nthe operating system must continue generating audit records if possible\n(automatically restarting the audit service if necessary), overwriting the\noldest audit records in a first-in-first-out manner.\n\n 2) If audit records are sent to a centralized collection server and\ncommunication with this server is lost or the server fails, the operating\nsystem must queue audit records locally until communication is restored or\nuntil the audit records are retrieved manually. Upon restoration of the\nconnection to the centralized collection server, action should be taken to\nsynchronize the local audit data with the collection server.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system takes the appropriate action when the\naudit storage volume is full with the following command:\n\n $ sudo grep '^disk_full_action' /etc/audit/auditd.conf\n\n disk_full_action = HALT\n\n If the value of the \\\"disk_full_action\\\" option is not \\\"SYSLOG\\\",\n\\\"SINGLE\\\", or \\\"HALT\\\", or the line is commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to shut down by default upon audit\nfailure (unless availability is an overriding concern).\n\n Add or update the following line (depending on configuration,\n\\\"disk_full_action\\\" can be set to \\\"SYSLOG\\\", \\\"HALT\\\" or \\\"SINGLE\\\") in\n\\\"/etc/audit/auditd.conf\\\" file:\n\n disk_full_action = HALT\n\n Restart the \\\"auditd\\\" service so the changes take effect:\n\n $ sudo systemctl restart auditd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000047-GPOS-00023'\n tag gid: 'V-238244'\n tag rid: 'SV-238244r653907_rule'\n tag stig_id: 'UBTU-20-010118'\n tag fix_id: 'F-41413r653906_fix'\n tag cci: ['CCI-000140']\n tag legacy: []\n tag nist: ['AU-5 b']\n\n describe auditd_conf do\n its('disk_full_action') { should_not be_empty }\n its('disk_full_action') { should cmp /(?:SYSLOG|SINGLE|HALT)/i }\n end\nend\n","source_location":{"ref":"./controls/V-238244.rb","line":3},"id":"V-238244"},{"title":"The Ubuntu operating system must prevent all software from executing\nat higher privilege levels than users executing the software and the audit\nsystem must be configured to audit the execution of privileged functions.","desc":"In certain situations, software applications/programs need to execute\nwith elevated privileges to perform required functions. However, if the\nprivileges required for execution are at a higher level than the privileges\nassigned to organizational users invoking such applications/programs, those\nusers are indirectly provided with greater privileges than assigned by the\norganizations.\n\n Some programs and processes are required to operate at a higher privilege\nlevel and therefore should be excluded from the organization-defined software\nlist after review.","descriptions":{"default":"In certain situations, software applications/programs need to execute\nwith elevated privileges to perform required functions. However, if the\nprivileges required for execution are at a higher level than the privileges\nassigned to organizational users invoking such applications/programs, those\nusers are indirectly provided with greater privileges than assigned by the\norganizations.\n\n Some programs and processes are required to operate at a higher privilege\nlevel and therefore should be excluded from the organization-defined software\nlist after review.","rationale":"","check":"Verify the Ubuntu operating system audits the execution of privilege\nfunctions by auditing the \"execve\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep execve\n\n -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to audit the execution of all\nprivileged functions.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000326-GPOS-00126","satisfies":["SRG-OS-000326-GPOS-00126","SRG-OS-000327-GPOS-00127"],"gid":"V-238304","rid":"SV-238304r654087_rule","stig_id":"UBTU-20-010211","fix_id":"F-41473r654086_fix","cci":["CCI-002233","CCI-002234"],"legacy":[],"nist":["AC-6 (8)","AC-6 (9)"]},"code":"control 'V-238304' do\n title \"The Ubuntu operating system must prevent all software from executing\nat higher privilege levels than users executing the software and the audit\nsystem must be configured to audit the execution of privileged functions.\"\n desc \"In certain situations, software applications/programs need to execute\nwith elevated privileges to perform required functions. However, if the\nprivileges required for execution are at a higher level than the privileges\nassigned to organizational users invoking such applications/programs, those\nusers are indirectly provided with greater privileges than assigned by the\norganizations.\n\n Some programs and processes are required to operate at a higher privilege\nlevel and therefore should be excluded from the organization-defined software\nlist after review.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system audits the execution of privilege\nfunctions by auditing the \\\"execve\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep execve\n\n -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to audit the execution of all\nprivileged functions.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=execpriv\n\n -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -F key=execpriv\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000326-GPOS-00126'\n tag satisfies: ['SRG-OS-000326-GPOS-00126', 'SRG-OS-000327-GPOS-00127']\n tag gid: 'V-238304'\n tag rid: 'SV-238304r654087_rule'\n tag stig_id: 'UBTU-20-010211'\n tag fix_id: 'F-41473r654086_fix'\n tag cci: ['CCI-002233', 'CCI-002234']\n tag legacy: []\n tag nist: ['AC-6 (8)', 'AC-6 (9)']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('execve').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('execve').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238304.rb","line":3},"id":"V-238304"},{"title":"The Ubuntu operating system must generate audit records when loading\ndynamic kernel modules.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record when adding\nand deleting kernel modules.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -delete_module\n\n always,exit -F arch=b32 -S delete_module -k modules\n always,exit -F arch=b64 -S delete_module -k modules\n\n If the command does not return lines that matches the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate audit events when adding and\ndeleting kernel modules.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n always,exit -F arch=b32 -S delete_module -k modules\n always,exit -F arch=b64 -S delete_module -k modules\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000471-GPOS-00216","gid":"V-238314","rid":"SV-238314r654117_rule","stig_id":"UBTU-20-010276","fix_id":"F-41483r654116_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238314' do\n title \"The Ubuntu operating system must generate audit records when loading\ndynamic kernel modules.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record when adding\nand deleting kernel modules.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -delete_module\n\n always,exit -F arch=b32 -S delete_module -k modules\n always,exit -F arch=b64 -S delete_module -k modules\n\n If the command does not return lines that matches the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events when adding and\ndeleting kernel modules.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n always,exit -F arch=b32 -S delete_module -k modules\n always,exit -F arch=b64 -S delete_module -k modules\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000471-GPOS-00216'\n tag gid: 'V-238314'\n tag rid: 'SV-238314r654117_rule'\n tag stig_id: 'UBTU-20-010276'\n tag fix_id: 'F-41483r654116_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n #CHECK RULE, missing action\n if os.arch == 'x86_64'\n describe auditd.syscall('delete_module').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('delete_module').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238314.rb","line":3},"id":"V-238314"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the mount command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \"mount\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/mount'\n\n -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-mount\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"mount\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-mount\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238254","rid":"SV-238254r653937_rule","stig_id":"UBTU-20-010138","fix_id":"F-41423r653936_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238254' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the mount command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \\\"mount\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/mount'\n\n -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-mount\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"mount\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-mount\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238254'\n tag rid: 'SV-238254r653937_rule'\n tag stig_id: 'UBTU-20-010138'\n tag fix_id: 'F-41423r653936_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/mount'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238254.rb","line":3},"id":"V-238254"},{"title":"The Ubuntu operating system must have directories that contain system\ncommands owned by root.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":{"default":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","rationale":"","check":"Verify the system commands directories are owned by root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Use the following command for the check:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type d -exec stat -c \"%n %U\" '{}' \\;\n\n If any system commands directories are returned, this is a finding.","fix":"Configure the system commands directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type d -exec chown root '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000258-GPOS-00099","gid":"V-238345","rid":"SV-238345r654210_rule","stig_id":"UBTU-20-010424","fix_id":"F-41514r654209_fix","cci":["CCI-001495"],"legacy":[],"nist":["AU-9"]},"code":"control 'V-238345' do\n title \"The Ubuntu operating system must have directories that contain system\ncommands owned by root.\"\n desc \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system commands directories are owned by root:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Use the following command for the check:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type d -exec stat -c \\\"%n %U\\\" '{}' \\\\;\n\n If any system commands directories are returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the system commands directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin !\n-user root -type d -exec chown root '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000258-GPOS-00099'\n tag gid: 'V-238345'\n tag rid: 'SV-238345r654210_rule'\n tag stig_id: 'UBTU-20-010424'\n tag fix_id: 'F-41514r654209_fix'\n tag cci: ['CCI-001495']\n tag legacy: []\n tag nist: ['AU-9']\n\n system_commands = command(\"find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -user root -type d\").stdout.strip.split(\"\\n\").entries\n valid_system_commands = Set[]\n\n if system_commands.count > 0\n system_commands.each do |sys_cmd|\n if file(sys_cmd).exist?\n valid_system_commands = valid_system_commands << sys_cmd\n end\n end\n end\n\n if valid_system_commands.count > 0\n valid_system_commands.each do |val_sys_cmd|\n describe file(val_sys_cmd) do\n its(\"owner\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of directories that contain system commands found in /bin, /sbin, /usr/bin, /usr/sbin,\n /usr/local/bin or /usr/local/sbin, that are NOT owned by root\" do\n subject { valid_system_commands }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238345.rb","line":3},"id":"V-238345"},{"title":"The Ubuntu operating system must uniquely identify interactive users.","desc":"To assure accountability and prevent unauthenticated access,\norganizational users must be identified and authenticated to prevent potential\nmisuse and compromise of the system.\n\n Organizational users include organizational employees or individuals the\norganization deems to have equivalent status of employees (e.g., contractors).\nOrganizational users (and processes acting on behalf of users) must be uniquely\nidentified and authenticated to all accesses, except for the following:\n\n 1) Accesses explicitly identified and documented by the organization.\nOrganizations document specific user actions that can be performed on the\ninformation system without identification or authentication; and\n\n 2) Accesses that occur through authorized use of group authenticators\nwithout individual authentication. Organizations may require unique\nidentification of individuals in group accounts (e.g., shared privilege\naccounts) or for detailed accountability of individual activity.","descriptions":{"default":"To assure accountability and prevent unauthenticated access,\norganizational users must be identified and authenticated to prevent potential\nmisuse and compromise of the system.\n\n Organizational users include organizational employees or individuals the\norganization deems to have equivalent status of employees (e.g., contractors).\nOrganizational users (and processes acting on behalf of users) must be uniquely\nidentified and authenticated to all accesses, except for the following:\n\n 1) Accesses explicitly identified and documented by the organization.\nOrganizations document specific user actions that can be performed on the\ninformation system without identification or authentication; and\n\n 2) Accesses that occur through authorized use of group authenticators\nwithout individual authentication. Organizations may require unique\nidentification of individuals in group accounts (e.g., shared privilege\naccounts) or for detailed accountability of individual activity.","rationale":"","check":"Verify the Ubuntu operating system contains no duplicate User IDs (UIDs)\nfor interactive users with the following command:\n\n $ awk -F \":\" 'list[$3]++{print $1, $3}' /etc/passwd\n\n If output is produced and the accounts listed are interactive user\naccounts, this is a finding.","fix":"Edit the file \"/etc/passwd\" and provide each interactive user\naccount that has a duplicate UID with a unique UID."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000104-GPOS-00051","satisfies":["SRG-OS-000104-GPOS-00051","SRG-OS-000121-GPOS-00062"],"gid":"V-238205","rid":"SV-238205r653790_rule","stig_id":"UBTU-20-010010","fix_id":"F-41374r653789_fix","cci":["CCI-000764","CCI-000804"],"legacy":[],"nist":["IA-2","IA-8"]},"code":"control 'V-238205' do\n title 'The Ubuntu operating system must uniquely identify interactive users.'\n desc \"To assure accountability and prevent unauthenticated access,\norganizational users must be identified and authenticated to prevent potential\nmisuse and compromise of the system.\n\n Organizational users include organizational employees or individuals the\norganization deems to have equivalent status of employees (e.g., contractors).\nOrganizational users (and processes acting on behalf of users) must be uniquely\nidentified and authenticated to all accesses, except for the following:\n\n 1) Accesses explicitly identified and documented by the organization.\nOrganizations document specific user actions that can be performed on the\ninformation system without identification or authentication; and\n\n 2) Accesses that occur through authorized use of group authenticators\nwithout individual authentication. Organizations may require unique\nidentification of individuals in group accounts (e.g., shared privilege\naccounts) or for detailed accountability of individual activity.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system contains no duplicate User IDs (UIDs)\nfor interactive users with the following command:\n\n $ awk -F \\\":\\\" 'list[$3]++{print $1, $3}' /etc/passwd\n\n If output is produced and the accounts listed are interactive user\naccounts, this is a finding.\n \"\n desc 'fix', \"Edit the file \\\"/etc/passwd\\\" and provide each interactive user\naccount that has a duplicate UID with a unique UID.\"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000104-GPOS-00051'\n tag satisfies: ['SRG-OS-000104-GPOS-00051', 'SRG-OS-000121-GPOS-00062']\n tag gid: 'V-238205'\n tag rid: 'SV-238205r653790_rule'\n tag stig_id: 'UBTU-20-010010'\n tag fix_id: 'F-41374r653789_fix'\n tag cci: ['CCI-000764', 'CCI-000804']\n tag legacy: []\n tag nist: ['IA-2', 'IA-8']\n\n user_list = command(\"awk -F \\\":\\\" 'list[$3]++{print $1}' /etc/passwd\").stdout.split(\"\\n\")\n findings = Set[]\n\n user_list.each do |user_name|\n findings = findings << user_name\n end\n describe 'Duplicate User IDs (UIDs) must not exist for interactive users' do\n subject { findings.to_a }\n it { should be_empty }\n end\nend\n","source_location":{"ref":"./controls/V-238205.rb","line":3},"id":"V-238205"},{"title":"The Ubuntu operating system must accept Personal Identity Verification\n(PIV) credentials.","desc":"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.","descriptions":{"default":"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.","rationale":"","check":"Verify the Ubuntu operating system accepts PIV credentials.\n\n Verify the \"opensc-pcks11\" package is installed on the system with the\nfollowing command:\n\n $ dpkg -l | grep opensc-pkcs11\n\n ii opensc-pkcs11:amd64 0.15.0-1Ubuntu1 amd64 Smart card\nutilities with support for PKCS#15 compatible cards\n\n If the \"opensc-pcks11\" package is not installed, this is a finding.","fix":"Configure the Ubuntu operating system to accept PIV credentials.\n\nInstall the \"opensc-pkcs11\" package using the following command:\n\n$ sudo apt-get install opensc-pkcs11"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000376-GPOS-00161","gid":"V-238231","rid":"SV-238231r653868_rule","stig_id":"UBTU-20-010064","fix_id":"F-41400r653867_fix","cci":["CCI-001953"],"legacy":[],"nist":["IA-2 (12)"]},"code":"control 'V-238231' do\n title \"The Ubuntu operating system must accept Personal Identity Verification\n(PIV) credentials.\"\n desc \"The use of PIV credentials facilitates standardization and reduces the\nrisk of unauthorized access.\n\n DoD has mandated the use of the CAC to support identity management and\npersonal authentication for systems covered under Homeland Security\nPresidential Directive (HSPD) 12, as well as making the CAC a primary component\nof layered protection for national security systems.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system accepts PIV credentials.\n\n Verify the \\\"opensc-pcks11\\\" package is installed on the system with the\nfollowing command:\n\n $ dpkg -l | grep opensc-pkcs11\n\n ii opensc-pkcs11:amd64 0.15.0-1Ubuntu1 amd64 Smart card\nutilities with support for PKCS#15 compatible cards\n\n If the \\\"opensc-pcks11\\\" package is not installed, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to accept PIV credentials.\n\n Install the \\\"opensc-pkcs11\\\" package using the following command:\n\n $ sudo apt-get install opensc-pkcs11\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000376-GPOS-00161'\n tag gid: 'V-238231'\n tag rid: 'SV-238231r653868_rule'\n tag stig_id: 'UBTU-20-010064'\n tag fix_id: 'F-41400r653867_fix'\n tag cci: ['CCI-001953']\n tag legacy: []\n tag nist: ['IA-2 (12)']\n\n describe package('opensc-pkcs11') do\n it { should be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238231.rb","line":3},"id":"V-238231"},{"title":"The Ubuntu operating system must use a file integrity tool to verify\ncorrect operation of all security functions.","desc":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n This requirement applies to the Ubuntu operating system performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.","descriptions":{"default":"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n This requirement applies to the Ubuntu operating system performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.","rationale":"","check":"Verify that Advanced Intrusion Detection Environment (AIDE) is installed\nand verifies the correct operation of all security functions.\n\n Check that the AIDE package is installed with the following command:\n\n $ sudo dpkg -l | grep aide\n ii aide 0.16.1-1build2 amd64 Advanced Intrusion Detection\nEnvironment - static binary\n\n If AIDE is not installed, ask the System Administrator how file integrity\nchecks are performed on the system.\n\n If no application is installed to perform integrity checks, this is a\nfinding.","fix":"Install the AIDE package by running the following command:\n\n$ sudo apt-get install aide"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000445-GPOS-00199","gid":"V-238371","rid":"SV-238371r654288_rule","stig_id":"UBTU-20-010450","fix_id":"F-41540r654287_fix","cci":["CCI-002696"],"legacy":[],"nist":["SI-6 a"]},"code":"control 'V-238371' do\n title \"The Ubuntu operating system must use a file integrity tool to verify\ncorrect operation of all security functions.\"\n desc \"Without verification of the security functions, security functions may\nnot operate correctly and the failure may go unnoticed. Security function is\ndefined as the hardware, software, and/or firmware of the information system\nresponsible for enforcing the system security policy and supporting the\nisolation of code and data on which the protection is based. Security\nfunctionality includes, but is not limited to, establishing system accounts,\nconfiguring access authorizations (i.e., permissions, privileges), setting\nevents to be audited, and setting intrusion detection parameters.\n\n This requirement applies to the Ubuntu operating system performing security\nfunction verification/testing and/or systems and environments that require this\nfunctionality.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that Advanced Intrusion Detection Environment (AIDE) is installed\nand verifies the correct operation of all security functions.\n\n Check that the AIDE package is installed with the following command:\n\n $ sudo dpkg -l | grep aide\n ii aide 0.16.1-1build2 amd64 Advanced Intrusion Detection\nEnvironment - static binary\n\n If AIDE is not installed, ask the System Administrator how file integrity\nchecks are performed on the system.\n\n If no application is installed to perform integrity checks, this is a\nfinding.\n \"\n desc 'fix', \"\n Install the AIDE package by running the following command:\n\n $ sudo apt-get install aide\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000445-GPOS-00199'\n tag gid: 'V-238371'\n tag rid: 'SV-238371r654288_rule'\n tag stig_id: 'UBTU-20-010450'\n tag fix_id: 'F-41540r654287_fix'\n tag cci: ['CCI-002696']\n tag legacy: []\n tag nist: ['SI-6 a']\n\n describe package('aide') do\n it { should be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238371.rb","line":3},"id":"V-238371"},{"title":"The Ubuntu operating system must generate audit records for any use of\nthe fsetxattr system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"fsetxattr\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fsetxattr\n\n -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fsetxattr\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238260","rid":"SV-238260r653955_rule","stig_id":"UBTU-20-010144","fix_id":"F-41429r653954_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238260' do\n title \"The Ubuntu operating system must generate audit records for any use of\nthe fsetxattr system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"fsetxattr\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fsetxattr\n\n -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fsetxattr\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b64 -S fsetxattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238260'\n tag rid: 'SV-238260r653955_rule'\n tag stig_id: 'UBTU-20-010144'\n tag fix_id: 'F-41429r653954_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"fsetxattr\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"fsetxattr\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238260.rb","line":3},"id":"V-238260"},{"title":"The Ubuntu operating system must generate audit records when\nsuccessful/unsuccessful attempts to use the fdisk command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system is configured to audit the execution of\nthe partition management program \"fdisk\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fdisk\n\n -w /sbin/fdisk -p x -k fdisk\n\n If the command does not return a line, or the line is commented out, this\nis a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to audit the execution of the\npartition management program \"fdisk\".\n\n Add or update the following rule in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /bin/fdisk -p x -k fdisk\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000477-GPOS-00222","gid":"V-238320","rid":"SV-238320r654135_rule","stig_id":"UBTU-20-010298","fix_id":"F-41489r654134_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238320' do\n title \"The Ubuntu operating system must generate audit records when\nsuccessful/unsuccessful attempts to use the fdisk command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to audit the execution of\nthe partition management program \\\"fdisk\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep fdisk\n\n -w /sbin/fdisk -p x -k fdisk\n\n If the command does not return a line, or the line is commented out, this\nis a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to audit the execution of the\npartition management program \\\"fdisk\\\".\n\n Add or update the following rule in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /bin/fdisk -p x -k fdisk\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000477-GPOS-00222'\n tag gid: 'V-238320'\n tag rid: 'SV-238320r654135_rule'\n tag stig_id: 'UBTU-20-010298'\n tag fix_id: 'F-41489r654134_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = \"/sbin/fdisk\"\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its(\"permissions\") { should_not cmp [] }\n its(\"action\") { should_not include \"never\" }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include \"x\" }\n end\n end\n else\n describe (\"Audit line(s) for \" + @audit_file + \" exist\") do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238320.rb","line":3},"id":"V-238320"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the crontab command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"crontab\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w crontab\n\n -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-crontab\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"crontab\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-crontab\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238293","rid":"SV-238293r654054_rule","stig_id":"UBTU-20-010177","fix_id":"F-41462r654053_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238293' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the crontab command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"crontab\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w crontab\n\n -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-crontab\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"crontab\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-crontab\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238293'\n tag rid: 'SV-238293r654054_rule'\n tag stig_id: 'UBTU-20-010177'\n tag fix_id: 'F-41462r654053_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/crontab'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238293.rb","line":3},"id":"V-238293"},{"title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/shadow.","desc":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","descriptions":{"default":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","rationale":"","check":"Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\"/etc/shadow\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep shadow\n\n -w /etc/shadow -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\"/etc/shadow\".\n\n Add or update the following rule to \"/etc/audit/rules.d/stig.rules\":\n\n -w /etc/shadow -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","satisfies":["SRG-OS-000004-GPOS-00004","SRG-OS-000239-GPOS-00089","SRG-OS-000240-GPOS-00090","SRG-OS-000241-GPOS-00091","SRG-OS-000303-GPOS-00120","SRG-OS-000458-GPOS-00203","SRG-OS-000476-GPOS-00221"],"gid":"V-238240","rid":"SV-238240r653895_rule","stig_id":"UBTU-20-010102","fix_id":"F-41409r653894_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-001404","CCI-001405","CCI-002130"],"legacy":[],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)","AC-2 (4)","AC-2\n(4)"]},"code":"control 'V-238240' do\n title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/shadow.\"\n desc \"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\\\"/etc/shadow\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep shadow\n\n -w /etc/shadow -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\\\"/etc/shadow\\\".\n\n Add or update the following rule to \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -w /etc/shadow -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000004-GPOS-00004'\n tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089',\n'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091',\n'SRG-OS-000303-GPOS-00120', 'SRG-OS-000458-GPOS-00203',\n'SRG-OS-000476-GPOS-00221']\n tag gid: 'V-238240'\n tag rid: 'SV-238240r653895_rule'\n tag stig_id: 'UBTU-20-010102'\n tag fix_id: 'F-41409r653894_fix'\n tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-001404',\n'CCI-001405', 'CCI-002130']\n tag legacy: []\n tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AC-2 (4)', \"AC-2\n(4)\"]\n\n @audit_file = '/etc/shadow'\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238240.rb","line":3},"id":"V-238240"},{"title":"The Ubuntu operating system must configure audit tools with a mode of\n0755 or less permissive.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":{"default":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","rationale":"","check":"Verify the Ubuntu operating system configures the audit tools to have a\nfile permission of 0755 or less to prevent unauthorized access by running the\nfollowing command:\n\n $ stat -c \"%n %a\" /sbin/auditctl /sbin/aureport /sbin/ausearch\n/sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules\n\n /sbin/auditctl 755\n /sbin/aureport 755\n /sbin/ausearch 755\n /sbin/autrace 755\n /sbin/auditd 755\n /sbin/audispd 755\n /sbin/augenrules 755\n\n If any of the audit tools have a mode more permissive than 0755, this is a\nfinding.","fix":"Configure the audit tools on the Ubuntu operating system to be protected\nfrom unauthorized access by setting the correct permissive mode using the\nfollowing command:\n\n $ sudo chmod 0755 [audit_tool]\n\n Replace \"[audit_tool]\" with the audit tool that does not have the correct\npermissions."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000256-GPOS-00097","satisfies":["SRG-OS-000256-GPOS-00097","SRG-OS-000257-GPOS-00098"],"gid":"V-238300","rid":"SV-238300r654075_rule","stig_id":"UBTU-20-010199","fix_id":"F-41469r654074_fix","cci":["CCI-001493","CCI-001494"],"legacy":[],"nist":["AU-9","AU-9"]},"code":"control 'V-238300' do\n title \"The Ubuntu operating system must configure audit tools with a mode of\n0755 or less permissive.\"\n desc \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system configures the audit tools to have a\nfile permission of 0755 or less to prevent unauthorized access by running the\nfollowing command:\n\n $ stat -c \\\"%n %a\\\" /sbin/auditctl /sbin/aureport /sbin/ausearch\n/sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules\n\n /sbin/auditctl 755\n /sbin/aureport 755\n /sbin/ausearch 755\n /sbin/autrace 755\n /sbin/auditd 755\n /sbin/audispd 755\n /sbin/augenrules 755\n\n If any of the audit tools have a mode more permissive than 0755, this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the audit tools on the Ubuntu operating system to be protected\nfrom unauthorized access by setting the correct permissive mode using the\nfollowing command:\n\n $ sudo chmod 0755 [audit_tool]\n\n Replace \\\"[audit_tool]\\\" with the audit tool that does not have the correct\npermissions.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000256-GPOS-00097'\n tag satisfies: ['SRG-OS-000256-GPOS-00097', 'SRG-OS-000257-GPOS-00098']\n tag gid: 'V-238300'\n tag rid: 'SV-238300r654075_rule'\n tag stig_id: 'UBTU-20-010199'\n tag fix_id: 'F-41469r654074_fix'\n tag cci: ['CCI-001493', 'CCI-001494']\n tag legacy: []\n tag nist: ['AU-9', 'AU-9']\n\n audit_tools = input('audit_tools')\n\n audit_tools.each do |tool|\n describe file(tool) do\n it { should_not be_more_permissive_than('0755') }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238300.rb","line":3},"id":"V-238300"},{"title":"The Ubuntu operating system must use strong authenticators in\nestablishing nonlocal maintenance and diagnostic sessions.","desc":"Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network. Local maintenance and\ndiagnostic activities are those activities carried out by individuals\nphysically present at the information system or information system component\nand not communicating across a network connection. Typically, strong\nauthentication requires authenticators that are resistant to replay attacks and\nemploy multifactor authentication. Strong authenticators include, for example,\nPKI where certificates are stored on a token protected by a password,\npassphrase, or biometric.","descriptions":{"default":"Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network. Local maintenance and\ndiagnostic activities are those activities carried out by individuals\nphysically present at the information system or information system component\nand not communicating across a network connection. Typically, strong\nauthentication requires authenticators that are resistant to replay attacks and\nemploy multifactor authentication. Strong authenticators include, for example,\nPKI where certificates are stored on a token protected by a password,\npassphrase, or biometric.","rationale":"","check":"Verify the Ubuntu operating system is configured to use strong\nauthenticators in the establishment of nonlocal maintenance and diagnostic\nmaintenance.\n\n Verify that \"UsePAM\" is set to \"yes\" in \"/etc/ssh/sshd_config:\n\n $ grep ^UsePAM /etc/ssh/sshd_config\n\n UsePAM yes\n\n If \"UsePAM\" is not set to \"yes\", this is a finding.","fix":"Configure the Ubuntu operating system to use strong authentication when\nestablishing nonlocal maintenance and diagnostic sessions.\n\n Add or modify the following line to /etc/ssh/sshd_config:\n\n UsePAM yes"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000125-GPOS-00065","gid":"V-238211","rid":"SV-238211r653808_rule","stig_id":"UBTU-20-010035","fix_id":"F-41380r653807_fix","cci":["CCI-000877"],"legacy":[],"nist":["MA-4 c"]},"code":"control 'V-238211' do\n title \"The Ubuntu operating system must use strong authenticators in\nestablishing nonlocal maintenance and diagnostic sessions.\"\n desc \"Nonlocal maintenance and diagnostic activities are those activities\nconducted by individuals communicating through a network, either an external\nnetwork (e.g., the internet) or an internal network. Local maintenance and\ndiagnostic activities are those activities carried out by individuals\nphysically present at the information system or information system component\nand not communicating across a network connection. Typically, strong\nauthentication requires authenticators that are resistant to replay attacks and\nemploy multifactor authentication. Strong authenticators include, for example,\nPKI where certificates are stored on a token protected by a password,\npassphrase, or biometric.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system is configured to use strong\nauthenticators in the establishment of nonlocal maintenance and diagnostic\nmaintenance.\n\n Verify that \\\"UsePAM\\\" is set to \\\"yes\\\" in \\\"/etc/ssh/sshd_config:\n\n $ grep ^UsePAM /etc/ssh/sshd_config\n\n UsePAM yes\n\n If \\\"UsePAM\\\" is not set to \\\"yes\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to use strong authentication when\nestablishing nonlocal maintenance and diagnostic sessions.\n\n Add or modify the following line to /etc/ssh/sshd_config:\n\n UsePAM yes\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000125-GPOS-00065'\n tag gid: 'V-238211'\n tag rid: 'SV-238211r653808_rule'\n tag stig_id: 'UBTU-20-010035'\n tag fix_id: 'F-41380r653807_fix'\n tag cci: ['CCI-000877']\n tag legacy: []\n tag nist: ['MA-4 c']\n\n describe sshd_config do\n its('UsePAM') { should cmp 'yes' }\n end\nend\n","source_location":{"ref":"./controls/V-238211.rb","line":3},"id":"V-238211"},{"title":"The Ubuntu operating system library files must be group-owned by root.","desc":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","descriptions":{"default":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","rationale":"","check":"Verify the system-wide library files contained in the directories \"/lib\",\n\"/lib64\", and \"/usr/lib\" are group-owned by root with the following\ncommand:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type f -exec stat -c \"%n\n%G\" '{}' \\;\n\n If any system-wide shared library file is returned, this is a finding.","fix":"Configure the system library files to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type f -exec chgrp root\n'{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238351","rid":"SV-238351r654228_rule","stig_id":"UBTU-20-010430","fix_id":"F-41520r654227_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238351' do\n title 'The Ubuntu operating system library files must be group-owned by root.'\n desc \" If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system-wide library files contained in the directories \\\"/lib\\\",\n\\\"/lib64\\\", and \\\"/usr/lib\\\" are group-owned by root with the following\ncommand:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type f -exec stat -c \\\"%n\n%G\\\" '{}' \\\\;\n\n If any system-wide shared library file is returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the system library files to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -group root -type f -exec chgrp root\n'{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238351'\n tag rid: 'SV-238351r654228_rule'\n tag stig_id: 'UBTU-20-010430'\n tag fix_id: 'F-41520r654227_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n if os.arch == \"x86_64\"\n library_files = command('find /lib /usr/lib /usr/lib32 /lib32 /lib64 ! \\-group root \\-type f').stdout.strip.split(\"\\n\").entries\n else\n library_files = command('find /lib /usr/lib /usr/lib32 /lib32 ! \\-group root \\-type f').stdout.strip.split(\"\\n\").entries\n end\n\n if library_files.count > 0\n library_files.each do |lib_file|\n describe file(lib_file) do\n its(\"group\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of system-wide shared library files found that are NOT group-owned by root\" do\n subject { library_files }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238351.rb","line":3},"id":"V-238351"},{"title":"The Ubuntu operating system must generate audit records for the use\nand modification of the lastlog file.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record when\nsuccessful/unsuccessful modifications to the \"lastlog\" file occur.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep lastlog\n\n -w /var/log/lastlog -p wa -k logins\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \"lastlog\" file.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/log/lastlog -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000470-GPOS-00214","SRG-OS-000473-GPOS-00218"],"gid":"V-238287","rid":"SV-238287r654036_rule","stig_id":"UBTU-20-010171","fix_id":"F-41456r654035_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238287' do\n title \"The Ubuntu operating system must generate audit records for the use\nand modification of the lastlog file.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record when\nsuccessful/unsuccessful modifications to the \\\"lastlog\\\" file occur.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep lastlog\n\n -w /var/log/lastlog -p wa -k logins\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \\\"lastlog\\\" file.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/log/lastlog -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000470-GPOS-00214',\n'SRG-OS-000473-GPOS-00218']\n tag gid: 'V-238287'\n tag rid: 'SV-238287r654036_rule'\n tag stig_id: 'UBTU-20-010171'\n tag fix_id: 'F-41456r654035_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/var/log/lastlog'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238287.rb","line":3},"id":"V-238287"},{"title":"Ubuntu operating system must implement cryptographic mechanisms to\nprevent unauthorized modification of all information at rest.","desc":"Operating systems handling data requiring \"data at rest\" protections\nmust employ cryptographic mechanisms to prevent unauthorized disclosure and\nmodification of the information at rest.\n\n Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).","descriptions":{"default":"Operating systems handling data requiring \"data at rest\" protections\nmust employ cryptographic mechanisms to prevent unauthorized disclosure and\nmodification of the information at rest.\n\n Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).","rationale":"","check":"If there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\n Verify the Ubuntu operating system prevents unauthorized disclosure or\nmodification of all information requiring at-rest protection by using disk\nencryption.\n\n Determine the partition layout for the system with the following command:\n\n $ sudo fdisk -l\n (..)\n Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors\n Units: sectors of 1 * 512 = 512 bytes\n Sector size (logical/physical): 512 bytes / 512 bytes\n I/O size (minimum/optimal): 512 bytes / 512 bytes\n Disklabel type: gpt\n Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB\n\n Device Start End Sectors Size Type\n /dev/vda1 2048 4095 2048 1M BIOS boot\n /dev/vda2 4096 2101247 2097152 1G Linux filesystem\n /dev/vda3 2101248 31455231 29353984 14G Linux filesystem\n (...)\n\n Verify that the system partitions are all encrypted with the following\ncommand:\n\n $ more /etc/crypttab\n\n Every persistent disk partition present must have an entry in the file.\n\n If any partitions other than the boot partition or pseudo file systems\n(such as /proc or /sys) are not listed, this is a finding.","fix":"To encrypt an entire partition, dedicate a partition for encryption in the\npartition layout.\n\n Note: Encrypting a partition in an already-installed system is more\ndifficult because it will need to be resized and existing partitions changed."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000404-GPOS-00183","gid":"V-238365","rid":"SV-238365r654270_rule","stig_id":"UBTU-20-010444","fix_id":"F-41534r654269_fix","cci":["CCI-002475"],"legacy":[],"nist":["SC-28 (1)"]},"code":"control 'V-238365' do\n title \"Ubuntu operating system must implement cryptographic mechanisms to\nprevent unauthorized modification of all information at rest.\"\n desc \"Operating systems handling data requiring \\\"data at rest\\\" protections\nmust employ cryptographic mechanisms to prevent unauthorized disclosure and\nmodification of the information at rest.\n\n Selection of a cryptographic mechanism is based on the need to protect the\nintegrity of organizational information. The strength of the mechanism is\ncommensurate with the security category and/or classification of the\ninformation. Organizations have the flexibility to either encrypt all\ninformation on storage devices (i.e., full disk encryption) or encrypt specific\ndata structures (e.g., files, records, or fields).\n \"\n desc 'rationale', ''\n desc 'check', \"\n If there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\n Verify the Ubuntu operating system prevents unauthorized disclosure or\nmodification of all information requiring at-rest protection by using disk\nencryption.\n\n Determine the partition layout for the system with the following command:\n\n $ sudo fdisk -l\n (..)\n Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors\n Units: sectors of 1 * 512 = 512 bytes\n Sector size (logical/physical): 512 bytes / 512 bytes\n I/O size (minimum/optimal): 512 bytes / 512 bytes\n Disklabel type: gpt\n Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB\n\n Device Start End Sectors Size Type\n /dev/vda1 2048 4095 2048 1M BIOS boot\n /dev/vda2 4096 2101247 2097152 1G Linux filesystem\n /dev/vda3 2101248 31455231 29353984 14G Linux filesystem\n (...)\n\n Verify that the system partitions are all encrypted with the following\ncommand:\n\n $ more /etc/crypttab\n\n Every persistent disk partition present must have an entry in the file.\n\n If any partitions other than the boot partition or pseudo file systems\n(such as /proc or /sys) are not listed, this is a finding.\n \"\n desc 'fix', \"\n To encrypt an entire partition, dedicate a partition for encryption in the\npartition layout.\n\n Note: Encrypting a partition in an already-installed system is more\ndifficult because it will need to be resized and existing partitions changed.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000404-GPOS-00183'\n tag gid: 'V-238365'\n tag rid: 'SV-238365r654270_rule'\n tag stig_id: 'UBTU-20-010444'\n tag fix_id: 'F-41534r654269_fix'\n tag cci: ['CCI-002475']\n tag legacy: []\n tag nist: ['SC-28 (1)']\n\n describe 'Not Applicable' do\n skip 'Encryption of data at rest is handled by the IaaS'\n end\nend\n","source_location":{"ref":"./controls/V-238365.rb","line":3},"id":"V-238365"},{"title":"The Ubuntu operating system must enforce a minimum 15-character\npassword length.","desc":"The shorter the password, the lower the number of possible\ncombinations that need to be tested before the password is compromised.\n\n Password complexity, or strength, is a measure of the effectiveness of a\npassword in resisting attempts at guessing and brute-force attacks. Password\nlength is one factor of several that helps to determine strength and how long\nit takes to crack a password. Use of more characters in a password helps to\nexponentially increase the time and/or resources required to compromise the\npassword.","descriptions":{"default":"The shorter the password, the lower the number of possible\ncombinations that need to be tested before the password is compromised.\n\n Password complexity, or strength, is a measure of the effectiveness of a\npassword in resisting attempts at guessing and brute-force attacks. Password\nlength is one factor of several that helps to determine strength and how long\nit takes to crack a password. Use of more characters in a password helps to\nexponentially increase the time and/or resources required to compromise the\npassword.","rationale":"","check":"Verify the pwquality configuration file enforces a minimum 15-character\npassword length by running the following command:\n\n $ grep -i ^minlen /etc/security/pwquality.conf\n minlen=15\n\n If \"minlen\" parameter value is not \"15\" or higher or is commented out,\nthis is a finding.","fix":"Configure the Ubuntu operating system to enforce a minimum 15-character\npassword length.\n\n Add or modify the \"minlen\" parameter value to the\n\"/etc/security/pwquality.conf\" file:\n\n minlen=15"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000078-GPOS-00046","gid":"V-238225","rid":"SV-238225r653850_rule","stig_id":"UBTU-20-010054","fix_id":"F-41394r653849_fix","cci":["CCI-000205"],"legacy":[],"nist":["IA-5 (1) (a)"]},"code":"control 'V-238225' do\n title \"The Ubuntu operating system must enforce a minimum 15-character\npassword length.\"\n desc \"The shorter the password, the lower the number of possible\ncombinations that need to be tested before the password is compromised.\n\n Password complexity, or strength, is a measure of the effectiveness of a\npassword in resisting attempts at guessing and brute-force attacks. Password\nlength is one factor of several that helps to determine strength and how long\nit takes to crack a password. Use of more characters in a password helps to\nexponentially increase the time and/or resources required to compromise the\npassword.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the pwquality configuration file enforces a minimum 15-character\npassword length by running the following command:\n\n $ grep -i ^minlen /etc/security/pwquality.conf\n minlen=15\n\n If \\\"minlen\\\" parameter value is not \\\"15\\\" or higher or is commented out,\nthis is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to enforce a minimum 15-character\npassword length.\n\n Add or modify the \\\"minlen\\\" parameter value to the\n\\\"/etc/security/pwquality.conf\\\" file:\n\n minlen=15\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000078-GPOS-00046'\n tag gid: 'V-238225'\n tag rid: 'SV-238225r653850_rule'\n tag stig_id: 'UBTU-20-010054'\n tag fix_id: 'F-41394r653849_fix'\n tag cci: ['CCI-000205']\n tag legacy: []\n tag nist: ['IA-5 (1) (a)']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('minlen') { should cmp >= 15 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238225.rb","line":3},"id":"V-238225"},{"title":"The Ubuntu operating system must disable kernel core dumps so that it\ncan fail to a secure state if system initialization fails, shutdown fails or\naborts fail.","desc":"Kernel core dumps may contain the full contents of system memory at\nthe time of the crash. Kernel core dumps may consume a considerable amount of\ndisk space and may result in denial of service by exhausting the available\nspace on the target file system partition.","descriptions":{"default":"Kernel core dumps may contain the full contents of system memory at\nthe time of the crash. Kernel core dumps may consume a considerable amount of\ndisk space and may result in denial of service by exhausting the available\nspace on the target file system partition.","rationale":"","check":"Verify that kernel core dumps are disabled unless needed.\n\n Check if \"kdump\" service is active with the following command:\n\n $ systemctl is-active kdump.service\n inactive\n\n If the \"kdump\" service is active, ask the SA if the use of the service is\nrequired and documented with the ISSO.\n\n If the service is active and is not documented, this is a finding.","fix":"If kernel core dumps are not required, disable the \"kdump\" service with\nthe following command:\n\n $ sudo systemctl disable kdump.service\n\n If kernel core dumps are required, document the need with the ISSO."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000184-GPOS-00078","gid":"V-238334","rid":"SV-238334r654177_rule","stig_id":"UBTU-20-010413","fix_id":"F-41503r654176_fix","cci":["CCI-001190"],"legacy":[],"nist":["SC-24"]},"code":"control 'V-238334' do\n title \"The Ubuntu operating system must disable kernel core dumps so that it\ncan fail to a secure state if system initialization fails, shutdown fails or\naborts fail.\"\n desc \"Kernel core dumps may contain the full contents of system memory at\nthe time of the crash. Kernel core dumps may consume a considerable amount of\ndisk space and may result in denial of service by exhausting the available\nspace on the target file system partition.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify that kernel core dumps are disabled unless needed.\n\n Check if \\\"kdump\\\" service is active with the following command:\n\n $ systemctl is-active kdump.service\n inactive\n\n If the \\\"kdump\\\" service is active, ask the SA if the use of the service is\nrequired and documented with the ISSO.\n\n If the service is active and is not documented, this is a finding.\n \"\n desc 'fix', \"\n If kernel core dumps are not required, disable the \\\"kdump\\\" service with\nthe following command:\n\n $ sudo systemctl disable kdump.service\n\n If kernel core dumps are required, document the need with the ISSO.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000184-GPOS-00078'\n tag gid: 'V-238334'\n tag rid: 'SV-238334r654177_rule'\n tag stig_id: 'UBTU-20-010413'\n tag fix_id: 'F-41503r654176_fix'\n tag cci: ['CCI-001190']\n tag legacy: []\n tag nist: ['SC-24']\n\n is_kdump_required = input('is_kdump_required')\n if is_kdump_required\n describe service('kdump') do\n it { should be_enabled }\n it { should be_installed }\n it { should be_running }\n end\n else\n describe service('kdump') do\n it { should_not be_enabled }\n it { should_not be_installed }\n it { should_not be_running }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238334.rb","line":3},"id":"V-238334"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the creat system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \"creat\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep creat\n\n -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any unsuccessful\nuse of the \"creat\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000474-GPOS-00219"],"gid":"V-238274","rid":"SV-238274r653997_rule","stig_id":"UBTU-20-010158","fix_id":"F-41443r653996_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238274' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the creat system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \\\"creat\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep creat\n\n -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any unsuccessful\nuse of the \\\"creat\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000474-GPOS-00219']\n tag gid: 'V-238274'\n tag rid: 'SV-238274r653997_rule'\n tag stig_id: 'UBTU-20-010158'\n tag fix_id: 'F-41443r653996_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('creat').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('creat').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\n end\n describe auditd.syscall('creat').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('creat').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\nend\n","source_location":{"ref":"./controls/V-238274.rb","line":3},"id":"V-238274"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chown system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"chown\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep chown\n\n -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"chown\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238264","rid":"SV-238264r653967_rule","stig_id":"UBTU-20-010148","fix_id":"F-41433r653966_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238264' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the chown system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"chown\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep chown\n\n -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=-1 -k perm_chng\n -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"chown\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238264'\n tag rid: 'SV-238264r653967_rule'\n tag stig_id: 'UBTU-20-010148'\n tag fix_id: 'F-41433r653966_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('chown').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('chown').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238264.rb","line":3},"id":"V-238264"},{"title":"The Ubuntu operating system must monitor remote access methods.","desc":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated monitoring\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Automated monitoring of remote access sessions allows organizations to\ndetect cyber attacks and also ensure ongoing compliance with remote access\npolicies by auditing connection activities of remote access capabilities, such\nas Remote Desktop Protocol (RDP), on a variety of information system components\n(e.g., servers, workstations, notebook computers, smartphones, and tablets).","descriptions":{"default":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated monitoring\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Automated monitoring of remote access sessions allows organizations to\ndetect cyber attacks and also ensure ongoing compliance with remote access\npolicies by auditing connection activities of remote access capabilities, such\nas Remote Desktop Protocol (RDP), on a variety of information system components\n(e.g., servers, workstations, notebook computers, smartphones, and tablets).","rationale":"","check":"Verify that the Ubuntu operating system monitors all remote access methods.\n\n Check that remote access methods are being logged by running the following\ncommand:\n\n $ grep -E -r '^(auth,authpriv\\.\\*|daemon\\.\\*)' /etc/rsyslog.*\n /etc/rsyslog.d/50-default.conf:auth,authpriv.*\n/var/log/auth.log\n /etc/rsyslog.d/50-default.conf:daemon.notice\n/var/log/messages\n\n If \"auth.*\", \"authpriv.*\", or \"daemon.*\" are not configured to be\nlogged in at least one of the config files, this is a finding.","fix":"Configure the Ubuntu operating system to monitor all remote access methods\nby adding the following lines to the \"/etc/rsyslog.d/50-default.conf\" file:\n\n auth.*,authpriv.* /var/log/secure\n daemon.notice /var/log/messages\n\n For the changes to take effect, restart the \"rsyslog\" service with the\nfollowing command:\n\n $ sudo systemctl restart rsyslog.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000032-GPOS-00013","gid":"V-238324","rid":"SV-238324r654147_rule","stig_id":"UBTU-20-010403","fix_id":"F-41493r654146_fix","cci":["CCI-000067"],"legacy":[],"nist":["AC-17 (1)"]},"code":"control 'V-238324' do\n title 'The Ubuntu operating system must monitor remote access methods.'\n desc \"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated monitoring\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Automated monitoring of remote access sessions allows organizations to\ndetect cyber attacks and also ensure ongoing compliance with remote access\npolicies by auditing connection activities of remote access capabilities, such\nas Remote Desktop Protocol (RDP), on a variety of information system components\n(e.g., servers, workstations, notebook computers, smartphones, and tablets).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system monitors all remote access methods.\n\n Check that remote access methods are being logged by running the following\ncommand:\n\n $ grep -E -r '^(auth,authpriv\\\\.\\\\*|daemon\\\\.\\\\*)' /etc/rsyslog.*\n /etc/rsyslog.d/50-default.conf:auth,authpriv.*\n/var/log/auth.log\n /etc/rsyslog.d/50-default.conf:daemon.notice\n/var/log/messages\n\n If \\\"auth.*\\\", \\\"authpriv.*\\\", or \\\"daemon.*\\\" are not configured to be\nlogged in at least one of the config files, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to monitor all remote access methods\nby adding the following lines to the \\\"/etc/rsyslog.d/50-default.conf\\\" file:\n\n auth.*,authpriv.* /var/log/secure\n daemon.notice /var/log/messages\n\n For the changes to take effect, restart the \\\"rsyslog\\\" service with the\nfollowing command:\n\n $ sudo systemctl restart rsyslog.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000032-GPOS-00013'\n tag gid: 'V-238324'\n tag rid: 'SV-238324r654147_rule'\n tag stig_id: 'UBTU-20-010403'\n tag fix_id: 'F-41493r654146_fix'\n tag cci: ['CCI-000067']\n tag legacy: []\n tag nist: ['AC-17 (1)']\n\n options = {\n assignment_regex: /^\\s*([^:]*?)\\s*\\t\\s*(.*?)\\s*$/\n }\n config_file = '/etc/rsyslog.d/50-default.conf'\n auth_setting = parse_config_file(config_file, options).params['auth,authpriv.*']\n daemon_setting = parse_config_file(config_file, options).params['daemon.notice']\n describe auth_setting do\n it { should_not be_nil }\n it { should_not be_empty }\n end\n describe daemon_setting do\n it { should_not be_nil }\n it { should_not be_empty }\n end\nend\n","source_location":{"ref":"./controls/V-238324.rb","line":3},"id":"V-238324"},{"title":"The Ubuntu operating system must automatically lock an account until\nthe locked account is released by an administrator when three unsuccessful\nlogon attempts have been made.","desc":"By limiting the number of failed logon attempts, the risk of\nunauthorized system access via user password guessing, otherwise known as\nbrute-forcing, is reduced. Limits are imposed by locking the account.","descriptions":{"default":"By limiting the number of failed logon attempts, the risk of\nunauthorized system access via user password guessing, otherwise known as\nbrute-forcing, is reduced. Limits are imposed by locking the account.","rationale":"","check":"Verify the Ubuntu operating system locks an account after three\nunsuccessful login attempts with following command:\n\n $ grep pam_tally2 /etc/pam.d/common-auth\n\n auth required pam_tally2.so onerr=fail deny=3\n\n If no line is returned or the line is commented out, this is a finding.\n\n If the line is missing \"onerr=fail\", this is a finding.\n\n If the line has \"deny\" set to a value more than \"3\", this is a finding.","fix":"Configure the Ubuntu operating system to lock an account after three\nunsuccessful login attempts.\n\n Edit the \"/etc/pam.d/common-auth\" file. The \"pam_tally2.so\" entry must\nbe placed at the top of the \"auth\" stack.\n\n Add the following line before the first \"auth\" entry in the file:\n\n auth required pam_tally2.so onerr=fail deny=3"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000329-GPOS-00128","satisfies":["SRG-OS-000329-GPOS-00128","SRG-OS-000021-GPOS-00005"],"gid":"V-238235","rid":"SV-238235r653880_rule","stig_id":"UBTU-20-010072","fix_id":"F-41404r653879_fix","cci":["CCI-000044","CCI-002238"],"legacy":[],"nist":["AC-7 a","AC-7 b"]},"code":"control 'V-238235' do\n title \"The Ubuntu operating system must automatically lock an account until\nthe locked account is released by an administrator when three unsuccessful\nlogon attempts have been made.\"\n desc \"By limiting the number of failed logon attempts, the risk of\nunauthorized system access via user password guessing, otherwise known as\nbrute-forcing, is reduced. Limits are imposed by locking the account.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system locks an account after three\nunsuccessful login attempts with following command:\n\n $ grep pam_tally2 /etc/pam.d/common-auth\n\n auth required pam_tally2.so onerr=fail deny=3\n\n If no line is returned or the line is commented out, this is a finding.\n\n If the line is missing \\\"onerr=fail\\\", this is a finding.\n\n If the line has \\\"deny\\\" set to a value more than \\\"3\\\", this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to lock an account after three\nunsuccessful login attempts.\n\n Edit the \\\"/etc/pam.d/common-auth\\\" file. The \\\"pam_tally2.so\\\" entry must\nbe placed at the top of the \\\"auth\\\" stack.\n\n Add the following line before the first \\\"auth\\\" entry in the file:\n\n auth required pam_tally2.so onerr=fail deny=3\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000329-GPOS-00128'\n tag satisfies: ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']\n tag gid: 'V-238235'\n tag rid: 'SV-238235r653880_rule'\n tag stig_id: 'UBTU-20-010072'\n tag fix_id: 'F-41404r653879_fix'\n tag cci: ['CCI-000044', 'CCI-002238']\n tag legacy: []\n tag nist: ['AC-7 a', 'AC-7 b']\n\n describe file('/etc/pam.d/common-auth') do\n it { should exist }\n end\n\n describe command('grep pam_tally /etc/pam.d/common-auth') do\n its('exit_status') { should eq 0 }\n its('stdout.strip') { should match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3($|\\s+.*$)/ }\n its('stdout.strip') { should_not match /^\\s*auth\\s+required\\s+pam_tally2.so\\s+.*onerr=fail\\s+deny=3\\s+.*unlock_time.*$/ }\n end\nend\n","source_location":{"ref":"./controls/V-238235.rb","line":3},"id":"V-238235"},{"title":"The Ubuntu operating system must disable all wireless network\nadapters.","desc":"Without protection of communications with wireless peripherals,\nconfidentiality and integrity may be compromised because unprotected\ncommunications can be intercepted and either read, altered, or used to\ncompromise the operating system.\n\n This requirement applies to wireless peripheral technologies (e.g.,\nwireless mice, keyboards, displays, etc.) used with an operating system.\nWireless peripherals (e.g., Wi-Fi/Bluetooth/IR Keyboards, Mice, and Pointing\nDevices and Near Field Communications [NFC]) present a unique challenge by\ncreating an open, unsecured port on a computer. Wireless peripherals must meet\nDoD requirements for wireless data transmission and be approved for use by the\nAO. Even though some wireless peripherals, such as mice and pointing devices,\ndo not ordinarily carry information that need to be protected, modification of\ncommunications with these wireless peripherals may be used to compromise the\noperating system. Communication paths outside the physical protection of a\ncontrolled boundary are exposed to the possibility of interception and\nmodification.\n\n Protecting the confidentiality and integrity of communications with\nwireless peripherals can be accomplished by physical means (e.g., employing\nphysical barriers to wireless radio frequencies) or by logical means (e.g.,\nemploying cryptographic techniques). If physical means of protection are\nemployed, then logical means (cryptography) do not have to be employed, and\nvice versa. If the wireless peripheral is only passing telemetry data,\nencryption of the data may not be required.","descriptions":{"default":"Without protection of communications with wireless peripherals,\nconfidentiality and integrity may be compromised because unprotected\ncommunications can be intercepted and either read, altered, or used to\ncompromise the operating system.\n\n This requirement applies to wireless peripheral technologies (e.g.,\nwireless mice, keyboards, displays, etc.) used with an operating system.\nWireless peripherals (e.g., Wi-Fi/Bluetooth/IR Keyboards, Mice, and Pointing\nDevices and Near Field Communications [NFC]) present a unique challenge by\ncreating an open, unsecured port on a computer. Wireless peripherals must meet\nDoD requirements for wireless data transmission and be approved for use by the\nAO. Even though some wireless peripherals, such as mice and pointing devices,\ndo not ordinarily carry information that need to be protected, modification of\ncommunications with these wireless peripherals may be used to compromise the\noperating system. Communication paths outside the physical protection of a\ncontrolled boundary are exposed to the possibility of interception and\nmodification.\n\n Protecting the confidentiality and integrity of communications with\nwireless peripherals can be accomplished by physical means (e.g., employing\nphysical barriers to wireless radio frequencies) or by logical means (e.g.,\nemploying cryptographic techniques). If physical means of protection are\nemployed, then logical means (cryptography) do not have to be employed, and\nvice versa. If the wireless peripheral is only passing telemetry data,\nencryption of the data may not be required.","rationale":"","check":"Note: This requirement is Not Applicable for systems that do not have\nphysical wireless network radios.\n\n Verify that there are no wireless interfaces configured on the system with\nthe following command:\n\n $ ls -L -d /sys/class/net/*/wireless | xargs dirname | xargs basename\n\n If a wireless interface is configured and has not been documented and\napproved by the ISSO, this is a finding.","fix":"List all the wireless interfaces with the following command:\n\n $ ls -L -d /sys/class/net/*/wireless | xargs dirname | xargs basename\n\n For each interface, configure the system to disable wireless network\ninterfaces with the following command:\n\n $ sudo ifdown \n\n For each interface listed, find their respective module with the following\ncommand:\n\n $ basename $(readlink -f /sys/class/net//device/driver)\n\n where must be substituted by the actual interface name.\n\n Create a file in the \"/etc/modprobe.d\" directory and for each module, add\nthe following line:\n\n install /bin/true\n\n For each module from the system, execute the following command to remove\nit:\n\n $ sudo modprobe -r "},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000481-GPOS-000481","gid":"V-238375","rid":"SV-238375r654300_rule","stig_id":"UBTU-20-010455","fix_id":"F-41544r654299_fix","cci":["CCI-002418"],"legacy":[],"nist":["SC-8"]},"code":"control 'V-238375' do\n title \"The Ubuntu operating system must disable all wireless network\nadapters.\"\n desc \"Without protection of communications with wireless peripherals,\nconfidentiality and integrity may be compromised because unprotected\ncommunications can be intercepted and either read, altered, or used to\ncompromise the operating system.\n\n This requirement applies to wireless peripheral technologies (e.g.,\nwireless mice, keyboards, displays, etc.) used with an operating system.\nWireless peripherals (e.g., Wi-Fi/Bluetooth/IR Keyboards, Mice, and Pointing\nDevices and Near Field Communications [NFC]) present a unique challenge by\ncreating an open, unsecured port on a computer. Wireless peripherals must meet\nDoD requirements for wireless data transmission and be approved for use by the\nAO. Even though some wireless peripherals, such as mice and pointing devices,\ndo not ordinarily carry information that need to be protected, modification of\ncommunications with these wireless peripherals may be used to compromise the\noperating system. Communication paths outside the physical protection of a\ncontrolled boundary are exposed to the possibility of interception and\nmodification.\n\n Protecting the confidentiality and integrity of communications with\nwireless peripherals can be accomplished by physical means (e.g., employing\nphysical barriers to wireless radio frequencies) or by logical means (e.g.,\nemploying cryptographic techniques). If physical means of protection are\nemployed, then logical means (cryptography) do not have to be employed, and\nvice versa. If the wireless peripheral is only passing telemetry data,\nencryption of the data may not be required.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Note: This requirement is Not Applicable for systems that do not have\nphysical wireless network radios.\n\n Verify that there are no wireless interfaces configured on the system with\nthe following command:\n\n $ ls -L -d /sys/class/net/*/wireless | xargs dirname | xargs basename\n\n If a wireless interface is configured and has not been documented and\napproved by the ISSO, this is a finding.\n \"\n desc 'fix', \"\n List all the wireless interfaces with the following command:\n\n $ ls -L -d /sys/class/net/*/wireless | xargs dirname | xargs basename\n\n For each interface, configure the system to disable wireless network\ninterfaces with the following command:\n\n $ sudo ifdown \n\n For each interface listed, find their respective module with the following\ncommand:\n\n $ basename $(readlink -f /sys/class/net//device/driver)\n\n where must be substituted by the actual interface name.\n\n Create a file in the \\\"/etc/modprobe.d\\\" directory and for each module, add\nthe following line:\n\n install /bin/true\n\n For each module from the system, execute the following command to remove\nit:\n\n $ sudo modprobe -r \n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000481-GPOS-000481'\n tag gid: 'V-238375'\n tag rid: 'SV-238375r654300_rule'\n tag stig_id: 'UBTU-20-010455'\n tag fix_id: 'F-41544r654299_fix'\n tag cci: ['CCI-002418']\n tag legacy: []\n tag nist: ['SC-8']\n\n allowed_network_interfaces = input('allowed_network_interfaces')\n ifconfig_output = command('ifconfig -s | cut -d \" \" -f 1').stdout.split(\"\\n\")\n system_network_interfaces = ifconfig_output.drop(1)\n\n other_network_interfaces = system_network_interfaces - allowed_network_interfaces\n\n if other_network_interfaces.count > 0\n other_network_interfaces.each do |net_int|\n describe ('Interface: ' + net_int + ' not permitted') do\n subject { net_int }\n it { should be_empty }\n end\n end\n else\n describe 'Number of wireless network interfaces found' do\n subject { other_network_interfaces }\n its('count') { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238375.rb","line":3},"id":"V-238375"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the delete_module syscall.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record for any\nsuccessful/unsuccessful attempts to use the \"delete_module\" syscall.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w delete_module\n\n -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"delete_module\" syscall.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238297","rid":"SV-238297r654066_rule","stig_id":"UBTU-20-010181","fix_id":"F-41466r654065_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238297' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the delete_module syscall.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record for any\nsuccessful/unsuccessful attempts to use the \\\"delete_module\\\" syscall.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w delete_module\n\n -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"delete_module\\\" syscall.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n -a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238297'\n tag rid: 'SV-238297r654066_rule'\n tag stig_id: 'UBTU-20-010181'\n tag fix_id: 'F-41466r654065_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('delete_module').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('delete_module').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238297.rb","line":3},"id":"V-238297"},{"title":"The Ubuntu operating system must configure the /var/log/syslog file to\nbe group-owned by adm.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":{"default":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","rationale":"","check":"Verify that the Ubuntu operating system configures the \"/var/log/syslog\"\nfile to be group-owned by adm with the following command:\n\n $ sudo stat -c \"%n %G\" /var/log/syslog\n /var/log/syslog adm\n\n If the \"/var/log/syslog\" file is not group-owned by adm, this is a\nfinding.","fix":"Configure the Ubuntu operating system to have adm group-own the\n\"/var/log/syslog\" file by running the following command:\n\n $ sudo chgrp adm /var/log/syslog"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-238341","rid":"SV-238341r654198_rule","stig_id":"UBTU-20-010420","fix_id":"F-41510r654197_fix","cci":["CCI-001314"],"legacy":[],"nist":["SI-11 b"]},"code":"control 'V-238341' do\n title \"The Ubuntu operating system must configure the /var/log/syslog file to\nbe group-owned by adm.\"\n desc \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system configures the \\\"/var/log/syslog\\\"\nfile to be group-owned by adm with the following command:\n\n $ sudo stat -c \\\"%n %G\\\" /var/log/syslog\n /var/log/syslog adm\n\n If the \\\"/var/log/syslog\\\" file is not group-owned by adm, this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to have adm group-own the\n\\\"/var/log/syslog\\\" file by running the following command:\n\n $ sudo chgrp adm /var/log/syslog\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000206-GPOS-00084'\n tag gid: 'V-238341'\n tag rid: 'SV-238341r654198_rule'\n tag stig_id: 'UBTU-20-010420'\n tag fix_id: 'F-41510r654197_fix'\n tag cci: ['CCI-001314']\n tag legacy: []\n tag nist: ['SI-11 b']\n\n describe file('/var/log/syslog') do\n its('group') { should cmp 'adm' }\n end\nend\n","source_location":{"ref":"./controls/V-238341.rb","line":3},"id":"V-238341"},{"title":"The Ubuntu operating system must map the authenticated identity to the\nuser or group account for PKI-based authentication.","desc":"Without mapping the certificate used to authenticate to the user\naccount, the ability to determine the identity of the individual user or group\nwill not be available for forensic analysis.","descriptions":{"default":"Without mapping the certificate used to authenticate to the user\naccount, the ability to determine the identity of the individual user or group\nwill not be available for forensic analysis.","rationale":"","check":"Verify that \"use_mappers\" is set to \"pwent\" in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\" file:\n\n $ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf\n use_mappers = pwent\n\n If \"use_mappers\" is not found or the list does not contain \"pwent\" this\nis a finding.","fix":"Set \"use_mappers=pwent\" in \"/etc/pam_pkcs11/pam_pkcs11.conf\" or, if\nthere is already a comma-separated list of mappers, add it to the list,\nseparated by comma, and before the null mapper.\n\n If the system is missing an \"/etc/pam_pkcs11/\" directory and an\n\"/etc/pam_pkcs11/pam_pkcs11.conf\", find an example to copy into place and\nmodify accordingly at\n\"/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz\"."},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000068-GPOS-00036","gid":"V-238201","rid":"SV-238201r653778_rule","stig_id":"UBTU-20-010006","fix_id":"F-41370r653777_fix","cci":["CCI-000187"],"legacy":[],"nist":["IA-5 (2) (c)"]},"code":"control 'V-238201' do\n title \"The Ubuntu operating system must map the authenticated identity to the\nuser or group account for PKI-based authentication.\"\n desc \"Without mapping the certificate used to authenticate to the user\naccount, the ability to determine the identity of the individual user or group\nwill not be available for forensic analysis.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify that \\\"use_mappers\\\" is set to \\\"pwent\\\" in\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" file:\n\n $ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf\n use_mappers = pwent\n\n If \\\"use_mappers\\\" is not found or the list does not contain \\\"pwent\\\" this\nis a finding.\n \"\n desc 'fix', \"\n Set \\\"use_mappers=pwent\\\" in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" or, if\nthere is already a comma-separated list of mappers, add it to the list,\nseparated by comma, and before the null mapper.\n\n If the system is missing an \\\"/etc/pam_pkcs11/\\\" directory and an\n\\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\", find an example to copy into place and\nmodify accordingly at\n\\\"/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz\\\".\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000068-GPOS-00036'\n tag gid: 'V-238201'\n tag rid: 'SV-238201r653778_rule'\n tag stig_id: 'UBTU-20-010006'\n tag fix_id: 'F-41370r653777_fix'\n tag cci: ['CCI-000187']\n tag legacy: []\n tag nist: ['IA-5 (2) (c)']\n\n config_file = '/etc/pam_pkcs11/pam_pkcs11.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('use_mappers') { should cmp 'pwent' }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238201.rb","line":3},"id":"V-238201"},{"title":"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of unlink system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of unlink system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep unlink\n\n -a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of unlink system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b64 -S unlink -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000468-GPOS-00212","gid":"V-238310","rid":"SV-238310r654105_rule","stig_id":"UBTU-20-010267","fix_id":"F-41479r654104_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238310' do\n title \"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of unlink system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of unlink system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep unlink\n\n -a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of unlink system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b64 -S unlink -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000468-GPOS-00212'\n tag gid: 'V-238310'\n tag rid: 'SV-238310r654105_rule'\n tag stig_id: 'UBTU-20-010267'\n tag fix_id: 'F-41479r654104_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"unlink\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"unlink\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238310.rb","line":3},"id":"V-238310"},{"title":"The Ubuntu operating system must permit only authorized accounts to\nown the audit configuration files.","desc":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.","descriptions":{"default":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.","rationale":"","check":"Verify that \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\" and\n\"/etc/audit/auditd.conf\" files are owned by root account by using the\nfollowing command:\n\n $ sudo ls -al /etc/audit/ /etc/audit/rules.d/\n\n /etc/audit/:\n\n drwxr-x--- 3 root root 4096 Nov 25 11:02 .\n\n drwxr-xr-x 130 root root 12288 Dec 19 13:42 ..\n\n -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf\n\n -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules\n\n -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev\n\n -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d\n\n /etc/audit/rules.d/:\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 .\n\n drwxr-x--- 3 root root 4096 Nov 25 11:02 ..\n\n -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules\n\n If the \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\", or\n\"/etc/audit/auditd.conf\" file is owned by a user other than \"root\", this is\na finding.","fix":"Configure \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\" and\n\"/etc/audit/auditd.conf\" files to be owned by root user by using the\nfollowing command:\n\n $ sudo chown root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000063-GPOS-00032","gid":"V-238250","rid":"SV-238250r653925_rule","stig_id":"UBTU-20-010134","fix_id":"F-41419r653924_fix","cci":["CCI-000171"],"legacy":[],"nist":["AU-12 b"]},"code":"control 'V-238250' do\n title \"The Ubuntu operating system must permit only authorized accounts to\nown the audit configuration files.\"\n desc \"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\" and\n\\\"/etc/audit/auditd.conf\\\" files are owned by root account by using the\nfollowing command:\n\n $ sudo ls -al /etc/audit/ /etc/audit/rules.d/\n\n /etc/audit/:\n\n drwxr-x--- 3 root root 4096 Nov 25 11:02 .\n\n drwxr-xr-x 130 root root 12288 Dec 19 13:42 ..\n\n -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf\n\n -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules\n\n -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev\n\n -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d\n\n /etc/audit/rules.d/:\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 .\n\n drwxr-x--- 3 root root 4096 Nov 25 11:02 ..\n\n -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules\n\n If the \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\", or\n\\\"/etc/audit/auditd.conf\\\" file is owned by a user other than \\\"root\\\", this is\na finding.\n \"\n desc 'fix', \"\n Configure \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\" and\n\\\"/etc/audit/auditd.conf\\\" files to be owned by root user by using the\nfollowing command:\n\n $ sudo chown root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000063-GPOS-00032'\n tag gid: 'V-238250'\n tag rid: 'SV-238250r653925_rule'\n tag stig_id: 'UBTU-20-010134'\n tag fix_id: 'F-41419r653924_fix'\n tag cci: ['CCI-000171']\n tag legacy: []\n tag nist: ['AU-12 b']\n\n files1 = command('find /etc/audit/ -type f \\( -iname \\*.rules -o -iname \\*.conf \\)').stdout.strip.split(\"\\n\").entries\n files2 = command('find /etc/audit/rules.d/* -type f').stdout.strip.split(\"\\n\").entries\n\n audit_conf_files = files1 + files2\n\n audit_conf_files.each do |conf|\n describe file(conf) do\n its('owner') { should cmp 'root' }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238250.rb","line":3},"id":"V-238250"},{"title":"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/gshadow.","desc":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","descriptions":{"default":"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.","rationale":"","check":"Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\"/etc/gshadow\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep gshadow\n\n -w /etc/gshadow -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\"/etc/gshadow\".\n\n Add or update the following rule to \"/etc/audit/rules.d/stig.rules\":\n\n -w /etc/gshadow -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","satisfies":["SRG-OS-000004-GPOS-00004","SRG-OS-000239-GPOS-00089","SRG-OS-000240-GPOS-00090","SRG-OS-000241-GPOS-00091","SRG-OS-000303-GPOS-00120","SRG-OS-000458-GPOS-00203","SRG-OS-000476-GPOS-00221"],"gid":"V-238241","rid":"SV-238241r653898_rule","stig_id":"UBTU-20-010103","fix_id":"F-41410r653897_fix","cci":["CCI-000172","CCI-001403","CCI-001404","CCI-001405","CCI-002130"],"legacy":[],"nist":["AU-12 c","AC-2 (4)","AC-2 (4)","AC-2 (4)","AC-2 (4)"]},"code":"control 'V-238241' do\n title \"The Ubuntu operating system must generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n/etc/gshadow.\"\n desc \"Once an attacker establishes access to a system, the attacker often\nattempts to create a persistent method of reestablishing access. One way to\naccomplish this is for the attacker to create an account. Auditing account\ncreation actions provides logging that can be used for forensic purposes.\n\n To address access requirements, many operating systems may be integrated\nwith enterprise level authentication/access/auditing mechanisms that meet or\nexceed access control policy requirements.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for all account\ncreations, modifications, disabling, and termination events that affect\n\\\"/etc/gshadow\\\".\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep gshadow\n\n -w /etc/gshadow -p wa -k usergroup_modification\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to generate audit records for all\naccount creations, modifications, disabling, and termination events that affect\n\\\"/etc/gshadow\\\".\n\n Add or update the following rule to \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -w /etc/gshadow -p wa -k usergroup_modification\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000004-GPOS-00004'\n tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089',\n'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091',\n'SRG-OS-000303-GPOS-00120', 'SRG-OS-000458-GPOS-00203',\n'SRG-OS-000476-GPOS-00221']\n tag gid: 'V-238241'\n tag rid: 'SV-238241r653898_rule'\n tag stig_id: 'UBTU-20-010103'\n tag fix_id: 'F-41410r653897_fix'\n tag cci: ['CCI-000172', 'CCI-001403', 'CCI-001404', 'CCI-001405',\n'CCI-002130']\n tag legacy: []\n tag nist: ['AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AC-2 (4)', 'AC-2 (4)']\n\n @audit_file = '/etc/gshadow'\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238241.rb","line":3},"id":"V-238241"},{"title":"The Ubuntu operating system must configure audit tools to be owned by\nroot.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":{"default":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","rationale":"","check":"Verify the Ubuntu operating system configures the audit tools to be owned\nby root to prevent any unauthorized access.\n\n Check the ownership by running the following command:\n\n $ stat -c \"%n %U\" /sbin/auditctl /sbin/aureport /sbin/ausearch\n/sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules\n\n /sbin/auditctl root\n /sbin/aureport root\n /sbin/ausearch root\n /sbin/autrace root\n /sbin/auditd root\n /sbin/audispd root\n /sbin/augenrules root\n\n If any of the audit tools are not owned by root, this is a finding.","fix":"Configure the audit tools on the Ubuntu operating system to be protected\nfrom unauthorized access by setting the file owner as root using the following\ncommand:\n\n $ sudo chown root [audit_tool]\n\n Replace \"[audit_tool]\" with each audit tool not owned by root."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000256-GPOS-00097","satisfies":["SRG-OS-000256-GPOS-00097","SRG-OS-000257-GPOS-00098"],"gid":"V-238301","rid":"SV-238301r654078_rule","stig_id":"UBTU-20-010200","fix_id":"F-41470r654077_fix","cci":["CCI-001493","CCI-001494"],"legacy":[],"nist":["AU-9","AU-9"]},"code":"control 'V-238301' do\n title \"The Ubuntu operating system must configure audit tools to be owned by\nroot.\"\n desc \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user enjoys in order to make access decisions\nregarding the access to audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system configures the audit tools to be owned\nby root to prevent any unauthorized access.\n\n Check the ownership by running the following command:\n\n $ stat -c \\\"%n %U\\\" /sbin/auditctl /sbin/aureport /sbin/ausearch\n/sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules\n\n /sbin/auditctl root\n /sbin/aureport root\n /sbin/ausearch root\n /sbin/autrace root\n /sbin/auditd root\n /sbin/audispd root\n /sbin/augenrules root\n\n If any of the audit tools are not owned by root, this is a finding.\n \"\n desc 'fix', \"\n Configure the audit tools on the Ubuntu operating system to be protected\nfrom unauthorized access by setting the file owner as root using the following\ncommand:\n\n $ sudo chown root [audit_tool]\n\n Replace \\\"[audit_tool]\\\" with each audit tool not owned by root.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000256-GPOS-00097'\n tag satisfies: ['SRG-OS-000256-GPOS-00097', 'SRG-OS-000257-GPOS-00098']\n tag gid: 'V-238301'\n tag rid: 'SV-238301r654078_rule'\n tag stig_id: 'UBTU-20-010200'\n tag fix_id: 'F-41470r654077_fix'\n tag cci: ['CCI-001493', 'CCI-001494']\n tag legacy: []\n tag nist: ['AU-9', 'AU-9']\n\n audit_tools = input('audit_tools')\n\n audit_tools.each do |tool|\n describe file(tool) do\n its('owner') { should cmp 'root' }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238301.rb","line":3},"id":"V-238301"},{"title":"The Ubuntu operating system must implement smart card logins for\nmultifactor authentication for local and network access to privileged and\nnon-privileged accounts.","desc":"Without the use of multifactor authentication, the ease of access to\nprivileged functions is greatly increased.\n\n Multifactor authentication requires using two or more factors to achieve\nauthentication.\n\n Factors include:\n 1) something a user knows (e.g., password/PIN);\n 2) something a user has (e.g., cryptographic identification device, token);\nand\n 3) something a user is (e.g., biometric).\n\n A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n Network access is defined as access to an information system by a user (or\na process acting on behalf of a user) communicating through a network (e.g.,\nlocal area network, wide area network, or the internet).\n\n The DoD CAC with DoD-approved PKI is an example of multifactor\nauthentication.","descriptions":{"default":"Without the use of multifactor authentication, the ease of access to\nprivileged functions is greatly increased.\n\n Multifactor authentication requires using two or more factors to achieve\nauthentication.\n\n Factors include:\n 1) something a user knows (e.g., password/PIN);\n 2) something a user has (e.g., cryptographic identification device, token);\nand\n 3) something a user is (e.g., biometric).\n\n A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n Network access is defined as access to an information system by a user (or\na process acting on behalf of a user) communicating through a network (e.g.,\nlocal area network, wide area network, or the internet).\n\n The DoD CAC with DoD-approved PKI is an example of multifactor\nauthentication.","rationale":"","check":"Verify the Ubuntu operating system has the packages required for\nmultifactor authentication installed with the following commands:\n\n $ dpkg -l | grep libpam-pkcs11\n\n ii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for\nusing PKCS#11 smart cards\n\n If the \"libpam-pkcs11\" package is not installed, this is a finding.\n\n Verify the sshd daemon allows public key authentication with the following,\n\n $ grep ^Pubkeyauthentication /etc/ssh/sshd_config\n\n PubkeyAuthentication yes\n\n If this option is set to \"no\" or is missing, this is a finding.","fix":"Configure the Ubuntu operating system to use multifactor authentication for\nnetwork access to accounts.\n\n Add or update \"pam_pkcs11.so\" in \"/etc/pam.d/common-auth\" to match the\nfollowing line:\n\n auth [success=2 default=ignore] pam_pkcs11.so\n\n Set the sshd option \"PubkeyAuthentication yes\" in the\n\"/etc/ssh/sshd_config\" file."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000105-GPOS-00052","satisfies":["SRG-OS-000105-GPOS-00052","SRG-OS-000106-GPOS-00053","SRG-OS-000107-GPOS-00054","SRG-OS-000108-GPOS-00055"],"gid":"V-238210","rid":"SV-238210r653805_rule","stig_id":"UBTU-20-010033","fix_id":"F-41379r653804_fix","cci":["CCI-000765","CCI-000766","CCI-000767","CCI-000768"],"legacy":[],"nist":["IA-2 (1)","IA-2 (2)","IA-2 (3)","IA-2 (4)"]},"code":"control 'V-238210' do\n title \"The Ubuntu operating system must implement smart card logins for\nmultifactor authentication for local and network access to privileged and\nnon-privileged accounts.\"\n desc \"Without the use of multifactor authentication, the ease of access to\nprivileged functions is greatly increased.\n\n Multifactor authentication requires using two or more factors to achieve\nauthentication.\n\n Factors include:\n 1) something a user knows (e.g., password/PIN);\n 2) something a user has (e.g., cryptographic identification device, token);\nand\n 3) something a user is (e.g., biometric).\n\n A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n Network access is defined as access to an information system by a user (or\na process acting on behalf of a user) communicating through a network (e.g.,\nlocal area network, wide area network, or the internet).\n\n The DoD CAC with DoD-approved PKI is an example of multifactor\nauthentication.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system has the packages required for\nmultifactor authentication installed with the following commands:\n\n $ dpkg -l | grep libpam-pkcs11\n\n ii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for\nusing PKCS#11 smart cards\n\n If the \\\"libpam-pkcs11\\\" package is not installed, this is a finding.\n\n Verify the sshd daemon allows public key authentication with the following,\n\n $ grep ^Pubkeyauthentication /etc/ssh/sshd_config\n\n PubkeyAuthentication yes\n\n If this option is set to \\\"no\\\" or is missing, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to use multifactor authentication for\nnetwork access to accounts.\n\n Add or update \\\"pam_pkcs11.so\\\" in \\\"/etc/pam.d/common-auth\\\" to match the\nfollowing line:\n\n auth [success=2 default=ignore] pam_pkcs11.so\n\n Set the sshd option \\\"PubkeyAuthentication yes\\\" in the\n\\\"/etc/ssh/sshd_config\\\" file.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000105-GPOS-00052'\n tag satisfies: ['SRG-OS-000105-GPOS-00052', 'SRG-OS-000106-GPOS-00053',\n'SRG-OS-000107-GPOS-00054', 'SRG-OS-000108-GPOS-00055']\n tag gid: 'V-238210'\n tag rid: 'SV-238210r653805_rule'\n tag stig_id: 'UBTU-20-010033'\n tag fix_id: 'F-41379r653804_fix'\n tag cci: ['CCI-000765', 'CCI-000766', 'CCI-000767', 'CCI-000768']\n tag legacy: []\n tag nist: ['IA-2 (1)', 'IA-2 (2)', 'IA-2 (3)', 'IA-2 (4)']\n\n describe package('libpam-pkcs11') do\n it { should be_installed }\n end\n\n describe sshd_config do\n its('PubkeyAuthentication') { should cmp 'yes' }\n end\nend\n","source_location":{"ref":"./controls/V-238210.rb","line":3},"id":"V-238210"},{"title":"The Ubuntu operating system library directories must be owned by root.","desc":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","descriptions":{"default":"If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.","rationale":"","check":"Verify the system-wide shared library directories \"/lib\", \"/lib64\", and\n\"/usr/lib\" are owned by root with the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec stat -c \"%n\n%U\" '{}' \\;\n\n If any system-wide library directory is returned, this is a finding.","fix":"Configure the library files and their respective parent directories to be\nprotected from unauthorized access. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec chown root '{}'\n\\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000259-GPOS-00100","gid":"V-238350","rid":"SV-238350r654225_rule","stig_id":"UBTU-20-010429","fix_id":"F-41519r654224_fix","cci":["CCI-001499"],"legacy":[],"nist":["CM-5 (6)"]},"code":"control 'V-238350' do\n title 'The Ubuntu operating system library directories must be owned by root.'\n desc \" If the operating system were to allow any user to make changes to\nsoftware libraries, then those changes might be implemented without undergoing\nthe appropriate testing and approvals that are part of a robust change\nmanagement process.\n\n This requirement applies to operating systems with software libraries that\nare accessible and configurable, as in the case of interpreted languages.\nSoftware libraries also include privileged programs which execute with\nescalated privileges. Only qualified and authorized individuals must be allowed\nto obtain access to information system components for purposes of initiating\nchanges, including upgrades and modifications.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system-wide shared library directories \\\"/lib\\\", \\\"/lib64\\\", and\n\\\"/usr/lib\\\" are owned by root with the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec stat -c \\\"%n\n%U\\\" '{}' \\\\;\n\n If any system-wide library directory is returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the library files and their respective parent directories to be\nprotected from unauthorized access. Run the following command:\n\n $ sudo find /lib /usr/lib /lib64 ! -user root -type d -exec chown root '{}'\n\\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000259-GPOS-00100'\n tag gid: 'V-238350'\n tag rid: 'SV-238350r654225_rule'\n tag stig_id: 'UBTU-20-010429'\n tag fix_id: 'F-41519r654224_fix'\n tag cci: ['CCI-001499']\n tag legacy: []\n tag nist: ['CM-5 (6)']\n\n if os.arch == \"x86_64\"\n library_dirs = command('find /lib /usr/lib /usr/lib32 /lib32 /lib64 ! \\-user root \\-type d').stdout.strip.split(\"\\n\").entries\n else\n library_dirs = command('find /lib /usr/lib /usr/lib32 /lib32 ! \\-user root \\-type d').stdout.strip.split(\"\\n\").entries\n end\n\n if library_dirs.count > 0\n library_dirs.each do |lib_file|\n describe file(lib_file) do\n its(\"owner\") { should cmp \"root\" }\n end\n end\n else\n describe \"Number of system-wide shared library directories found that are NOT owned by root\" do\n subject { library_dirs }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238350.rb","line":3},"id":"V-238350"},{"title":"The Ubuntu operating system must generate audit records for the use\nand modification of faillog file.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful modifications to the \"faillog\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep faillog\n\n -w /var/log/faillog -p wa -k logins\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \"faillog\" file.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/log/faillog -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000470-GPOS-00214","SRG-OS-000473-GPOS-00218"],"gid":"V-238286","rid":"SV-238286r654033_rule","stig_id":"UBTU-20-010170","fix_id":"F-41455r654032_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238286' do\n title \"The Ubuntu operating system must generate audit records for the use\nand modification of faillog file.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful modifications to the \\\"faillog\\\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep faillog\n\n -w /var/log/faillog -p wa -k logins\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful modifications to the \\\"faillog\\\" file.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/log/faillog -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000470-GPOS-00214',\n'SRG-OS-000473-GPOS-00218']\n tag gid: 'V-238286'\n tag rid: 'SV-238286r654033_rule'\n tag stig_id: 'UBTU-20-010170'\n tag fix_id: 'F-41455r654032_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/var/log/faillog'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'w' }\n it { should include 'a' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238286.rb","line":3},"id":"V-238286"},{"title":"The Ubuntu operating system must only allow the use of DoD\nPKI-established certificate authorities for verification of the establishment\nof protected sessions.","desc":"Untrusted Certificate Authorities (CA) can issue certificates, but\nthey may be issued by organizations or individuals that seek to compromise DoD\nsystems or by organizations with insufficient security controls. If the CA used\nfor verifying the certificate is not a DoD-approved CA, trust of this CA has\nnot been established.\n\n The DoD will only accept PKI-certificates obtained from a DoD-approved\ninternal or external certificate authority. Reliance on CAs for the\nestablishment of secure sessions includes, for example, the use of SSL/TLS\ncertificates.","descriptions":{"default":"Untrusted Certificate Authorities (CA) can issue certificates, but\nthey may be issued by organizations or individuals that seek to compromise DoD\nsystems or by organizations with insufficient security controls. If the CA used\nfor verifying the certificate is not a DoD-approved CA, trust of this CA has\nnot been established.\n\n The DoD will only accept PKI-certificates obtained from a DoD-approved\ninternal or external certificate authority. Reliance on CAs for the\nestablishment of secure sessions includes, for example, the use of SSL/TLS\ncertificates.","rationale":"","check":"Verify the directory containing the root certificates for the Ubuntu\noperating system (/etc/ssl/certs) only contains certificate files for DoD\nPKI-established certificate authorities.\n\n Determine if \"/etc/ssl/certs\" only contains certificate files whose\nsha256 fingerprint match the fingerprint of DoD PKI-established certificate\nauthorities with the following command:\n\n $ for f in $(ls /etc/ssl/certs); do openssl x509 -sha256 -in $f -noout\n-fingerprint | cut -d= -f2 | tr -d ':' | egrep -vw\n'(9676F287356C89A12683D65234098CB77C4F1C18F23C0E541DE0E196725B7EBE|B107B33F453E5510F68E513110C6F6944BACC263DF0137F821C1B3C2F8F863D2|559A5189452B13F8233F0022363C06F26E3C517C1D4B77445035959DF3244F74|1F4EDE9DC2A241F6521BF518424ACD49EBE84420E69DAF5BAC57AF1F8EE294A9)';\ndone\n\n If any entry is found, this is a finding.","fix":"Configure the Ubuntu operating system to only allow the use of DoD\nPKI-established certificate authorities for verification of the establishment\nof protected sessions.\n\n Edit the \"/etc/ca-certificates.conf\" file, adding the character \"!\" to\nthe beginning of all uncommented lines that do not start with the \"!\"\ncharacter with the following command:\n\n $ sudo sed -iE 's/^([^!#]+)/!\\1/' /etc/ca-certificates.conf\n\n Add at least one DoD certificate authority to the\n\"/usr/local/share/ca-certificates\" directory in the PEM format.\n\n Update the \"/etc/ssl/certs\" directory with the following command:\n\n $ sudo update-ca-certificates"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000403-GPOS-00182","gid":"V-238364","rid":"SV-238364r654267_rule","stig_id":"UBTU-20-010443","fix_id":"F-41533r654266_fix","cci":["CCI-002470"],"legacy":[],"nist":["SC-23 (5)"]},"code":"control 'V-238364' do\n title \"The Ubuntu operating system must only allow the use of DoD\nPKI-established certificate authorities for verification of the establishment\nof protected sessions.\"\n desc \"Untrusted Certificate Authorities (CA) can issue certificates, but\nthey may be issued by organizations or individuals that seek to compromise DoD\nsystems or by organizations with insufficient security controls. If the CA used\nfor verifying the certificate is not a DoD-approved CA, trust of this CA has\nnot been established.\n\n The DoD will only accept PKI-certificates obtained from a DoD-approved\ninternal or external certificate authority. Reliance on CAs for the\nestablishment of secure sessions includes, for example, the use of SSL/TLS\ncertificates.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the directory containing the root certificates for the Ubuntu\noperating system (/etc/ssl/certs) only contains certificate files for DoD\nPKI-established certificate authorities.\n\n Determine if \\\"/etc/ssl/certs\\\" only contains certificate files whose\nsha256 fingerprint match the fingerprint of DoD PKI-established certificate\nauthorities with the following command:\n\n $ for f in $(ls /etc/ssl/certs); do openssl x509 -sha256 -in $f -noout\n-fingerprint | cut -d= -f2 | tr -d ':' | egrep -vw\n'(9676F287356C89A12683D65234098CB77C4F1C18F23C0E541DE0E196725B7EBE|B107B33F453E5510F68E513110C6F6944BACC263DF0137F821C1B3C2F8F863D2|559A5189452B13F8233F0022363C06F26E3C517C1D4B77445035959DF3244F74|1F4EDE9DC2A241F6521BF518424ACD49EBE84420E69DAF5BAC57AF1F8EE294A9)';\ndone\n\n If any entry is found, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to only allow the use of DoD\nPKI-established certificate authorities for verification of the establishment\nof protected sessions.\n\n Edit the \\\"/etc/ca-certificates.conf\\\" file, adding the character \\\"!\\\" to\nthe beginning of all uncommented lines that do not start with the \\\"!\\\"\ncharacter with the following command:\n\n $ sudo sed -iE 's/^([^!#]+)/!\\\\1/' /etc/ca-certificates.conf\n\n Add at least one DoD certificate authority to the\n\\\"/usr/local/share/ca-certificates\\\" directory in the PEM format.\n\n Update the \\\"/etc/ssl/certs\\\" directory with the following command:\n\n $ sudo update-ca-certificates\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000403-GPOS-00182'\n tag gid: 'V-238364'\n tag rid: 'SV-238364r654267_rule'\n tag stig_id: 'UBTU-20-010443'\n tag fix_id: 'F-41533r654266_fix'\n tag cci: ['CCI-002470']\n tag legacy: []\n tag nist: ['SC-23 (5)']\n\n allowed_ca_fingerprints_regex = input('allowed_ca_fingerprints_regex')\n find_command = \"\"\"\n for f in $(find -L /etc/ssl/certs -type f); do \n openssl x509 -sha256 -in $f -noout -fingerprint | cut -d= -f2 | tr -d ':' | egrep -vw '#{allowed_ca_fingerprints_regex}'\n done\n \"\"\"\n describe command(find_command) do\n its(\"stdout\") { should cmp \"\" }\n end\nend\n","source_location":{"ref":"./controls/V-238364.rb","line":3},"id":"V-238364"},{"title":"The Ubuntu operating system must require the change of at least 8\ncharacters when passwords are changed.","desc":"If the operating system allows the user to consecutively reuse\nextensive portions of passwords, this increases the chances of password\ncompromise by increasing the window of opportunity for attempts at guessing and\nbrute-force attacks.\n\n The number of changed characters refers to the number of changes required\nwith respect to the total number of positions in the current password. In other\nwords, characters may be the same within the two passwords; however, the\npositions of the like characters must be different.\n\n If the password length is an odd number then number of changed characters\nmust be rounded up. For example, a password length of 15 characters must\nrequire the change of at least 8 characters.","descriptions":{"default":"If the operating system allows the user to consecutively reuse\nextensive portions of passwords, this increases the chances of password\ncompromise by increasing the window of opportunity for attempts at guessing and\nbrute-force attacks.\n\n The number of changed characters refers to the number of changes required\nwith respect to the total number of positions in the current password. In other\nwords, characters may be the same within the two passwords; however, the\npositions of the like characters must be different.\n\n If the password length is an odd number then number of changed characters\nmust be rounded up. For example, a password length of 15 characters must\nrequire the change of at least 8 characters.","rationale":"","check":"Verify the Ubuntu operating system requires the change of at least eight\ncharacters when passwords are changed.\n\n Determine if the field \"difok\" is set in the\n\"/etc/security/pwquality.conf\" file with the following command:\n\n $ grep -i \"difok\" /etc/security/pwquality.conf\n difok=8\n\n If the \"difok\" parameter is less than \"8\" or is commented out, this is\na finding.","fix":"Configure the Ubuntu operating system to require the change of at least\neight characters when passwords are changed.\n\n Add or update the \"/etc/security/pwquality.conf\" file to include the\n\"difok=8\" parameter:\n\n difok=8"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000072-GPOS-00040","gid":"V-238224","rid":"SV-238224r653847_rule","stig_id":"UBTU-20-010053","fix_id":"F-41393r653846_fix","cci":["CCI-000195"],"legacy":[],"nist":["IA-5 (1) (b)"]},"code":"control 'V-238224' do\n title \"The Ubuntu operating system must require the change of at least 8\ncharacters when passwords are changed.\"\n desc \" If the operating system allows the user to consecutively reuse\nextensive portions of passwords, this increases the chances of password\ncompromise by increasing the window of opportunity for attempts at guessing and\nbrute-force attacks.\n\n The number of changed characters refers to the number of changes required\nwith respect to the total number of positions in the current password. In other\nwords, characters may be the same within the two passwords; however, the\npositions of the like characters must be different.\n\n If the password length is an odd number then number of changed characters\nmust be rounded up. For example, a password length of 15 characters must\nrequire the change of at least 8 characters.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system requires the change of at least eight\ncharacters when passwords are changed.\n\n Determine if the field \\\"difok\\\" is set in the\n\\\"/etc/security/pwquality.conf\\\" file with the following command:\n\n $ grep -i \\\"difok\\\" /etc/security/pwquality.conf\n difok=8\n\n If the \\\"difok\\\" parameter is less than \\\"8\\\" or is commented out, this is\na finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to require the change of at least\neight characters when passwords are changed.\n\n Add or update the \\\"/etc/security/pwquality.conf\\\" file to include the\n\\\"difok=8\\\" parameter:\n\n difok=8\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000072-GPOS-00040'\n tag gid: 'V-238224'\n tag rid: 'SV-238224r653847_rule'\n tag stig_id: 'UBTU-20-010053'\n tag fix_id: 'F-41393r653846_fix'\n tag cci: ['CCI-000195']\n tag legacy: []\n tag nist: ['IA-5 (1) (b)']\n\n config_file = '/etc/security/pwquality.conf'\n config_file_exists = file(config_file).exist?\n\n if config_file_exists\n describe parse_config_file(config_file) do\n its('difok') { should cmp >= 8 }\n end\n else\n describe (config_file + ' exists') do\n subject { config_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238224.rb","line":3},"id":"V-238224"},{"title":"Ubuntu operating systems handling data requiring \"data at rest\"\nprotections must employ cryptographic mechanisms to prevent unauthorized\ndisclosure and modification of the information at rest.","desc":"Information at rest refers to the state of information when it is\nlocated on a secondary storage device (e.g., disk drive and tape drive, when\nused for backups) within an operating system.\n\n This requirement addresses protection of user-generated data, as well as\noperating system-specific configuration data. Organizations may choose to\nemploy different mechanisms to achieve confidentiality and integrity\nprotections, as appropriate, in accordance with the security category and/or\nclassification of the information.","descriptions":{"default":"Information at rest refers to the state of information when it is\nlocated on a secondary storage device (e.g., disk drive and tape drive, when\nused for backups) within an operating system.\n\n This requirement addresses protection of user-generated data, as well as\noperating system-specific configuration data. Organizations may choose to\nemploy different mechanisms to achieve confidentiality and integrity\nprotections, as appropriate, in accordance with the security category and/or\nclassification of the information.","rationale":"","check":"If there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\n Verify the Ubuntu operating system prevents unauthorized disclosure or\nmodification of all information requiring at-rest protection by using disk\nencryption.\n\n Determine the partition layout for the system with the following command:\n\n #sudo fdisk -l\n (..)\n Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors\n Units: sectors of 1 * 512 = 512 bytes\n Sector size (logical/physical): 512 bytes / 512 bytes\n I/O size (minimum/optimal): 512 bytes / 512 bytes\n Disklabel type: gpt\n Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB\n\n Device Start End Sectors Size Type\n /dev/vda1 2048 4095 2048 1M BIOS boot\n /dev/vda2 4096 2101247 2097152 1G Linux filesystem\n /dev/vda3 2101248 31455231 29353984 14G Linux filesystem\n (...)\n\n Verify the system partitions are all encrypted with the following command:\n\n # more /etc/crypttab\n\n Every persistent disk partition present must have an entry in the file.\n\n If any partitions other than the boot partition or pseudo file systems\n(such as /proc or /sys) are not listed, this is a finding.","fix":"To encrypt an entire partition, dedicate a partition for encryption in the\npartition layout.\n\n Note: Encrypting a partition in an already-installed system is more\ndifficult because it will need to be resized and existing partitions changed."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000185-GPOS-00079","gid":"V-238335","rid":"SV-238335r654180_rule","stig_id":"UBTU-20-010414","fix_id":"F-41504r654179_fix","cci":["CCI-001199"],"legacy":[],"nist":["SC-28"]},"code":"control 'V-238335' do\n title \"Ubuntu operating systems handling data requiring \\\"data at rest\\\"\nprotections must employ cryptographic mechanisms to prevent unauthorized\ndisclosure and modification of the information at rest.\"\n desc \"Information at rest refers to the state of information when it is\nlocated on a secondary storage device (e.g., disk drive and tape drive, when\nused for backups) within an operating system.\n\n This requirement addresses protection of user-generated data, as well as\noperating system-specific configuration data. Organizations may choose to\nemploy different mechanisms to achieve confidentiality and integrity\nprotections, as appropriate, in accordance with the security category and/or\nclassification of the information.\n \"\n desc 'rationale', ''\n desc 'check', \"\n If there is a documented and approved reason for not having data-at-rest\nencryption, this requirement is Not Applicable.\n\n Verify the Ubuntu operating system prevents unauthorized disclosure or\nmodification of all information requiring at-rest protection by using disk\nencryption.\n\n Determine the partition layout for the system with the following command:\n\n #sudo fdisk -l\n (..)\n Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors\n Units: sectors of 1 * 512 = 512 bytes\n Sector size (logical/physical): 512 bytes / 512 bytes\n I/O size (minimum/optimal): 512 bytes / 512 bytes\n Disklabel type: gpt\n Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB\n\n Device Start End Sectors Size Type\n /dev/vda1 2048 4095 2048 1M BIOS boot\n /dev/vda2 4096 2101247 2097152 1G Linux filesystem\n /dev/vda3 2101248 31455231 29353984 14G Linux filesystem\n (...)\n\n Verify the system partitions are all encrypted with the following command:\n\n # more /etc/crypttab\n\n Every persistent disk partition present must have an entry in the file.\n\n If any partitions other than the boot partition or pseudo file systems\n(such as /proc or /sys) are not listed, this is a finding.\n \"\n desc 'fix', \"\n To encrypt an entire partition, dedicate a partition for encryption in the\npartition layout.\n\n Note: Encrypting a partition in an already-installed system is more\ndifficult because it will need to be resized and existing partitions changed.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000185-GPOS-00079'\n tag gid: 'V-238335'\n tag rid: 'SV-238335r654180_rule'\n tag stig_id: 'UBTU-20-010414'\n tag fix_id: 'F-41504r654179_fix'\n tag cci: ['CCI-001199']\n tag legacy: []\n tag nist: ['SC-28']\n\n describe 'Not Applicable' do\n skip 'Encryption of data at rest is handled by the IaaS'\n end\nend\n","source_location":{"ref":"./controls/V-238335.rb","line":3},"id":"V-238335"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the openat system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \"openat\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep openat\n\n -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any unsuccessful\nuse of the \"openat\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000474-GPOS-00219"],"gid":"V-238275","rid":"SV-238275r654000_rule","stig_id":"UBTU-20-010159","fix_id":"F-41444r653999_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238275' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the openat system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \\\"openat\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep openat\n\n -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any unsuccessful\nuse of the \\\"openat\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000474-GPOS-00219']\n tag gid: 'V-238275'\n tag rid: 'SV-238275r654000_rule'\n tag stig_id: 'UBTU-20-010159'\n tag fix_id: 'F-41444r653999_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('openat').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('openat').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\n end\n describe auditd.syscall('openat').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('openat').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\nend\n","source_location":{"ref":"./controls/V-238275.rb","line":3},"id":"V-238275"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchown system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"fchown\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep fchown\n\n -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"fchown\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\":\n\n -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206"],"gid":"V-238265","rid":"SV-238265r653970_rule","stig_id":"UBTU-20-010149","fix_id":"F-41434r653969_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238265' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the fchown system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"fchown\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep fchown\n\n -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"fchown\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\":\n\n -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k\nperm_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206']\n tag gid: 'V-238265'\n tag rid: 'SV-238265r653970_rule'\n tag stig_id: 'UBTU-20-010149'\n tag fix_id: 'F-41434r653969_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('fchown').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('fchown').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238265.rb","line":3},"id":"V-238265"},{"title":"The Ubuntu operating system must encrypt all stored passwords with a\nFIPS 140-2 approved cryptographic hashing algorithm.","desc":"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.","descriptions":{"default":"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.","rationale":"","check":"Verify that the shadow password suite configuration is set to encrypt\npasswords with a FIPS 140-2 approved cryptographic hashing algorithm.\n\n Check the hashing algorithm that is being used to hash passwords with the\nfollowing command:\n\n $ cat /etc/login.defs | grep -i encrypt_method\n\n ENCRYPT_METHOD SHA512\n\n If \"ENCRYPT_METHOD\" does not equal SHA512 or greater, this is a finding.","fix":"Configure the Ubuntu operating system to encrypt all stored passwords.\n\n Edit/modify the following line in the \"/etc/login.defs\" file and set\n\"ENCRYPT_METHOD\" to SHA512:\n\n ENCRYPT_METHOD SHA512"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000120-GPOS-00061","gid":"V-238325","rid":"SV-238325r654150_rule","stig_id":"UBTU-20-010404","fix_id":"F-41494r654149_fix","cci":["CCI-000803"],"legacy":[],"nist":["IA-7"]},"code":"control 'V-238325' do\n title \"The Ubuntu operating system must encrypt all stored passwords with a\nFIPS 140-2 approved cryptographic hashing algorithm.\"\n desc \"Passwords need to be protected at all times, and encryption is the\nstandard method for protecting passwords. If passwords are not encrypted, they\ncan be plainly read (i.e., clear text) and easily compromised.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the shadow password suite configuration is set to encrypt\npasswords with a FIPS 140-2 approved cryptographic hashing algorithm.\n\n Check the hashing algorithm that is being used to hash passwords with the\nfollowing command:\n\n $ cat /etc/login.defs | grep -i encrypt_method\n\n ENCRYPT_METHOD SHA512\n\n If \\\"ENCRYPT_METHOD\\\" does not equal SHA512 or greater, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to encrypt all stored passwords.\n\n Edit/modify the following line in the \\\"/etc/login.defs\\\" file and set\n\\\"ENCRYPT_METHOD\\\" to SHA512:\n\n ENCRYPT_METHOD SHA512\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000120-GPOS-00061'\n tag gid: 'V-238325'\n tag rid: 'SV-238325r654150_rule'\n tag stig_id: 'UBTU-20-010404'\n tag fix_id: 'F-41494r654149_fix'\n tag cci: ['CCI-000803']\n tag legacy: []\n tag nist: ['IA-7']\n\n describe login_defs do\n its('ENCRYPT_METHOD') { should eq 'SHA512' }\n end\nend\n","source_location":{"ref":"./controls/V-238325.rb","line":3},"id":"V-238325"},{"title":"The Ubuntu operating system must prohibit password reuse for a minimum\nof five generations.","desc":"Password complexity, or strength, is a measure of the effectiveness of\na password in resisting attempts at guessing and brute-force attacks. If the\ninformation system or application allows the user to consecutively reuse their\npassword when that password has exceeded its defined lifetime, the end result\nis a password that is not changed as per policy requirements.","descriptions":{"default":"Password complexity, or strength, is a measure of the effectiveness of\na password in resisting attempts at guessing and brute-force attacks. If the\ninformation system or application allows the user to consecutively reuse their\npassword when that password has exceeded its defined lifetime, the end result\nis a password that is not changed as per policy requirements.","rationale":"","check":"Verify the Ubuntu operating system prevents passwords from being reused for\na minimum of five generations by running the following command:\n\n $ grep -i remember /etc/pam.d/common-password\n\n password [success=1 default=ignore] pam_unix.so obsecure sha512 shadow\nremember=5 rounds=5000\n\n If the \"remember\" parameter value is not greater than or equal to \"5\",\nis commented out, or is not set at all, this is a finding.","fix":"Configure the Ubuntu operating system to prevent passwords from being\nreused for a minimum of five generations.\n\n Add or modify the \"remember\" parameter value to the following line in\n\"/etc/pam.d/common-password\" file:\n\n password [success=1 default=ignore] pam_unix.so obsecure sha512 shadow\nremember=5 rounds=5000"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000077-GPOS-00045","satisfies":["SRG-OS-000077-GPOS-00045","SRG-OS-000073-GPOS-00041"],"gid":"V-238234","rid":"SV-238234r685225_rule","stig_id":"UBTU-20-010070","fix_id":"F-41403r653876_fix","cci":["CCI-000196","CCI-000200"],"legacy":[],"nist":["IA-5 (1) (c)","IA-5 (1) (e)"]},"code":"control 'V-238234' do\n title \"The Ubuntu operating system must prohibit password reuse for a minimum\nof five generations.\"\n desc \"Password complexity, or strength, is a measure of the effectiveness of\na password in resisting attempts at guessing and brute-force attacks. If the\ninformation system or application allows the user to consecutively reuse their\npassword when that password has exceeded its defined lifetime, the end result\nis a password that is not changed as per policy requirements.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system prevents passwords from being reused for\na minimum of five generations by running the following command:\n\n $ grep -i remember /etc/pam.d/common-password\n\n password [success=1 default=ignore] pam_unix.so obsecure sha512 shadow\nremember=5 rounds=5000\n\n If the \\\"remember\\\" parameter value is not greater than or equal to \\\"5\\\",\nis commented out, or is not set at all, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to prevent passwords from being\nreused for a minimum of five generations.\n\n Add or modify the \\\"remember\\\" parameter value to the following line in\n\\\"/etc/pam.d/common-password\\\" file:\n\n password [success=1 default=ignore] pam_unix.so obsecure sha512 shadow\nremember=5 rounds=5000\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000077-GPOS-00045'\n tag satisfies: ['SRG-OS-000077-GPOS-00045', 'SRG-OS-000073-GPOS-00041']\n tag gid: 'V-238234'\n tag rid: 'SV-238234r685225_rule'\n tag stig_id: 'UBTU-20-010070'\n tag fix_id: 'F-41403r653876_fix'\n tag cci: ['CCI-000196', 'CCI-000200']\n tag legacy: []\n tag nist: ['IA-5 (1) (c)', 'IA-5 (1) (e)']\n\n describe file('/etc/pam.d/common-password') do\n it { should exist }\n end\n\n describe command(\"grep -i remember /etc/pam.d/common-password | sed 's/.*remember=\\\\([^ ]*\\\\).*/\\\\1/'\") do\n its('exit_status') { should eq 0 }\n its('stdout.strip') { should cmp >= 5 }\n end\nend\n","source_location":{"ref":"./controls/V-238234.rb","line":3},"id":"V-238234"},{"title":"The Ubuntu operating system must have an application firewall enabled.","desc":"Firewalls protect computers from network attacks by blocking or\nlimiting access to open network ports. Application firewalls limit which\napplications are allowed to communicate over the network.","descriptions":{"default":"Firewalls protect computers from network attacks by blocking or\nlimiting access to open network ports. Application firewalls limit which\napplications are allowed to communicate over the network.","rationale":"","check":"Verify the Uncomplicated Firewall is enabled on the system by running the\nfollowing command:\n\n $ systemctl status ufw.service | grep -i \"active:\"\n\n Active: active (exited) since Mon 2016-10-17 12:30:29 CDT; 1s ago\n\n If the above command returns the status as \"inactive\", this is a finding.\n\n If the Uncomplicated Firewall is not installed, ask the System\nAdministrator if another application firewall is installed. If no application\nfirewall is installed, this is a finding.","fix":"Enable the Uncomplicated Firewall by using the following command:\n\n $ sudo systemctl enable ufw.service\n\n If the Uncomplicated Firewall is not currently running on the system, start\nit with the following command:\n\n $ sudo systemctl start ufw.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00232","gid":"V-238374","rid":"SV-238374r654297_rule","stig_id":"UBTU-20-010454","fix_id":"F-41543r654296_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238374' do\n title 'The Ubuntu operating system must have an application firewall enabled.'\n desc \"Firewalls protect computers from network attacks by blocking or\nlimiting access to open network ports. Application firewalls limit which\napplications are allowed to communicate over the network.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Uncomplicated Firewall is enabled on the system by running the\nfollowing command:\n\n $ systemctl status ufw.service | grep -i \\\"active:\\\"\n\n Active: active (exited) since Mon 2016-10-17 12:30:29 CDT; 1s ago\n\n If the above command returns the status as \\\"inactive\\\", this is a finding.\n\n If the Uncomplicated Firewall is not installed, ask the System\nAdministrator if another application firewall is installed. If no application\nfirewall is installed, this is a finding.\n \"\n desc 'fix', \"\n Enable the Uncomplicated Firewall by using the following command:\n\n $ sudo systemctl enable ufw.service\n\n If the Uncomplicated Firewall is not currently running on the system, start\nit with the following command:\n\n $ sudo systemctl start ufw.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000480-GPOS-00232'\n tag gid: 'V-238374'\n tag rid: 'SV-238374r654297_rule'\n tag stig_id: 'UBTU-20-010454'\n tag fix_id: 'F-41543r654296_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe service('ufw') do\n it { should be_installed }\n it { should be_enabled }\n it { should be_running }\n end\nend\n","source_location":{"ref":"./controls/V-238374.rb","line":3},"id":"V-238374"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the finit_module syscall.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record for any\nsuccessful/unsuccessful attempts to use the \"finit_module\" syscall.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w finit_module\n\n -a always,exit -F arch=b32 -S finit_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n -a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"finit_module\" syscall.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S finit_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n -a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000477-GPOS-00222"],"gid":"V-238296","rid":"SV-238296r654063_rule","stig_id":"UBTU-20-010180","fix_id":"F-41465r654062_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238296' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the finit_module syscall.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record for any\nsuccessful/unsuccessful attempts to use the \\\"finit_module\\\" syscall.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w finit_module\n\n -a always,exit -F arch=b32 -S finit_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n -a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F auid!=-1 -k\nmodule_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"finit_module\\\" syscall.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S finit_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n -a always,exit -F arch=b64 -S finit_module -F auid>=1000 -F\nauid!=4294967295 -k module_chng\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000477-GPOS-00222']\n tag gid: 'V-238296'\n tag rid: 'SV-238296r654063_rule'\n tag stig_id: 'UBTU-20-010180'\n tag fix_id: 'F-41465r654062_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('finit_module').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n end\n describe auditd.syscall('finit_module').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\nend\n","source_location":{"ref":"./controls/V-238296.rb","line":3},"id":"V-238296"},{"title":"The Ubuntu operating system must configure the /var/log directory to\nhave mode 0750 or less permissive.","desc":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","descriptions":{"default":"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.","rationale":"","check":"Verify that the Ubuntu operating system configures the \"/var/log\"\ndirectory with a mode of 750 or less permissive with the following command:\n\n $ stat -c \"%n %a\" /var/log\n\n /var/log 750\n\n If a value of \"750\" or less permissive is not returned, this is a finding.","fix":"Configure the Ubuntu operating system to have permissions of 0750 for the\n\"/var/log\" directory by running the following command:\n\n $ sudo chmod 0750 /var/log"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000206-GPOS-00084","gid":"V-238340","rid":"SV-238340r654195_rule","stig_id":"UBTU-20-010419","fix_id":"F-41509r654194_fix","cci":["CCI-001314"],"legacy":[],"nist":["SI-11 b"]},"code":"control 'V-238340' do\n title \"The Ubuntu operating system must configure the /var/log directory to\nhave mode 0750 or less permissive.\"\n desc \"Only authorized personnel should be aware of errors and the details of\nthe errors. Error messages are an indicator of an organization's operational\nstate or can identify the operating system or platform. Additionally,\nPersonally Identifiable Information (PII) and operational information must not\nbe revealed through error messages to unauthorized personnel or their\ndesignated representatives.\n\n The structure and content of error messages must be carefully considered by\nthe organization and development team. The extent to which the information\nsystem is able to identify and handle error conditions is guided by\norganizational policy and operational requirements.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Ubuntu operating system configures the \\\"/var/log\\\"\ndirectory with a mode of 750 or less permissive with the following command:\n\n $ stat -c \\\"%n %a\\\" /var/log\n\n /var/log 750\n\n If a value of \\\"750\\\" or less permissive is not returned, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to have permissions of 0750 for the\n\\\"/var/log\\\" directory by running the following command:\n\n $ sudo chmod 0750 /var/log\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000206-GPOS-00084'\n tag gid: 'V-238340'\n tag rid: 'SV-238340r654195_rule'\n tag stig_id: 'UBTU-20-010419'\n tag fix_id: 'F-41509r654194_fix'\n tag cci: ['CCI-001314']\n tag legacy: []\n tag nist: ['SI-11 b']\n\n describe directory(\"/var/log\") do\n it { should_not be_more_permissive_than(\"0750\") }\n end\nend\n","source_location":{"ref":"./controls/V-238340.rb","line":3},"id":"V-238340"},{"title":"The Ubuntu operating system must allow users to directly initiate a\nsession lock for all connection types.","desc":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n The session lock is implemented at the point where session activity can be\ndetermined. Rather than be forced to wait for a period of time to expire before\nthe user session can be locked, the Ubuntu operating systems need to provide\nusers with the ability to manually invoke a session lock so users may secure\ntheir session if they need to temporarily vacate the immediate physical\nvicinity.","descriptions":{"default":"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n The session lock is implemented at the point where session activity can be\ndetermined. Rather than be forced to wait for a period of time to expire before\nthe user session can be locked, the Ubuntu operating systems need to provide\nusers with the ability to manually invoke a session lock so users may secure\ntheir session if they need to temporarily vacate the immediate physical\nvicinity.","rationale":"","check":"Verify the Ubuntu operating system has the \"vlock\" package installed by\nrunning the following command:\n\n $ dpkg -l | grep vlock\n\n If \"vlock\" is not installed, this is a finding.","fix":"Install the \"vlock\" package (if it is not already installed) by running\nthe following command:\n\n $ sudo apt-get install vlock"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000030-GPOS-00011","satisfies":["SRG-OS-000030-GPOS-00011","SRG-OS-000031-GPOS-00012"],"gid":"V-238200","rid":"SV-238200r653775_rule","stig_id":"UBTU-20-010005","fix_id":"F-41369r653774_fix","cci":["CCI-000058","CCI-000060"],"legacy":[],"nist":["AC-11 a","AC-11 (1)"]},"code":"control 'V-238200' do\n title \"The Ubuntu operating system must allow users to directly initiate a\nsession lock for all connection types.\"\n desc \"A session lock is a temporary action taken when a user stops work and\nmoves away from the immediate physical vicinity of the information system but\ndoes not want to log out because of the temporary nature of the absence.\n\n The session lock is implemented at the point where session activity can be\ndetermined. Rather than be forced to wait for a period of time to expire before\nthe user session can be locked, the Ubuntu operating systems need to provide\nusers with the ability to manually invoke a session lock so users may secure\ntheir session if they need to temporarily vacate the immediate physical\nvicinity.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system has the \\\"vlock\\\" package installed by\nrunning the following command:\n\n $ dpkg -l | grep vlock\n\n If \\\"vlock\\\" is not installed, this is a finding.\n \"\n desc 'fix', \"\n Install the \\\"vlock\\\" package (if it is not already installed) by running\nthe following command:\n\n $ sudo apt-get install vlock\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000030-GPOS-00011'\n tag satisfies: ['SRG-OS-000030-GPOS-00011', 'SRG-OS-000031-GPOS-00012']\n tag gid: 'V-238200'\n tag rid: 'SV-238200r653775_rule'\n tag stig_id: 'UBTU-20-010005'\n tag fix_id: 'F-41369r653774_fix'\n tag cci: ['CCI-000058', 'CCI-000060']\n tag legacy: []\n tag nist: ['AC-11 a', 'AC-11 (1)']\n\n describe package('vlock') do\n it { should be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238200.rb","line":3},"id":"V-238200"},{"title":"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of unlinkat system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of unlinkat system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep unlinkat\n\n -a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of the unlinkat system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b64 -S unlinkat -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000468-GPOS-00212","gid":"V-238311","rid":"SV-238311r654108_rule","stig_id":"UBTU-20-010268","fix_id":"F-41480r654107_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238311' do\n title \"The Ubuntu operating system must generate audit records for any\nsuccessful/unsuccessful use of unlinkat system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records for any\nsuccessful/unsuccessful use of unlinkat system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep unlinkat\n\n -a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=-1 -k delete\n -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=-1 -k delete\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events for any\nsuccessful/unsuccessful use of the unlinkat system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b64 -S unlinkat -Fauid>=1000 -F auid!=4294967295 -k\ndelete\n -a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k\ndelete\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000468-GPOS-00212'\n tag gid: 'V-238311'\n tag rid: 'SV-238311r654108_rule'\n tag stig_id: 'UBTU-20-010268'\n tag fix_id: 'F-41480r654107_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"unlinkat\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"unlinkat\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238311.rb","line":3},"id":"V-238311"},{"title":"The Ubuntu operating system must permit only authorized groups to own\nthe audit configuration files.","desc":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.","descriptions":{"default":"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.","rationale":"","check":"Verify that \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\", and\n\"/etc/audit/auditd.conf\" files are owned by root group by using the following\ncommand:\n\n $ sudo ls -al /etc/audit/ /etc/audit/rules.d/\n\n /etc/audit/:\n\n -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf\n\n -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules\n\n -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev\n\n -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d\n\n /etc/audit/rules.d/:\n\n -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules\n\n If the \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\", or\n\"/etc/audit/auditd.conf\" file is owned by a group other than \"root\", this\nis a finding.","fix":"Configure \"/etc/audit/audit.rules\", \"/etc/audit/rules.d/*\", and\n\"/etc/audit/auditd.conf\" files to be owned by root group by using the\nfollowing command:\n\n $ sudo chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000063-GPOS-00032","gid":"V-238251","rid":"SV-238251r653928_rule","stig_id":"UBTU-20-010135","fix_id":"F-41420r653927_fix","cci":["CCI-000171"],"legacy":[],"nist":["AU-12 b"]},"code":"control 'V-238251' do\n title \"The Ubuntu operating system must permit only authorized groups to own\nthe audit configuration files.\"\n desc \"Without the capability to restrict which roles and individuals can\nselect which events are audited, unauthorized personnel may be able to prevent\nthe auditing of critical events.\n\n Misconfigured audits may degrade the system's performance by overwhelming\nthe audit log. Misconfigured audits may also make it more difficult to\nestablish, correlate, and investigate the events relating to an incident or\nidentify those responsible for one.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\", and\n\\\"/etc/audit/auditd.conf\\\" files are owned by root group by using the following\ncommand:\n\n $ sudo ls -al /etc/audit/ /etc/audit/rules.d/\n\n /etc/audit/:\n\n -rw-r----- 1 root root 804 Nov 25 11:01 auditd.conf\n\n -rw-r----- 1 root root 9128 Dec 27 09:56 audit.rules\n\n -rw-r----- 1 root root 9373 Dec 27 09:56 audit.rules.prev\n\n -rw-r----- 1 root root 127 Feb 7 2018 audit-stop.rules\n\n drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d\n\n /etc/audit/rules.d/:\n\n -rw-r----- 1 root root 10357 Dec 27 09:56 stig.rules\n\n If the \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\", or\n\\\"/etc/audit/auditd.conf\\\" file is owned by a group other than \\\"root\\\", this\nis a finding.\n \"\n desc 'fix', \"\n Configure \\\"/etc/audit/audit.rules\\\", \\\"/etc/audit/rules.d/*\\\", and\n\\\"/etc/audit/auditd.conf\\\" files to be owned by root group by using the\nfollowing command:\n\n $ sudo chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000063-GPOS-00032'\n tag gid: 'V-238251'\n tag rid: 'SV-238251r653928_rule'\n tag stig_id: 'UBTU-20-010135'\n tag fix_id: 'F-41420r653927_fix'\n tag cci: ['CCI-000171']\n tag legacy: []\n tag nist: ['AU-12 b']\n\n files1 = command('find /etc/audit/ -type f \\( -iname \\*.rules -o -iname \\*.conf \\)').stdout.strip.split(\"\\n\").entries\n files2 = command('find /etc/audit/rules.d/* -type f').stdout.strip.split(\"\\n\").entries\n\n audit_conf_files = files1 + files2\n\n audit_conf_files.each do |conf|\n describe file(conf) do\n its('group') { should cmp 'root' }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238251.rb","line":3},"id":"V-238251"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the apparmor_parser command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"apparmor_parser\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep apparmor_parser\n\n -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=-1 -k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"apparmor_parser\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238282","rid":"SV-238282r654021_rule","stig_id":"UBTU-20-010166","fix_id":"F-41451r654020_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238282' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the apparmor_parser command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"apparmor_parser\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep apparmor_parser\n\n -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=-1 -k perm_chng\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"apparmor_parser\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k perm_chng\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238282'\n tag rid: 'SV-238282r654021_rule'\n tag stig_id: 'UBTU-20-010166'\n tag fix_id: 'F-41451r654020_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/sbin/apparmor_parser'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238282.rb","line":3},"id":"V-238282"},{"title":"The Ubuntu operating system must automatically remove or disable\nemergency accounts after 72 hours.","desc":"Emergency accounts are different from infrequently used accounts\n(i.e., local logon accounts used by the organization's System Administrator\n s when network or normal logon/access is not available). Infrequently used\naccounts are not subject to automatic termination dates. Emergency accounts\nare accounts created in response to crisis situations, usually for use by\nmaintenance personnel. The automatic expiration or disabling time period may be\nextended as needed until the crisis is resolved; however, it must not be\nextended indefinitely. A permanent account should be established for privileged\nusers who need long-term maintenance accounts.","descriptions":{"default":"Emergency accounts are different from infrequently used accounts\n(i.e., local logon accounts used by the organization's System Administrator\n s when network or normal logon/access is not available). Infrequently used\naccounts are not subject to automatic termination dates. Emergency accounts\nare accounts created in response to crisis situations, usually for use by\nmaintenance personnel. The automatic expiration or disabling time period may be\nextended as needed until the crisis is resolved; however, it must not be\nextended indefinitely. A permanent account should be established for privileged\nusers who need long-term maintenance accounts.","rationale":"","check":"Verify the Ubuntu operating system expires emergency accounts within 72\nhours or less.\n\n For every emergency account, run the following command to obtain its\naccount expiration information:\n\n $ sudo chage -l account_name | grep expires\n\n Password expires : Aug 07, 2019\n Account expires : Aug 07, 2019\n\n Verify each of these accounts has an expiration date set within 72 hours of\naccount creation.\n\n If any of these accounts do not expire within 72 hours of that account's\ncreation, this is a finding.","fix":"If an emergency account must be created, configure the system to terminate\nthe account after a 72-hour time period with the following command to set an\nexpiration date on it. Substitute \"account_name\" with the account to be\ncreated.\n\n $ sudo chage -E $(date -d \"+3 days\" +%F) account_name"},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000123-GPOS-00064","gid":"V-238331","rid":"SV-238331r654168_rule","stig_id":"UBTU-20-010410","fix_id":"F-41500r654167_fix","cci":["CCI-001682"],"legacy":[],"nist":["AC-2 (2)"]},"code":"control 'V-238331' do\n title \"The Ubuntu operating system must automatically remove or disable\nemergency accounts after 72 hours.\"\n desc \"Emergency accounts are different from infrequently used accounts\n(i.e., local logon accounts used by the organization's System Administrator\n s when network or normal logon/access is not available). Infrequently used\naccounts are not subject to automatic termination dates. Emergency accounts\nare accounts created in response to crisis situations, usually for use by\nmaintenance personnel. The automatic expiration or disabling time period may be\nextended as needed until the crisis is resolved; however, it must not be\nextended indefinitely. A permanent account should be established for privileged\nusers who need long-term maintenance accounts.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system expires emergency accounts within 72\nhours or less.\n\n For every emergency account, run the following command to obtain its\naccount expiration information:\n\n $ sudo chage -l account_name | grep expires\n\n Password expires : Aug 07, 2019\n Account expires : Aug 07, 2019\n\n Verify each of these accounts has an expiration date set within 72 hours of\naccount creation.\n\n If any of these accounts do not expire within 72 hours of that account's\ncreation, this is a finding.\n \"\n desc 'fix', \"\n If an emergency account must be created, configure the system to terminate\nthe account after a 72-hour time period with the following command to set an\nexpiration date on it. Substitute \\\"account_name\\\" with the account to be\ncreated.\n\n $ sudo chage -E $(date -d \\\"+3 days\\\" +%F) account_name\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000123-GPOS-00064'\n tag gid: 'V-238331'\n tag rid: 'SV-238331r654168_rule'\n tag stig_id: 'UBTU-20-010410'\n tag fix_id: 'F-41500r654167_fix'\n tag cci: ['CCI-001682']\n tag legacy: []\n tag nist: ['AC-2 (2)']\n\n describe 'Manual verification required' do\n skip 'Manually verify if emergency account must be created\n the system must terminate the account after a 72 hour time period.'\n end\nend\n","source_location":{"ref":"./controls/V-238331.rb","line":3},"id":"V-238331"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the open system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \"open\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep open\n\n -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1\n-k perm_access\n -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1\n-k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any unsuccessful\nuse of the \"open\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000474-GPOS-00219"],"gid":"V-238271","rid":"SV-238271r653988_rule","stig_id":"UBTU-20-010155","fix_id":"F-41440r653987_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238271' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the open system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nunsuccessful attempts to use the \\\"open\\\" system call.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep open\n\n -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1\n-k perm_access\n -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=-1\n-k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=-1 -k perm_access\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any unsuccessful\nuse of the \\\"open\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n -a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F\nauid!=4294967295 -k perm_access\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000474-GPOS-00219']\n tag gid: 'V-238271'\n tag rid: 'SV-238271r653988_rule'\n tag stig_id: 'UBTU-20-010155'\n tag fix_id: 'F-41440r653987_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == 'x86_64'\n describe auditd.syscall('open').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('open').where { arch == 'b64' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\n end\n describe auditd.syscall('open').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EPERM' }\n end\n describe auditd.syscall('open').where { arch == 'b32' } do\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n its('exit.uniq') { should include '-EACCES' }\n end\nend\n","source_location":{"ref":"./controls/V-238271.rb","line":3},"id":"V-238271"},{"title":"The Ubuntu operating system must be configured to use AppArmor.","desc":"Control of program execution is a mechanism used to prevent execution\nof unauthorized programs. Some operating systems may provide a capability that\nruns counter to the mission or provides users with functionality that exceeds\nmission requirements. This includes functions and services installed at the\noperating system-level.\n\n Some of the programs, installed by default, may be harmful or may not be\nnecessary to support essential organizational operations (e.g., key missions,\nfunctions). Removal of executable programs is not always possible; therefore,\nestablishing a method of preventing program execution is critical to\nmaintaining a secure system baseline.\n\n Methods for complying with this requirement include restricting execution\nof programs in certain environments, while preventing execution in other\nenvironments; or limiting execution of certain program functionality based on\norganization-defined criteria (e.g., privileges, subnets, sandboxed\nenvironments, or roles).","descriptions":{"default":"Control of program execution is a mechanism used to prevent execution\nof unauthorized programs. Some operating systems may provide a capability that\nruns counter to the mission or provides users with functionality that exceeds\nmission requirements. This includes functions and services installed at the\noperating system-level.\n\n Some of the programs, installed by default, may be harmful or may not be\nnecessary to support essential organizational operations (e.g., key missions,\nfunctions). Removal of executable programs is not always possible; therefore,\nestablishing a method of preventing program execution is critical to\nmaintaining a secure system baseline.\n\n Methods for complying with this requirement include restricting execution\nof programs in certain environments, while preventing execution in other\nenvironments; or limiting execution of certain program functionality based on\norganization-defined criteria (e.g., privileges, subnets, sandboxed\nenvironments, or roles).","rationale":"","check":"Verify the operating system prevents program execution in accordance with\nlocal policies.\n\n Check that AppArmor is installed and active by running the following\ncommand,\n\n $ dpkg -l | grep apparmor\n\n If the \"apparmor\" package is not installed, this is a finding.\n\n $ systemctl is-active apparmor.service\n\n active\n\n If \"active\" is not returned, this is a finding.\n\n $ systemctl is-enabled apparmor.service\n\n enabled\n\n If \"enabled\" is not returned, this is a finding.","fix":"Install \"AppArmor\" (if it is not installed) with the following command:\n\n $ sudo apt-get install apparmor\n\n $ sudo systemctl enable apparmor.service\n\n Start \"apparmor\" with the following command:\n\n $ sudo systemctl start apparmor.service\n\n Note: AppArmor must have properly configured profiles for applications and\nhome directories. All configurations will be based on the actual system setup\nand organization and normally are on a per role basis. See the AppArmor\ndocumentation for more information on configuring profiles."},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000368-GPOS-00154","satisfies":["SRG-OS-000368-GPOS-00154","SRG-OS-000312-GPOS-00122","SRG-OS-000312-GPOS-00123","SRG-OS-000312-GPOS-00124","SRG-OS-000324-GPOS-00125","SRG-OS-000370-GPOS-00155"],"gid":"V-238360","rid":"SV-238360r654255_rule","stig_id":"UBTU-20-010439","fix_id":"F-41529r654254_fix","cci":["CCI-001764","CCI-001774","CCI-002165","CCI-002235"],"legacy":[],"nist":["CM-7 (2)","CM-7 (5) (b)","AC-3 (4)","AC-6 (10)"]},"code":"control 'V-238360' do\n title 'The Ubuntu operating system must be configured to use AppArmor.'\n desc \"Control of program execution is a mechanism used to prevent execution\nof unauthorized programs. Some operating systems may provide a capability that\nruns counter to the mission or provides users with functionality that exceeds\nmission requirements. This includes functions and services installed at the\noperating system-level.\n\n Some of the programs, installed by default, may be harmful or may not be\nnecessary to support essential organizational operations (e.g., key missions,\nfunctions). Removal of executable programs is not always possible; therefore,\nestablishing a method of preventing program execution is critical to\nmaintaining a secure system baseline.\n\n Methods for complying with this requirement include restricting execution\nof programs in certain environments, while preventing execution in other\nenvironments; or limiting execution of certain program functionality based on\norganization-defined criteria (e.g., privileges, subnets, sandboxed\nenvironments, or roles).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the operating system prevents program execution in accordance with\nlocal policies.\n\n Check that AppArmor is installed and active by running the following\ncommand,\n\n $ dpkg -l | grep apparmor\n\n If the \\\"apparmor\\\" package is not installed, this is a finding.\n\n $ systemctl is-active apparmor.service\n\n active\n\n If \\\"active\\\" is not returned, this is a finding.\n\n $ systemctl is-enabled apparmor.service\n\n enabled\n\n If \\\"enabled\\\" is not returned, this is a finding.\n \"\n desc 'fix', \"\n Install \\\"AppArmor\\\" (if it is not installed) with the following command:\n\n $ sudo apt-get install apparmor\n\n $ sudo systemctl enable apparmor.service\n\n Start \\\"apparmor\\\" with the following command:\n\n $ sudo systemctl start apparmor.service\n\n Note: AppArmor must have properly configured profiles for applications and\nhome directories. All configurations will be based on the actual system setup\nand organization and normally are on a per role basis. See the AppArmor\ndocumentation for more information on configuring profiles.\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000368-GPOS-00154'\n tag satisfies: ['SRG-OS-000368-GPOS-00154', 'SRG-OS-000312-GPOS-00122',\n'SRG-OS-000312-GPOS-00123', 'SRG-OS-000312-GPOS-00124',\n'SRG-OS-000324-GPOS-00125', 'SRG-OS-000370-GPOS-00155']\n tag gid: 'V-238360'\n tag rid: 'SV-238360r654255_rule'\n tag stig_id: 'UBTU-20-010439'\n tag fix_id: 'F-41529r654254_fix'\n tag cci: ['CCI-001764', 'CCI-001774', 'CCI-002165', 'CCI-002235']\n tag legacy: []\n tag nist: ['CM-7 (2)', 'CM-7 (5) (b)', 'AC-3 (4)', 'AC-6 (10)']\n\n describe service('apparmor') do\n it { should be_installed }\n it { should be_enabled }\n it { should be_running }\n end\nend\n","source_location":{"ref":"./controls/V-238360.rb","line":3},"id":"V-238360"},{"title":"The Ubuntu operating system SSH daemon must prevent remote hosts from\nconnecting to the proxy display.","desc":"When X11 forwarding is enabled, there may be additional exposure to\nthe server and client displays if the sshd proxy display is configured to\nlisten on the wildcard address. By default, sshd binds the forwarding server\nto the loopback address and sets the hostname part of the DISPLAY environment\nvariable to localhost. This prevents remote hosts from connecting to the proxy\ndisplay.","descriptions":{"default":"When X11 forwarding is enabled, there may be additional exposure to\nthe server and client displays if the sshd proxy display is configured to\nlisten on the wildcard address. By default, sshd binds the forwarding server\nto the loopback address and sets the hostname part of the DISPLAY environment\nvariable to localhost. This prevents remote hosts from connecting to the proxy\ndisplay.","rationale":"","check":"Verify the SSH daemon prevents remote hosts from connecting to the proxy\ndisplay.\n\n Check the SSH X11UseLocalhost setting with the following command:\n\n $ sudo grep -i x11uselocalhost /etc/ssh/sshd_config\n X11UseLocalhost yes\n\n If the \"X11UseLocalhost\" keyword is set to \"no\", is missing, or is\ncommented out, this is a finding.","fix":"Configure the SSH daemon to prevent remote hosts from connecting to the\nproxy display.\n\n Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the\n\"X11UseLocalhost\" keyword and set its value to \"yes\" (this file may be\nnamed differently or be in a different location if using a version of SSH that\nis provided by a third-party vendor):\n\n X11UseLocalhost yes\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-238220","rid":"SV-238220r653835_rule","stig_id":"UBTU-20-010049","fix_id":"F-41389r653834_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"]},"code":"control 'V-238220' do\n title \"The Ubuntu operating system SSH daemon must prevent remote hosts from\nconnecting to the proxy display.\"\n desc \"When X11 forwarding is enabled, there may be additional exposure to\nthe server and client displays if the sshd proxy display is configured to\nlisten on the wildcard address. By default, sshd binds the forwarding server\nto the loopback address and sets the hostname part of the DISPLAY environment\nvariable to localhost. This prevents remote hosts from connecting to the proxy\ndisplay.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify the SSH daemon prevents remote hosts from connecting to the proxy\ndisplay.\n\n Check the SSH X11UseLocalhost setting with the following command:\n\n $ sudo grep -i x11uselocalhost /etc/ssh/sshd_config\n X11UseLocalhost yes\n\n If the \\\"X11UseLocalhost\\\" keyword is set to \\\"no\\\", is missing, or is\ncommented out, this is a finding.\n \"\n desc 'fix', \"\n Configure the SSH daemon to prevent remote hosts from connecting to the\nproxy display.\n\n Edit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the\n\\\"X11UseLocalhost\\\" keyword and set its value to \\\"yes\\\" (this file may be\nnamed differently or be in a different location if using a version of SSH that\nis provided by a third-party vendor):\n\n X11UseLocalhost yes\n\n Restart the SSH daemon for the changes to take effect:\n\n $ sudo systemctl restart sshd.service\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000480-GPOS-00227'\n tag gid: 'V-238220'\n tag rid: 'SV-238220r653835_rule'\n tag stig_id: 'UBTU-20-010049'\n tag fix_id: 'F-41389r653834_fix'\n tag cci: ['CCI-000366']\n tag legacy: []\n tag nist: ['CM-6 b']\n\n describe sshd_config do\n its('X11UseLocalhost') { should cmp 'yes' }\n end\nend\n","source_location":{"ref":"./controls/V-238220.rb","line":3},"id":"V-238220"},{"title":"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting any local or remote connection to the\nsystem.","desc":"Display of a standardized and approved use notification before\ngranting access to the publicly accessible operating system ensures privacy and\nsecurity notification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \"I've read and consent to terms in IS user agreem't.\"","descriptions":{"default":"Display of a standardized and approved use notification before\ngranting access to the publicly accessible operating system ensures privacy and\nsecurity notification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \"I've read and consent to terms in IS user agreem't.\"","rationale":"","check":"Verify the Ubuntu operating system displays the Standard Mandatory DoD\nNotice and Consent Banner before granting access to the Ubuntu operating system\nvia an SSH logon with the following command:\n\n $ grep -i banner /etc/ssh/sshd_config\n\n Banner /etc/issue.net\n\n The command will return the banner option along with the name of the file\nthat contains the SSH banner. If the line is commented out, this is a finding.\n\n Verify the specified banner file matches the Standard Mandatory DoD Notice\nand Consent Banner exactly:\n\n $ cat /etc/issue.net\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n If the banner text does not match the Standard Mandatory DoD Notice and\nConsent Banner exactly, this is a finding.","fix":"Set the parameter Banner in \"/etc/ssh/sshd_config\" to point to the\n\"/etc/issue.net\" file:\n\n $ sudo sed -i '/^Banner/d' /etc/ssh/sshd_config\n $ sudo sed -i '$aBanner /etc/issue.net' /etc/ssh/sshd_config\n\n Either create the file containing the banner or replace the text in the\nfile with the Standard Mandatory DoD Notice and Consent Banner. The DoD\nrequired text is:\n\n \"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\"\n\n Restart the SSH daemon for the changes to take effect and then signal the\nSSH server to reload the configuration file:\n\n $ sudo systemctl -s SIGHUP kill sshd"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000228-GPOS-00088","satisfies":["SRG-OS-000228-GPOS-00088","SRG-OS-000023-GPOS-00006"],"gid":"V-238214","rid":"SV-238214r653817_rule","stig_id":"UBTU-20-010038","fix_id":"F-41383r653816_fix","cci":["CCI-000048","CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"],"legacy":[],"nist":["AC-8 a","AC-8 c 1","AC-8 c 2","AC-8 c 2","AC-8 c 2","AC-8 c\n3"]},"code":"control 'V-238214' do\n title \"The Ubuntu operating system must display the Standard Mandatory DoD\nNotice and Consent Banner before granting any local or remote connection to the\nsystem.\"\n desc \"Display of a standardized and approved use notification before\ngranting access to the publicly accessible operating system ensures privacy and\nsecurity notification verbiage used is consistent with applicable federal laws,\nExecutive Orders, directives, policies, regulations, standards, and guidance.\n\n System use notifications are required only for access via logon interfaces\nwith human users and are not required when such human interfaces do not exist.\n\n The banner must be formatted in accordance with applicable DoD policy. Use\nthe following verbiage for operating systems that can accommodate banners of\n1300 characters:\n\n \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n Use the following verbiage for operating systems that have severe\nlimitations on the number of characters that can be displayed in the banner:\n\n \\\"I've read and consent to terms in IS user agreem't.\\\"\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system displays the Standard Mandatory DoD\nNotice and Consent Banner before granting access to the Ubuntu operating system\nvia an SSH logon with the following command:\n\n $ grep -i banner /etc/ssh/sshd_config\n\n Banner /etc/issue.net\n\n The command will return the banner option along with the name of the file\nthat contains the SSH banner. If the line is commented out, this is a finding.\n\n Verify the specified banner file matches the Standard Mandatory DoD Notice\nand Consent Banner exactly:\n\n $ cat /etc/issue.net\n\n \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n If the banner text does not match the Standard Mandatory DoD Notice and\nConsent Banner exactly, this is a finding.\n \"\n desc 'fix', \"\n Set the parameter Banner in \\\"/etc/ssh/sshd_config\\\" to point to the\n\\\"/etc/issue.net\\\" file:\n\n $ sudo sed -i '/^Banner/d' /etc/ssh/sshd_config\n $ sudo sed -i '$aBanner /etc/issue.net' /etc/ssh/sshd_config\n\n Either create the file containing the banner or replace the text in the\nfile with the Standard Mandatory DoD Notice and Consent Banner. The DoD\nrequired text is:\n\n \\\"You are accessing a U.S. Government (USG) Information System (IS) that is\nprovided for USG-authorized use only.\n\n By using this IS (which includes any device attached to this IS), you\nconsent to the following conditions:\n\n -The USG routinely intercepts and monitors communications on this IS for\npurposes including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork operations and defense, personnel misconduct (PM), law enforcement\n(LE), and counterintelligence (CI) investigations.\n\n -At any time, the USG may inspect and seize data stored on this IS.\n\n -Communications using, or data stored on, this IS are not private, are\nsubject to routine monitoring, interception, and search, and may be disclosed\nor used for any USG-authorized purpose.\n\n -This IS includes security measures (e.g., authentication and access\ncontrols) to protect USG interests--not for your personal benefit or privacy.\n\n -Notwithstanding the above, using this IS does not constitute consent to\nPM, LE or CI investigative searching or monitoring of the content of privileged\ncommunications, or work product, related to personal representation or services\nby attorneys, psychotherapists, or clergy, and their assistants. Such\ncommunications and work product are private and confidential. See User\nAgreement for details.\\\"\n\n Restart the SSH daemon for the changes to take effect and then signal the\nSSH server to reload the configuration file:\n\n $ sudo systemctl -s SIGHUP kill sshd\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000228-GPOS-00088'\n tag satisfies: ['SRG-OS-000228-GPOS-00088', 'SRG-OS-000023-GPOS-00006']\n tag gid: 'V-238214'\n tag rid: 'SV-238214r653817_rule'\n tag stig_id: 'UBTU-20-010038'\n tag fix_id: 'F-41383r653816_fix'\n tag cci: ['CCI-000048', 'CCI-001384', 'CCI-001385', 'CCI-001386',\n'CCI-001387', 'CCI-001388']\n tag legacy: []\n tag nist: ['AC-8 a', 'AC-8 c 1', 'AC-8 c 2', 'AC-8 c 2', 'AC-8 c 2', \"AC-8 c\n3\"]\n banner_text = input('banner_text')\n banner_files = [sshd_config.banner].flatten\n\n banner_files.each do |banner_file|\n if banner_file.nil?\n describe 'The SSHD Banner is not set' do\n subject { banner_file.nil? }\n it { should be false }\n end\n end\n if !banner_file.nil? && !banner_file.match(/none/i).nil?\n describe 'The SSHD Banner is disabled' do\n subject { banner_file.match(/none/i).nil? }\n it { should be true }\n end\n end\n if !banner_file.nil? && banner_file.match(/none/i).nil? && !file(banner_file).exist?\n describe 'The SSHD Banner is set, but, the file does not exist' do\n subject { file(banner_file).exist? }\n it { should be true }\n end\n end\n next unless !banner_file.nil? && banner_file.match(/none/i).nil? && file(banner_file).exist?\n\n describe 'The SSHD Banner is set to the standard banner and has the correct text' do\n clean_banner = banner_text.gsub(/[\\r\\n\\s]/, '')\n subject { file(banner_file).content.gsub(/[\\r\\n\\s]/, '') }\n it { should cmp clean_banner }\n end\n end\n\n\nend\n","source_location":{"ref":"./controls/V-238214.rb","line":3},"id":"V-238214"},{"title":"The Ubuntu operating system must have an application firewall\ninstalled in order to control remote access methods.","desc":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated control\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).","descriptions":{"default":"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated control\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).","rationale":"","check":"Verify that the Uncomplicated Firewall is installed with the following\ncommand:\n\n $ dpkg -l | grep ufw\n\n ii ufw 0.36-6\n\n If the \"ufw\" package is not installed, ask the System Administrator if\nanother application firewall is installed.\n\n If no application firewall is installed, this is a finding.","fix":"Install the Uncomplicated Firewall by using the following command:\n\n$ sudo apt-get install ufw"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000297-GPOS-00115","gid":"V-238354","rid":"SV-238354r654237_rule","stig_id":"UBTU-20-010433","fix_id":"F-41523r654236_fix","cci":["CCI-002314"],"legacy":[],"nist":["AC-17 (1)"]},"code":"control 'V-238354' do\n title \"The Ubuntu operating system must have an application firewall\ninstalled in order to control remote access methods.\"\n desc \"Remote access services, such as those providing remote access to\nnetwork devices and information systems, which lack automated control\ncapabilities, increase risk and make remote user access management difficult at\nbest.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n Ubuntu operating system functionality (e.g., RDP) must be capable of taking\nenforcement action if the audit reveals unauthorized activity. Automated\ncontrol of remote access sessions allows organizations to ensure ongoing\ncompliance with remote access policies by enforcing connection rules of remote\naccess applications on a variety of information system components (e.g.,\nservers, workstations, notebook computers, smartphones, and tablets).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the Uncomplicated Firewall is installed with the following\ncommand:\n\n $ dpkg -l | grep ufw\n\n ii ufw 0.36-6\n\n If the \\\"ufw\\\" package is not installed, ask the System Administrator if\nanother application firewall is installed.\n\n If no application firewall is installed, this is a finding.\n \"\n desc 'fix', \"\n Install the Uncomplicated Firewall by using the following command:\n\n $ sudo apt-get install ufw\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000297-GPOS-00115'\n tag gid: 'V-238354'\n tag rid: 'SV-238354r654237_rule'\n tag stig_id: 'UBTU-20-010433'\n tag fix_id: 'F-41523r654236_fix'\n tag cci: ['CCI-002314']\n tag legacy: []\n tag nist: ['AC-17 (1)']\n\n describe package('ufw') do\n it { should be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238354.rb","line":3},"id":"V-238354"},{"title":"The Ubuntu operating system must be configured so that audit log files\nare not read or write-accessible by unauthorized users.","desc":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.","descriptions":{"default":"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.","rationale":"","check":"Verify that the audit log files have a mode of \"0600\" or less permissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\naudit log files have a mode of \"0600\" or less by using the following command:\n\n $ sudo stat -c \"%n %a\" /var/log/audit/*\n /var/log/audit/audit.log 600\n\n If the audit log files have a mode more permissive than \"0600\", this is a\nfinding.","fix":"Configure the audit log files to have a mode of \"0600\" or less\npermissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log files to have a mode of \"0600\" or less permissive by using the\nfollowing command:\n\n $ sudo chmod 0600 /var/log/audit/*"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028"],"gid":"V-238245","rid":"SV-238245r653910_rule","stig_id":"UBTU-20-010122","fix_id":"F-41414r653909_fix","cci":["CCI-000162","CCI-000163"],"legacy":[],"nist":["AU-9","AU-9"]},"code":"control 'V-238245' do\n title \"The Ubuntu operating system must be configured so that audit log files\nare not read or write-accessible by unauthorized users.\"\n desc \"Unauthorized disclosure of audit records can reveal system and\nconfiguration data to attackers, thus compromising its confidentiality.\n\n Audit information includes all information (e.g., audit records, audit\nsettings, audit reports) needed to successfully audit operating system activity.\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that the audit log files have a mode of \\\"0600\\\" or less permissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, determine if the\naudit log files have a mode of \\\"0600\\\" or less by using the following command:\n\n $ sudo stat -c \\\"%n %a\\\" /var/log/audit/*\n /var/log/audit/audit.log 600\n\n If the audit log files have a mode more permissive than \\\"0600\\\", this is a\nfinding.\n \"\n desc 'fix', \"\n Configure the audit log files to have a mode of \\\"0600\\\" or less\npermissive.\n\n Determine where the audit logs are stored with the following command:\n\n $ sudo grep -iw log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Using the path of the directory containing the audit logs, configure the\naudit log files to have a mode of \\\"0600\\\" or less permissive by using the\nfollowing command:\n\n $ sudo chmod 0600 /var/log/audit/*\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000057-GPOS-00027'\n tag satisfies: ['SRG-OS-000057-GPOS-00027', 'SRG-OS-000058-GPOS-00028']\n tag gid: 'V-238245'\n tag rid: 'SV-238245r653910_rule'\n tag stig_id: 'UBTU-20-010122'\n tag fix_id: 'F-41414r653909_fix'\n tag cci: ['CCI-000162', 'CCI-000163']\n tag legacy: []\n tag nist: ['AU-9', 'AU-9']\n\n log_file = auditd_conf.log_file\n\n log_file_exists = !log_file.nil?\n if log_file_exists\n describe file(log_file) do\n it { should_not be_more_permissive_than('0600') }\n end\n else\n describe ('Audit log file ' + log_file + ' exists') do\n subject { log_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238245.rb","line":3},"id":"V-238245"},{"title":"The Ubuntu operating system must allocate audit record storage\ncapacity to store at least one weeks' worth of audit records, when audit\nrecords are not immediately sent to a central audit record storage facility.","desc":"In order to ensure operating systems have a sufficient storage\ncapacity in which to write the audit logs, operating systems need to be able to\nallocate audit record storage capacity.\n\n The task of allocating audit record storage capacity is usually performed\nduring initial installation of the operating system.","descriptions":{"default":"In order to ensure operating systems have a sufficient storage\ncapacity in which to write the audit logs, operating systems need to be able to\nallocate audit record storage capacity.\n\n The task of allocating audit record storage capacity is usually performed\nduring initial installation of the operating system.","rationale":"","check":"Verify the Ubuntu operating system allocates audit record storage capacity\nto store at least one week's worth of audit records when audit records are not\nimmediately sent to a central audit record storage facility.\n\n Determine which partition the audit records are being written to with the\nfollowing command:\n\n $ sudo grep ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Check the size of the partition that audit records are written to (with the\nexample being \"/var/log/audit/\") with the following command:\n\n $ sudo df –h /var/log/audit/\n /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit\n\n If the audit records are not written to a partition made specifically for\naudit records (\"/var/log/audit\" is a separate partition), determine the\namount of space being used by other files in the partition with the following\ncommand:\n\n $ sudo du –sh [audit_partition]\n 1.8G /var/log/audit\n\n Note: The partition size needed to capture a week's worth of audit records\nis based on the activity level of the system and the total storage capacity\navailable. In normal circumstances, 10.0 GB of storage space for audit records\nwill be sufficient.\n\n If the audit record partition is not allocated for sufficient storage\ncapacity, this is a finding.","fix":"Allocate enough storage capacity for at least one week's worth of audit\nrecords when audit records are not immediately sent to a central audit record\nstorage facility.\n\n If audit records are stored on a partition made specifically for audit\nrecords, use the \"parted\" program to resize the partition with sufficient\nspace to contain one week's worth of audit records.\n\n If audit records are not stored on a partition made specifically for audit\nrecords, a new partition with sufficient amount of space will need be to be\ncreated.\n\n Set the auditd server to point to the mount point where the audit records\nmust be located:\n\n $ sudo sed -i -E 's@^(log_file\\s*=\\s*).*@\\1 /audit.log@'\n/etc/audit/auditd.conf\n\n where is the aforementioned mount point."},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000341-GPOS-00132","gid":"V-238305","rid":"SV-238305r654090_rule","stig_id":"UBTU-20-010215","fix_id":"F-41474r654089_fix","cci":["CCI-001849"],"legacy":[],"nist":["AU-4"]},"code":"control 'V-238305' do\n title \"The Ubuntu operating system must allocate audit record storage\ncapacity to store at least one weeks' worth of audit records, when audit\nrecords are not immediately sent to a central audit record storage facility.\"\n desc \"In order to ensure operating systems have a sufficient storage\ncapacity in which to write the audit logs, operating systems need to be able to\nallocate audit record storage capacity.\n\n The task of allocating audit record storage capacity is usually performed\nduring initial installation of the operating system.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system allocates audit record storage capacity\nto store at least one week's worth of audit records when audit records are not\nimmediately sent to a central audit record storage facility.\n\n Determine which partition the audit records are being written to with the\nfollowing command:\n\n $ sudo grep ^log_file /etc/audit/auditd.conf\n log_file = /var/log/audit/audit.log\n\n Check the size of the partition that audit records are written to (with the\nexample being \\\"/var/log/audit/\\\") with the following command:\n\n $ sudo df –h /var/log/audit/\n /dev/sda2 24G 10.4G 13.6G 43% /var/log/audit\n\n If the audit records are not written to a partition made specifically for\naudit records (\\\"/var/log/audit\\\" is a separate partition), determine the\namount of space being used by other files in the partition with the following\ncommand:\n\n $ sudo du –sh [audit_partition]\n 1.8G /var/log/audit\n\n Note: The partition size needed to capture a week's worth of audit records\nis based on the activity level of the system and the total storage capacity\navailable. In normal circumstances, 10.0 GB of storage space for audit records\nwill be sufficient.\n\n If the audit record partition is not allocated for sufficient storage\ncapacity, this is a finding.\n \"\n desc 'fix', \"\n Allocate enough storage capacity for at least one week's worth of audit\nrecords when audit records are not immediately sent to a central audit record\nstorage facility.\n\n If audit records are stored on a partition made specifically for audit\nrecords, use the \\\"parted\\\" program to resize the partition with sufficient\nspace to contain one week's worth of audit records.\n\n If audit records are not stored on a partition made specifically for audit\nrecords, a new partition with sufficient amount of space will need be to be\ncreated.\n\n Set the auditd server to point to the mount point where the audit records\nmust be located:\n\n $ sudo sed -i -E 's@^(log_file\\\\s*=\\\\s*).*@\\\\1 /audit.log@'\n/etc/audit/auditd.conf\n\n where is the aforementioned mount point.\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000341-GPOS-00132'\n tag gid: 'V-238305'\n tag rid: 'SV-238305r654090_rule'\n tag stig_id: 'UBTU-20-010215'\n tag fix_id: 'F-41474r654089_fix'\n tag cci: ['CCI-001849']\n tag legacy: []\n tag nist: ['AU-4']\n \n\n log_file = auditd_conf.log_file\n log_dir_exists = !log_file.nil? && !File.dirname(log_file).nil?\n\n if log_dir_exists\n log_file_dir = File.dirname(log_file)\n available_storage = filesystem(log_file_dir).free_kb\n log_file_size = file(log_file).size\n standard_audit_log_size = input('standard_audit_log_size')\n describe ('Current audit log file size is less than the specified standard of ' + standard_audit_log_size.to_s) do\n subject { log_file_size.to_i }\n it { should be <= standard_audit_log_size }\n end\n describe ('Available storage for audit log should be more than the defined standard of ' + standard_audit_log_size.to_s) do\n subject { available_storage.to_i }\n it { should be > standard_audit_log_size }\n end\n else\n describe ('Audit file/directory for file ' + log_file + ' exists') do\n subject { log_dir_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238305.rb","line":3},"id":"V-238305"},{"title":"The Ubuntu operating system must generate audit records for the\n/var/log/wtmp file.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates audit records showing start\nand stop times for user access to the system via the \"/var/log/wtmp\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep '/var/log/wtmp'\n\n -w /var/log/wtmp -p wa -k logins\n\n If the command does not return a line matching the example or the line is\ncommented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate audit events showing start and stop\ntimes for user access via the \"/var/log/wtmp\" file.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -w /var/log/wtmp -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000472-GPOS-00217","gid":"V-238315","rid":"SV-238315r654120_rule","stig_id":"UBTU-20-010277","fix_id":"F-41484r654119_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238315' do\n title \"The Ubuntu operating system must generate audit records for the\n/var/log/wtmp file.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates audit records showing start\nand stop times for user access to the system via the \\\"/var/log/wtmp\\\" file.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep '/var/log/wtmp'\n\n -w /var/log/wtmp -p wa -k logins\n\n If the command does not return a line matching the example or the line is\ncommented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate audit events showing start and stop\ntimes for user access via the \\\"/var/log/wtmp\\\" file.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -w /var/log/wtmp -p wa -k logins\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000472-GPOS-00217'\n tag gid: 'V-238315'\n tag rid: 'SV-238315r654120_rule'\n tag stig_id: 'UBTU-20-010277'\n tag fix_id: 'F-41484r654119_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = \"/var/log/wtmp\"\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its(\"permissions\") { should_not cmp [] }\n its(\"action\") { should_not include \"never\" }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include \"w\" }\n it { should include \"a\" }\n end\n end\n else\n describe (\"Audit line(s) for \" + @audit_file + \" exist\") do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238315.rb","line":3},"id":"V-238315"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the umount command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify if the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \"umount\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/umount'\n\n -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-umount\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"umount\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-umount\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238255","rid":"SV-238255r653940_rule","stig_id":"UBTU-20-010139","fix_id":"F-41424r653939_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238255' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the umount command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify if the Ubuntu operating system generates audit records upon\nsuccessful/unsuccessful attempts to use the \\\"umount\\\" command.\n\n Check the configured audit rules with the following commands:\n\n $ sudo auditctl -l | grep '/usr/bin/umount'\n\n -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=-1\n-k privileged-umount\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"umount\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-umount\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238255'\n tag rid: 'SV-238255r653940_rule'\n tag stig_id: 'UBTU-20-010139'\n tag fix_id: 'F-41424r653939_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/bin/umount'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n its('action.uniq') { should eq ['always'] }\n its('list.uniq') { should eq ['exit'] }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238255.rb","line":3},"id":"V-238255"},{"title":"The Ubuntu operating system must have directories that contain system\ncommands set to a mode of 0755 or less permissive.","desc":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","descriptions":{"default":"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.","rationale":"","check":"Verify the system commands directories have mode 0755 or less permissive:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Check that the system command directories have mode 0755 or less permissive\nwith the following command:\n\n $ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm\n/022 -type d -exec stat -c \"%n %a\" '{}' \\;\n\n If any directories are found to be group-writable or world-writable, this\nis a finding.","fix":"Configure the system commands directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n-perm /022 -type d -exec chmod -R 755 '{}' \\;"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000258-GPOS-00099","gid":"V-238344","rid":"SV-238344r654207_rule","stig_id":"UBTU-20-010423","fix_id":"F-41513r654206_fix","cci":["CCI-001495"],"legacy":[],"nist":["AU-9"]},"code":"control 'V-238344' do\n title \"The Ubuntu operating system must have directories that contain system\ncommands set to a mode of 0755 or less permissive.\"\n desc \"Protecting audit information also includes identifying and protecting\nthe tools used to view and manipulate log data. Therefore, protecting audit\ntools is necessary to prevent unauthorized operation on audit information.\n\n Operating systems providing tools to interface with audit information will\nleverage user permissions and roles identifying the user accessing the tools\nand the corresponding rights the user has in order to make access decisions\nregarding the deletion of audit tools.\n\n Audit tools include, but are not limited to, vendor-provided and open\nsource audit tools needed to successfully view and manipulate audit information\nsystem activity and records. Audit tools include custom queries and report\ngenerators.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the system commands directories have mode 0755 or less permissive:\n\n /bin\n /sbin\n /usr/bin\n /usr/sbin\n /usr/local/bin\n /usr/local/sbin\n\n Check that the system command directories have mode 0755 or less permissive\nwith the following command:\n\n $ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm\n/022 -type d -exec stat -c \\\"%n %a\\\" '{}' \\\\;\n\n If any directories are found to be group-writable or world-writable, this\nis a finding.\n \"\n desc 'fix', \"\n Configure the system commands directories to be protected from unauthorized\naccess. Run the following command:\n\n $ sudo find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin\n-perm /022 -type d -exec chmod -R 755 '{}' \\\\;\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000258-GPOS-00099'\n tag gid: 'V-238344'\n tag rid: 'SV-238344r654207_rule'\n tag stig_id: 'UBTU-20-010423'\n tag fix_id: 'F-41513r654206_fix'\n tag cci: ['CCI-001495']\n tag legacy: []\n tag nist: ['AU-9']\n\n system_commands = command(\"find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -perm /022 -type d\").stdout.strip.split(\"\\n\").entries\n valid_system_commands = Set[]\n\n if system_commands.count > 0\n system_commands.each do |sys_cmd|\n if file(sys_cmd).exist?\n valid_system_commands = valid_system_commands << sys_cmd\n end\n end\n end\n\n if valid_system_commands.count > 0\n valid_system_commands.each do |val_sys_cmd|\n describe file(val_sys_cmd) do\n it { should_not be_more_permissive_than(\"0755\") }\n end\n end\n else\n describe \"Number of directories that contain system commands found in /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin or\n /usr/local/sbin, that are less permissive than 0755\" do\n subject { valid_system_commands }\n its(\"count\") { should eq 0 }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238344.rb","line":3},"id":"V-238344"},{"title":"Ubuntu operating systems when booted must require authentication upon\nbooting into single-user and maintenance modes.","desc":"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access.\n\n Successful authentication must not automatically give an entity access to\nan asset or security boundary. Authorization procedures and controls must be\nimplemented to ensure each authenticated entity also has a validated and\ncurrent authorization. Authorization is the process of determining whether an\nentity, once authenticated, is permitted to access a specific asset.\nInformation systems use access control policies and enforcement mechanisms to\nimplement this requirement.\n\n Access control policies include identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.","descriptions":{"default":"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access.\n\n Successful authentication must not automatically give an entity access to\nan asset or security boundary. Authorization procedures and controls must be\nimplemented to ensure each authenticated entity also has a validated and\ncurrent authorization. Authorization is the process of determining whether an\nentity, once authenticated, is permitted to access a specific asset.\nInformation systems use access control policies and enforcement mechanisms to\nimplement this requirement.\n\n Access control policies include identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.","rationale":"","check":"Run the following command to verify the encrypted password is set:\n\n $ grep -i password /boot/grub/grub.cfg\n\n password_pbkdf2 root\ngrub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG\n\n If the root password entry does not begin with \"password_pbkdf2\", this is\na finding.","fix":"Configure the system to require a password for authentication upon booting\ninto single-user and maintenance modes.\n\n Generate an encrypted (grub) password for root with the following command:\n\n $ grub-mkpasswd-pbkdf2\n Enter Password:\n Reenter Password:\n PBKDF2 hash of your password is\ngrub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG\n\n Using the hash from the output, modify the \"/etc/grub.d/40_custom\" file\nwith the following command to add a boot password:\n\n $ sudo sed -i '$i set superusers=\\\"root\\\" password_pbkdf2 root ' /etc/grub.d/40_custom\n\n where is the hash generated by grub-mkpasswd-pbdkf2 command.\n\n Generate an updated \"grub.conf\" file with the new password by using the\nfollowing command:\n\n $ sudo update-grub"},"impact":0.7,"refs":[],"tags":{"severity":"high","gtitle":"SRG-OS-000080-GPOS-00048","gid":"V-238204","rid":"SV-238204r653787_rule","stig_id":"UBTU-20-010009","fix_id":"F-41373r653786_fix","cci":["CCI-000213"],"legacy":[],"nist":["AC-3"]},"code":"control 'V-238204' do\n title \"Ubuntu operating systems when booted must require authentication upon\nbooting into single-user and maintenance modes.\"\n desc \"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., web servers and web portals) must be properly configured to\nincorporate access control methods that do not rely solely on the possession of\na certificate for access.\n\n Successful authentication must not automatically give an entity access to\nan asset or security boundary. Authorization procedures and controls must be\nimplemented to ensure each authenticated entity also has a validated and\ncurrent authorization. Authorization is the process of determining whether an\nentity, once authenticated, is permitted to access a specific asset.\nInformation systems use access control policies and enforcement mechanisms to\nimplement this requirement.\n\n Access control policies include identity-based policies, role-based\npolicies, and attribute-based policies. Access enforcement mechanisms include\naccess control lists, access control matrices, and cryptography. These policies\nand mechanisms must be employed by the application to control access between\nusers (or processes acting on behalf of users) and objects (e.g., devices,\nfiles, records, processes, programs, and domains) in the information system.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Run the following command to verify the encrypted password is set:\n\n $ grep -i password /boot/grub/grub.cfg\n\n password_pbkdf2 root\ngrub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG\n\n If the root password entry does not begin with \\\"password_pbkdf2\\\", this is\na finding.\n \"\n desc 'fix', \"\n Configure the system to require a password for authentication upon booting\ninto single-user and maintenance modes.\n\n Generate an encrypted (grub) password for root with the following command:\n\n $ grub-mkpasswd-pbkdf2\n Enter Password:\n Reenter Password:\n PBKDF2 hash of your password is\ngrub.pbkdf2.sha512.10000.MFU48934NJD84NF8NSD39993JDHF84NG\n\n Using the hash from the output, modify the \\\"/etc/grub.d/40_custom\\\" file\nwith the following command to add a boot password:\n\n $ sudo sed -i '$i set superusers=\\\\\\\"root\\\\\\\"\\\n password_pbkdf2 root ' /etc/grub.d/40_custom\n\n where is the hash generated by grub-mkpasswd-pbdkf2 command.\n\n Generate an updated \\\"grub.conf\\\" file with the new password by using the\nfollowing command:\n\n $ sudo update-grub\n \"\n impact 0.7\n tag severity: 'high'\n tag gtitle: 'SRG-OS-000080-GPOS-00048'\n tag gid: 'V-238204'\n tag rid: 'SV-238204r653787_rule'\n tag stig_id: 'UBTU-20-010009'\n tag fix_id: 'F-41373r653786_fix'\n tag cci: ['CCI-000213']\n tag legacy: []\n tag nist: ['AC-3']\n\n describe file('/boot/grub/grub.cfg') do\n its('content') { should match '^password_pbkdf2' }\n end\nend\n","source_location":{"ref":"./controls/V-238204.rb","line":3},"id":"V-238204"},{"title":"The Ubuntu operating system must implement multifactor authentication\nfor remote access to privileged accounts in such a way that one of the factors\nis provided by a device separate from the system gaining access.","desc":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).","descriptions":{"default":"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).","rationale":"","check":"Verify the Ubuntu operating system has the packages required for\nmultifactor authentication installed with the following commands:\n\n $ dpkg -l | grep libpam-pkcs11\n\n ii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for\nusing PKCS#11 smart cards\n\n If the \"libpam-pkcs11\" package is not installed, this is a finding.","fix":"Configure the Ubuntu operating system to implement multifactor\nauthentication by installing the required packages.\n\n Install the \"libpam-pkcs11\" package on the system with the following\ncommand:\n\n $ sudo apt install libpam-pkcs11"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000375-GPOS-00160","gid":"V-238230","rid":"SV-238230r653865_rule","stig_id":"UBTU-20-010063","fix_id":"F-41399r653864_fix","cci":["CCI-001948"],"legacy":[],"nist":["IA-2 (11)"]},"code":"control 'V-238230' do\n title \"The Ubuntu operating system must implement multifactor authentication\nfor remote access to privileged accounts in such a way that one of the factors\nis provided by a device separate from the system gaining access.\"\n desc \"Using an authentication device, such as a CAC or token that is\nseparate from the information system, ensures that even if the information\nsystem is compromised, that compromise will not affect credentials stored on\nthe authentication device.\n\n Multifactor solutions that require devices separate from information\nsystems gaining access include, for example, hardware tokens providing\ntime-based or challenge-response authenticators and smart cards such as the\nU.S. Government Personal Identity Verification card and the DoD Common Access\nCard.\n\n A privileged account is defined as an information system account with\nauthorizations of a privileged user.\n\n Remote access is access to DoD nonpublic information systems by an\nauthorized user (or an information system) communicating through an external,\nnon-organization-controlled network. Remote access methods include, for\nexample, dial-up, broadband, and wireless.\n\n This requirement only applies to components where this is specific to the\nfunction of the device or has the concept of an organizational user (e.g., VPN,\nproxy capability). This does not apply to authentication for the purpose of\nconfiguring the device itself (management).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system has the packages required for\nmultifactor authentication installed with the following commands:\n\n $ dpkg -l | grep libpam-pkcs11\n\n ii libpam-pkcs11 0.6.8-4 amd64 Fully featured PAM module for\nusing PKCS#11 smart cards\n\n If the \\\"libpam-pkcs11\\\" package is not installed, this is a finding.\n \"\n desc 'fix', \"\n Configure the Ubuntu operating system to implement multifactor\nauthentication by installing the required packages.\n\n Install the \\\"libpam-pkcs11\\\" package on the system with the following\ncommand:\n\n $ sudo apt install libpam-pkcs11\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000375-GPOS-00160'\n tag gid: 'V-238230'\n tag rid: 'SV-238230r653865_rule'\n tag stig_id: 'UBTU-20-010063'\n tag fix_id: 'F-41399r653864_fix'\n tag cci: ['CCI-001948']\n tag legacy: []\n tag nist: ['IA-2 (11)']\n\n describe package('libpam-pkcs11') do\n it { should be_installed }\n end\nend\n","source_location":{"ref":"./controls/V-238230.rb","line":3},"id":"V-238230"},{"title":"The Ubuntu operating system must be configured so that Advance Package\nTool (APT) removes all software components after updated versions have been\ninstalled.","desc":"Previous versions of software components that are not removed from the\ninformation system after updates have been installed may be exploited by\nadversaries. Some information technology products may remove older versions of\nsoftware automatically from the information system.","descriptions":{"default":"Previous versions of software components that are not removed from the\ninformation system after updates have been installed may be exploited by\nadversaries. Some information technology products may remove older versions of\nsoftware automatically from the information system.","rationale":"","check":"Verify is configured to remove all software components after updated\nversions have been installed with the following command:\n\n $ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades\n Unattended-Upgrade::Remove-Unused-Dependencies \"true\";\n Unattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";\n\n If the \"::Remove-Unused-Dependencies\" and\n\"::Remove-Unused-Kernel-Packages\" parameters are not set to \"true\" or are\nmissing or commented out, this is a finding.","fix":"Configure APT to remove all software components after updated versions have\nbeen installed.\n\n Add or updated the following options to the\n\"/etc/apt/apt.conf.d/50unattended-upgrades\" file:\n\n Unattended-Upgrade::Remove-Unused-Dependencies \"true\";\n Unattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000437-GPOS-00194","gid":"V-238370","rid":"SV-238370r654285_rule","stig_id":"UBTU-20-010449","fix_id":"F-41539r654284_fix","cci":["CCI-002617"],"legacy":[],"nist":["SI-2 (6)"]},"code":"control 'V-238370' do\n title \"The Ubuntu operating system must be configured so that Advance Package\nTool (APT) removes all software components after updated versions have been\ninstalled.\"\n desc \"Previous versions of software components that are not removed from the\ninformation system after updates have been installed may be exploited by\nadversaries. Some information technology products may remove older versions of\nsoftware automatically from the information system.\"\n desc 'rationale', ''\n desc 'check', \"\n Verify is configured to remove all software components after updated\nversions have been installed with the following command:\n\n $ grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades\n Unattended-Upgrade::Remove-Unused-Dependencies \\\"true\\\";\n Unattended-Upgrade::Remove-Unused-Kernel-Packages \\\"true\\\";\n\n If the \\\"::Remove-Unused-Dependencies\\\" and\n\\\"::Remove-Unused-Kernel-Packages\\\" parameters are not set to \\\"true\\\" or are\nmissing or commented out, this is a finding.\n \"\n desc 'fix', \"\n Configure APT to remove all software components after updated versions have\nbeen installed.\n\n Add or updated the following options to the\n\\\"/etc/apt/apt.conf.d/50unattended-upgrades\\\" file:\n\n Unattended-Upgrade::Remove-Unused-Dependencies \\\"true\\\";\n Unattended-Upgrade::Remove-Unused-Kernel-Packages \\\"true\\\";\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000437-GPOS-00194'\n tag gid: 'V-238370'\n tag rid: 'SV-238370r654285_rule'\n tag stig_id: 'UBTU-20-010449'\n tag fix_id: 'F-41539r654284_fix'\n tag cci: ['CCI-002617']\n tag legacy: []\n tag nist: ['SI-2 (6)']\n\n describe directory('/etc/apt/apt.conf.d') do\n it { should exist }\n end\n\n describe command('grep -i remove-unused /etc/apt/apt.conf.d/50unattended-upgrades').stdout.strip do\n it { should match /^\\s*([^\\s]*::Remove-Unused-Dependencies)\\s*\\\"true\\\"\\s*;$/ }\n it { should match /^\\s*([^\\s]*::Remove-Unused-Kernel-Packages)\\s*\\\"true\\\"\\s*;$/ }\n end\nend\n","source_location":{"ref":"./controls/V-238370.rb","line":3},"id":"V-238370"},{"title":"The Ubuntu operating system must generate audit records for any use of\nthe removexattr system call.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \"removexattr\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep removexattr\n\n -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \"-k\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \"removexattr\" system call.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000462-GPOS-00206","SRG-OS-000466-GPOS-00210"],"gid":"V-238261","rid":"SV-238261r653958_rule","stig_id":"UBTU-20-010145","fix_id":"F-41430r653957_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238261' do\n title \"The Ubuntu operating system must generate audit records for any use of\nthe removexattr system call.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n\n\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify the Ubuntu operating system generates an audit record upon\nsuccessful/unsuccessful attempts to use the \\\"removexattr\\\" system call.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep removexattr\n\n -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k\nperm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\n If the command does not return lines that match the example or the lines\nare commented out, this is a finding.\n\n Notes:\n - For 32-bit architectures, only the 32-bit specific output lines from the\ncommands are required.\n - The \\\"-k\\\" allows for specifying an arbitrary identifier, and the string\nafter it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful use of the \\\"removexattr\\\" system call.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295\n-k perm_mod\n -a always,exit -F arch=b64 -S removexattr -F auid=0 -k perm_mod\n\n Notes: For 32-bit architectures, only the 32-bit specific entries are\nrequired.\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000462-GPOS-00206',\n'SRG-OS-000466-GPOS-00210']\n tag gid: 'V-238261'\n tag rid: 'SV-238261r653958_rule'\n tag stig_id: 'UBTU-20-010145'\n tag fix_id: 'F-41430r653957_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n if os.arch == \"x86_64\"\n describe auditd.syscall(\"removexattr\").where { arch == \"b64\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\n end\n describe auditd.syscall(\"removexattr\").where { arch == \"b32\" } do\n its(\"action.uniq\") { should eq [\"always\"] }\n its(\"list.uniq\") { should eq [\"exit\"] }\n end\nend\n","source_location":{"ref":"./controls/V-238261.rb","line":3},"id":"V-238261"},{"title":"The Ubuntu operating system must have a crontab script running weekly\nto offload audit events of standalone systems.","desc":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n Offloading is a common process in information systems with limited audit\nstorage capacity.","descriptions":{"default":"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n Offloading is a common process in information systems with limited audit\nstorage capacity.","rationale":"","check":"Note: If this is an interconnected system, this is Not Applicable.\n\n Verify there is a script that offloads audit data and that script runs\nweekly.\n\n Check if there is a script in the \"/etc/cron.weekly\" directory that\noffloads audit data:\n\n # sudo ls /etc/cron.weekly\n\n audit-offload\n\n Check if the script inside the file does offloading of audit logs to\nexternal media.\n\n If the script file does not exist or does not offload audit logs, this is a\nfinding.","fix":"Create a script that offloads audit logs to external media and runs weekly.\n\nThe script must be located in the \"/etc/cron.weekly\" directory."},"impact":0.3,"refs":[],"tags":{"severity":"low","gtitle":"SRG-OS-000479-GPOS-00224","gid":"V-238321","rid":"SV-238321r654138_rule","stig_id":"UBTU-20-010300","fix_id":"F-41490r654137_fix","cci":["CCI-001851"],"legacy":[],"nist":["AU-4 (1)"]},"code":"control 'V-238321' do\n title \"The Ubuntu operating system must have a crontab script running weekly\nto offload audit events of standalone systems.\"\n desc \"Information stored in one location is vulnerable to accidental or\nincidental deletion or alteration.\n\n Offloading is a common process in information systems with limited audit\nstorage capacity.\n \"\n desc 'rationale', ''\n desc 'check', \"\n Note: If this is an interconnected system, this is Not Applicable.\n\n Verify there is a script that offloads audit data and that script runs\nweekly.\n\n Check if there is a script in the \\\"/etc/cron.weekly\\\" directory that\noffloads audit data:\n\n # sudo ls /etc/cron.weekly\n\n audit-offload\n\n Check if the script inside the file does offloading of audit logs to\nexternal media.\n\n If the script file does not exist or does not offload audit logs, this is a\nfinding.\n \"\n desc 'fix', \"\n Create a script that offloads audit logs to external media and runs weekly.\n\n The script must be located in the \\\"/etc/cron.weekly\\\" directory.\n \"\n impact 0.3\n tag severity: 'low'\n tag gtitle: 'SRG-OS-000479-GPOS-00224'\n tag gid: 'V-238321'\n tag rid: 'SV-238321r654138_rule'\n tag stig_id: 'UBTU-20-010300'\n tag fix_id: 'F-41490r654137_fix'\n tag cci: ['CCI-001851']\n tag legacy: []\n tag nist: ['AU-4 (1)']\n\n cron_file = '/etc/cron.weekly/audit-offload'\n cron_file_exists = file(cron_file).exist?\n\n if cron_file_exists\n describe file(cron_file) do\n its('content') { should_not be_empty }\n end\n else\n describe cron_file + ' exists' do\n subject { cron_file_exists }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238321.rb","line":3},"id":"V-238321"},{"title":"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the usermod command.","desc":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","descriptions":{"default":"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).","rationale":"","check":"Verify that an audit event is generated for any successful/unsuccessful use\nof the \"usermod\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w usermod\n\n -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=-1 -k privileged-usermod\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \"-k\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.","fix":"Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \"usermod\" command.\n\n Add or update the following rules in the \"/etc/audit/rules.d/stig.rules\"\nfile:\n\n -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-usermod\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load"},"impact":0.5,"refs":[],"tags":{"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","gid":"V-238292","rid":"SV-238292r654051_rule","stig_id":"UBTU-20-010176","fix_id":"F-41461r654050_fix","cci":["CCI-000172"],"legacy":[],"nist":["AU-12 c"]},"code":"control 'V-238292' do\n title \"The Ubuntu operating system must generate audit records for\nsuccessful/unsuccessful uses of the usermod command.\"\n desc \"Without generating audit records that are specific to the security and\nmission needs of the organization, it would be difficult to establish,\ncorrelate, and investigate the events relating to an incident or identify those\nresponsible for one.\n\n Audit records can be generated from various components within the\ninformation system (e.g., module or policy filter).\n \"\n desc 'rationale', ''\n desc 'check', \"\n Verify that an audit event is generated for any successful/unsuccessful use\nof the \\\"usermod\\\" command.\n\n Check the currently configured audit rules with the following command:\n\n $ sudo auditctl -l | grep -w usermod\n\n -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=-1 -k privileged-usermod\n\n If the command does not return a line that matches the example or the line\nis commented out, this is a finding.\n\n Note: The \\\"-k\\\" allows for specifying an arbitrary identifier, and the\nstring after it does not need to match the example output above.\n \"\n desc 'fix', \"\n Configure the audit system to generate an audit event for any\nsuccessful/unsuccessful uses of the \\\"usermod\\\" command.\n\n Add or update the following rules in the \\\"/etc/audit/rules.d/stig.rules\\\"\nfile:\n\n -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F\nauid!=4294967295 -k privileged-usermod\n\n To reload the rules file, issue the following command:\n\n $ sudo augenrules --load\n \"\n impact 0.5\n tag severity: 'medium'\n tag gtitle: 'SRG-OS-000064-GPOS-00033'\n tag gid: 'V-238292'\n tag rid: 'SV-238292r654051_rule'\n tag stig_id: 'UBTU-20-010176'\n tag fix_id: 'F-41461r654050_fix'\n tag cci: ['CCI-000172']\n tag legacy: []\n tag nist: ['AU-12 c']\n\n @audit_file = '/usr/sbin/usermod'\n\n audit_lines_exist = !auditd.lines.index { |line| line.include?(@audit_file) }.nil?\n if audit_lines_exist\n describe auditd.file(@audit_file) do\n its('permissions') { should_not cmp [] }\n its('action') { should_not include 'never' }\n end\n\n @perms = auditd.file(@audit_file).permissions\n\n @perms.each do |perm|\n describe perm do\n it { should include 'x' }\n end\n end\n else\n describe ('Audit line(s) for ' + @audit_file + ' exist') do\n subject { audit_lines_exist }\n it { should be true }\n end\n end\nend\n","source_location":{"ref":"./controls/V-238292.rb","line":3},"id":"V-238292"}],"groups":[{"title":null,"controls":["V-238213"],"id":"controls/V-238213.rb"},{"title":null,"controls":["V-238353"],"id":"controls/V-238353.rb"},{"title":null,"controls":["V-238242"],"id":"controls/V-238242.rb"},{"title":null,"controls":["V-238302"],"id":"controls/V-238302.rb"},{"title":null,"controls":["V-238336"],"id":"controls/V-238336.rb"},{"title":null,"controls":["V-238276"],"id":"controls/V-238276.rb"},{"title":null,"controls":["V-238367"],"id":"controls/V-238367.rb"},{"title":null,"controls":["V-238227"],"id":"controls/V-238227.rb"},{"title":null,"controls":["V-238285"],"id":"controls/V-238285.rb"},{"title":null,"controls":["V-238295"],"id":"controls/V-238295.rb"},{"title":null,"controls":["V-238237"],"id":"controls/V-238237.rb"},{"title":null,"controls":["V-238377"],"id":"controls/V-238377.rb"},{"title":null,"controls":["V-238266"],"id":"controls/V-238266.rb"},{"title":null,"controls":["V-238326"],"id":"controls/V-238326.rb"},{"title":null,"controls":["V-238312"],"id":"controls/V-238312.rb"},{"title":null,"controls":["V-238252"],"id":"controls/V-238252.rb"},{"title":null,"controls":["V-238343"],"id":"controls/V-238343.rb"},{"title":null,"controls":["V-238203"],"id":"controls/V-238203.rb"},{"title":null,"controls":["V-238363"],"id":"controls/V-238363.rb"},{"title":null,"controls":["V-238223"],"id":"controls/V-238223.rb"},{"title":null,"controls":["V-238332"],"id":"controls/V-238332.rb"},{"title":null,"controls":["V-238272"],"id":"controls/V-238272.rb"},{"title":null,"controls":["V-238281"],"id":"controls/V-238281.rb"},{"title":null,"controls":["V-238246"],"id":"controls/V-238246.rb"},{"title":null,"controls":["V-238306"],"id":"controls/V-238306.rb"},{"title":null,"controls":["V-238217"],"id":"controls/V-238217.rb"},{"title":null,"controls":["V-238357"],"id":"controls/V-238357.rb"},{"title":null,"controls":["V-238347"],"id":"controls/V-238347.rb"},{"title":null,"controls":["V-238207"],"id":"controls/V-238207.rb"},{"title":null,"controls":["V-238196"],"id":"controls/V-238196.rb"},{"title":null,"controls":["V-238316"],"id":"controls/V-238316.rb"},{"title":null,"controls":["V-238256"],"id":"controls/V-238256.rb"},{"title":null,"controls":["V-238380"],"id":"controls/V-238380.rb"},{"title":null,"controls":["V-238291"],"id":"controls/V-238291.rb"},{"title":null,"controls":["V-238262"],"id":"controls/V-238262.rb"},{"title":null,"controls":["V-238322"],"id":"controls/V-238322.rb"},{"title":null,"controls":["V-238233"],"id":"controls/V-238233.rb"},{"title":null,"controls":["V-238373"],"id":"controls/V-238373.rb"},{"title":null,"controls":["V-238362"],"id":"controls/V-238362.rb"},{"title":null,"controls":["V-238222"],"id":"controls/V-238222.rb"},{"title":null,"controls":["V-238333"],"id":"controls/V-238333.rb"},{"title":null,"controls":["V-238273"],"id":"controls/V-238273.rb"},{"title":null,"controls":["V-238280"],"id":"controls/V-238280.rb"},{"title":null,"controls":["V-238247"],"id":"controls/V-238247.rb"},{"title":null,"controls":["V-238307"],"id":"controls/V-238307.rb"},{"title":null,"controls":["V-238216"],"id":"controls/V-238216.rb"},{"title":null,"controls":["V-238356"],"id":"controls/V-238356.rb"},{"title":null,"controls":["V-238346"],"id":"controls/V-238346.rb"},{"title":null,"controls":["V-238197"],"id":"controls/V-238197.rb"},{"title":null,"controls":["V-238206"],"id":"controls/V-238206.rb"},{"title":null,"controls":["V-238317"],"id":"controls/V-238317.rb"},{"title":null,"controls":["V-238257"],"id":"controls/V-238257.rb"},{"title":null,"controls":["V-238290"],"id":"controls/V-238290.rb"},{"title":null,"controls":["V-238263"],"id":"controls/V-238263.rb"},{"title":null,"controls":["V-238323"],"id":"controls/V-238323.rb"},{"title":null,"controls":["V-238232"],"id":"controls/V-238232.rb"},{"title":null,"controls":["V-238372"],"id":"controls/V-238372.rb"},{"title":null,"controls":["V-238212"],"id":"controls/V-238212.rb"},{"title":null,"controls":["V-238352"],"id":"controls/V-238352.rb"},{"title":null,"controls":["V-238243"],"id":"controls/V-238243.rb"},{"title":null,"controls":["V-238303"],"id":"controls/V-238303.rb"},{"title":null,"controls":["V-238337"],"id":"controls/V-238337.rb"},{"title":null,"controls":["V-238277"],"id":"controls/V-238277.rb"},{"title":null,"controls":["V-238366"],"id":"controls/V-238366.rb"},{"title":null,"controls":["V-238226"],"id":"controls/V-238226.rb"},{"title":null,"controls":["V-238284"],"id":"controls/V-238284.rb"},{"title":null,"controls":["V-238294"],"id":"controls/V-238294.rb"},{"title":null,"controls":["V-238236"],"id":"controls/V-238236.rb"},{"title":null,"controls":["V-238376"],"id":"controls/V-238376.rb"},{"title":null,"controls":["V-238267"],"id":"controls/V-238267.rb"},{"title":null,"controls":["V-238327"],"id":"controls/V-238327.rb"},{"title":null,"controls":["V-238313"],"id":"controls/V-238313.rb"},{"title":null,"controls":["V-238253"],"id":"controls/V-238253.rb"},{"title":null,"controls":["V-238342"],"id":"controls/V-238342.rb"},{"title":null,"controls":["V-238202"],"id":"controls/V-238202.rb"},{"title":null,"controls":["V-238219"],"id":"controls/V-238219.rb"},{"title":null,"controls":["V-238359"],"id":"controls/V-238359.rb"},{"title":null,"controls":["V-238248"],"id":"controls/V-238248.rb"},{"title":null,"controls":["V-238308"],"id":"controls/V-238308.rb"},{"title":null,"controls":["V-238318"],"id":"controls/V-238318.rb"},{"title":null,"controls":["V-238258"],"id":"controls/V-238258.rb"},{"title":null,"controls":["V-238349"],"id":"controls/V-238349.rb"},{"title":null,"controls":["V-238209"],"id":"controls/V-238209.rb"},{"title":null,"controls":["V-238198"],"id":"controls/V-238198.rb"},{"title":null,"controls":["V-238369"],"id":"controls/V-238369.rb"},{"title":null,"controls":["V-238229"],"id":"controls/V-238229.rb"},{"title":null,"controls":["V-238338"],"id":"controls/V-238338.rb"},{"title":null,"controls":["V-238278"],"id":"controls/V-238278.rb"},{"title":null,"controls":["V-238268"],"id":"controls/V-238268.rb"},{"title":null,"controls":["V-238328"],"id":"controls/V-238328.rb"},{"title":null,"controls":["V-238239"],"id":"controls/V-238239.rb"},{"title":null,"controls":["V-238379"],"id":"controls/V-238379.rb"},{"title":null,"controls":["V-238368"],"id":"controls/V-238368.rb"},{"title":null,"controls":["V-238228"],"id":"controls/V-238228.rb"},{"title":null,"controls":["V-238339"],"id":"controls/V-238339.rb"},{"title":null,"controls":["V-238279"],"id":"controls/V-238279.rb"},{"title":null,"controls":["V-238269"],"id":"controls/V-238269.rb"},{"title":null,"controls":["V-238329"],"id":"controls/V-238329.rb"},{"title":null,"controls":["V-238238"],"id":"controls/V-238238.rb"},{"title":null,"controls":["V-238378"],"id":"controls/V-238378.rb"},{"title":null,"controls":["V-238218"],"id":"controls/V-238218.rb"},{"title":null,"controls":["V-238358"],"id":"controls/V-238358.rb"},{"title":null,"controls":["V-238249"],"id":"controls/V-238249.rb"},{"title":null,"controls":["V-238309"],"id":"controls/V-238309.rb"},{"title":null,"controls":["V-238319"],"id":"controls/V-238319.rb"},{"title":null,"controls":["V-238259"],"id":"controls/V-238259.rb"},{"title":null,"controls":["V-238348"],"id":"controls/V-238348.rb"},{"title":null,"controls":["V-238199"],"id":"controls/V-238199.rb"},{"title":null,"controls":["V-238208"],"id":"controls/V-238208.rb"},{"title":null,"controls":["V-238289"],"id":"controls/V-238289.rb"},{"title":null,"controls":["V-238299"],"id":"controls/V-238299.rb"},{"title":null,"controls":["V-238288"],"id":"controls/V-238288.rb"},{"title":null,"controls":["V-238298"],"id":"controls/V-238298.rb"},{"title":null,"controls":["V-238283"],"id":"controls/V-238283.rb"},{"title":null,"controls":["V-238330"],"id":"controls/V-238330.rb"},{"title":null,"controls":["V-238270"],"id":"controls/V-238270.rb"},{"title":null,"controls":["V-238361"],"id":"controls/V-238361.rb"},{"title":null,"controls":["V-238221"],"id":"controls/V-238221.rb"},{"title":null,"controls":["V-238215"],"id":"controls/V-238215.rb"},{"title":null,"controls":["V-238355"],"id":"controls/V-238355.rb"},{"title":null,"controls":["V-238244"],"id":"controls/V-238244.rb"},{"title":null,"controls":["V-238304"],"id":"controls/V-238304.rb"},{"title":null,"controls":["V-238314"],"id":"controls/V-238314.rb"},{"title":null,"controls":["V-238254"],"id":"controls/V-238254.rb"},{"title":null,"controls":["V-238345"],"id":"controls/V-238345.rb"},{"title":null,"controls":["V-238205"],"id":"controls/V-238205.rb"},{"title":null,"controls":["V-238231"],"id":"controls/V-238231.rb"},{"title":null,"controls":["V-238371"],"id":"controls/V-238371.rb"},{"title":null,"controls":["V-238260"],"id":"controls/V-238260.rb"},{"title":null,"controls":["V-238320"],"id":"controls/V-238320.rb"},{"title":null,"controls":["V-238293"],"id":"controls/V-238293.rb"},{"title":null,"controls":["V-238240"],"id":"controls/V-238240.rb"},{"title":null,"controls":["V-238300"],"id":"controls/V-238300.rb"},{"title":null,"controls":["V-238211"],"id":"controls/V-238211.rb"},{"title":null,"controls":["V-238351"],"id":"controls/V-238351.rb"},{"title":null,"controls":["V-238287"],"id":"controls/V-238287.rb"},{"title":null,"controls":["V-238365"],"id":"controls/V-238365.rb"},{"title":null,"controls":["V-238225"],"id":"controls/V-238225.rb"},{"title":null,"controls":["V-238334"],"id":"controls/V-238334.rb"},{"title":null,"controls":["V-238274"],"id":"controls/V-238274.rb"},{"title":null,"controls":["V-238264"],"id":"controls/V-238264.rb"},{"title":null,"controls":["V-238324"],"id":"controls/V-238324.rb"},{"title":null,"controls":["V-238235"],"id":"controls/V-238235.rb"},{"title":null,"controls":["V-238375"],"id":"controls/V-238375.rb"},{"title":null,"controls":["V-238297"],"id":"controls/V-238297.rb"},{"title":null,"controls":["V-238341"],"id":"controls/V-238341.rb"},{"title":null,"controls":["V-238201"],"id":"controls/V-238201.rb"},{"title":null,"controls":["V-238310"],"id":"controls/V-238310.rb"},{"title":null,"controls":["V-238250"],"id":"controls/V-238250.rb"},{"title":null,"controls":["V-238241"],"id":"controls/V-238241.rb"},{"title":null,"controls":["V-238301"],"id":"controls/V-238301.rb"},{"title":null,"controls":["V-238210"],"id":"controls/V-238210.rb"},{"title":null,"controls":["V-238350"],"id":"controls/V-238350.rb"},{"title":null,"controls":["V-238286"],"id":"controls/V-238286.rb"},{"title":null,"controls":["V-238364"],"id":"controls/V-238364.rb"},{"title":null,"controls":["V-238224"],"id":"controls/V-238224.rb"},{"title":null,"controls":["V-238335"],"id":"controls/V-238335.rb"},{"title":null,"controls":["V-238275"],"id":"controls/V-238275.rb"},{"title":null,"controls":["V-238265"],"id":"controls/V-238265.rb"},{"title":null,"controls":["V-238325"],"id":"controls/V-238325.rb"},{"title":null,"controls":["V-238234"],"id":"controls/V-238234.rb"},{"title":null,"controls":["V-238374"],"id":"controls/V-238374.rb"},{"title":null,"controls":["V-238296"],"id":"controls/V-238296.rb"},{"title":null,"controls":["V-238340"],"id":"controls/V-238340.rb"},{"title":null,"controls":["V-238200"],"id":"controls/V-238200.rb"},{"title":null,"controls":["V-238311"],"id":"controls/V-238311.rb"},{"title":null,"controls":["V-238251"],"id":"controls/V-238251.rb"},{"title":null,"controls":["V-238282"],"id":"controls/V-238282.rb"},{"title":null,"controls":["V-238331"],"id":"controls/V-238331.rb"},{"title":null,"controls":["V-238271"],"id":"controls/V-238271.rb"},{"title":null,"controls":["V-238360"],"id":"controls/V-238360.rb"},{"title":null,"controls":["V-238220"],"id":"controls/V-238220.rb"},{"title":null,"controls":["V-238214"],"id":"controls/V-238214.rb"},{"title":null,"controls":["V-238354"],"id":"controls/V-238354.rb"},{"title":null,"controls":["V-238245"],"id":"controls/V-238245.rb"},{"title":null,"controls":["V-238305"],"id":"controls/V-238305.rb"},{"title":null,"controls":["V-238315"],"id":"controls/V-238315.rb"},{"title":null,"controls":["V-238255"],"id":"controls/V-238255.rb"},{"title":null,"controls":["V-238344"],"id":"controls/V-238344.rb"},{"title":null,"controls":["V-238204"],"id":"controls/V-238204.rb"},{"title":null,"controls":["V-238230"],"id":"controls/V-238230.rb"},{"title":null,"controls":["V-238370"],"id":"controls/V-238370.rb"},{"title":null,"controls":["V-238261"],"id":"controls/V-238261.rb"},{"title":null,"controls":["V-238321"],"id":"controls/V-238321.rb"},{"title":null,"controls":["V-238292"],"id":"controls/V-238292.rb"}],"sha256":"d7b2b86b33b61a59087dad76f74fee43445854cd2c4f1e8723a3bc3d34275e84","status_message":"","status":"loaded","generator":{"name":"inspec","version":"5.12.2"}}