| ALMA-09-011240 | V1R4 | AlmaLinux OS 9 must disable core dumps for all users. | AlmaLinux OS 9 |
| ALMA-09-011350 | V1R4 | AlmaLinux OS 9 must disable acquiring, saving, and processing core dumps. | AlmaLinux OS 9 |
| ALMA-09-011460 | V1R4 | AlmaLinux OS 9 must disable storing core dumps. | AlmaLinux OS 9 |
| ALMA-09-011570 | V1R4 | AlmaLinux OS 9 must disable core dump backtraces. | AlmaLinux OS 9 |
| ALMA-09-011680 | V1R4 | AlmaLinux OS 9 must disable the kernel.core_pattern. | AlmaLinux OS 9 |
| ALMA-09-011790 | V1R4 | AlmaLinux OS 9 cron configuration files directory must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-011900 | V1R4 | AlmaLinux OS 9 cron configuration files directory must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-012010 | V1R4 | AlmaLinux OS 9 cron configuration directories must have a mode of 0700 or less permissive. | AlmaLinux OS 9 |
| ALMA-09-012120 | V1R4 | AlmaLinux OS 9 /etc/crontab file must have mode 0600. | AlmaLinux OS 9 |
| ALMA-09-012230 | V1R4 | AlmaLinux OS 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot. | AlmaLinux OS 9 |
| ALMA-09-012340 | V1R4 | AlmaLinux OS 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface. | AlmaLinux OS 9 |
| ALMA-09-012450 | V1R4 | All AlmaLinux OS 9 local files and directories must have a valid group owner. | AlmaLinux OS 9 |
| ALMA-09-012560 | V1R4 | All AlmaLinux OS 9 local files and directories must have a valid owner. | AlmaLinux OS 9 |
| ALMA-09-012670 | V1R4 | AlmaLinux OS 9 /etc/group- file must be group owned by root. | AlmaLinux OS 9 |
| ALMA-09-012780 | V1R4 | AlmaLinux OS 9 /etc/group- file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-012890 | V1R4 | AlmaLinux OS 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-013000 | V1R4 | AlmaLinux OS 9 /etc/group file must be group owned by root. | AlmaLinux OS 9 |
| ALMA-09-013110 | V1R4 | AlmaLinux OS 9 /etc/group file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-013220 | V1R4 | AlmaLinux OS 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-013330 | V1R4 | The /boot/grub2/grub.cfg file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-013440 | V1R4 | The /boot/grub2/grub.cfg file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-013550 | V1R4 | AlmaLinux OS 9 must disable the ability of systemd to spawn an interactive boot process. | AlmaLinux OS 9 |
| ALMA-09-013660 | V1R4 | AlmaLinux OS 9 /etc/gshadow- file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-013770 | V1R4 | AlmaLinux OS 9 /etc/gshadow- file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-013880 | V1R4 | AlmaLinux OS 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-013990 | V1R4 | AlmaLinux OS 9 /etc/gshadow file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-014100 | V1R4 | AlmaLinux OS 9 /etc/gshadow file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-014210 | V1R4 | AlmaLinux OS 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-014320 | V1R4 | The graphical display manager must not be the default target on AlmaLinux OS 9 unless approved. | AlmaLinux OS 9 |
| ALMA-09-014430 | V1R4 | AlmaLinux OS 9 must disable the user list at logon for graphical user interfaces. | AlmaLinux OS 9 |
| ALMA-09-015640 | V1R4 | AlmaLinux OS 9 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. | AlmaLinux OS 9 |
| ALMA-09-015750 | V1R4 | AlmaLinux OS 9 must not allow blank or null passwords. | AlmaLinux OS 9 |
| ALMA-09-015860 | V1R4 | AlmaLinux OS 9 must not have accounts configured with blank or null passwords. | AlmaLinux OS 9 |
| ALMA-09-015970 | V1R4 | AlmaLinux OS 9 /etc/passwd- file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-016080 | V1R4 | AlmaLinux OS 9 /etc/passwd- file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-016190 | V1R4 | AlmaLinux OS 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-016300 | V1R4 | AlmaLinux OS 9 /etc/passwd file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-016410 | V1R4 | AlmaLinux OS 9 /etc/passwd file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-016520 | V1R4 | AlmaLinux OS 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-016630 | V1R4 | AlmaLinux OS 9 /etc/shadow- file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-016740 | V1R4 | AlmaLinux OS 9 /etc/shadow- file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-016850 | V1R4 | AlmaLinux OS 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-016960 | V1R4 | AlmaLinux OS 9 /etc/shadow file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-017070 | V1R4 | AlmaLinux OS 9 /etc/shadow file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-017180 | V1R4 | AlmaLinux OS 9 /etc/shadow file must have mode 0000 to prevent unauthorized access. | AlmaLinux OS 9 |
| ALMA-09-017290 | V1R4 | AlmaLinux OS 9 must restrict privilege elevation to authorized personnel. | AlmaLinux OS 9 |
| ALMA-09-017400 | V1R4 | AlmaLinux OS 9 must use the invoking user's password for privilege escalation when using "sudo". | AlmaLinux OS 9 |
| ALMA-09-017950 | V1R4 | AlmaLinux OS 9 must not have unauthorized accounts. | AlmaLinux OS 9 |
| ALMA-09-018060 | V1R4 | AlmaLinux OS 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs). | AlmaLinux OS 9 |
| ALMA-09-018170 | V1R4 | AlmaLinux OS 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories. | AlmaLinux OS 9 |
| ALMA-09-018280 | V1R4 | AlmaLinux OS 9 must be configured so that the file integrity tool verifies extended attributes. | AlmaLinux OS 9 |
| ALMA-09-018500 | V1R4 | AlmaLinux OS 9 must not accept router advertisements on all IPv6 interfaces. | AlmaLinux OS 9 |
| ALMA-09-018610 | V1R4 | AlmaLinux OS 9 must ignore Internet Control Message Protocol (ICMP) redirect messages. | AlmaLinux OS 9 |
| ALMA-09-018830 | V1R4 | AlmaLinux OS 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems. | AlmaLinux OS 9 |
| ALMA-09-018940 | V1R4 | AlmaLinux OS 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs. | AlmaLinux OS 9 |
| ALMA-09-019050 | V1R4 | AlmaLinux OS 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | AlmaLinux OS 9 |
| ALMA-09-019160 | V1R4 | AlmaLinux OS 9 must not enable IP packet forwarding unless the system is a router. | AlmaLinux OS 9 |
| ALMA-09-019270 | V1R4 | AlmaLinux OS 9 must not have unauthorized IP tunnels configured. | AlmaLinux OS 9 |
| ALMA-09-019380 | V1R4 | AlmaLinux OS 9 must log packets with impossible addresses. | AlmaLinux OS 9 |
| ALMA-09-019490 | V1R4 | AlmaLinux OS 9 must be configured to prevent unrestricted mail relaying. | AlmaLinux OS 9 |
| ALMA-09-019600 | V1R4 | AlmaLinux OS 9 must have the nss-tools package installed. | AlmaLinux OS 9 |
| ALMA-09-019710 | V1R4 | AlmaLinux OS 9 network interfaces must not be in promiscuous mode. | AlmaLinux OS 9 |
| ALMA-09-019820 | V1R4 | AlmaLinux OS 9 must use reverse path filtering on all IP interfaces. | AlmaLinux OS 9 |
| ALMA-09-019930 | V1R4 | AlmaLinux OS 9 must not send Internet Control Message Protocol (ICMP) redirects. | AlmaLinux OS 9 |
| ALMA-09-020040 | V1R4 | There must be no .shosts files on AlmaLinux OS 9. | AlmaLinux OS 9 |
| ALMA-09-020150 | V1R4 | There must be no shosts.equiv files on AlmaLinux OS 9. | AlmaLinux OS 9 |
| ALMA-09-020260 | V1R4 | Alma Linux OS 9 must not accept IPv4 source-routed packets by default. | AlmaLinux OS 9 |
| ALMA-09-020370 | V1R4 | AlmaLinux OS 9 SSH daemon must not allow compression or must only allow compression after successful authentication. | AlmaLinux OS 9 |
| ALMA-09-020480 | V1R4 | The AlmaLinux OS 9 SSH server configuration file must be group-owned by root. | AlmaLinux OS 9 |
| ALMA-09-020590 | V1R4 | The AlmaLinux OS 9 SSH server configuration file must be owned by root. | AlmaLinux OS 9 |
| ALMA-09-020700 | V1R4 | AlmaLinux OS 9 SSH server configuration files must have mode 0600 or less permissive. | AlmaLinux OS 9 |
| ALMA-09-020810 | V1R4 | AlmaLinux OS 9 must not allow a noncertificate trusted host SSH logon to the system. | AlmaLinux OS 9 |
| ALMA-09-020920 | V1R4 | AlmaLinux OS 9 SSH private host key files must have mode 0640 or less permissive. | AlmaLinux OS 9 |
| ALMA-09-021030 | V1R4 | AlmaLinux OS 9 SSH public host key files must have mode 0644 or less permissive. | AlmaLinux OS 9 |
| ALMA-09-021140 | V1R4 | AlmaLinux OS 9 SSH daemon must not allow known hosts authentication. | AlmaLinux OS 9 |
| ALMA-09-021250 | V1R4 | AlmaLinux OS 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon. | AlmaLinux OS 9 |
| ALMA-09-021360 | V1R4 | AlmaLinux OS 9 SSH daemon must not allow rhosts authentication. | AlmaLinux OS 9 |
| ALMA-09-021470 | V1R4 | AlmaLinux OS 9 SSH daemon must disable remote X connections for interactive users. | AlmaLinux OS 9 |
| ALMA-09-021580 | V1R4 | AlmaLinux OS 9 SSH daemon must prevent remote hosts from connecting to the proxy display. | AlmaLinux OS 9 |
| ALMA-09-021690 | V1R4 | If the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon must be configured to operate in secure mode. | AlmaLinux OS 9 |
| ALMA-09-021800 | V1R4 | AlmaLinux OS 9 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time (JIT) compiler. | AlmaLinux OS 9 |
| ALMA-09-021910 | V1R4 | AlmaLinux OS 9 effective dconf policy must match the policy keyfiles. | AlmaLinux OS 9 |
| ALMA-09-022020 | V1R4 | AlmaLinux OS 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | AlmaLinux OS 9 |
| ALMA-09-022130 | V1R4 | All AlmaLinux OS 9 local initialization files must have mode 0740 or less permissive. | AlmaLinux OS 9 |
| ALMA-09-022240 | V1R4 | AlmaLinux OS 9 must have the gnutls-utils package installed. | AlmaLinux OS 9 |
| ALMA-09-022350 | V1R4 | The kdump service on AlmaLinux OS 9 must be disabled. | AlmaLinux OS 9 |
| ALMA-09-022460 | V1R4 | AlmaLinux OS 9 must disable the ability of a user to restart the system from the login screen. | AlmaLinux OS 9 |
| ALMA-09-022570 | V1R4 | AlmaLinux OS 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface. | AlmaLinux OS 9 |
| ALMA-09-022680 | V1R4 | AlmaLinux OS 9 must prevent special devices on file systems that are used with removable media. | AlmaLinux OS 9 |
| ALMA-09-022790 | V1R4 | AlmaLinux OS 9 must prevent code from being executed on file systems that are used with removable media. | AlmaLinux OS 9 |
| ALMA-09-022900 | V1R4 | AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | AlmaLinux OS 9 |
| ALMA-09-023010 | V1R4 | AlmaLinux OS 9 must disable the use of user namespaces. | AlmaLinux OS 9 |
| ALMA-09-023120 | V1R4 | AlmaLinux OS 9 must prevent special devices on file systems that are imported via Network File System (NFS). | AlmaLinux OS 9 |
| ALMA-09-023230 | V1R4 | AlmaLinux OS 9 must prevent code execution on file systems that are imported via Network File System (NFS). | AlmaLinux OS 9 |
| ALMA-09-023450 | V1R4 | AlmaLinux OS 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). | AlmaLinux OS 9 |
| ALMA-09-023560 | V1R4 | AlmaLinux OS 9 must configure a DNS processing mode set be Network Manager. | AlmaLinux OS 9 |
| ALMA-09-023670 | V1R4 | AlmaLinux OS 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured. | AlmaLinux OS 9 |
| ALMA-09-023780 | V1R4 | AlmaLinux OS 9 must prevent special devices on nonroot local partitions. | AlmaLinux OS 9 |
| ALMA-09-023890 | V1R4 | The root account must be the only account having unrestricted access to an AlmaLinux OS 9 system. | AlmaLinux OS 9 |
| ALMA-09-024000 | V1R4 | AlmaLinux OS 9 must be configured so that the cryptographic hashes of system files match vendor values. | AlmaLinux OS 9 |
| ALMA-09-024110 | V1R4 | AlmaLinux OS 9 must clear the page allocator to prevent use-after-free attacks. | AlmaLinux OS 9 |
| ALMA-09-024220 | V1R4 | AlmaLinux OS 9 must display the date and time of the last successful account logon upon logon. | AlmaLinux OS 9 |
| ALMA-09-024330 | V1R4 | AlmaLinux OS 9 security patches and updates must be installed and up to date. | AlmaLinux OS 9 |
| ALMA-09-024440 | V1R4 | AlmaLinux OS 9 policycoreutils-python-utils package must be installed. | AlmaLinux OS 9 |
| ALMA-09-024550 | V1R4 | AlmaLinux OS 9 must enable the hardware random number generator entropy gatherer service. | AlmaLinux OS 9 |
| ALMA-09-024660 | V1R4 | AlmaLinux OS 9 must have the rng-tools package installed. | AlmaLinux OS 9 |
| ALMA-09-024990 | V1R4 | AlmaLinux OS 9 system accounts must not have an interactive login shell. | AlmaLinux OS 9 |
| ALMA-09-025100 | V1R4 | AlmaLinux OS 9 must use a separate file system for /tmp. | AlmaLinux OS 9 |
| ALMA-09-025210 | V1R4 | Local AlmaLinux OS 9 initialization files must not execute world-writable programs. | AlmaLinux OS 9 |
| ALMA-09-025320 | V1R4 | AlmaLinux OS 9 must use a separate file system for /var/log. | AlmaLinux OS 9 |
| ALMA-09-025430 | V1R4 | AlmaLinux OS 9 must use a separate file system for /var. | AlmaLinux OS 9 |
| ALMA-09-025540 | V1R4 | AlmaLinux OS 9 must use a separate file system for /var/tmp. | AlmaLinux OS 9 |
| ALMA-09-025650 | V1R4 | AlmaLinux OS 9 must disable virtual system calls. | AlmaLinux OS 9 |
| ALMA-09-025760 | V1R4 | AlmaLinux OS 9 must use cron logging. | AlmaLinux OS 9 |
| ALMA-09-025870 | V1R4 | AlmaLinux OS 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | AlmaLinux OS 9 |
| APPL-13-000016 | V1R5 | The macOS system must be integrated into a directory services infrastructure. | macOS 13 - Ventura |
| APPL-13-000032 | V1R5 | The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup. | macOS 13 - Ventura |
| APPL-13-000033 | V1R5 | The macOS system must be configured to disable password forwarding for FileVault. | macOS 13 - Ventura |
| APPL-13-002050 | V1R5 | The macOS system must disable the Screen Sharing feature. | macOS 13 - Ventura |
| APPL-13-002060 | V1R5 | The macOS system must only allow applications with a valid digital signature to run. | macOS 13 - Ventura |
| APPL-13-002070 | V1R5 | The macOS system must use an approved antivirus program. | macOS 13 - Ventura |
| APPL-13-003012 | V1R5 | The macOS system must be configured to prevent displaying password hints. | macOS 13 - Ventura |
| APPL-13-003013 | V1R5 | The macOS system must be configured with a firmware password to prevent access to single user mode and booting from alternative media. | macOS 13 - Ventura |
| APPL-13-003050 | V1R5 | The macOS system must be configured so that the login command requires smart card authentication. | macOS 13 - Ventura |
| APPL-13-003051 | V1R5 | The macOS system must be configured so that the su command requires smart card authentication. | macOS 13 - Ventura |
| APPL-13-003052 | V1R5 | The macOS system must be configured so that the sudo command requires smart card authentication. | macOS 13 - Ventura |
| APPL-13-005051 | V1R5 | The macOS system must restrict the ability of individuals to use USB storage devices. | macOS 13 - Ventura |
| APPL-13-005053 | V1R5 | The macOS system must restrict the ability of individuals to write to external optical media. | macOS 13 - Ventura |
| APPL-14-003013 | V2R4 | The macOS system must enable firmware password. | macOS 14 - Sonoma |
| APPL-14-005110 | V2R4 | The macOS system must enforce enrollment in mobile device management. | macOS 14 - Sonoma |
| APPL-14-005120 | V2R4 | The macOS system must enable recovery lock. | macOS 14 - Sonoma |
| APPL-14-005130 | V2R4 | The macOS system must enforce installation of XProtect Remediator and Gatekeeper updates automatically. | macOS 14 - Sonoma |
| APPL-15-003013 | V1R5 | The macOS system must enable firmware password. | macOS 15 - Sequoia |
| APPL-15-005110 | V1R5 | The macOS system must enforce enrollment in Mobile Device Management (MDM). | macOS 15 - Sequoia |
| APPL-15-005120 | V1R5 | The macOS system must enable Recovery Lock. | macOS 15 - Sequoia |
| APPL-15-005130 | V1R5 | The macOS system must enforce installation of XProtect Remediator and Gatekeeper updates automatically. | macOS 15 - Sequoia |
| OL07-00-010020 | V3R3 | The Oracle Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values. | Oracle Linux 7 |
| OL07-00-010290 | V3R3 | The Oracle Linux operating system must not allow accounts configured with blank or null passwords. | Oracle Linux 7 |
| OL07-00-020230 | V3R3 | The Oracle Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line. | Oracle Linux 7 |
| OL07-00-020250 | V3R3 | The Oracle Linux operating system must be a vendor supported release. | Oracle Linux 7 |
| OL07-00-020260 | V3R3 | The Oracle Linux operating system security patches and updates must be installed and up to date. | Oracle Linux 7 |
| OL07-00-020270 | V3R3 | The Oracle Linux operating system must not have unnecessary accounts. | Oracle Linux 7 |
| OL07-00-020310 | V3R3 | The Oracle Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system. | Oracle Linux 7 |
| OL07-00-020320 | V3R3 | The Oracle Linux operating system must be configured so that all files and directories have a valid owner. | Oracle Linux 7 |
| OL07-00-020330 | V3R3 | The Oracle Linux operating system must be configured so that all files and directories have a valid group owner. | Oracle Linux 7 |
| OL07-00-020610 | V3R3 | The Oracle Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory. | Oracle Linux 7 |
| OL07-00-020620 | V3R3 | The Oracle Linux operating system must be configured so that all local interactive users have a home directory assigned and defined in the /etc/passwd file. | Oracle Linux 7 |
| OL07-00-020630 | V3R3 | The Oracle Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive. | Oracle Linux 7 |
| OL07-00-020640 | V3R3 | The Oracle Linux operating system must be configured so that all local interactive user home directories are owned by their respective users. | Oracle Linux 7 |
| OL07-00-020650 | V3R3 | The Oracle Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group. | Oracle Linux 7 |
| OL07-00-020660 | V3R3 | The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a valid owner. | Oracle Linux 7 |
| OL07-00-020670 | V3R3 | The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member. | Oracle Linux 7 |
| OL07-00-020680 | V3R3 | The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive. | Oracle Linux 7 |
| OL07-00-020690 | V3R3 | The Oracle Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root. | Oracle Linux 7 |
| OL07-00-020700 | V3R3 | The Oracle Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root. | Oracle Linux 7 |
| OL07-00-020710 | V3R3 | The Oracle Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive. | Oracle Linux 7 |
| OL07-00-020720 | V3R3 | The Oracle Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory. | Oracle Linux 7 |
| OL07-00-020730 | V3R3 | The Oracle Linux operating system must be configured so that local initialization files do not execute world-writable programs. | Oracle Linux 7 |
| OL07-00-020900 | V3R3 | The Oracle Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | Oracle Linux 7 |
| OL07-00-021000 | V3R3 | The Oracle Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed. | Oracle Linux 7 |
| OL07-00-021010 | V3R3 | The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Oracle Linux 7 |
| OL07-00-021020 | V3R3 | The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS). | Oracle Linux 7 |
| OL07-00-021021 | V3R3 | The Oracle Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS). | Oracle Linux 7 |
| OL07-00-021030 | V3R3 | The Oracle Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group. | Oracle Linux 7 |
| OL07-00-021040 | V3R3 | The Oracle Linux operating system must set the umask value to 077 for all local interactive user accounts. | Oracle Linux 7 |
| OL07-00-021100 | V3R3 | The Oracle Linux operating system must have cron logging implemented. | Oracle Linux 7 |
| OL07-00-021110 | V3R3 | The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root. | Oracle Linux 7 |
| OL07-00-021120 | V3R3 | The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root. | Oracle Linux 7 |
| OL07-00-021300 | V3R3 | The Oracle Linux operating system must disable Kernel core dumps unless needed. | Oracle Linux 7 |
| OL07-00-021310 | V3R3 | The Oracle Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent). | Oracle Linux 7 |
| OL07-00-021320 | V3R3 | The Oracle Linux operating system must use a separate file system for /var. | Oracle Linux 7 |
| OL07-00-021340 | V3R3 | The Oracle Linux operating system must use a separate file system for /tmp (or equivalent). | Oracle Linux 7 |
| OL07-00-021600 | V3R3 | The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs). | Oracle Linux 7 |
| OL07-00-021610 | V3R3 | The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes. | Oracle Linux 7 |
| OL07-00-021620 | V3R3 | The Oracle Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories. | Oracle Linux 7 |
| OL07-00-031000 | V3R3 | The Oracle Linux operating system must send rsyslog output to a log aggregation server. | Oracle Linux 7 |
| OL07-00-031010 | V3R3 | The Oracle Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | Oracle Linux 7 |
| OL07-00-032000 | V3R3 | The Oracle Linux operating system must use a virus scan program. | Oracle Linux 7 |
| OL07-00-040330 | V3R3 | The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication. | Oracle Linux 7 |
| OL07-00-040350 | V3R3 | The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication. | Oracle Linux 7 |
| OL07-00-040360 | V3R3 | The Oracle Linux operating system must display the date and time of the last successful account logon upon an SSH logon. | Oracle Linux 7 |
| OL07-00-040370 | V3R3 | The Oracle Linux operating system must not permit direct logons to the root account using remote access via SSH. | Oracle Linux 7 |
| OL07-00-040380 | V3R3 | The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication. | Oracle Linux 7 |
| OL07-00-040410 | V3R3 | The Oracle Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive. | Oracle Linux 7 |
| OL07-00-040420 | V3R3 | The Oracle Linux operating system must be configured so the SSH private host key files have mode 0640 or less permissive. | Oracle Linux 7 |
| OL07-00-040450 | V3R3 | The Oracle Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files. | Oracle Linux 7 |
| OL07-00-040460 | V3R3 | The Oracle Linux operating system must be configured so that the SSH daemon uses privilege separation. | Oracle Linux 7 |
| OL07-00-040470 | V3R3 | The Oracle Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication. | Oracle Linux 7 |
| OL07-00-040520 | V3R3 | The Oracle Linux operating system must enable an application firewall, if available. | Oracle Linux 7 |
| OL07-00-040530 | V3R3 | The Oracle Linux operating system must display the date and time of the last successful account logon upon logon. | Oracle Linux 7 |
| OL07-00-040540 | V3R3 | The Oracle Linux operating system must not contain .shosts files. | Oracle Linux 7 |
| OL07-00-040550 | V3R3 | The Oracle Linux operating system must not contain shosts.equiv files. | Oracle Linux 7 |
| OL07-00-040600 | V3R3 | For Oracle Linux operating systems using DNS resolution, at least two name servers must be configured. | Oracle Linux 7 |
| OL07-00-040610 | V3R3 | The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets. | Oracle Linux 7 |
| OL07-00-040611 | V3R3 | The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces. | Oracle Linux 7 |
| OL07-00-040612 | V3R3 | The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default. | Oracle Linux 7 |
| OL07-00-040620 | V3R3 | The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default. | Oracle Linux 7 |
| OL07-00-040630 | V3R3 | The Oracle Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Oracle Linux 7 |
| OL07-00-040640 | V3R3 | The Oracle Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Oracle Linux 7 |
| OL07-00-040641 | V3R3 | The Oracle Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. | Oracle Linux 7 |
| OL07-00-040650 | V3R3 | The Oracle Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default. | Oracle Linux 7 |
| OL07-00-040660 | V3R3 | The Oracle Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects. | Oracle Linux 7 |
| OL07-00-040670 | V3R3 | Network interfaces configured on The Oracle Linux operating system must not be in promiscuous mode. | Oracle Linux 7 |
| OL07-00-040680 | V3R3 | The Oracle Linux operating system must be configured to prevent unrestricted mail relaying. | Oracle Linux 7 |
| OL07-00-040690 | V3R3 | The Oracle Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed. | Oracle Linux 7 |
| OL07-00-040700 | V3R3 | The Oracle Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support. | Oracle Linux 7 |
| OL07-00-040710 | V3R3 | The Oracle Linux operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Oracle Linux 7 |
| OL07-00-040720 | V3R3 | The Oracle Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode. | Oracle Linux 7 |
| OL07-00-040730 | V3R3 | The Oracle Linux operating system must not have a graphical display manager installed unless approved. | Oracle Linux 7 |
| OL07-00-040740 | V3R3 | The Oracle Linux operating system must not be performing packet forwarding unless the system is a router. | Oracle Linux 7 |
| OL07-00-040750 | V3R3 | The Oracle Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS. | Oracle Linux 7 |
| OL07-00-040800 | V3R3 | SNMP community strings on the Oracle Linux operating system must be changed from the default. | Oracle Linux 7 |
| OL07-00-040810 | V3R3 | The Oracle Linux operating system access control program must be configured to grant or deny system access to specific hosts and services. | Oracle Linux 7 |
| OL07-00-040820 | V3R3 | The Oracle Linux operating system must not have unauthorized IP tunnels configured. | Oracle Linux 7 |
| OL07-00-040830 | V3R3 | The Oracle Linux operating system must not forward IPv6 source-routed packets. | Oracle Linux 7 |
| OL07-00-020231 | V3R3 | The Oracle Linux operating system must be configured so the x86 Ctrl-Alt-Delete key sequence is disabled in the Graphical User Interface. | Oracle Linux 7 |
| OL07-00-021031 | V3R3 | The Oracle Linux operating system must be configured so that all world-writable directories are owned by root, sys, bin, or an application user. | Oracle Linux 7 |
| OL07-00-040711 | V3R3 | The Oracle Linux operating system SSH daemon must prevent remote hosts from connecting to the proxy display. | Oracle Linux 7 |
| OL07-00-010341 | V3R3 | The Oracle Linux operating system must restrict privilege elevation to authorized personnel. | Oracle Linux 7 |
| OL07-00-010342 | V3R3 | The Oracle Linux operating system must use the invoking user's password for privilege escalation when using "sudo". | Oracle Linux 7 |
| OL07-00-010291 | V3R3 | The Oracle Linux operating system must not have accounts configured with blank or null passwords. | Oracle Linux 7 |
| OL07-00-010339 | V3R3 | The Oracle Linux operating system must specify the default "include" directory for the /etc/sudoers file. | Oracle Linux 7 |
| OL07-00-010063 | V3R3 | The Oracle Linux operating system must disable the login screen user list for graphical user interfaces. | Oracle Linux 7 |
| OL08-00-010000 | V2R6 | OL 8 must be a vendor-supported release. | Oracle Linux 8 |
| OL08-00-010010 | V2R6 | OL 8 vendor-packaged system security patches and updates must be installed and up to date. | Oracle Linux 8 |
| OL08-00-010382 | V2R6 | OL 8 must restrict privilege elevation to authorized personnel. | Oracle Linux 8 |
| OL08-00-010383 | V2R6 | OL 8 must use the invoking user's password for privilege escalation when using "sudo". | Oracle Linux 8 |
| OL08-00-010424 | V2R6 | OL 8 must not let Meltdown and Spectre exploit critical vulnerabilities in modern processors. | Oracle Linux 8 |
| OL08-00-010460 | V2R6 | There must be no "shosts.equiv" files on the OL 8 operating system. | Oracle Linux 8 |
| OL08-00-010470 | V2R6 | There must be no ".shosts" files on the OL 8 operating system. | Oracle Linux 8 |
| OL08-00-010473 | V2R6 | OL 8 must enable the hardware random number generator entropy gatherer service. | Oracle Linux 8 |
| OL08-00-010472 | V2R6 | OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. | Oracle Linux 8 |
| OL08-00-010480 | V2R6 | The OL 8 SSH public host key files must have mode "0644" or less permissive. | Oracle Linux 8 |
| OL08-00-010490 | V2R6 | The OL 8 SSH private host key files must have mode "0640" or less permissive. | Oracle Linux 8 |
| OL08-00-010500 | V2R6 | The OL 8 SSH daemon must perform strict mode checking of home directory configuration files. | Oracle Linux 8 |
| OL08-00-010520 | V2R6 | The OL 8 SSH daemon must not allow authentication using known host's authentication. | Oracle Linux 8 |
| OL08-00-010521 | V2R6 | The OL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements. | Oracle Linux 8 |
| OL08-00-010522 | V2R6 | The OL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements. | Oracle Linux 8 |
| OL08-00-010540 | V2R6 | OL 8 must use a separate file system for "/var". | Oracle Linux 8 |
| OL08-00-010541 | V2R6 | OL 8 must use a separate file system for "/var/log". | Oracle Linux 8 |
| OL08-00-010542 | V2R6 | OL 8 must use a separate file system for the system audit data path. | Oracle Linux 8 |
| OL08-00-010543 | V2R6 | OL 8 must use a separate file system for "/tmp". | Oracle Linux 8 |
| OL08-00-010544 | V2R6 | OL 8 must use a separate file system for /var/tmp. | Oracle Linux 8 |
| OL08-00-010561 | V2R6 | OL 8 must have the rsyslog service enabled and active. | Oracle Linux 8 |
| OL08-00-010570 | V2R6 | OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories. | Oracle Linux 8 |
| OL08-00-010571 | V2R6 | OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory. | Oracle Linux 8 |
| OL08-00-010572 | V2R6 | OL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. | Oracle Linux 8 |
| OL08-00-010580 | V2R6 | OL 8 must prevent special devices on non-root local partitions. | Oracle Linux 8 |
| OL08-00-010590 | V2R6 | OL 8 file systems that contain user home directories must not execute binary files. | Oracle Linux 8 |
| OL08-00-010600 | V2R6 | OL 8 file systems must not interpret character or block special devices from untrusted file systems. | Oracle Linux 8 |
| OL08-00-010610 | V2R6 | OL 8 file systems must not execute binary files on removable media. | Oracle Linux 8 |
| OL08-00-010620 | V2R6 | OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Oracle Linux 8 |
| OL08-00-010630 | V2R6 | OL 8 file systems must not execute binary files that are imported via Network File System (NFS). | Oracle Linux 8 |
| OL08-00-010640 | V2R6 | OL 8 file systems must not interpret character or block special devices that are imported via NFS. | Oracle Linux 8 |
| OL08-00-010650 | V2R6 | OL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). | Oracle Linux 8 |
| OL08-00-010660 | V2R6 | Local OL 8 initialization files must not execute world-writable programs. | Oracle Linux 8 |
| OL08-00-010671 | V2R6 | OL 8 must disable the "kernel.core_pattern". | Oracle Linux 8 |
| OL08-00-010672 | V2R6 | OL 8 must disable acquiring, saving, and processing core dumps. | Oracle Linux 8 |
| OL08-00-010673 | V2R6 | OL 8 must disable core dumps for all users. | Oracle Linux 8 |
| OL08-00-010674 | V2R6 | OL 8 must disable storing core dumps. | Oracle Linux 8 |
| OL08-00-010675 | V2R6 | OL 8 must disable core dump backtraces. | Oracle Linux 8 |
| OL08-00-010680 | V2R6 | For OL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured. | Oracle Linux 8 |
| OL08-00-010690 | V2R6 | Executable search paths within the initialization files of all local interactive OL 8 users must only contain paths that resolve to the system default or the user's home directory. | Oracle Linux 8 |
| OL08-00-010700 | V2R6 | All OL 8 world-writable directories must be owned by root, sys, bin, or an application user. | Oracle Linux 8 |
| OL08-00-010710 | V2R6 | All OL 8 world-writable directories must be group-owned by root, sys, bin, or an application group. | Oracle Linux 8 |
| OL08-00-010720 | V2R6 | All OL 8 local interactive users must have a home directory assigned in the "/etc/passwd" file. | Oracle Linux 8 |
| OL08-00-010730 | V2R6 | All OL 8 local interactive user home directories must have mode "0750" or less permissive. | Oracle Linux 8 |
| OL08-00-010731 | V2R6 | All OL 8 local interactive user home directory files must have mode "0750" or less permissive. | Oracle Linux 8 |
| OL08-00-010740 | V2R6 | All OL 8 local interactive user home directories must be group-owned by the home directory owner's primary group. | Oracle Linux 8 |
| OL08-00-010741 | V2R6 | OL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member. | Oracle Linux 8 |
| OL08-00-010750 | V2R6 | All OL 8 local interactive user home directories defined in the "/etc/passwd" file must exist. | Oracle Linux 8 |
| OL08-00-010760 | V2R6 | All OL 8 local interactive user accounts must be assigned a home directory upon creation. | Oracle Linux 8 |
| OL08-00-010770 | V2R6 | All OL 8 local initialization files must have mode "0740" or less permissive. | Oracle Linux 8 |
| OL08-00-010780 | V2R6 | All OL 8 files and directories must have a valid owner. | Oracle Linux 8 |
| OL08-00-010790 | V2R6 | All OL 8 files and directories must have a valid group owner. | Oracle Linux 8 |
| OL08-00-010800 | V2R6 | A separate OL 8 filesystem must be used for user home directories (such as "/home" or an equivalent). | Oracle Linux 8 |
| OL08-00-020032 | V2R6 | OL 8 must disable the user list at logon for graphical user interfaces. | Oracle Linux 8 |
| OL08-00-020320 | V2R6 | OL 8 must not have unnecessary accounts. | Oracle Linux 8 |
| OL08-00-020330 | V2R6 | OL 8 must not allow accounts configured with blank or null passwords. | Oracle Linux 8 |
| OL08-00-020331 | V2R6 | OL 8 must not allow blank or null passwords in the system-auth file. | Oracle Linux 8 |
| OL08-00-020332 | V2R6 | OL 8 must not allow blank or null passwords in the password-auth file. | Oracle Linux 8 |
| OL08-00-020340 | V2R6 | OL 8 must display the date and time of the last successful account logon upon logon. | Oracle Linux 8 |
| OL08-00-020350 | V2R6 | OL 8 must display the date and time of the last successful account logon upon an SSH logon. | Oracle Linux 8 |
| OL08-00-030010 | V2R6 | Cron logging must be implemented in OL 8. | Oracle Linux 8 |
| OL08-00-030061 | V2R6 | The OL 8 audit system must audit local events. | Oracle Linux 8 |
| OL08-00-030063 | V2R6 | OL 8 must resolve audit information before writing to disk. | Oracle Linux 8 |
| OL08-00-030670 | V2R6 | OL 8 must have the packages required for offloading audit logs installed. | Oracle Linux 8 |
| OL08-00-030680 | V2R6 | OL 8 must have the packages required for encrypting offloaded audit logs installed. | Oracle Linux 8 |
| OL08-00-040021 | V2R6 | OL 8 must not have the asynchronous transfer mode (ATM) kernel module installed if not required for operational support. | Oracle Linux 8 |
| OL08-00-040022 | V2R6 | OL 8 must not have the Controller Area Network (CAN) kernel module installed if not required for operational support. | Oracle Linux 8 |
| OL08-00-040023 | V2R6 | OL 8 must not have the stream control transmission protocol (SCTP) kernel module installed if not required for operational support. | Oracle Linux 8 |
| OL08-00-040170 | V2R6 | The x86 Ctrl-Alt-Delete key sequence must be disabled on OL 8. | Oracle Linux 8 |
| OL08-00-040171 | V2R6 | The x86 Ctrl-Alt-Delete key sequence in OL 8 must be disabled if a graphical user interface is installed. | Oracle Linux 8 |
| OL08-00-040172 | V2R6 | OL 8 must disable the systemd Ctrl-Alt-Delete burst key sequence. | Oracle Linux 8 |
| OL08-00-040180 | V2R6 | OL 8 must disable the debug-shell systemd service. | Oracle Linux 8 |
| OL08-00-040190 | V2R6 | The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for OL 8 operational support. | Oracle Linux 8 |
| OL08-00-040200 | V2R6 | The root account must be the only account having unrestricted access to the OL 8 system. | Oracle Linux 8 |
| OL08-00-040209 | V2R6 | OL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Oracle Linux 8 |
| OL08-00-040210 | V2R6 | OL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Oracle Linux 8 |
| OL08-00-040220 | V2R6 | OL 8 must not send Internet Control Message Protocol (ICMP) redirects. | Oracle Linux 8 |
| OL08-00-040230 | V2R6 | OL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Oracle Linux 8 |
| OL08-00-040239 | V2R6 | OL 8 must not forward IPv4 source-routed packets. | Oracle Linux 8 |
| OL08-00-040240 | V2R6 | OL 8 must not forward IPv6 source-routed packets. | Oracle Linux 8 |
| OL08-00-040249 | V2R6 | OL 8 must not forward IPv4 source-routed packets by default. | Oracle Linux 8 |
| OL08-00-040250 | V2R6 | OL 8 must not forward IPv6 source-routed packets by default. | Oracle Linux 8 |
| OL08-00-040260 | V2R6 | OL 8 must not enable IPv6 packet forwarding unless the system is a router. | Oracle Linux 8 |
| OL08-00-040261 | V2R6 | OL 8 must not accept router advertisements on all IPv6 interfaces. | Oracle Linux 8 |
| OL08-00-040262 | V2R6 | OL 8 must not accept router advertisements on all IPv6 interfaces by default. | Oracle Linux 8 |
| OL08-00-040270 | V2R6 | OL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. | Oracle Linux 8 |
| OL08-00-040279 | V2R6 | OL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages. | Oracle Linux 8 |
| OL08-00-040280 | V2R6 | OL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. | Oracle Linux 8 |
| OL08-00-040281 | V2R6 | OL 8 must disable access to the network "bpf" syscall from unprivileged processes. | Oracle Linux 8 |
| OL08-00-040282 | V2R6 | OL 8 must restrict the use of "ptrace" to descendant processes. | Oracle Linux 8 |
| OL08-00-040283 | V2R6 | OL 8 must restrict exposed kernel pointer addresses access. | Oracle Linux 8 |
| OL08-00-040284 | V2R6 | OL 8 must disable the use of user namespaces. | Oracle Linux 8 |
| OL08-00-040285 | V2R6 | OL 8 must use reverse path filtering on all IPv4 interfaces. | Oracle Linux 8 |
| OL08-00-040286 | V2R6 | OL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler. | Oracle Linux 8 |
| OL08-00-040290 | V2R6 | OL 8 must be configured to prevent unrestricted mail relaying. | Oracle Linux 8 |
| OL08-00-040300 | V2R6 | The OL 8 file integrity tool must be configured to verify extended attributes. | Oracle Linux 8 |
| OL08-00-040310 | V2R6 | The OL 8 file integrity tool must be configured to verify Access Control Lists (ACLs). | Oracle Linux 8 |
| OL08-00-040320 | V2R6 | The graphical display manager must not be installed on OL 8 unless approved. | Oracle Linux 8 |
| OL08-00-040330 | V2R6 | OL 8 network interfaces must not be in promiscuous mode. | Oracle Linux 8 |
| OL08-00-040340 | V2R6 | OL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements. | Oracle Linux 8 |
| OL08-00-040341 | V2R6 | The OL 8 SSH daemon must prevent remote hosts from connecting to the proxy display. | Oracle Linux 8 |
| OL08-00-040350 | V2R6 | If the Trivial File Transfer Protocol (TFTP) server is required, the OL 8 TFTP daemon must be configured to operate in secure mode. | Oracle Linux 8 |
| OL08-00-040360 | V2R6 | A File Transfer Protocol (FTP) server package must not be installed unless mission essential on OL 8. | Oracle Linux 8 |
| OL08-00-040370 | V2R6 | OL 8 must not have the "gssproxy" package installed if not required for operational support. | Oracle Linux 8 |
| OL08-00-040380 | V2R6 | OL 8 must not have the "iprutils" package installed if not required for operational support. | Oracle Linux 8 |
| OL08-00-040390 | V2R6 | OL 8 must not have the "tuned" package installed if not required for operational support. | Oracle Linux 8 |
| OL08-00-010121 | V2R6 | The OL 8 operating system must not have accounts configured with blank or null passwords. | Oracle Linux 8 |
| OL08-00-010379 | V2R6 | OL 8 must specify the default "include" directory for the /etc/sudoers file. | Oracle Linux 8 |
| OL08-00-020101 | V2R6 | OL 8 must ensure the password complexity module is enabled in the system-auth file. | Oracle Linux 8 |
| OL08-00-020102 | V2R6 | OL 8 systems below version 8.4 must ensure the password complexity module in the system-auth file is configured for three retries or less. | Oracle Linux 8 |
| OL08-00-020103 | V2R6 | OL 8 systems below version 8.4 must ensure the password complexity module in the password-auth file is configured for three retries or less. | Oracle Linux 8 |
| OL08-00-020104 | V2R6 | OL 8 systems, version 8.4 and above, must ensure the password complexity module is configured for three retries or less. | Oracle Linux 8 |
| OL08-00-040259 | V2R6 | OL 8 must not enable IPv4 packet forwarding unless the system is a router. | Oracle Linux 8 |
| OL08-00-040321 | V2R6 | The graphical display manager must not be the default target on OL 8 unless approved. | Oracle Linux 8 |
| OL09-00-000003 | V1R3 | OL 9 must be configured so that a separate file system must be used for user home directories (such as /home or an equivalent). | Oracle Linux 9 |
| OL09-00-000004 | V1R3 | OL 9 must use a separate file system for /tmp. | Oracle Linux 9 |
| OL09-00-000005 | V1R3 | OL 9 must use a separate file system for /var. | Oracle Linux 9 |
| OL09-00-000006 | V1R3 | OL 9 must use a separate file system for /var/log. | Oracle Linux 9 |
| OL09-00-000007 | V1R3 | OL 9 must use a separate file system for /var/tmp. | Oracle Linux 9 |
| OL09-00-000015 | V1R3 | OL 9 vendor packaged system security patches and updates must be installed and up to date. | Oracle Linux 9 |
| OL09-00-000020 | V1R3 | OL 9 must be configured so that the graphical display manager is not the default target unless approved. | Oracle Linux 9 |
| OL09-00-000135 | V1R3 | OL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed. | Oracle Linux 9 |
| OL09-00-000140 | V1R3 | OL 9 must not have the quagga package installed. | Oracle Linux 9 |
| OL09-00-000145 | V1R3 | OL 9 must not have a graphical display manager installed unless approved. | Oracle Linux 9 |
| OL09-00-000210 | V1R3 | OL 9 policycoreutils-python-utils package must be installed. | Oracle Linux 9 |
| OL09-00-000224 | V1R3 | OL 9 must be configured so that the firewall employs a deny-all, allow-by-exception policy for allowing connections to other systems. | Oracle Linux 9 |
| OL09-00-000231 | V1R3 | OL 9 must use the invoking user's password for privilege escalation when using sudo. | Oracle Linux 9 |
| OL09-00-000232 | V1R3 | OL 9 must restrict privilege elevation to authorized personnel. | Oracle Linux 9 |
| OL09-00-000243 | V1R3 | OL 9 must be configured so that the cryptographic hashes of system files match vendor values. | Oracle Linux 9 |
| OL09-00-000260 | V1R3 | OL 9 must have the openssh-clients package installed. | Oracle Linux 9 |
| OL09-00-000302 | V1R3 | OL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories. | Oracle Linux 9 |
| OL09-00-000303 | V1R3 | OL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs). | Oracle Linux 9 |
| OL09-00-000304 | V1R3 | OL 9 must be configured so that the file integrity tool verifies extended attributes. | Oracle Linux 9 |
| OL09-00-000351 | V1R3 | OL 9 must be configured so that the rsyslog service is active. | Oracle Linux 9 |
| OL09-00-000360 | V1R3 | OL 9 must enable the hardware random number generator entropy gatherer service. | Oracle Linux 9 |
| OL09-00-000370 | V1R3 | OL 9 must have the rng-tools package installed. | Oracle Linux 9 |
| OL09-00-000380 | V1R3 | OL 9 must have the nss-tools package installed. | Oracle Linux 9 |
| OL09-00-000430 | V1R3 | OL 9 must have the gnutls-utils package installed. | Oracle Linux 9 |
| OL09-00-000880 | V1R3 | OL 9 must write audit records to disk. | Oracle Linux 9 |
| OL09-00-001000 | V1R3 | OL 9 must ensure the password complexity module is enabled in the system-auth file. | Oracle Linux 9 |
| OL09-00-001110 | V1R3 | OL 9 must not allow blank or null passwords. | Oracle Linux 9 |
| OL09-00-001130 | V1R3 | OL 9 must not have accounts configured with blank or null passwords. | Oracle Linux 9 |
| OL09-00-002010 | V1R3 | OL 9 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS. | Oracle Linux 9 |
| OL09-00-002011 | V1R3 | OL 9 must prevent special devices on file systems that are imported via Network File System (NFS). | Oracle Linux 9 |
| OL09-00-002012 | V1R3 | OL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS). | Oracle Linux 9 |
| OL09-00-002013 | V1R3 | OL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). | Oracle Linux 9 |
| OL09-00-002020 | V1R3 | OL 9 must prevent code from being executed on file systems that are used with removable media. | Oracle Linux 9 |
| OL09-00-002021 | V1R3 | OL 9 must prevent special devices on file systems that are used with removable media. | Oracle Linux 9 |
| OL09-00-002022 | V1R3 | OL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Oracle Linux 9 |
| OL09-00-002072 | V1R3 | OL 9 must prevent code from being executed on file systems that contain user home directories. | Oracle Linux 9 |
| OL09-00-002080 | V1R3 | OL 9 must prevent special devices on nonroot local partitions. | Oracle Linux 9 |
| OL09-00-002102 | V1R3 | OL 9 must disable the user list at logon for graphical user interfaces. | Oracle Linux 9 |
| OL09-00-002107 | V1R3 | OL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot. | Oracle Linux 9 |
| OL09-00-002127 | V1R3 | OL 9 must disable the ability of a user to restart the system from the login screen. | Oracle Linux 9 |
| OL09-00-002128 | V1R3 | OL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface. | Oracle Linux 9 |
| OL09-00-002129 | V1R3 | OL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface. | Oracle Linux 9 |
| OL09-00-002162 | V1R3 | OL 9 effective dconf policy must match the policy keyfiles. | Oracle Linux 9 |
| OL09-00-002301 | V1R3 | OL 9 must define default permissions for the bash shell. | Oracle Linux 9 |
| OL09-00-002302 | V1R3 | OL 9 must define default permissions for the c shell. | Oracle Linux 9 |
| OL09-00-002303 | V1R3 | OL 9 must define default permissions for the system default profile. | Oracle Linux 9 |
| OL09-00-002348 | V1R3 | OL 9 SSH daemon must not allow rhosts authentication. | Oracle Linux 9 |
| OL09-00-002349 | V1R3 | OL 9 SSH daemon must not allow known hosts authentication. | Oracle Linux 9 |
| OL09-00-002350 | V1R3 | OL 9 SSH daemon must disable remote X connections for interactive users. | Oracle Linux 9 |
| OL09-00-002351 | V1R3 | OL 9 SSH daemon must perform strict mode checking of home directory configuration files. | Oracle Linux 9 |
| OL09-00-002352 | V1R3 | OL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon. | Oracle Linux 9 |
| OL09-00-002354 | V1R3 | OL 9 SSH daemon must prevent remote hosts from connecting to the proxy display. | Oracle Linux 9 |
| OL09-00-002355 | V1R3 | OL 9 SSH daemon must not allow compression or must only allow compression after successful authentication. | Oracle Linux 9 |
| OL09-00-002360 | V1R3 | OL 9 must require reauthentication when using the "sudo" command. | Oracle Linux 9 |
| OL09-00-002370 | V1R3 | OL 9 must disable the use of user namespaces. | Oracle Linux 9 |
| OL09-00-002380 | V1R3 | OL 9 must disable the kernel.core_pattern. | Oracle Linux 9 |
| OL09-00-002381 | V1R3 | OL 9 must disable core dump backtraces. | Oracle Linux 9 |
| OL09-00-002382 | V1R3 | OL 9 must disable storing core dumps. | Oracle Linux 9 |
| OL09-00-002383 | V1R3 | OL 9 must disable core dumps for all users. | Oracle Linux 9 |
| OL09-00-002384 | V1R3 | OL 9 must disable acquiring, saving, and processing core dumps. | Oracle Linux 9 |
| OL09-00-002385 | V1R3 | OL 9 must be configured so that the kdump service is disabled. | Oracle Linux 9 |
| OL09-00-002392 | V1R3 | OL 9 must disable the ability of systemd to spawn an interactive boot process. | Oracle Linux 9 |
| OL09-00-002419 | V1R3 | OL 9 file systems must not contain shosts.equiv files. | Oracle Linux 9 |
| OL09-00-002420 | V1R3 | OL 9 file systems must not contain .shosts files. | Oracle Linux 9 |
| OL09-00-002425 | V1R3 | OL 9 must be configured to prevent unrestricted mail relaying. | Oracle Linux 9 |
| OL09-00-002426 | V1R3 | OL 9 Trivial File Transfer Protocol (TFTP) daemon must be configured to operate in secure mode if the TFTP server is required. | Oracle Linux 9 |
| OL09-00-002427 | V1R3 | OL 9 must be configured so that local initialization files do not execute world-writable programs. | Oracle Linux 9 |
| OL09-00-002430 | V1R3 | OL 9 must enable hardening for the Berkeley Packet Filter (BPF) just-in-time compiler. | Oracle Linux 9 |
| OL09-00-002500 | V1R3 | OL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | Oracle Linux 9 |
| OL09-00-002501 | V1R3 | OL 9 must not have unauthorized accounts. | Oracle Linux 9 |
| OL09-00-002502 | V1R3 | OL 9 SSH private host key files must have mode 0640 or less permissive. | Oracle Linux 9 |
| OL09-00-002503 | V1R3 | OL 9 SSH public host key files must have mode 0644 or less permissive. | Oracle Linux 9 |
| OL09-00-002507 | V1R3 | OL 9 SSH server configuration file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002508 | V1R3 | OL 9 SSH server configuration file must be owned by root. | Oracle Linux 9 |
| OL09-00-002509 | V1R3 | OL 9 SSH server configuration file must have mode 0600 or less permissive. | Oracle Linux 9 |
| OL09-00-002511 | V1R3 | OL 9 local files and directories must have a valid group owner. | Oracle Linux 9 |
| OL09-00-002512 | V1R3 | OL 9 local files and directories must have a valid owner. | Oracle Linux 9 |
| OL09-00-002513 | V1R3 | OL 9 local initialization files must have mode 0740 or less permissive. | Oracle Linux 9 |
| OL09-00-002514 | V1R3 | OL 9 local interactive user home directories must be group-owned by the home directory owner's primary group. | Oracle Linux 9 |
| OL09-00-002515 | V1R3 | OL 9 local interactive user home directories must have mode 0750 or less permissive. | Oracle Linux 9 |
| OL09-00-002530 | V1R3 | OL 9 /boot/grub2/grub.cfg file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002531 | V1R3 | OL 9 /boot/grub2/grub.cfg file must be owned by root. | Oracle Linux 9 |
| OL09-00-002532 | V1R3 | OL 9 /etc/group file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002533 | V1R3 | OL 9 /etc/group- file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002534 | V1R3 | OL 9 /etc/group file must be owned by root. | Oracle Linux 9 |
| OL09-00-002535 | V1R3 | OL 9 /etc/group- file must be owned by root. | Oracle Linux 9 |
| OL09-00-002536 | V1R3 | OL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002537 | V1R3 | OL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002538 | V1R3 | OL 9 /etc/gshadow file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002539 | V1R3 | OL 9 /etc/gshadow- file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002540 | V1R3 | OL 9 /etc/gshadow file must be owned by root. | Oracle Linux 9 |
| OL09-00-002541 | V1R3 | OL 9 /etc/gshadow- file must be owned by root. | Oracle Linux 9 |
| OL09-00-002542 | V1R3 | OL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002543 | V1R3 | OL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002544 | V1R3 | OL 9 /etc/passwd file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002545 | V1R3 | OL 9 /etc/passwd- file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002546 | V1R3 | OL 9 /etc/passwd file must be owned by root. | Oracle Linux 9 |
| OL09-00-002547 | V1R3 | OL 9 /etc/passwd- file must be owned by root. | Oracle Linux 9 |
| OL09-00-002548 | V1R3 | OL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002549 | V1R3 | OL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002550 | V1R3 | OL 9 /etc/shadow file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002551 | V1R3 | OL 9 /etc/shadow- file must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002552 | V1R3 | OL 9 /etc/shadow file must be owned by root. | Oracle Linux 9 |
| OL09-00-002553 | V1R3 | OL 9 /etc/shadow- file must be owned by root. | Oracle Linux 9 |
| OL09-00-002554 | V1R3 | OL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002555 | V1R3 | OL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access. | Oracle Linux 9 |
| OL09-00-002580 | V1R3 | OL 9 cron configuration directories must have a mode of 0700 or less permissive. | Oracle Linux 9 |
| OL09-00-002581 | V1R3 | OL 9 cron configuration files directory must be group-owned by root. | Oracle Linux 9 |
| OL09-00-002582 | V1R3 | OL 9 cron configuration files directory must be owned by root. | Oracle Linux 9 |
| OL09-00-002583 | V1R3 | OL 9 /etc/crontab file must have mode 0600. | Oracle Linux 9 |
| OL09-00-003000 | V1R3 | OL 9 must be configured so that the root account is the only account having unrestricted access to the system. | Oracle Linux 9 |
| OL09-00-003002 | V1R3 | OL 9 local interactive users must have a home directory assigned in the /etc/passwd file. | Oracle Linux 9 |
| OL09-00-003050 | V1R3 | OL 9 local interactive user home directories defined in the /etc/passwd file must exist. | Oracle Linux 9 |
| OL09-00-003051 | V1R3 | OL 9 system accounts must not have an interactive login shell. | Oracle Linux 9 |
| OL09-00-003052 | V1R3 | OL 9 local interactive user accounts must be assigned a home directory upon creation. | Oracle Linux 9 |
| OL09-00-003053 | V1R3 | OL 9 must be configured so that executable search paths within the initialization files of all local interactive users must only contain paths that resolve to the system default or the users home directory. | Oracle Linux 9 |
| OL09-00-003060 | V1R3 | OL 9 must set the umask value to 077 for all local interactive user accounts. | Oracle Linux 9 |
| OL09-00-005010 | V1R3 | OL 9 must use cron logging. | Oracle Linux 9 |
| OL09-00-005030 | V1R3 | OL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | Oracle Linux 9 |
| OL09-00-006002 | V1R3 | OL 9 must configure a DNS processing mode set be Network Manager. | Oracle Linux 9 |
| OL09-00-006003 | V1R3 | OL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured. | Oracle Linux 9 |
| OL09-00-006004 | V1R3 | OL 9 network interfaces must not be in promiscuous mode. | Oracle Linux 9 |
| OL09-00-006010 | V1R3 | OL 9 must not have unauthorized IP tunnels configured. | Oracle Linux 9 |
| OL09-00-006020 | V1R3 | OL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. | Oracle Linux 9 |
| OL09-00-006021 | V1R3 | OL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets. | Oracle Linux 9 |
| OL09-00-006022 | V1R3 | OL 9 must log IPv4 packets with impossible addresses. | Oracle Linux 9 |
| OL09-00-006023 | V1R3 | OL 9 must log IPv4 packets with impossible addresses by default. | Oracle Linux 9 |
| OL09-00-006024 | V1R3 | OL 9 must use reverse path filtering on all IPv4 interfaces. | Oracle Linux 9 |
| OL09-00-006025 | V1R3 | OL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Oracle Linux 9 |
| OL09-00-006026 | V1R3 | OL 9 must not forward IPv4 source-routed packets by default. | Oracle Linux 9 |
| OL09-00-006027 | V1R3 | OL 9 must use a reverse-path filter for IPv4 network traffic, when possible, by default. | Oracle Linux 9 |
| OL09-00-006028 | V1R3 | OL 9 must not enable IPv4 packet forwarding unless the system is a router. | Oracle Linux 9 |
| OL09-00-006030 | V1R3 | OL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Oracle Linux 9 |
| OL09-00-006031 | V1R3 | OL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs. | Oracle Linux 9 |
| OL09-00-006032 | V1R3 | OL 9 must not send Internet Control Message Protocol (ICMP) redirects. | Oracle Linux 9 |
| OL09-00-006033 | V1R3 | OL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. | Oracle Linux 9 |
| OL09-00-006040 | V1R3 | OL 9 must not accept router advertisements on all IPv6 interfaces. | Oracle Linux 9 |
| OL09-00-006041 | V1R3 | OL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. | Oracle Linux 9 |
| OL09-00-006042 | V1R3 | OL 9 must not forward IPv6 source-routed packets. | Oracle Linux 9 |
| OL09-00-006043 | V1R3 | OL 9 must not enable IPv6 packet forwarding unless the system is a router. | Oracle Linux 9 |
| OL09-00-006044 | V1R3 | OL 9 must not accept router advertisements on all IPv6 interfaces by default. | Oracle Linux 9 |
| OL09-00-006045 | V1R3 | OL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Oracle Linux 9 |
| OL09-00-006046 | V1R3 | OL 9 must not forward IPv6 source-routed packets by default. | Oracle Linux 9 |
| RHEL-07-010290 | V3R9 | The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null passwords. | Red Hat Enterprise Linux 7 |
| RHEL-07-020230 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line. | Red Hat Enterprise Linux 7 |
| RHEL-07-020231 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled in the Graphical User Interface. | Red Hat Enterprise Linux 7 |
| RHEL-07-020250 | V3R9 | The Red Hat Enterprise Linux operating system must be a vendor supported release. | Red Hat Enterprise Linux 7 |
| RHEL-07-020260 | V3R9 | The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to date. | Red Hat Enterprise Linux 7 |
| RHEL-07-020270 | V3R9 | The Red Hat Enterprise Linux operating system must not have unnecessary accounts. | Red Hat Enterprise Linux 7 |
| RHEL-07-020310 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system. | Red Hat Enterprise Linux 7 |
| RHEL-07-020320 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid owner. | Red Hat Enterprise Linux 7 |
| RHEL-07-020330 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid group owner. | Red Hat Enterprise Linux 7 |
| RHEL-07-020610 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory. | Red Hat Enterprise Linux 7 |
| RHEL-07-020620 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned and defined in the /etc/passwd file. | Red Hat Enterprise Linux 7 |
| RHEL-07-020630 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive. | Red Hat Enterprise Linux 7 |
| RHEL-07-020640 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are owned by their respective users. | Red Hat Enterprise Linux 7 |
| RHEL-07-020650 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group. | Red Hat Enterprise Linux 7 |
| RHEL-07-020660 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a valid owner. | Red Hat Enterprise Linux 7 |
| RHEL-07-020670 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member. | Red Hat Enterprise Linux 7 |
| RHEL-07-020680 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive. | Red Hat Enterprise Linux 7 |
| RHEL-07-020690 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root. | Red Hat Enterprise Linux 7 |
| RHEL-07-020700 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root. | Red Hat Enterprise Linux 7 |
| RHEL-07-020710 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive. | Red Hat Enterprise Linux 7 |
| RHEL-07-020720 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory. | Red Hat Enterprise Linux 7 |
| RHEL-07-020730 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not execute world-writable programs. | Red Hat Enterprise Linux 7 |
| RHEL-07-020900 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | Red Hat Enterprise Linux 7 |
| RHEL-07-021000 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed. | Red Hat Enterprise Linux 7 |
| RHEL-07-021010 | V3R9 | The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Red Hat Enterprise Linux 7 |
| RHEL-07-021020 | V3R9 | The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS). | Red Hat Enterprise Linux 7 |
| RHEL-07-021021 | V3R9 | The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS). | Red Hat Enterprise Linux 7 |
| RHEL-07-021030 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group. | Red Hat Enterprise Linux 7 |
| RHEL-07-021040 | V3R9 | The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts. | Red Hat Enterprise Linux 7 |
| RHEL-07-021100 | V3R9 | The Red Hat Enterprise Linux operating system must have cron logging implemented. | Red Hat Enterprise Linux 7 |
| RHEL-07-021110 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root. | Red Hat Enterprise Linux 7 |
| RHEL-07-021120 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root. | Red Hat Enterprise Linux 7 |
| RHEL-07-021300 | V3R9 | The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed. | Red Hat Enterprise Linux 7 |
| RHEL-07-021310 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent). | Red Hat Enterprise Linux 7 |
| RHEL-07-021320 | V3R9 | The Red Hat Enterprise Linux operating system must use a separate file system for /var. | Red Hat Enterprise Linux 7 |
| RHEL-07-021330 | V3R9 | The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data path. | Red Hat Enterprise Linux 7 |
| RHEL-07-021340 | V3R9 | The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent). | Red Hat Enterprise Linux 7 |
| RHEL-07-021600 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs). | Red Hat Enterprise Linux 7 |
| RHEL-07-021610 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes. | Red Hat Enterprise Linux 7 |
| RHEL-07-021620 | V3R9 | The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories. | Red Hat Enterprise Linux 7 |
| RHEL-07-031000 | V3R9 | The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server. | Red Hat Enterprise Linux 7 |
| RHEL-07-031010 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | Red Hat Enterprise Linux 7 |
| RHEL-07-040201 | V3R9 | The Red Hat Enterprise Linux operating system must implement virtual address space randomization. | Red Hat Enterprise Linux 7 |
| RHEL-07-040330 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication. | Red Hat Enterprise Linux 7 |
| RHEL-07-040350 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication. | Red Hat Enterprise Linux 7 |
| RHEL-07-040360 | V3R9 | The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon an SSH logon. | Red Hat Enterprise Linux 7 |
| RHEL-07-040370 | V3R9 | The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using remote access via SSH. | Red Hat Enterprise Linux 7 |
| RHEL-07-040380 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication. | Red Hat Enterprise Linux 7 |
| RHEL-07-040410 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive. | Red Hat Enterprise Linux 7 |
| RHEL-07-040420 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0600 or less permissive. | Red Hat Enterprise Linux 7 |
| RHEL-07-040450 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files. | Red Hat Enterprise Linux 7 |
| RHEL-07-040460 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege separation. | Red Hat Enterprise Linux 7 |
| RHEL-07-040470 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication. | Red Hat Enterprise Linux 7 |
| RHEL-07-040520 | V3R9 | The Red Hat Enterprise Linux operating system must enable an application firewall, if available. | Red Hat Enterprise Linux 7 |
| RHEL-07-040530 | V3R9 | The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon logon. | Red Hat Enterprise Linux 7 |
| RHEL-07-040540 | V3R9 | The Red Hat Enterprise Linux operating system must not contain .shosts files. | Red Hat Enterprise Linux 7 |
| RHEL-07-040550 | V3R9 | The Red Hat Enterprise Linux operating system must not contain shosts.equiv files. | Red Hat Enterprise Linux 7 |
| RHEL-07-040600 | V3R9 | For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be configured. | Red Hat Enterprise Linux 7 |
| RHEL-07-040610 | V3R9 | The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets. | Red Hat Enterprise Linux 7 |
| RHEL-07-040611 | V3R9 | The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces. | Red Hat Enterprise Linux 7 |
| RHEL-07-040612 | V3R9 | The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default. | Red Hat Enterprise Linux 7 |
| RHEL-07-040620 | V3R9 | The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default. | Red Hat Enterprise Linux 7 |
| RHEL-07-040630 | V3R9 | The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Red Hat Enterprise Linux 7 |
| RHEL-07-040640 | V3R9 | The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Red Hat Enterprise Linux 7 |
| RHEL-07-040641 | V3R9 | The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. | Red Hat Enterprise Linux 7 |
| RHEL-07-040650 | V3R9 | The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default. | Red Hat Enterprise Linux 7 |
| RHEL-07-040660 | V3R9 | The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects. | Red Hat Enterprise Linux 7 |
| RHEL-07-040670 | V3R9 | Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous mode. | Red Hat Enterprise Linux 7 |
| RHEL-07-040680 | V3R9 | The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying. | Red Hat Enterprise Linux 7 |
| RHEL-07-040690 | V3R9 | The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed. | Red Hat Enterprise Linux 7 |
| RHEL-07-040700 | V3R9 | The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support. | Red Hat Enterprise Linux 7 |
| RHEL-07-040710 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that remote X connections are disabled except to fulfill documented and validated mission requirements. | Red Hat Enterprise Linux 7 |
| RHEL-07-040720 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode. | Red Hat Enterprise Linux 7 |
| RHEL-07-040730 | V3R9 | The Red Hat Enterprise Linux operating system must not have a graphical display manager installed unless approved. | Red Hat Enterprise Linux 7 |
| RHEL-07-040740 | V3R9 | The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is a router. | Red Hat Enterprise Linux 7 |
| RHEL-07-040750 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS. | Red Hat Enterprise Linux 7 |
| RHEL-07-040800 | V3R9 | SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default. | Red Hat Enterprise Linux 7 |
| RHEL-07-040810 | V3R9 | The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny system access to specific hosts and services. | Red Hat Enterprise Linux 7 |
| RHEL-07-040820 | V3R9 | The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured. | Red Hat Enterprise Linux 7 |
| RHEL-07-040830 | V3R9 | The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets. | Red Hat Enterprise Linux 7 |
| RHEL-07-010020 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values. | Red Hat Enterprise Linux 7 |
| RHEL-07-020019 | V3R9 | The Red Hat Enterprise Linux operating system must implement the Endpoint Security for Linux Threat Prevention tool. | Red Hat Enterprise Linux 7 |
| RHEL-07-032000 | V3R9 | The Red Hat Enterprise Linux operating system must use a virus scan program. | Red Hat Enterprise Linux 7 |
| RHEL-07-021031 | V3R9 | The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are owned by root, sys, bin, or an application user. | Red Hat Enterprise Linux 7 |
| RHEL-07-040711 | V3R9 | The Red Hat Enterprise Linux operating system SSH daemon must prevent remote hosts from connecting to the proxy display. | Red Hat Enterprise Linux 7 |
| RHEL-07-010341 | V3R9 | The Red Hat Enterprise Linux operating system must restrict privilege elevation to authorized personnel. | Red Hat Enterprise Linux 7 |
| RHEL-07-010342 | V3R9 | The Red Hat Enterprise Linux operating system must use the invoking user's password for privilege escalation when using "sudo". | Red Hat Enterprise Linux 7 |
| RHEL-07-010291 | V3R9 | The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords. | Red Hat Enterprise Linux 7 |
| RHEL-07-010339 | V3R9 | The Red Hat Enterprise Linux operating system must specify the default "include" directory for the /etc/sudoers file. | Red Hat Enterprise Linux 7 |
| RHEL-08-010000 | V2R5 | RHEL 8 must be a vendor-supported release. | Red Hat Enterprise Linux 8 |
| RHEL-08-010010 | V2R5 | RHEL 8 vendor packaged system security patches and updates must be installed and up to date. | Red Hat Enterprise Linux 8 |
| RHEL-08-010292 | V2R5 | RHEL 8 must ensure the SSH server uses strong entropy. | Red Hat Enterprise Linux 8 |
| RHEL-08-010460 | V2R5 | There must be no shosts.equiv files on the RHEL 8 operating system. | Red Hat Enterprise Linux 8 |
| RHEL-08-010470 | V2R5 | There must be no .shosts files on the RHEL 8 operating system. | Red Hat Enterprise Linux 8 |
| RHEL-08-010471 | V2R5 | RHEL 8 must enable the hardware random number generator entropy gatherer service. | Red Hat Enterprise Linux 8 |
| RHEL-08-010480 | V2R5 | The RHEL 8 SSH public host key files must have mode 0644 or less permissive. | Red Hat Enterprise Linux 8 |
| RHEL-08-010490 | V2R5 | The RHEL 8 SSH private host key files must have mode 0640 or less permissive. | Red Hat Enterprise Linux 8 |
| RHEL-08-010500 | V2R5 | The RHEL 8 SSH daemon must perform strict mode checking of home directory configuration files. | Red Hat Enterprise Linux 8 |
| RHEL-08-010520 | V2R5 | The RHEL 8 SSH daemon must not allow authentication using known host’s authentication. | Red Hat Enterprise Linux 8 |
| RHEL-08-010521 | V2R5 | The RHEL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements. | Red Hat Enterprise Linux 8 |
| RHEL-08-010540 | V2R5 | RHEL 8 must use a separate file system for /var. | Red Hat Enterprise Linux 8 |
| RHEL-08-010541 | V2R5 | RHEL 8 must use a separate file system for /var/log. | Red Hat Enterprise Linux 8 |
| RHEL-08-010542 | V2R5 | RHEL 8 must use a separate file system for the system audit data path. | Red Hat Enterprise Linux 8 |
| RHEL-08-010543 | V2R5 | A separate RHEL 8 filesystem must be used for the /tmp directory. | Red Hat Enterprise Linux 8 |
| RHEL-08-010561 | V2R5 | The rsyslog service must be running in RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-010570 | V2R5 | RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories. | Red Hat Enterprise Linux 8 |
| RHEL-08-010571 | V2R5 | RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory. | Red Hat Enterprise Linux 8 |
| RHEL-08-010580 | V2R5 | RHEL 8 must prevent special devices on non-root local partitions. | Red Hat Enterprise Linux 8 |
| RHEL-08-010590 | V2R5 | RHEL 8 must prevent code from being executed on file systems that contain user home directories. | Red Hat Enterprise Linux 8 |
| RHEL-08-010600 | V2R5 | RHEL 8 must prevent special devices on file systems that are used with removable media. | Red Hat Enterprise Linux 8 |
| RHEL-08-010610 | V2R5 | RHEL 8 must prevent code from being executed on file systems that are used with removable media. | Red Hat Enterprise Linux 8 |
| RHEL-08-010620 | V2R5 | RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Red Hat Enterprise Linux 8 |
| RHEL-08-010630 | V2R5 | RHEL 8 must prevent code from being executed on file systems that are imported via Network File System (NFS). | Red Hat Enterprise Linux 8 |
| RHEL-08-010640 | V2R5 | RHEL 8 must prevent special devices on file systems that are imported via Network File System (NFS). | Red Hat Enterprise Linux 8 |
| RHEL-08-010650 | V2R5 | RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). | Red Hat Enterprise Linux 8 |
| RHEL-08-010660 | V2R5 | Local RHEL 8 initialization files must not execute world-writable programs. | Red Hat Enterprise Linux 8 |
| RHEL-08-010670 | V2R5 | RHEL 8 must disable kernel dumps unless needed. | Red Hat Enterprise Linux 8 |
| RHEL-08-010671 | V2R5 | RHEL 8 must disable the kernel.core_pattern. | Red Hat Enterprise Linux 8 |
| RHEL-08-010672 | V2R5 | RHEL 8 must disable acquiring, saving, and processing core dumps. | Red Hat Enterprise Linux 8 |
| RHEL-08-010673 | V2R5 | RHEL 8 must disable core dumps for all users. | Red Hat Enterprise Linux 8 |
| RHEL-08-010674 | V2R5 | RHEL 8 must disable storing core dumps. | Red Hat Enterprise Linux 8 |
| RHEL-08-010675 | V2R5 | RHEL 8 must disable core dump backtraces. | Red Hat Enterprise Linux 8 |
| RHEL-08-010680 | V2R5 | For RHEL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured. | Red Hat Enterprise Linux 8 |
| RHEL-08-010690 | V2R5 | Executable search paths within the initialization files of all local interactive RHEL 8 users must only contain paths that resolve to the system default or the users home directory. | Red Hat Enterprise Linux 8 |
| RHEL-08-010700 | V2R5 | All RHEL 8 world-writable directories must be owned by root, sys, bin, or an application user. | Red Hat Enterprise Linux 8 |
| RHEL-08-010710 | V2R5 | All RHEL 8 world-writable directories must be group-owned by root, sys, bin, or an application group. | Red Hat Enterprise Linux 8 |
| RHEL-08-010720 | V2R5 | All RHEL 8 local interactive users must have a home directory assigned in the /etc/passwd file. | Red Hat Enterprise Linux 8 |
| RHEL-08-010730 | V2R5 | All RHEL 8 local interactive user home directories must have mode 0750 or less permissive. | Red Hat Enterprise Linux 8 |
| RHEL-08-010740 | V2R5 | All RHEL 8 local interactive user home directories must be group-owned by the home directory owner’s primary group. | Red Hat Enterprise Linux 8 |
| RHEL-08-010750 | V2R5 | All RHEL 8 local interactive user home directories defined in the /etc/passwd file must exist. | Red Hat Enterprise Linux 8 |
| RHEL-08-010760 | V2R5 | All RHEL 8 local interactive user accounts must be assigned a home directory upon creation. | Red Hat Enterprise Linux 8 |
| RHEL-08-010770 | V2R5 | All RHEL 8 local initialization files must have mode 0740 or less permissive. | Red Hat Enterprise Linux 8 |
| RHEL-08-010780 | V2R5 | All RHEL 8 local files and directories must have a valid owner. | Red Hat Enterprise Linux 8 |
| RHEL-08-010790 | V2R5 | All RHEL 8 local files and directories must have a valid group owner. | Red Hat Enterprise Linux 8 |
| RHEL-08-010800 | V2R5 | A separate RHEL 8 filesystem must be used for user home directories (such as /home or an equivalent). | Red Hat Enterprise Linux 8 |
| RHEL-08-020320 | V2R5 | RHEL 8 must not have unnecessary accounts. | Red Hat Enterprise Linux 8 |
| RHEL-08-020330 | V2R5 | RHEL 8 must not allow accounts configured with blank or null passwords. | Red Hat Enterprise Linux 8 |
| RHEL-08-020340 | V2R5 | RHEL 8 must display the date and time of the last successful account logon upon logon. | Red Hat Enterprise Linux 8 |
| RHEL-08-020350 | V2R5 | RHEL 8 must display the date and time of the last successful account logon upon an SSH logon. | Red Hat Enterprise Linux 8 |
| RHEL-08-020353 | V2R5 | RHEL 8 must define default permissions for logon and non-logon shells. | Red Hat Enterprise Linux 8 |
| RHEL-08-030010 | V2R5 | Cron logging must be implemented in RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-030061 | V2R5 | The RHEL 8 audit system must audit local events. | Red Hat Enterprise Linux 8 |
| RHEL-08-030063 | V2R5 | RHEL 8 must resolve audit information before writing to disk. | Red Hat Enterprise Linux 8 |
| RHEL-08-030670 | V2R5 | RHEL 8 must have the packages required for offloading audit logs installed. | Red Hat Enterprise Linux 8 |
| RHEL-08-030680 | V2R5 | RHEL 8 must have the packages required for encrypting offloaded audit logs installed. | Red Hat Enterprise Linux 8 |
| RHEL-08-040170 | V2R5 | The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-040171 | V2R5 | The x86 Ctrl-Alt-Delete key sequence in RHEL 8 must be disabled if a graphical user interface is installed. | Red Hat Enterprise Linux 8 |
| RHEL-08-040172 | V2R5 | The systemd Ctrl-Alt-Delete burst key sequence in RHEL 8 must be disabled. | Red Hat Enterprise Linux 8 |
| RHEL-08-040180 | V2R5 | The debug-shell systemd service must be disabled on RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-040190 | V2R5 | The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for RHEL 8 operational support. | Red Hat Enterprise Linux 8 |
| RHEL-08-040200 | V2R5 | The root account must be the only account having unrestricted access to the RHEL 8 system. | Red Hat Enterprise Linux 8 |
| RHEL-08-040210 | V2R5 | RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Red Hat Enterprise Linux 8 |
| RHEL-08-040220 | V2R5 | RHEL 8 must not send Internet Control Message Protocol (ICMP) redirects. | Red Hat Enterprise Linux 8 |
| RHEL-08-040230 | V2R5 | RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Red Hat Enterprise Linux 8 |
| RHEL-08-040240 | V2R5 | RHEL 8 must not forward IPv6 source-routed packets. | Red Hat Enterprise Linux 8 |
| RHEL-08-040250 | V2R5 | RHEL 8 must not forward IPv6 source-routed packets by default. | Red Hat Enterprise Linux 8 |
| RHEL-08-040260 | V2R5 | RHEL 8 must not enable IPv6 packet forwarding unless the system is a router. | Red Hat Enterprise Linux 8 |
| RHEL-08-040261 | V2R5 | RHEL 8 must not accept router advertisements on all IPv6 interfaces. | Red Hat Enterprise Linux 8 |
| RHEL-08-040262 | V2R5 | RHEL 8 must not accept router advertisements on all IPv6 interfaces by default. | Red Hat Enterprise Linux 8 |
| RHEL-08-040270 | V2R5 | RHEL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. | Red Hat Enterprise Linux 8 |
| RHEL-08-040280 | V2R5 | RHEL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. | Red Hat Enterprise Linux 8 |
| RHEL-08-040281 | V2R5 | RHEL 8 must disable access to network bpf syscall from unprivileged processes. | Red Hat Enterprise Linux 8 |
| RHEL-08-040282 | V2R5 | RHEL 8 must restrict usage of ptrace to descendant processes. | Red Hat Enterprise Linux 8 |
| RHEL-08-040283 | V2R5 | RHEL 8 must restrict exposed kernel pointer addresses access. | Red Hat Enterprise Linux 8 |
| RHEL-08-040284 | V2R5 | RHEL 8 must disable the use of user namespaces. | Red Hat Enterprise Linux 8 |
| RHEL-08-040285 | V2R5 | RHEL 8 must use reverse path filtering on all IPv4 interfaces. | Red Hat Enterprise Linux 8 |
| RHEL-08-040290 | V2R5 | RHEL 8 must be configured to prevent unrestricted mail relaying. | Red Hat Enterprise Linux 8 |
| RHEL-08-040300 | V2R5 | The RHEL 8 file integrity tool must be configured to verify extended attributes. | Red Hat Enterprise Linux 8 |
| RHEL-08-040310 | V2R5 | The RHEL 8 file integrity tool must be configured to verify Access Control Lists (ACLs). | Red Hat Enterprise Linux 8 |
| RHEL-08-040320 | V2R5 | The graphical display manager must not be installed on RHEL 8 unless approved. | Red Hat Enterprise Linux 8 |
| RHEL-08-040330 | V2R5 | RHEL 8 network interfaces must not be in promiscuous mode. | Red Hat Enterprise Linux 8 |
| RHEL-08-040340 | V2R5 | RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements. | Red Hat Enterprise Linux 8 |
| RHEL-08-040341 | V2R5 | The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy display. | Red Hat Enterprise Linux 8 |
| RHEL-08-040350 | V2R5 | If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL 8 TFTP daemon must be configured to operate in secure mode. | Red Hat Enterprise Linux 8 |
| RHEL-08-040360 | V2R5 | A File Transfer Protocol (FTP) server package must not be installed unless mission essential on RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-040370 | V2R5 | The gssproxy package must not be installed unless mission essential on RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-040380 | V2R5 | The iprutils package must not be installed unless mission essential on RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-040390 | V2R5 | The tuned package must not be installed unless mission essential on RHEL 8. | Red Hat Enterprise Linux 8 |
| RHEL-08-010382 | V2R5 | RHEL 8 must restrict privilege elevation to authorized personnel. | Red Hat Enterprise Linux 8 |
| RHEL-08-010383 | V2R5 | RHEL 8 must use the invoking user's password for privilege escalation when using "sudo". | Red Hat Enterprise Linux 8 |
| RHEL-08-010472 | V2R5 | RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. | Red Hat Enterprise Linux 8 |
| RHEL-08-010522 | V2R5 | The RHEL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented and validated mission requirements. | Red Hat Enterprise Linux 8 |
| RHEL-08-010544 | V2R5 | RHEL 8 must use a separate file system for /var/tmp. | Red Hat Enterprise Linux 8 |
| RHEL-08-010572 | V2R5 | RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory. | Red Hat Enterprise Linux 8 |
| RHEL-08-010731 | V2R5 | All RHEL 8 local interactive user home directory files must have mode 0750 or less permissive. | Red Hat Enterprise Linux 8 |
| RHEL-08-010741 | V2R5 | RHEL 8 must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member. | Red Hat Enterprise Linux 8 |
| RHEL-08-020032 | V2R5 | RHEL 8 must disable the user list at logon for graphical user interfaces. | Red Hat Enterprise Linux 8 |
| RHEL-08-020332 | V2R5 | RHEL 8 must not allow blank or null passwords in the password-auth file. | Red Hat Enterprise Linux 8 |
| RHEL-08-040209 | V2R5 | RHEL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Red Hat Enterprise Linux 8 |
| RHEL-08-040239 | V2R5 | RHEL 8 must not forward IPv4 source-routed packets. | Red Hat Enterprise Linux 8 |
| RHEL-08-040249 | V2R5 | RHEL 8 must not forward IPv4 source-routed packets by default. | Red Hat Enterprise Linux 8 |
| RHEL-08-040279 | V2R5 | RHEL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages. | Red Hat Enterprise Linux 8 |
| RHEL-08-040286 | V2R5 | RHEL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler. | Red Hat Enterprise Linux 8 |
| RHEL-08-040259 | V2R5 | RHEL 8 must not enable IPv4 packet forwarding unless the system is a router. | Red Hat Enterprise Linux 8 |
| RHEL-08-010121 | V2R5 | The RHEL 8 operating system must not have accounts configured with blank or null passwords. | Red Hat Enterprise Linux 8 |
| RHEL-08-010379 | V2R5 | RHEL 8 must specify the default "include" directory for the /etc/sudoers file. | Red Hat Enterprise Linux 8 |
| RHEL-08-020101 | V2R5 | RHEL 8 must ensure the password complexity module is enabled in the system-auth file. | Red Hat Enterprise Linux 8 |
| RHEL-08-020104 | V2R5 | RHEL 8 systems, version 8.4 and above, must ensure the password complexity module is configured for three retries or less. | Red Hat Enterprise Linux 8 |
| RHEL-08-040321 | V2R5 | The graphical display manager must not be the default target on RHEL 8 unless approved. | Red Hat Enterprise Linux 8 |
| RHEL-08-020331 | V2R5 | RHEL 8 must not allow blank or null passwords in the system-auth file. | Red Hat Enterprise Linux 8 |
| RHEL-09-211010 | V2R6 | RHEL 9 must be a vendor-supported release. | Red Hat Enterprise Linux 9 |
| RHEL-09-211015 | V2R6 | RHEL 9 vendor packaged system security patches and updates must be installed and up to date. | Red Hat Enterprise Linux 9 |
| RHEL-09-211030 | V2R6 | The graphical display manager must not be the default target on RHEL 9 unless approved. | Red Hat Enterprise Linux 9 |
| RHEL-09-211035 | V2R6 | RHEL 9 must enable the hardware random number generator entropy gatherer service. | Red Hat Enterprise Linux 9 |
| RHEL-09-212015 | V2R6 | RHEL 9 must disable the ability of systemd to spawn an interactive boot process. | Red Hat Enterprise Linux 9 |
| RHEL-09-212025 | V2R6 | RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-212030 | V2R6 | RHEL 9 /boot/grub2/grub.cfg file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-212035 | V2R6 | RHEL 9 must disable virtual system calls. | Red Hat Enterprise Linux 9 |
| RHEL-09-212040 | V2R6 | RHEL 9 must clear the page allocator to prevent use-after-free attacks. | Red Hat Enterprise Linux 9 |
| RHEL-09-213020 | V2R6 | RHEL 9 must prevent the loading of a new kernel for later execution. | Red Hat Enterprise Linux 9 |
| RHEL-09-213040 | V2R6 | RHEL 9 must disable the kernel.core_pattern. | Red Hat Enterprise Linux 9 |
| RHEL-09-213085 | V2R6 | RHEL 9 must disable core dump backtraces. | Red Hat Enterprise Linux 9 |
| RHEL-09-213090 | V2R6 | RHEL 9 must disable storing core dumps. | Red Hat Enterprise Linux 9 |
| RHEL-09-213095 | V2R6 | RHEL 9 must disable core dumps for all users. | Red Hat Enterprise Linux 9 |
| RHEL-09-213100 | V2R6 | RHEL 9 must disable acquiring, saving, and processing core dumps. | Red Hat Enterprise Linux 9 |
| RHEL-09-213105 | V2R6 | RHEL 9 must disable the use of user namespaces. | Red Hat Enterprise Linux 9 |
| RHEL-09-213115 | V2R6 | The kdump service on RHEL 9 must be disabled. | Red Hat Enterprise Linux 9 |
| RHEL-09-214030 | V2R6 | RHEL 9 must be configured so that the cryptographic hashes of system files match vendor values. | Red Hat Enterprise Linux 9 |
| RHEL-09-215020 | V2R6 | RHEL 9 must not have the sendmail package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-215060 | V2R6 | RHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-215065 | V2R6 | RHEL 9 must not have the quagga package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-215070 | V2R6 | A graphical display manager must not be installed on RHEL 9 unless approved. | Red Hat Enterprise Linux 9 |
| RHEL-09-215080 | V2R6 | RHEL 9 must have the gnutls-utils package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-215085 | V2R6 | RHEL 9 must have the nss-tools package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-215090 | V2R6 | RHEL 9 must have the rng-tools package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-231010 | V2R6 | A separate RHEL 9 file system must be used for user home directories (such as /home or an equivalent). | Red Hat Enterprise Linux 9 |
| RHEL-09-231015 | V2R6 | RHEL 9 must use a separate file system for /tmp. | Red Hat Enterprise Linux 9 |
| RHEL-09-231020 | V2R6 | RHEL 9 must use a separate file system for /var. | Red Hat Enterprise Linux 9 |
| RHEL-09-231025 | V2R6 | RHEL 9 must use a separate file system for /var/log. | Red Hat Enterprise Linux 9 |
| RHEL-09-231035 | V2R6 | RHEL 9 must use a separate file system for /var/tmp. | Red Hat Enterprise Linux 9 |
| RHEL-09-231055 | V2R6 | RHEL 9 must prevent code from being executed on file systems that contain user home directories. | Red Hat Enterprise Linux 9 |
| RHEL-09-231065 | V2R6 | RHEL 9 must prevent special devices on file systems that are imported via Network File System (NFS). | Red Hat Enterprise Linux 9 |
| RHEL-09-231070 | V2R6 | RHEL 9 must prevent code from being executed on file systems that are imported via Network File System (NFS). | Red Hat Enterprise Linux 9 |
| RHEL-09-231075 | V2R6 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS). | Red Hat Enterprise Linux 9 |
| RHEL-09-231080 | V2R6 | RHEL 9 must prevent code from being executed on file systems that are used with removable media. | Red Hat Enterprise Linux 9 |
| RHEL-09-231085 | V2R6 | RHEL 9 must prevent special devices on file systems that are used with removable media. | Red Hat Enterprise Linux 9 |
| RHEL-09-231090 | V2R6 | RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media. | Red Hat Enterprise Linux 9 |
| RHEL-09-231200 | V2R6 | RHEL 9 must prevent special devices on non-root local partitions. | Red Hat Enterprise Linux 9 |
| RHEL-09-232040 | V2R6 | RHEL 9 permissions of cron configuration files and directories must not be modified from the operating system defaults. | Red Hat Enterprise Linux 9 |
| RHEL-09-232045 | V2R6 | All RHEL 9 local initialization files must have mode 0740 or less permissive. | Red Hat Enterprise Linux 9 |
| RHEL-09-232050 | V2R6 | All RHEL 9 local interactive user home directories must have mode 0750 or less permissive. | Red Hat Enterprise Linux 9 |
| RHEL-09-232055 | V2R6 | RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232060 | V2R6 | RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232065 | V2R6 | RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232070 | V2R6 | RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232075 | V2R6 | RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232080 | V2R6 | RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232085 | V2R6 | RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-232090 | V2R6 | RHEL 9 /etc/group file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232095 | V2R6 | RHEL 9 /etc/group file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232100 | V2R6 | RHEL 9 /etc/group- file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232105 | V2R6 | RHEL 9 /etc/group- file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232110 | V2R6 | RHEL 9 /etc/gshadow file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232115 | V2R6 | RHEL 9 /etc/gshadow file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232120 | V2R6 | RHEL 9 /etc/gshadow- file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232125 | V2R6 | RHEL 9 /etc/gshadow- file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232130 | V2R6 | RHEL 9 /etc/passwd file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232135 | V2R6 | RHEL 9 /etc/passwd file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232140 | V2R6 | RHEL 9 /etc/passwd- file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232145 | V2R6 | RHEL 9 /etc/passwd- file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232150 | V2R6 | RHEL 9 /etc/shadow file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232155 | V2R6 | RHEL 9 /etc/shadow file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232160 | V2R6 | RHEL 9 /etc/shadow- file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232165 | V2R6 | RHEL 9 /etc/shadow- file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232230 | V2R6 | RHEL 9 cron configuration files directory must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232235 | V2R6 | RHEL 9 cron configuration files directory must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-232240 | V2R6 | All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user. | Red Hat Enterprise Linux 9 |
| RHEL-09-232250 | V2R6 | All RHEL 9 local files and directories must have a valid group owner. | Red Hat Enterprise Linux 9 |
| RHEL-09-232255 | V2R6 | All RHEL 9 local files and directories must have a valid owner. | Red Hat Enterprise Linux 9 |
| RHEL-09-232260 | V2R6 | RHEL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification. | Red Hat Enterprise Linux 9 |
| RHEL-09-232270 | V2R6 | RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access. | Red Hat Enterprise Linux 9 |
| RHEL-09-251020 | V2R6 | The RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems. | Red Hat Enterprise Linux 9 |
| RHEL-09-251040 | V2R6 | RHEL 9 network interfaces must not be in promiscuous mode. | Red Hat Enterprise Linux 9 |
| RHEL-09-251045 | V2R6 | RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler. | Red Hat Enterprise Linux 9 |
| RHEL-09-252035 | V2R6 | RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers configured. | Red Hat Enterprise Linux 9 |
| RHEL-09-252040 | V2R6 | RHEL 9 must configure a DNS processing mode in Network Manager. | Red Hat Enterprise Linux 9 |
| RHEL-09-252045 | V2R6 | RHEL 9 must not have unauthorized IP tunnels configured. | Red Hat Enterprise Linux 9 |
| RHEL-09-252050 | V2R6 | RHEL 9 must be configured to prevent unrestricted mail relaying. | Red Hat Enterprise Linux 9 |
| RHEL-09-252065 | V2R6 | RHEL 9 libreswan package must be installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-252070 | V2R6 | There must be no shosts.equiv files on RHEL 9. | Red Hat Enterprise Linux 9 |
| RHEL-09-252075 | V2R6 | There must be no .shosts files on RHEL 9. | Red Hat Enterprise Linux 9 |
| RHEL-09-253010 | V2R6 | RHEL 9 must be configured to use TCP syncookies. | Red Hat Enterprise Linux 9 |
| RHEL-09-253015 | V2R6 | RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. | Red Hat Enterprise Linux 9 |
| RHEL-09-253020 | V2R6 | RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets. | Red Hat Enterprise Linux 9 |
| RHEL-09-253025 | V2R6 | RHEL 9 must log IPv4 packets with impossible addresses. | Red Hat Enterprise Linux 9 |
| RHEL-09-253030 | V2R6 | RHEL 9 must log IPv4 packets with impossible addresses by default. | Red Hat Enterprise Linux 9 |
| RHEL-09-253035 | V2R6 | RHEL 9 must use reverse path filtering on all IPv4 interfaces. | Red Hat Enterprise Linux 9 |
| RHEL-09-253040 | V2R6 | RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Red Hat Enterprise Linux 9 |
| RHEL-09-253045 | V2R6 | RHEL 9 must not forward IPv4 source-routed packets by default. | Red Hat Enterprise Linux 9 |
| RHEL-09-253050 | V2R6 | RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default. | Red Hat Enterprise Linux 9 |
| RHEL-09-253055 | V2R6 | RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Red Hat Enterprise Linux 9 |
| RHEL-09-253060 | V2R6 | RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs. | Red Hat Enterprise Linux 9 |
| RHEL-09-253065 | V2R6 | RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects. | Red Hat Enterprise Linux 9 |
| RHEL-09-253070 | V2R6 | RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. | Red Hat Enterprise Linux 9 |
| RHEL-09-253075 | V2R6 | RHEL 9 must not enable IPv4 packet forwarding unless the system is a router. | Red Hat Enterprise Linux 9 |
| RHEL-09-254010 | V2R6 | RHEL 9 must not accept router advertisements on all IPv6 interfaces. | Red Hat Enterprise Linux 9 |
| RHEL-09-254015 | V2R6 | RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. | Red Hat Enterprise Linux 9 |
| RHEL-09-254020 | V2R6 | RHEL 9 must not forward IPv6 source-routed packets. | Red Hat Enterprise Linux 9 |
| RHEL-09-254025 | V2R6 | RHEL 9 must not enable IPv6 packet forwarding unless the system is a router. | Red Hat Enterprise Linux 9 |
| RHEL-09-254030 | V2R6 | RHEL 9 must not accept router advertisements on all IPv6 interfaces by default. | Red Hat Enterprise Linux 9 |
| RHEL-09-254035 | V2R6 | RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Red Hat Enterprise Linux 9 |
| RHEL-09-254040 | V2R6 | RHEL 9 must not forward IPv6 source-routed packets by default. | Red Hat Enterprise Linux 9 |
| RHEL-09-255020 | V2R6 | RHEL 9 must have the openssh-clients package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-255105 | V2R6 | RHEL 9 SSH server configuration file must be group-owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-255110 | V2R6 | The RHEL 9 SSH server configuration file must be owned by root. | Red Hat Enterprise Linux 9 |
| RHEL-09-255115 | V2R6 | RHEL 9 SSH server configuration files' permissions must not be modified. | Red Hat Enterprise Linux 9 |
| RHEL-09-255120 | V2R6 | RHEL 9 SSH private host key files must have mode 0640 or less permissive. | Red Hat Enterprise Linux 9 |
| RHEL-09-255125 | V2R6 | RHEL 9 SSH public host key files must have mode 0644 or less permissive. | Red Hat Enterprise Linux 9 |
| RHEL-09-255130 | V2R6 | RHEL 9 SSH daemon must not allow compression or must only allow compression after successful authentication. | Red Hat Enterprise Linux 9 |
| RHEL-09-255145 | V2R6 | RHEL 9 SSH daemon must not allow rhosts authentication. | Red Hat Enterprise Linux 9 |
| RHEL-09-255150 | V2R6 | RHEL 9 SSH daemon must not allow known hosts authentication. | Red Hat Enterprise Linux 9 |
| RHEL-09-255155 | V2R6 | RHEL 9 SSH daemon must disable remote X connections for interactive users. | Red Hat Enterprise Linux 9 |
| RHEL-09-255160 | V2R6 | RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files. | Red Hat Enterprise Linux 9 |
| RHEL-09-255165 | V2R6 | RHEL 9 SSH daemon must display the date and time of the last successful account logon upon an SSH logon. | Red Hat Enterprise Linux 9 |
| RHEL-09-255175 | V2R6 | RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display. | Red Hat Enterprise Linux 9 |
| RHEL-09-271090 | V2R6 | RHEL 9 effective dconf policy must match the policy keyfiles. | Red Hat Enterprise Linux 9 |
| RHEL-09-271095 | V2R6 | RHEL 9 must disable the ability of a user to restart the system from the login screen. | Red Hat Enterprise Linux 9 |
| RHEL-09-271100 | V2R6 | RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface. | Red Hat Enterprise Linux 9 |
| RHEL-09-271105 | V2R6 | RHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot. | Red Hat Enterprise Linux 9 |
| RHEL-09-271110 | V2R6 | RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface. | Red Hat Enterprise Linux 9 |
| RHEL-09-271115 | V2R6 | RHEL 9 must disable the user list at logon for graphical user interfaces. | Red Hat Enterprise Linux 9 |
| RHEL-09-411020 | V2R6 | All RHEL 9 local interactive user accounts must be assigned a home directory upon creation. | Red Hat Enterprise Linux 9 |
| RHEL-09-411025 | V2R6 | RHEL 9 must set the umask value to 077 for all local interactive user accounts. | Red Hat Enterprise Linux 9 |
| RHEL-09-411035 | V2R6 | RHEL 9 system accounts must not have an interactive login shell. | Red Hat Enterprise Linux 9 |
| RHEL-09-411055 | V2R6 | Executable search paths within the initialization files of all local interactive RHEL 9 users must only contain paths that resolve to the system default or the users home directory. | Red Hat Enterprise Linux 9 |
| RHEL-09-411060 | V2R6 | All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd file. | Red Hat Enterprise Linux 9 |
| RHEL-09-411065 | V2R6 | All RHEL 9 local interactive user home directories defined in the /etc/passwd file must exist. | Red Hat Enterprise Linux 9 |
| RHEL-09-411070 | V2R6 | All RHEL 9 local interactive user home directories must be group-owned by the home directory owner's primary group. | Red Hat Enterprise Linux 9 |
| RHEL-09-411095 | V2R6 | RHEL 9 must not have unauthorized accounts. | Red Hat Enterprise Linux 9 |
| RHEL-09-411100 | V2R6 | The root account must be the only account having unrestricted access to RHEL 9 system. | Red Hat Enterprise Linux 9 |
| RHEL-09-411115 | V2R6 | Local RHEL 9 initialization files must not execute world-writable programs. | Red Hat Enterprise Linux 9 |
| RHEL-09-412075 | V2R6 | RHEL 9 must display the date and time of the last successful account logon upon logon. | Red Hat Enterprise Linux 9 |
| RHEL-09-431025 | V2R6 | RHEL 9 must have policycoreutils package installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-431030 | V2R6 | RHEL 9 policycoreutils-python-utils package must be installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-432020 | V2R6 | RHEL 9 must use the invoking user's password for privilege escalation when using "sudo". | Red Hat Enterprise Linux 9 |
| RHEL-09-432030 | V2R6 | RHEL 9 must restrict privilege elevation to authorized personnel. | Red Hat Enterprise Linux 9 |
| RHEL-09-611025 | V2R6 | RHEL 9 must not allow blank or null passwords. | Red Hat Enterprise Linux 9 |
| RHEL-09-611045 | V2R6 | RHEL 9 must ensure the password complexity module is enabled in the system-auth file. | Red Hat Enterprise Linux 9 |
| RHEL-09-611155 | V2R6 | RHEL 9 must not have accounts configured with blank or null passwords. | Red Hat Enterprise Linux 9 |
| RHEL-09-651020 | V2R6 | RHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic hashes for validating file contents and directories. | Red Hat Enterprise Linux 9 |
| RHEL-09-651030 | V2R6 | RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists (ACLs). | Red Hat Enterprise Linux 9 |
| RHEL-09-651035 | V2R6 | RHEL 9 must be configured so that the file integrity tool verifies extended attributes. | Red Hat Enterprise Linux 9 |
| RHEL-09-652015 | V2R6 | RHEL 9 must have the packages required for encrypting offloaded audit logs installed. | Red Hat Enterprise Linux 9 |
| RHEL-09-652020 | V2R6 | The rsyslog service on RHEL 9 must be active. | Red Hat Enterprise Linux 9 |
| RHEL-09-652025 | V2R6 | RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation. | Red Hat Enterprise Linux 9 |
| RHEL-09-652060 | V2R6 | RHEL 9 must use cron logging. | Red Hat Enterprise Linux 9 |
| RHEL-09-653105 | V2R6 | RHEL 9 must write audit records to disk. | Red Hat Enterprise Linux 9 |
| SLES-12-010000 | V3R2 | The SUSE operating system must be a vendor-supported release. | SUSE Linux Enterprise 12 |
| SLES-12-010010 | V3R2 | Vendor-packaged SUSE operating system security patches and updates must be installed and up to date. | SUSE Linux Enterprise 12 |
| SLES-12-010231 | V3R2 | The SUSE operating system must not be configured to allow blank or null passwords. | SUSE Linux Enterprise 12 |
| SLES-12-010390 | V3R2 | The SUSE operating system must display the date and time of the last successful account logon upon logon. | SUSE Linux Enterprise 12 |
| SLES-12-010400 | V3R2 | There must be no .shosts files on the SUSE operating system. | SUSE Linux Enterprise 12 |
| SLES-12-010410 | V3R2 | There must be no shosts.equiv files on the SUSE operating system. | SUSE Linux Enterprise 12 |
| SLES-12-010520 | V3R2 | The SUSE operating system file integrity tool must be configured to verify Access Control Lists (ACLs). | SUSE Linux Enterprise 12 |
| SLES-12-010530 | V3R2 | The SUSE operating system file integrity tool must be configured to verify extended attributes. | SUSE Linux Enterprise 12 |
| SLES-12-010610 | V3R2 | The SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence. | SUSE Linux Enterprise 12 |
| SLES-12-010611 | V3R2 | The SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence for Graphical User Interfaces. | SUSE Linux Enterprise 12 |
| SLES-12-010630 | V3R2 | The SUSE operating system must not have unnecessary accounts. | SUSE Linux Enterprise 12 |
| SLES-12-010650 | V3R2 | The SUSE operating system root account must be the only account having unrestricted access to the system. | SUSE Linux Enterprise 12 |
| SLES-12-010690 | V3R2 | All SUSE operating system files and directories must have a valid owner. | SUSE Linux Enterprise 12 |
| SLES-12-010700 | V3R2 | All SUSE operating system files and directories must have a valid group owner. | SUSE Linux Enterprise 12 |
| SLES-12-010710 | V3R2 | All SUSE operating system local interactive users must have a home directory assigned in the /etc/passwd file. | SUSE Linux Enterprise 12 |
| SLES-12-010720 | V3R2 | All SUSE operating system local interactive user accounts, upon creation, must be assigned a home directory. | SUSE Linux Enterprise 12 |
| SLES-12-010730 | V3R2 | All SUSE operating system local interactive user home directories defined in the /etc/passwd file must exist. | SUSE Linux Enterprise 12 |
| SLES-12-010740 | V3R2 | All SUSE operating system local interactive user home directories must have mode 0750 or less permissive. | SUSE Linux Enterprise 12 |
| SLES-12-010750 | V3R2 | All SUSE operating system local interactive user home directories must be group-owned by the home directory owners primary group. | SUSE Linux Enterprise 12 |
| SLES-12-010760 | V3R2 | All SUSE operating system local initialization files must have mode 0740 or less permissive. | SUSE Linux Enterprise 12 |
| SLES-12-010770 | V3R2 | All SUSE operating system local interactive user initialization files executable search paths must contain only paths that resolve to the users home directory. | SUSE Linux Enterprise 12 |
| SLES-12-010780 | V3R2 | All SUSE operating system local initialization files must not execute world-writable programs. | SUSE Linux Enterprise 12 |
| SLES-12-010790 | V3R2 | SUSE operating system file systems that contain user home directories must be mounted to prevent files with the setuid and setgid bit set from being executed. | SUSE Linux Enterprise 12 |
| SLES-12-010800 | V3R2 | SUSE operating system file systems that are used with removable media must be mounted to prevent files with the setuid and setgid bit set from being executed. | SUSE Linux Enterprise 12 |
| SLES-12-010810 | V3R2 | SUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent files with the setuid and setgid bit set from being executed. | SUSE Linux Enterprise 12 |
| SLES-12-010820 | V3R2 | SUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent binary files from being executed. | SUSE Linux Enterprise 12 |
| SLES-12-010830 | V3R2 | All SUSE operating system world-writable directories must be group-owned by root, sys, bin, or an application group. | SUSE Linux Enterprise 12 |
| SLES-12-010840 | V3R2 | SUSE operating system kernel core dumps must be disabled unless needed. | SUSE Linux Enterprise 12 |
| SLES-12-010850 | V3R2 | A separate file system must be used for SUSE operating system user home directories (such as /home or an equivalent). | SUSE Linux Enterprise 12 |
| SLES-12-010860 | V3R2 | The SUSE operating system must use a separate file system for /var. | SUSE Linux Enterprise 12 |
| SLES-12-010870 | V3R2 | The SUSE operating system must use a separate file system for the system audit data path. | SUSE Linux Enterprise 12 |
| SLES-12-010910 | V3R2 | The SUSE operating system must be configured to not overwrite Pluggable Authentication Modules (PAM) configuration on package changes. | SUSE Linux Enterprise 12 |
| SLES-12-020199 | V3R2 | The SUSE operating system must not disable syscall auditing. | SUSE Linux Enterprise 12 |
| SLES-12-030130 | V3R2 | The SUSE operating system must display the date and time of the last successful account logon upon an SSH logon. | SUSE Linux Enterprise 12 |
| SLES-12-030200 | V3R2 | The SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication. | SUSE Linux Enterprise 12 |
| SLES-12-030210 | V3R2 | The SUSE operating system SSH daemon public host key files must have mode 0644 or less permissive. | SUSE Linux Enterprise 12 |
| SLES-12-030220 | V3R2 | The SUSE operating system SSH daemon private host key files must have mode 0640 or less permissive. | SUSE Linux Enterprise 12 |
| SLES-12-030230 | V3R2 | The SUSE operating system SSH daemon must perform strict mode checking of home directory configuration files. | SUSE Linux Enterprise 12 |
| SLES-12-030240 | V3R2 | The SUSE operating system SSH daemon must use privilege separation. | SUSE Linux Enterprise 12 |
| SLES-12-030250 | V3R2 | The SUSE operating system SSH daemon must not allow compression or must only allow compression after successful authentication. | SUSE Linux Enterprise 12 |
| SLES-12-030260 | V3R2 | The SUSE operating system SSH daemon must disable forwarded remote X connections for interactive users, unless to fulfill documented and validated mission requirements. | SUSE Linux Enterprise 12 |
| SLES-12-030360 | V3R2 | The SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets. | SUSE Linux Enterprise 12 |
| SLES-12-030361 | V3R2 | The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets. | SUSE Linux Enterprise 12 |
| SLES-12-030370 | V3R2 | The SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default. | SUSE Linux Enterprise 12 |
| SLES-12-030380 | V3R2 | The SUSE operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | SUSE Linux Enterprise 12 |
| SLES-12-030390 | V3R2 | The SUSE operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted. | SUSE Linux Enterprise 12 |
| SLES-12-030400 | V3R2 | The SUSE operating system must not allow interfaces to accept Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default. | SUSE Linux Enterprise 12 |
| SLES-12-030401 | V3R2 | The SUSE operating system must not allow interfaces to accept Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages by default. | SUSE Linux Enterprise 12 |
| SLES-12-030410 | V3R2 | The SUSE operating system must not allow interfaces to send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default. | SUSE Linux Enterprise 12 |
| SLES-12-030420 | V3R2 | The SUSE operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects. | SUSE Linux Enterprise 12 |
| SLES-12-030430 | V3R2 | The SUSE operating system must not be performing Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router. | SUSE Linux Enterprise 12 |
| SLES-12-030440 | V3R2 | The SUSE operating system must not have network interfaces in promiscuous mode unless approved and documented. | SUSE Linux Enterprise 12 |
| SLES-12-030611 | V3R2 | The SUSE operating system must use a virus scan program. | SUSE Linux Enterprise 12 |
| SLES-12-030261 | V3R2 | The SUSE operating system SSH daemon must prevent remote hosts from connecting to the proxy display. | SUSE Linux Enterprise 12 |
| SLES-12-010111 | V3R2 | The SUSE operating system must restrict privilege elevation to authorized personnel. | SUSE Linux Enterprise 12 |
| SLES-12-010112 | V3R2 | The SUSE operating system must use the invoking user's password for privilege escalation when using "sudo". | SUSE Linux Enterprise 12 |
| SLES-12-010631 | V3R2 | The SUSE operating system must not have unnecessary account capabilities. | SUSE Linux Enterprise 12 |
| SLES-12-030362 | V3R2 | The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default. | SUSE Linux Enterprise 12 |
| SLES-12-030363 | V3R2 | The SUSE operating system must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted. | SUSE Linux Enterprise 12 |
| SLES-12-030364 | V3R2 | The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router. | SUSE Linux Enterprise 12 |
| SLES-12-030365 | V3R2 | The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding by default unless the system is a router. | SUSE Linux Enterprise 12 |
| SLES-12-010109 | V3R2 | The SUSE operating system must specify the default "include" directory for the /etc/sudoers file. | SUSE Linux Enterprise 12 |
| SLES-12-010221 | V3R2 | The SUSE operating system must not have accounts configured with blank or null passwords. | SUSE Linux Enterprise 12 |
| SLES-15-010000 | V2R4 | The SUSE operating system must be a vendor-supported release. | SUSE Linux Enterprise 15 |
| SLES-15-010010 | V2R4 | Vendor-packaged SUSE operating system security patches and updates must be installed and up to date. | SUSE Linux Enterprise 15 |
| SLES-15-020080 | V2R4 | The SUSE operating system must display the date and time of the last successful account logon upon logon. | SUSE Linux Enterprise 15 |
| SLES-15-020090 | V2R4 | The SUSE operating system must not have unnecessary accounts. | SUSE Linux Enterprise 15 |
| SLES-15-020091 | V2R4 | The SUSE operating system must not have unnecessary account capabilities. | SUSE Linux Enterprise 15 |
| SLES-15-020100 | V2R4 | The SUSE operating system root account must be the only account with unrestricted access to the system. | SUSE Linux Enterprise 15 |
| SLES-15-020101 | V2R4 | The SUSE operating system must restrict privilege elevation to authorized personnel. | SUSE Linux Enterprise 15 |
| SLES-15-020103 | V2R4 | The SUSE operating system must use the invoking user's password for privilege escalation when using "sudo". | SUSE Linux Enterprise 15 |
| SLES-15-020110 | V2R4 | All SUSE operating system local interactive user accounts, upon creation, must be assigned a home directory. | SUSE Linux Enterprise 15 |
| SLES-15-020120 | V2R4 | The SUSE operating system must display the date and time of the last successful account logon upon an SSH logon. | SUSE Linux Enterprise 15 |
| SLES-15-020300 | V2R4 | The SUSE operating system must not be configured to allow blank or null passwords. | SUSE Linux Enterprise 15 |
| SLES-15-030810 | V2R4 | The SUSE operating system must use a separate file system for the system audit data path. | SUSE Linux Enterprise 15 |
| SLES-15-030820 | V2R4 | The SUSE operating system must not disable syscall auditing. | SUSE Linux Enterprise 15 |
| SLES-15-040020 | V2R4 | There must be no .shosts files on the SUSE operating system. | SUSE Linux Enterprise 15 |
| SLES-15-040030 | V2R4 | There must be no shosts.equiv files on the SUSE operating system. | SUSE Linux Enterprise 15 |
| SLES-15-040040 | V2R4 | The SUSE operating system file integrity tool must be configured to verify Access Control Lists (ACLs). | SUSE Linux Enterprise 15 |
| SLES-15-040050 | V2R4 | The SUSE operating system file integrity tool must be configured to verify extended attributes. | SUSE Linux Enterprise 15 |
| SLES-15-040060 | V2R4 | The SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence. | SUSE Linux Enterprise 15 |
| SLES-15-040061 | V2R4 | The SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence for Graphical User Interfaces. | SUSE Linux Enterprise 15 |
| SLES-15-040062 | V2R4 | The SUSE operating system must disable the systemd Ctrl-Alt-Delete burst key sequence. | SUSE Linux Enterprise 15 |
| SLES-15-040070 | V2R4 | All SUSE operating system local interactive users must have a home directory assigned in the /etc/passwd file. | SUSE Linux Enterprise 15 |
| SLES-15-040080 | V2R4 | All SUSE operating system local interactive user home directories defined in the /etc/passwd file must exist. | SUSE Linux Enterprise 15 |
| SLES-15-040090 | V2R4 | All SUSE operating system local interactive user home directories must have mode 0750 or less permissive. | SUSE Linux Enterprise 15 |
| SLES-15-040100 | V2R4 | All SUSE operating system local interactive user home directories must be group-owned by the home directory owner's primary group. | SUSE Linux Enterprise 15 |
| SLES-15-040110 | V2R4 | All SUSE operating system local initialization files must have mode 0740 or less permissive. | SUSE Linux Enterprise 15 |
| SLES-15-040120 | V2R4 | All SUSE operating system local interactive user initialization files executable search paths must contain only paths that resolve to the users home directory. | SUSE Linux Enterprise 15 |
| SLES-15-040130 | V2R4 | All SUSE operating system local initialization files must not execute world-writable programs. | SUSE Linux Enterprise 15 |
| SLES-15-040140 | V2R4 | SUSE operating system file systems that contain user home directories must be mounted to prevent files with the setuid and setgid bit set from being executed. | SUSE Linux Enterprise 15 |
| SLES-15-040150 | V2R4 | SUSE operating system file systems that are used with removable media must be mounted to prevent files with the setuid and setgid bit set from being executed. | SUSE Linux Enterprise 15 |
| SLES-15-040160 | V2R4 | SUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent files with the setuid and setgid bit set from being executed. | SUSE Linux Enterprise 15 |
| SLES-15-040170 | V2R4 | SUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent binary files from being executed. | SUSE Linux Enterprise 15 |
| SLES-15-040180 | V2R4 | All SUSE operating system world-writable directories must be group-owned by root, sys, bin, or an application group. | SUSE Linux Enterprise 15 |
| SLES-15-040190 | V2R4 | SUSE operating system kernel core dumps must be disabled unless needed. | SUSE Linux Enterprise 15 |
| SLES-15-040200 | V2R4 | A separate file system must be used for SUSE operating system user home directories (such as /home or an equivalent). | SUSE Linux Enterprise 15 |
| SLES-15-040210 | V2R4 | The SUSE operating system must use a separate file system for /var. | SUSE Linux Enterprise 15 |
| SLES-15-040220 | V2R4 | The SUSE operating system must be configured to not overwrite Pluggable Authentication Modules (PAM) configuration on package changes. | SUSE Linux Enterprise 15 |
| SLES-15-040230 | V2R4 | The SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication. | SUSE Linux Enterprise 15 |
| SLES-15-040240 | V2R4 | The SUSE operating system SSH daemon public host key files must have mode 0644 or less permissive. | SUSE Linux Enterprise 15 |
| SLES-15-040250 | V2R4 | The SUSE operating system SSH daemon private host key files must have mode 0640 or less permissive. | SUSE Linux Enterprise 15 |
| SLES-15-040260 | V2R4 | The SUSE operating system SSH daemon must perform strict mode checking of home directory configuration files. | SUSE Linux Enterprise 15 |
| SLES-15-040290 | V2R4 | The SUSE operating system SSH daemon must disable forwarded remote X connections for interactive users, unless to fulfill documented and validated mission requirements. | SUSE Linux Enterprise 15 |
| SLES-15-040300 | V2R4 | The SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets. | SUSE Linux Enterprise 15 |
| SLES-15-040310 | V2R4 | The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets. | SUSE Linux Enterprise 15 |
| SLES-15-040320 | V2R4 | The SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default. | SUSE Linux Enterprise 15 |
| SLES-15-040321 | V2R4 | The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default. | SUSE Linux Enterprise 15 |
| SLES-15-040330 | V2R4 | The SUSE operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted. | SUSE Linux Enterprise 15 |
| SLES-15-040340 | V2R4 | The SUSE operating system must not allow interfaces to accept Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default. | SUSE Linux Enterprise 15 |
| SLES-15-040341 | V2R4 | The SUSE operating system must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted. | SUSE Linux Enterprise 15 |
| SLES-15-040350 | V2R4 | The SUSE operating system must not allow interfaces to accept Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages by default. | SUSE Linux Enterprise 15 |
| SLES-15-040360 | V2R4 | The SUSE operating system must not allow interfaces to send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default. | SUSE Linux Enterprise 15 |
| SLES-15-040370 | V2R4 | The SUSE operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects. | SUSE Linux Enterprise 15 |
| SLES-15-040380 | V2R4 | The SUSE operating system must not be performing Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router. | SUSE Linux Enterprise 15 |
| SLES-15-040381 | V2R4 | The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router. | SUSE Linux Enterprise 15 |
| SLES-15-040382 | V2R4 | The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding by default unless the system is a router. | SUSE Linux Enterprise 15 |
| SLES-15-040390 | V2R4 | The SUSE operating system must not have network interfaces in promiscuous mode unless approved and documented. | SUSE Linux Enterprise 15 |
| SLES-15-040400 | V2R4 | All SUSE operating system files and directories must have a valid owner. | SUSE Linux Enterprise 15 |
| SLES-15-040410 | V2R4 | All SUSE operating system files and directories must have a valid group owner. | SUSE Linux Enterprise 15 |
| SLES-15-020099 | V2R4 | The SUSE operating system must specify the default "include" directory for the /etc/sudoers file. | SUSE Linux Enterprise 15 |
| SLES-15-020181 | V2R4 | The SUSE operating system must not have accounts configured with blank or null passwords. | SUSE Linux Enterprise 15 |
| TOSS-04-010330 | V2R3 | For TOSS systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured. | Tri-Lab Operating System Stack |
| TOSS-04-010340 | V2R3 | The debug-shell systemd service must be disabled on TOSS. | Tri-Lab Operating System Stack |
| TOSS-04-010350 | V2R3 | The root account must be the only account having unrestricted access to the TOSS system. | Tri-Lab Operating System Stack |
| TOSS-04-010360 | V2R3 | The systemd Ctrl-Alt-Delete burst key sequence in TOSS must be disabled. | Tri-Lab Operating System Stack |
| TOSS-04-010370 | V2R3 | There must be no ".shosts" files on The TOSS operating system. | Tri-Lab Operating System Stack |
| TOSS-04-010380 | V2R3 | TOSS must not allow blank or null passwords in the system-auth file. | Tri-Lab Operating System Stack |
| TOSS-04-010390 | V2R3 | TOSS must not be performing packet forwarding unless the system is a router. | Tri-Lab Operating System Stack |
| TOSS-04-010400 | V2R3 | The TOSS SSH daemon must not allow authentication using known host's authentication. | Tri-Lab Operating System Stack |
| TOSS-04-010410 | V2R3 | The TOSS SSH daemon must not allow compression or must only allow compression after successful authentication. | Tri-Lab Operating System Stack |
| TOSS-04-010420 | V2R3 | The TOSS SSH daemon must not allow Kerberos authentication, except to fulfill documented and validated mission requirements. | Tri-Lab Operating System Stack |
| TOSS-04-020200 | V2R3 | All TOSS local interactive user accounts must be assigned a home directory upon creation. | Tri-Lab Operating System Stack |
| TOSS-04-020210 | V2R3 | All TOSS local interactive user home directories must be group-owned by the home directory owner's primary group. | Tri-Lab Operating System Stack |
| TOSS-04-020230 | V2R3 | All TOSS local interactive users must have a home directory assigned in the /etc/passwd file. | Tri-Lab Operating System Stack |
| TOSS-04-020240 | V2R3 | The x86 Ctrl-Alt-Delete key sequence in TOSS must be disabled if a graphical user interface is installed. | Tri-Lab Operating System Stack |
| TOSS-04-020250 | V2R3 | TOSS must disable the user list at logon for graphical user interfaces. | Tri-Lab Operating System Stack |
| TOSS-04-020260 | V2R3 | TOSS must display the date and time of the last successful account logon upon an SSH logon. | Tri-Lab Operating System Stack |
| TOSS-04-020270 | V2R3 | TOSS must not allow accounts configured with blank or null passwords. | Tri-Lab Operating System Stack |
| TOSS-04-020280 | V2R3 | TOSS must not have unnecessary accounts. | Tri-Lab Operating System Stack |
| TOSS-04-031340 | V2R3 | The auditd service must be running in TOSS. | Tri-Lab Operating System Stack |
| TOSS-04-031350 | V2R3 | The TOSS audit system must audit local events. | Tri-Lab Operating System Stack |
| TOSS-04-031360 | V2R3 | TOSS must resolve audit information before writing to disk. | Tri-Lab Operating System Stack |
| TOSS-04-031370 | V2R3 | TOSS must have the packages required for offloading audit logs installed. | Tri-Lab Operating System Stack |
| TOSS-04-031380 | V2R3 | TOSS must have the packages required for encrypting offloaded audit logs installed. | Tri-Lab Operating System Stack |
| TOSS-04-040560 | V2R3 | A File Transfer Protocol (FTP) server package must not be installed unless mission essential on TOSS. | Tri-Lab Operating System Stack |
| TOSS-04-040570 | V2R3 | All TOSS local files and directories must have a valid group owner. | Tri-Lab Operating System Stack |
| TOSS-04-040580 | V2R3 | All TOSS local files and directories must have a valid owner. | Tri-Lab Operating System Stack |
| TOSS-04-040590 | V2R3 | Cron logging must be implemented in TOSS. | Tri-Lab Operating System Stack |
| TOSS-04-040600 | V2R3 | If the Trivial File Transfer Protocol (TFTP) server is required, the TOSS TFTP daemon must be configured to operate in secure mode. | Tri-Lab Operating System Stack |
| TOSS-04-040610 | V2R3 | The graphical display manager must not be installed on TOSS unless approved. | Tri-Lab Operating System Stack |
| TOSS-04-040630 | V2R3 | The TOSS file integrity tool must be configured to verify Access Control Lists (ACLs). | Tri-Lab Operating System Stack |
| TOSS-04-040640 | V2R3 | The TOSS file integrity tool must be configured to verify extended attributes. | Tri-Lab Operating System Stack |
| TOSS-04-040650 | V2R3 | The TOSS SSH daemon must perform strict mode checking of home directory configuration files. | Tri-Lab Operating System Stack |
| TOSS-04-040660 | V2R3 | The TOSS SSH private host key files must have mode 0600 or less permissive. | Tri-Lab Operating System Stack |
| TOSS-04-040670 | V2R3 | The TOSS SSH public host key files must have mode 0644 or less permissive. | Tri-Lab Operating System Stack |
| TOSS-04-040680 | V2R3 | The x86 Ctrl-Alt-Delete key sequence must be disabled on TOSS. | Tri-Lab Operating System Stack |
| TOSS-04-040690 | V2R3 | TOSS must be a vendor-supported release. | Tri-Lab Operating System Stack |
| TOSS-04-040700 | V2R3 | TOSS must be configured to prevent unrestricted mail relaying. | Tri-Lab Operating System Stack |
| TOSS-04-040710 | V2R3 | TOSS must define default permissions for logon and non-logon shells. | Tri-Lab Operating System Stack |
| TOSS-04-040720 | V2R3 | TOSS must disable access to network bpf syscall from unprivileged processes. | Tri-Lab Operating System Stack |
| TOSS-04-040730 | V2R3 | TOSS must enable hardening for the Berkeley Packet Filter Just-in-time compiler. | Tri-Lab Operating System Stack |
| TOSS-04-040740 | V2R3 | TOSS must enable the hardware random number generator entropy gatherer service. | Tri-Lab Operating System Stack |
| TOSS-04-040750 | V2R3 | TOSS must ensure the SSH server uses strong entropy. | Tri-Lab Operating System Stack |
| TOSS-04-040760 | V2R3 | TOSS must have the packages required to use the hardware random number generator entropy gatherer service. | Tri-Lab Operating System Stack |
| TOSS-04-040770 | V2R3 | TOSS must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages. | Tri-Lab Operating System Stack |
| TOSS-04-040780 | V2R3 | TOSS must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages. | Tri-Lab Operating System Stack |
| TOSS-04-040790 | V2R3 | TOSS must not accept router advertisements on all IPv6 interfaces by default. | Tri-Lab Operating System Stack |
| TOSS-04-040800 | V2R3 | TOSS must not accept router advertisements on all IPv6 interfaces. | Tri-Lab Operating System Stack |
| TOSS-04-040810 | V2R3 | TOSS must not allow blank or null passwords in the password-auth file. | Tri-Lab Operating System Stack |
| TOSS-04-040820 | V2R3 | TOSS must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default. | Tri-Lab Operating System Stack |
| TOSS-04-040830 | V2R3 | TOSS must not forward IPv4 source-routed packets by default. | Tri-Lab Operating System Stack |
| TOSS-04-040840 | V2R3 | TOSS must not forward IPv4 source-routed packets. | Tri-Lab Operating System Stack |
| TOSS-04-040850 | V2R3 | TOSS must not forward IPv6 source-routed packets by default. | Tri-Lab Operating System Stack |
| TOSS-04-040860 | V2R3 | TOSS must not forward IPv6 source-routed packets. | Tri-Lab Operating System Stack |
| TOSS-04-040870 | V2R3 | TOSS must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Tri-Lab Operating System Stack |
| TOSS-04-040880 | V2R3 | TOSS must not send Internet Control Message Protocol (ICMP) redirects. | Tri-Lab Operating System Stack |
| TOSS-04-040890 | V2R3 | TOSS must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Tri-Lab Operating System Stack |
| TOSS-04-040900 | V2R3 | TOSS must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | Tri-Lab Operating System Stack |
| TOSS-04-040910 | V2R3 | TOSS must restrict exposed kernel pointer addresses access. | Tri-Lab Operating System Stack |
| TOSS-04-040920 | V2R3 | TOSS must restrict privilege elevation to authorized personnel. | Tri-Lab Operating System Stack |
| TOSS-04-040930 | V2R3 | TOSS must use reverse path filtering on all IPv4 interfaces. | Tri-Lab Operating System Stack |
| TOSS-04-040940 | V2R3 | TOSS network interfaces must not be in promiscuous mode. | Tri-Lab Operating System Stack |
| UBTU-18-010032 | V2R15 | The Ubuntu operating system must display the date and time of the last successful account logon upon logon. | Ubuntu 18.04 |
| UBTU-18-010150 | V2R15 | The Ubuntu Operating system must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed. | Ubuntu 18.04 |
| UBTU-18-010151 | V2R15 | The Ubuntu Operating system must disable the x86 Ctrl-Alt-Delete key sequence. | Ubuntu 18.04 |
| UBTU-18-010418 | V2R15 | The Ubuntu operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Ubuntu 18.04 |
| UBTU-18-010419 | V2R15 | The Ubuntu operating system SSH daemon must prevent remote hosts from connecting to the proxy display. | Ubuntu 18.04 |
| UBTU-18-010450 | V2R15 | All local interactive user home directories defined in the /etc/passwd file must exist. | Ubuntu 18.04 |
| UBTU-18-010451 | V2R15 | All local interactive user home directories must have mode 0750 or less permissive. | Ubuntu 18.04 |
| UBTU-18-010452 | V2R15 | All local interactive user home directories must be group-owned by the home directory owners primary group. | Ubuntu 18.04 |
| UBTU-18-010522 | V2R15 | The Ubuntu operating system must not have accounts configured with blank or null passwords. | Ubuntu 18.04 |
| UBTU-18-010523 | V2R15 | The Ubuntu operating system must not allow accounts configured with blank or null passwords. | Ubuntu 18.04 |
| UBTU-18-999999 | V2R15 | The Ubuntu operating system must be a vendor supported release. | Ubuntu 18.04 |
| UBTU-20-010048 | V2R3 | The Ubuntu operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Ubuntu 20.04 |
| UBTU-20-010049 | V2R3 | The Ubuntu operating system SSH daemon must prevent remote hosts from connecting to the proxy display. | Ubuntu 20.04 |
| UBTU-20-010453 | V2R3 | The Ubuntu operating system must display the date and time of the last successful account logon upon logon. | Ubuntu 20.04 |
| UBTU-20-010459 | V2R3 | The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed. | Ubuntu 20.04 |
| UBTU-20-010460 | V2R3 | The Ubuntu operating system must disable the x86 Ctrl-Alt-Delete key sequence. | Ubuntu 20.04 |
| UBTU-20-010462 | V2R3 | The Ubuntu operating system must not have accounts configured with blank or null passwords. | Ubuntu 20.04 |
| UBTU-20-010463 | V2R3 | The Ubuntu operating system must not allow accounts configured with blank or null passwords. | Ubuntu 20.04 |
| UBTU-22-211015 | V2R6 | Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence. | Ubuntu 22.04 |
| UBTU-22-215015 | V2R6 | Ubuntu 22.04 LTS must have the "chrony" package installed. | Ubuntu 22.04 |
| UBTU-22-215020 | V2R6 | Ubuntu 22.04 LTS must not have the "systemd-timesyncd" package installed. | Ubuntu 22.04 |
| UBTU-22-215025 | V2R6 | Ubuntu 22.04 LTS must not have the "ntp" package installed. | Ubuntu 22.04 |
| UBTU-22-255040 | V2R6 | Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Ubuntu 22.04 |
| UBTU-22-255045 | V2R6 | Ubuntu 22.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display. | Ubuntu 22.04 |
| UBTU-22-271030 | V2R6 | Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed. | Ubuntu 22.04 |
| UBTU-22-611060 | V2R6 | Ubuntu 22.04 LTS must not allow accounts configured with blank or null passwords. | Ubuntu 22.04 |
| UBTU-22-611065 | V2R6 | Ubuntu 22.04 LTS must not have accounts configured with blank or null passwords. | Ubuntu 22.04 |
| UBTU-22-654190 | V2R6 | Ubuntu 22.04 LTS must generate audit records for all events that affect the systemd journal files. | Ubuntu 22.04 |
| UBTU-22-211000 | V2R6 | Ubuntu 22.04 LTS must be a vendor-supported release. | Ubuntu 22.04 |
| UBTU-24-100010 | V1R1 | Ubuntu 24.04 LTS must not have the "systemd-timesyncd" package installed. | Ubuntu 24.04 |
| UBTU-24-100020 | V1R1 | Ubuntu 24.04 LTS must not have the "ntp" package installed. | Ubuntu 24.04 |
| UBTU-24-100700 | V1R1 | Ubuntu 24.04 LTS must have the "chrony" package installed. | Ubuntu 24.04 |
| UBTU-24-300021 | V1R1 | Ubuntu 24.04 LTS must require users to reauthenticate for privilege escalation or when changing roles. | Ubuntu 24.04 |
| UBTU-24-300022 | V1R1 | Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | Ubuntu 24.04 |
| UBTU-24-300023 | V1R1 | Ubuntu 24.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display. | Ubuntu 24.04 |
| UBTU-24-300024 | V1R1 | Ubuntu 24.04 LTS must display the date and time of the last successful account logon upon logon. | Ubuntu 24.04 |
| UBTU-24-300025 | V1R1 | Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed. | Ubuntu 24.04 |
| UBTU-24-300026 | V1R1 | Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence. | Ubuntu 24.04 |
| UBTU-24-300027 | V1R1 | Ubuntu 24.04 LTS must not have accounts configured with blank or null passwords. | Ubuntu 24.04 |
| UBTU-24-300028 | V1R1 | Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords. | Ubuntu 24.04 |
| UBTU-24-300029 | V1R1 | Ubuntu 24.04 LTS must generate audit records for all events that affect the systemd journal files. | Ubuntu 24.04 |
| WN10-00-000005 | V3R4 | Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version. | Microsoft Windows 10 |
| WN10-00-000010 | V3R4 | Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. | Microsoft Windows 10 |
| WN10-00-000015 | V3R4 | Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | Microsoft Windows 10 |
| WN10-00-000020 | V3R4 | Secure Boot must be enabled on Windows 10 systems. | Microsoft Windows 10 |
| WN10-00-000040 | V3R4 | Windows 10 systems must be maintained at a supported servicing level. | Microsoft Windows 10 |
| WN10-00-000045 | V3R4 | The Windows 10 system must use an anti-virus program. | Microsoft Windows 10 |
| WN10-00-000055 | V3R4 | Alternate operating systems must not be permitted on the same system. | Microsoft Windows 10 |
| WN10-00-000075 | V3R4 | Only accounts responsible for the backup operations must be members of the Backup Operators group. | Microsoft Windows 10 |
| WN10-00-000085 | V3R4 | Standard local user accounts must not exist on a system in a domain. | Microsoft Windows 10 |
| WN10-00-000130 | V3R4 | Software certificate installation files must be removed from Windows 10. | Microsoft Windows 10 |
| WN10-00-000135 | V3R4 | A host-based firewall must be installed and enabled on the system. | Microsoft Windows 10 |
| WN10-00-000140 | V3R4 | Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts. | Microsoft Windows 10 |
| WN10-00-000190 | V3R4 | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10. | Microsoft Windows 10 |
| WN10-00-000230 | V3R4 | The system must notify the user when a Bluetooth device attempts to connect. | Microsoft Windows 10 |
| WN10-00-000240 | V3R4 | Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. | Microsoft Windows 10 |
| WN10-CC-000020 | V3R4 | IPv6 source routing must be configured to highest protection. | Microsoft Windows 10 |
| WN10-CC-000025 | V3R4 | The system must be configured to prevent IP source routing. | Microsoft Windows 10 |
| WN10-CC-000030 | V3R4 | The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes. | Microsoft Windows 10 |
| WN10-CC-000040 | V3R4 | Insecure logons to an SMB server must be disabled. | Microsoft Windows 10 |
| WN10-CC-000055 | V3R4 | Simultaneous connections to the internet or a Windows domain must be limited. | Microsoft Windows 10 |
| WN10-CC-000060 | V3R4 | Connections to non-domain networks when connected to a domain authenticated network must be blocked. | Microsoft Windows 10 |
| WN10-CC-000065 | V3R4 | Wi-Fi Sense must be disabled. | Microsoft Windows 10 |
| WN10-CC-000068 | V3R4 | Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials. | Microsoft Windows 10 |
| WN10-CC-000070 | V3R4 | Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | Microsoft Windows 10 |
| WN10-CC-000075 | V3R4 | Credential Guard must be running on Windows 10 domain-joined systems. | Microsoft Windows 10 |
| WN10-CC-000085 | V3R4 | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers. | Microsoft Windows 10 |
| WN10-CC-000090 | V3R4 | Group Policy objects must be reprocessed even if they have not changed. | Microsoft Windows 10 |
| WN10-CC-000115 | V3R4 | Systems must at least attempt device authentication using certificates. | Microsoft Windows 10 |
| WN10-CC-000170 | V3R4 | The setting to allow Microsoft accounts to be optional for modern style apps must be enabled. | Microsoft Windows 10 |
| WN10-CC-000195 | V3R4 | Enhanced anti-spoofing for facial recognition must be enabled on Window 10. | Microsoft Windows 10 |
| WN10-CC-000204 | V3R4 | If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics. | Microsoft Windows 10 |
| WN10-CC-000205 | V3R4 | Windows Telemetry must not be configured to Full. | Microsoft Windows 10 |
| WN10-CC-000206 | V3R4 | Windows Update must not obtain updates from other PCs on the internet. | Microsoft Windows 10 |
| WN10-CC-000225 | V3R4 | File Explorer shell protocol must run in protected mode. | Microsoft Windows 10 |
| WN10-CC-000230 | V3R4 | Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge. | Microsoft Windows 10 |
| WN10-CC-000235 | V3R4 | Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge. | Microsoft Windows 10 |
| WN10-CC-000238 | V3R4 | Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge. | Microsoft Windows 10 |
| WN10-CC-000245 | V3R4 | The password manager function in the Edge browser must be disabled. | Microsoft Windows 10 |
| WN10-CC-000250 | V3R4 | The Windows Defender SmartScreen filter for Microsoft Edge must be enabled. | Microsoft Windows 10 |
| WN10-CC-000255 | V3R4 | The use of a hardware security device with Windows Hello for Business must be enabled. | Microsoft Windows 10 |
| WN10-CC-000260 | V3R4 | Windows 10 must be configured to require a minimum pin length of six characters or greater. | Microsoft Windows 10 |
| WN10-CC-000295 | V3R4 | Attachments must be prevented from being downloaded from RSS feeds. | Microsoft Windows 10 |
| WN10-CC-000320 | V3R4 | Users must be notified if a web-based program attempts to install software. | Microsoft Windows 10 |
| WN10-SO-000015 | V3R4 | Local accounts with blank passwords must be restricted to prevent access from the network. | Microsoft Windows 10 |
| WN10-SO-000020 | V3R4 | The built-in administrator account must be renamed. | Microsoft Windows 10 |
| WN10-SO-000025 | V3R4 | The built-in guest account must be renamed. | Microsoft Windows 10 |
| WN10-SO-000050 | V3R4 | The computer account password must not be prevented from being reset. | Microsoft Windows 10 |
| WN10-SO-000055 | V3R4 | The maximum age for machine account passwords must be configured to 30 days or less. | Microsoft Windows 10 |
| WN10-SO-000085 | V3R4 | Caching of logon credentials must be limited. | Microsoft Windows 10 |
| WN10-SO-000095 | V3R4 | The Smart Card removal option must be configured to Force Logoff or Lock Workstation. | Microsoft Windows 10 |
| WN10-SO-000140 | V3R4 | Anonymous SID/Name translation must not be allowed. | Microsoft Windows 10 |
| WN10-SO-000145 | V3R4 | Anonymous enumeration of SAM accounts must not be allowed. | Microsoft Windows 10 |
| WN10-SO-000160 | V3R4 | The system must be configured to prevent anonymous users from having the same rights as the Everyone group. | Microsoft Windows 10 |
| WN10-SO-000180 | V3R4 | NTLM must be prevented from falling back to a Null session. | Microsoft Windows 10 |
| WN10-SO-000185 | V3R4 | PKU2U authentication using online identities must be prevented. | Microsoft Windows 10 |
| WN10-SO-000205 | V3R4 | The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. | Microsoft Windows 10 |
| WN10-SO-000210 | V3R4 | The system must be configured to the required LDAP client signing level. | Microsoft Windows 10 |
| WN10-SO-000215 | V3R4 | The system must be configured to meet the minimum session security requirement for NTLM SSP based clients. | Microsoft Windows 10 |
| WN10-SO-000220 | V3R4 | The system must be configured to meet the minimum session security requirement for NTLM SSP based servers. | Microsoft Windows 10 |
| WN10-SO-000240 | V3R4 | The default permissions of global system objects must be increased. | Microsoft Windows 10 |
| WN10-UC-000020 | V3R4 | Zone information must be preserved when saving attachments. | Microsoft Windows 10 |
| WN10-CC-000050 | V3R4 | Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | Microsoft Windows 10 |
| WN10-CC-000080 | V3R4 | Virtualization-based protection of code integrity must be enabled. | Microsoft Windows 10 |
| WN10-00-000395 | V3R4 | Windows 10 must not have portproxy enabled or in use. | Microsoft Windows 10 |
| WN10-CC-000063 | V3R4 | Windows 10 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance. | Microsoft Windows 10 |
| WN11-00-000005 | V2R5 | Domain-joined systems must use Windows 11 Enterprise Edition 64-bit version. | Microsoft Windows 11 |
| WN11-00-000040 | V2R5 | Windows 11 systems must be maintained at a supported servicing level. | Microsoft Windows 11 |
| WN11-00-000045 | V2R5 | The Windows 11 system must use an antivirus program. | Microsoft Windows 11 |
| WN11-00-000055 | V2R5 | Alternate operating systems must not be permitted on the same system. | Microsoft Windows 11 |
| WN11-00-000075 | V2R5 | Only accounts responsible for the backup operations must be members of the Backup Operators group. | Microsoft Windows 11 |
| WN11-00-000085 | V2R5 | Standard local user accounts must not exist on a system in a domain. | Microsoft Windows 11 |
| WN11-00-000130 | V2R5 | Software certificate installation files must be removed from Windows 11. | Microsoft Windows 11 |
| WN11-00-000135 | V2R5 | A host-based firewall must be installed and enabled on the system. | Microsoft Windows 11 |
| WN11-00-000190 | V2R5 | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 11. | Microsoft Windows 11 |
| WN11-00-000230 | V2R5 | The system must notify the user when a Bluetooth device attempts to connect. | Microsoft Windows 11 |
| WN11-00-000240 | V2R5 | Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email. | Microsoft Windows 11 |
| WN11-CC-000020 | V2R5 | IPv6 source routing must be configured to highest protection. | Microsoft Windows 11 |
| WN11-CC-000025 | V2R5 | The system must be configured to prevent IP source routing. | Microsoft Windows 11 |
| WN11-CC-000030 | V2R5 | The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes. | Microsoft Windows 11 |
| WN11-CC-000040 | V2R5 | Insecure logons to an SMB server must be disabled. | Microsoft Windows 11 |
| WN11-CC-000050 | V2R5 | Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | Microsoft Windows 11 |
| WN11-CC-000060 | V2R5 | Connections to non-domain networks when connected to a domain authenticated network must be blocked. | Microsoft Windows 11 |
| WN11-CC-000065 | V2R5 | Wi-Fi Sense must be disabled. | Microsoft Windows 11 |
| WN11-CC-000068 | V2R5 | Windows 11 must be configured to enable Remote host allows delegation of non-exportable credentials. | Microsoft Windows 11 |
| WN11-CC-000070 | V2R5 | Virtualization-based Security must be enabled on Windows 11 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | Microsoft Windows 11 |
| WN11-CC-000075 | V2R5 | Credential Guard must be running on Windows 11 domain-joined systems. | Microsoft Windows 11 |
| WN11-CC-000080 | V2R5 | Virtualization-based protection of code integrity must be enabled. | Microsoft Windows 11 |
| WN11-CC-000085 | V2R5 | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers. | Microsoft Windows 11 |
| WN11-CC-000090 | V2R5 | Group Policy objects must be reprocessed even if they have not changed. | Microsoft Windows 11 |
| WN11-CC-000115 | V2R5 | Systems must at least attempt device authentication using certificates. | Microsoft Windows 11 |
| WN11-CC-000170 | V2R5 | The setting to allow Microsoft accounts to be optional for modern style apps must be enabled. | Microsoft Windows 11 |
| WN11-CC-000195 | V2R5 | Enhanced anti-spoofing for facial recognition must be enabled on Windows 11. | Microsoft Windows 11 |
| WN11-CC-000204 | V2R5 | Enhanced diagnostic data must be limited to the minimum required to support Windows Analytics. | Microsoft Windows 11 |
| WN11-CC-000206 | V2R5 | Windows Update must not obtain updates from other PCs on the internet. | Microsoft Windows 11 |
| WN11-CC-000225 | V2R5 | File Explorer shell protocol must run in protected mode. | Microsoft Windows 11 |
| WN11-CC-000255 | V2R5 | The use of a hardware security device with Windows Hello for Business must be enabled. | Microsoft Windows 11 |
| WN11-CC-000260 | V2R5 | Windows 11 must be configured to require a minimum pin length of six characters or greater. | Microsoft Windows 11 |
| WN11-CC-000295 | V2R5 | Attachments must be prevented from being downloaded from RSS feeds. | Microsoft Windows 11 |
| WN11-CC-000320 | V2R5 | Users must be notified if a web-based program attempts to install software. | Microsoft Windows 11 |
| WN11-SO-000015 | V2R5 | Local accounts with blank passwords must be restricted to prevent access from the network. | Microsoft Windows 11 |
| WN11-SO-000020 | V2R5 | The built-in administrator account must be renamed. | Microsoft Windows 11 |
| WN11-SO-000025 | V2R5 | The built-in guest account must be renamed. | Microsoft Windows 11 |
| WN11-SO-000050 | V2R5 | The computer account password must not be prevented from being reset. | Microsoft Windows 11 |
| WN11-SO-000055 | V2R5 | The maximum age for machine account passwords must be configured to 30 days or less. | Microsoft Windows 11 |
| WN11-SO-000085 | V2R5 | Caching of logon credentials must be limited. | Microsoft Windows 11 |
| WN11-SO-000095 | V2R5 | The Smart Card removal option must be configured to Force Logoff or Lock Workstation. | Microsoft Windows 11 |
| WN11-SO-000140 | V2R5 | Anonymous SID/Name translation must not be allowed. | Microsoft Windows 11 |
| WN11-SO-000145 | V2R5 | Anonymous enumeration of SAM accounts must not be allowed. | Microsoft Windows 11 |
| WN11-SO-000160 | V2R5 | The system must be configured to prevent anonymous users from having the same rights as the Everyone group. | Microsoft Windows 11 |
| WN11-SO-000180 | V2R5 | NTLM must be prevented from falling back to a Null session. | Microsoft Windows 11 |
| WN11-SO-000185 | V2R5 | PKU2U authentication using online identities must be prevented. | Microsoft Windows 11 |
| WN11-SO-000205 | V2R5 | The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. | Microsoft Windows 11 |
| WN11-SO-000210 | V2R5 | The system must be configured to the required LDAP client signing level. | Microsoft Windows 11 |
| WN11-SO-000215 | V2R5 | The system must be configured to meet the minimum session security requirement for NTLM SSP based clients. | Microsoft Windows 11 |
| WN11-SO-000220 | V2R5 | The system must be configured to meet the minimum session security requirement for NTLM SSP based servers. | Microsoft Windows 11 |
| WN11-SO-000240 | V2R5 | The default permissions of global system objects must be increased. | Microsoft Windows 11 |
| WN11-UC-000020 | V2R5 | Zone information must be preserved when saving attachments. | Microsoft Windows 11 |
| WN11-00-000395 | V2R5 | Windows 11 must not have portproxy enabled or in use. | Microsoft Windows 11 |
| WN11-CC-000063 | V2R5 | Windows 11 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance. | Microsoft Windows 11 |
| WN16-00-000010 | V2R9 | Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks. | Microsoft Windows Server 2016 |
| WN16-00-000040 | V2R9 | Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. | Microsoft Windows Server 2016 |
| WN16-00-000050 | V2R9 | Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. | Microsoft Windows Server 2016 |
| WN16-00-000070 | V2R9 | Manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. | Microsoft Windows Server 2016 |
| WN16-00-000100 | V2R9 | Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. | Microsoft Windows Server 2016 |
| WN16-00-000110 | V2R9 | Systems must be maintained at a supported servicing level. | Microsoft Windows Server 2016 |
| WN16-00-000120 | V2R9 | The Windows Server 2016 system must use an anti-virus program. | Microsoft Windows Server 2016 |
| WN16-00-000140 | V2R9 | Servers must have a host-based intrusion detection or prevention system. | Microsoft Windows Server 2016 |
| WN16-00-000270 | V2R9 | Software certificate installation files must be removed from Windows Server 2016. | Microsoft Windows Server 2016 |
| WN16-00-000310 | V2R9 | A host-based firewall must be installed and enabled on the system. | Microsoft Windows Server 2016 |
| WN16-00-000430 | V2R9 | FTP servers must be configured to prevent anonymous logons. | Microsoft Windows Server 2016 |
| WN16-00-000440 | V2R9 | FTP servers must be configured to prevent access to the system drive. | Microsoft Windows Server 2016 |
| WN16-00-000460 | V2R9 | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016. | Microsoft Windows Server 2016 |
| WN16-00-000470 | V2R9 | Secure Boot must be enabled on Windows Server 2016 systems. | Microsoft Windows Server 2016 |
| WN16-00-000480 | V2R9 | Windows 2016 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | Microsoft Windows Server 2016 |
| WN16-CC-000040 | V2R9 | Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing. | Microsoft Windows Server 2016 |
| WN16-CC-000050 | V2R9 | Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing. | Microsoft Windows Server 2016 |
| WN16-CC-000060 | V2R9 | Windows Server 2016 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. | Microsoft Windows Server 2016 |
| WN16-CC-000080 | V2R9 | Insecure logons to an SMB server must be disabled. | Microsoft Windows Server 2016 |
| WN16-CC-000090 | V2R9 | Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | Microsoft Windows Server 2016 |
| WN16-CC-000110 | V2R9 | Windows Server 2016 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | Microsoft Windows Server 2016 |
| WN16-CC-000140 | V2R9 | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad. | Microsoft Windows Server 2016 |
| WN16-CC-000150 | V2R9 | Group Policy objects must be reprocessed even if they have not changed. | Microsoft Windows Server 2016 |
| WN16-CC-000210 | V2R9 | Users must be prompted to authenticate when the system wakes from sleep (on battery). | Microsoft Windows Server 2016 |
| WN16-CC-000220 | V2R9 | Users must be prompted to authenticate when the system wakes from sleep (plugged in). | Microsoft Windows Server 2016 |
| WN16-CC-000290 | V2R9 | Windows Telemetry must be configured to Security or Basic. | Microsoft Windows Server 2016 |
| WN16-CC-000350 | V2R9 | Turning off File Explorer heap termination on corruption must be disabled. | Microsoft Windows Server 2016 |
| WN16-CC-000360 | V2R9 | File Explorer shell protocol must run in protected mode. | Microsoft Windows Server 2016 |
| WN16-CC-000420 | V2R9 | Attachments must be prevented from being downloaded from RSS feeds. | Microsoft Windows Server 2016 |
| WN16-CC-000470 | V2R9 | Users must be notified if a web-based program attempts to install software. | Microsoft Windows Server 2016 |
| WN16-DC-000150 | V2R9 | Directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access. | Microsoft Windows Server 2016 |
| WN16-DC-000330 | V2R9 | Domain controllers must be configured to allow reset of machine account passwords. | Microsoft Windows Server 2016 |
| WN16-DC-000430 | V2R9 | The password for the krbtgt account on a domain must be reset at least every 180 days. | Microsoft Windows Server 2016 |
| WN16-MS-000050 | V2R9 | Caching of logon credentials must be limited. | Microsoft Windows Server 2016 |
| WN16-MS-000120 | V2R9 | Windows Server 2016 must be running Credential Guard on domain-joined member servers. | Microsoft Windows Server 2016 |
| WN16-SO-000020 | V2R9 | Local accounts with blank passwords must be restricted to prevent access from the network. | Microsoft Windows Server 2016 |
| WN16-SO-000030 | V2R9 | Windows Server 2016 built-in administrator account must be renamed. | Microsoft Windows Server 2016 |
| WN16-SO-000040 | V2R9 | Windows Server 2016 built-in guest account must be renamed. | Microsoft Windows Server 2016 |
| WN16-SO-000120 | V2R9 | The maximum age for machine account passwords must be configured to 30 days or less. | Microsoft Windows Server 2016 |
| WN16-SO-000180 | V2R9 | The Smart Card removal option must be configured to Force Logoff or Lock Workstation. | Microsoft Windows Server 2016 |
| WN16-SO-000250 | V2R9 | Anonymous SID/Name translation must not be allowed. | Microsoft Windows Server 2016 |
| WN16-SO-000260 | V2R9 | Anonymous enumeration of Security Account Manager (SAM) accounts must not be allowed. | Microsoft Windows Server 2016 |
| WN16-SO-000290 | V2R9 | Windows Server 2016 must be configured to prevent anonymous users from having the same permissions as the Everyone group. | Microsoft Windows Server 2016 |
| WN16-SO-000320 | V2R9 | Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously. | Microsoft Windows Server 2016 |
| WN16-SO-000330 | V2R9 | NTLM must be prevented from falling back to a Null session. | Microsoft Windows Server 2016 |
| WN16-SO-000340 | V2R9 | PKU2U authentication using online identities must be prevented. | Microsoft Windows Server 2016 |
| WN16-SO-000380 | V2R9 | The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM. | Microsoft Windows Server 2016 |
| WN16-SO-000390 | V2R9 | Windows Server 2016 must be configured to at least negotiate signing for LDAP client signing. | Microsoft Windows Server 2016 |
| WN16-SO-000400 | V2R9 | Session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption. | Microsoft Windows Server 2016 |
| WN16-SO-000410 | V2R9 | Session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption. | Microsoft Windows Server 2016 |
| WN16-SO-000450 | V2R9 | The default permissions of global system objects must be strengthened. | Microsoft Windows Server 2016 |
| WN16-UC-000030 | V2R9 | Zone information must be preserved when saving attachments. | Microsoft Windows Server 2016 |
| WN19-00-000010 | V3R6 | Windows Server 2019 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks. | Microsoft Windows Server 2019 |
| WN19-00-000030 | V3R6 | Windows Server 2019 administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. | Microsoft Windows Server 2019 |
| WN19-00-000040 | V3R6 | Windows Server 2019 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. | Microsoft Windows Server 2019 |
| WN19-00-000060 | V3R6 | Windows Server 2019 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. | Microsoft Windows Server 2019 |
| WN19-00-000090 | V3R6 | Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. | Microsoft Windows Server 2019 |
| WN19-00-000100 | V3R6 | Windows Server 2019 must be maintained at a supported servicing level. | Microsoft Windows Server 2019 |
| WN19-00-000110 | V3R6 | Windows Server 2019 must use an anti-virus program. | Microsoft Windows Server 2019 |
| WN19-00-000120 | V3R6 | Windows Server 2019 must have a host-based intrusion detection or prevention system. | Microsoft Windows Server 2019 |
| WN19-00-000240 | V3R6 | Windows Server 2019 must have software certificate installation files removed. | Microsoft Windows Server 2019 |
| WN19-00-000420 | V3R6 | Windows Server 2019 FTP servers must be configured to prevent anonymous logons. | Microsoft Windows Server 2019 |
| WN19-00-000430 | V3R6 | Windows Server 2019 FTP servers must be configured to prevent access to the system drive. | Microsoft Windows Server 2019 |
| WN19-00-000450 | V3R6 | Windows Server 2019 must have orphaned security identifiers (SIDs) removed from user rights. | Microsoft Windows Server 2019 |
| WN19-00-000460 | V3R6 | Windows Server 2019 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | Microsoft Windows Server 2019 |
| WN19-00-000470 | V3R6 | Windows Server 2019 must have Secure Boot enabled. | Microsoft Windows Server 2019 |
| WN19-CC-000030 | V3R6 | Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing. | Microsoft Windows Server 2019 |
| WN19-CC-000040 | V3R6 | Windows Server 2019 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing. | Microsoft Windows Server 2019 |
| WN19-CC-000050 | V3R6 | Windows Server 2019 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. | Microsoft Windows Server 2019 |
| WN19-CC-000070 | V3R6 | Windows Server 2019 insecure logons to an SMB server must be disabled. | Microsoft Windows Server 2019 |
| WN19-CC-000080 | V3R6 | Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | Microsoft Windows Server 2019 |
| WN19-CC-000100 | V3R6 | Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable credentials. | Microsoft Windows Server 2019 |
| WN19-CC-000110 | V3R6 | Windows Server 2019 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | Microsoft Windows Server 2019 |
| WN19-CC-000130 | V3R6 | Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad. | Microsoft Windows Server 2019 |
| WN19-CC-000140 | V3R6 | Windows Server 2019 group policy objects must be reprocessed even if they have not changed. | Microsoft Windows Server 2019 |
| WN19-CC-000180 | V3R6 | Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on battery). | Microsoft Windows Server 2019 |
| WN19-CC-000190 | V3R6 | Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plugged in). | Microsoft Windows Server 2019 |
| WN19-CC-000250 | V3R6 | Windows Server 2019 Telemetry must be configured to Security or Basic. | Microsoft Windows Server 2019 |
| WN19-CC-000260 | V3R6 | Windows Server 2019 Windows Update must not obtain updates from other PCs on the Internet. | Microsoft Windows Server 2019 |
| WN19-CC-000320 | V3R6 | Windows Server 2019 Turning off File Explorer heap termination on corruption must be disabled. | Microsoft Windows Server 2019 |
| WN19-CC-000330 | V3R6 | Windows Server 2019 File Explorer shell protocol must run in protected mode. | Microsoft Windows Server 2019 |
| WN19-CC-000390 | V3R6 | Windows Server 2019 must prevent attachments from being downloaded from RSS feeds. | Microsoft Windows Server 2019 |
| WN19-CC-000440 | V3R6 | Windows Server 2019 users must be notified if a web-based program attempts to install software. | Microsoft Windows Server 2019 |
| WN19-DC-000150 | V3R6 | Windows Server 2019 directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access. | Microsoft Windows Server 2019 |
| WN19-DC-000330 | V3R6 | Windows Server 2019 domain controllers must be configured to allow reset of machine account passwords. | Microsoft Windows Server 2019 |
| WN19-DC-000430 | V3R6 | The password for the krbtgt account on a domain must be reset at least every 180 days. | Microsoft Windows Server 2019 |
| WN19-MS-000050 | V3R6 | Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined member servers. | Microsoft Windows Server 2019 |
| WN19-MS-000140 | V3R6 | Windows Server 2019 must be running Credential Guard on domain-joined member servers. | Microsoft Windows Server 2019 |
| WN19-SO-000020 | V3R6 | Windows Server 2019 must prevent local accounts with blank passwords from being used from the network. | Microsoft Windows Server 2019 |
| WN19-SO-000030 | V3R6 | Windows Server 2019 built-in administrator account must be renamed. | Microsoft Windows Server 2019 |
| WN19-SO-000040 | V3R6 | Windows Server 2019 built-in guest account must be renamed. | Microsoft Windows Server 2019 |
| WN19-SO-000100 | V3R6 | Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less. | Microsoft Windows Server 2019 |
| WN19-SO-000150 | V3R6 | Windows Server 2019 Smart Card removal option must be configured to Force Logoff or Lock Workstation. | Microsoft Windows Server 2019 |
| WN19-SO-000210 | V3R6 | Windows Server 2019 must not allow anonymous SID/Name translation. | Microsoft Windows Server 2019 |
| WN19-SO-000220 | V3R6 | Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts. | Microsoft Windows Server 2019 |
| WN19-SO-000240 | V3R6 | Windows Server 2019 must be configured to prevent anonymous users from having the same permissions as the Everyone group. | Microsoft Windows Server 2019 |
| WN19-SO-000260 | V3R6 | Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously. | Microsoft Windows Server 2019 |
| WN19-SO-000270 | V3R6 | Windows Server 2019 must prevent NTLM from falling back to a Null session. | Microsoft Windows Server 2019 |
| WN19-SO-000280 | V3R6 | Windows Server 2019 must prevent PKU2U authentication using online identities. | Microsoft Windows Server 2019 |
| WN19-SO-000310 | V3R6 | Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. | Microsoft Windows Server 2019 |
| WN19-SO-000320 | V3R6 | Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing. | Microsoft Windows Server 2019 |
| WN19-SO-000330 | V3R6 | Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption. | Microsoft Windows Server 2019 |
| WN19-SO-000340 | V3R6 | Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption. | Microsoft Windows Server 2019 |
| WN19-SO-000370 | V3R6 | Windows Server 2019 default permissions of global system objects must be strengthened. | Microsoft Windows Server 2019 |
| WN19-UC-000010 | V3R6 | Windows Server 2019 must preserve zone information when saving attachments. | Microsoft Windows Server 2019 |
| WN19-00-000280 | V3R6 | Windows Server 2019 must have a host-based firewall installed and enabled. | Microsoft Windows Server 2019 |
| WN22-00-000010 | V2R6 | Windows Server 2022 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks. | Microsoft Windows Server 2022 |
| WN22-00-000030 | V2R6 | Windows Server 2022 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email. | Microsoft Windows Server 2022 |
| WN22-00-000040 | V2R6 | Windows Server 2022 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. | Microsoft Windows Server 2022 |
| WN22-00-000060 | V2R6 | Windows Server 2022 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. | Microsoft Windows Server 2022 |
| WN22-00-000090 | V2R6 | Windows Server 2022 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. | Microsoft Windows Server 2022 |
| WN22-00-000100 | V2R6 | Windows Server 2022 must be maintained at a supported servicing level. | Microsoft Windows Server 2022 |
| WN22-00-000110 | V2R6 | Windows Server 2022 must use an antivirus program. | Microsoft Windows Server 2022 |
| WN22-00-000120 | V2R6 | Windows Server 2022 must have a host-based intrusion detection or prevention system. | Microsoft Windows Server 2022 |
| WN22-00-000240 | V2R6 | Windows Server 2022 must have software certificate installation files removed. | Microsoft Windows Server 2022 |
| WN22-00-000280 | V2R6 | Windows Server 2022 must have a host-based firewall installed and enabled. | Microsoft Windows Server 2022 |
| WN22-00-000420 | V2R6 | Windows Server 2022 FTP servers must be configured to prevent anonymous logons. | Microsoft Windows Server 2022 |
| WN22-00-000430 | V2R6 | Windows Server 2022 FTP servers must be configured to prevent access to the system drive. | Microsoft Windows Server 2022 |
| WN22-00-000450 | V2R6 | Windows Server 2022 must have orphaned security identifiers (SIDs) removed from user rights. | Microsoft Windows Server 2022 |
| WN22-00-000460 | V2R6 | Windows Server 2022 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | Microsoft Windows Server 2022 |
| WN22-00-000470 | V2R6 | Windows Server 2022 must have Secure Boot enabled. | Microsoft Windows Server 2022 |
| WN22-CC-000030 | V2R6 | Windows Server 2022 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing. | Microsoft Windows Server 2022 |
| WN22-CC-000040 | V2R6 | Windows Server 2022 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing. | Microsoft Windows Server 2022 |
| WN22-CC-000050 | V2R6 | Windows Server 2022 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. | Microsoft Windows Server 2022 |
| WN22-CC-000070 | V2R6 | Windows Server 2022 insecure logons to an SMB server must be disabled. | Microsoft Windows Server 2022 |
| WN22-CC-000080 | V2R6 | Windows Server 2022 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | Microsoft Windows Server 2022 |
| WN22-CC-000100 | V2R6 | Windows Server 2022 must be configured to enable Remote host allows delegation of nonexportable credentials. | Microsoft Windows Server 2022 |
| WN22-CC-000110 | V2R6 | Windows Server 2022 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | Microsoft Windows Server 2022 |
| WN22-CC-000130 | V2R6 | Windows Server 2022 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad. | Microsoft Windows Server 2022 |
| WN22-CC-000140 | V2R6 | Windows Server 2022 group policy objects must be reprocessed even if they have not changed. | Microsoft Windows Server 2022 |
| WN22-CC-000180 | V2R6 | Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (on battery). | Microsoft Windows Server 2022 |
| WN22-CC-000190 | V2R6 | Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (plugged in). | Microsoft Windows Server 2022 |
| WN22-CC-000250 | V2R6 | Windows Server 2022 Diagnostic Data must be configured to send "required diagnostic data" or "optional diagnostic data". | Microsoft Windows Server 2022 |
| WN22-CC-000260 | V2R6 | Windows Server 2022 Windows Update must not obtain updates from other PCs on the internet. | Microsoft Windows Server 2022 |
| WN22-CC-000320 | V2R6 | Windows Server 2022 Turning off File Explorer heap termination on corruption must be disabled. | Microsoft Windows Server 2022 |
| WN22-CC-000330 | V2R6 | Windows Server 2022 File Explorer shell protocol must run in protected mode. | Microsoft Windows Server 2022 |
| WN22-CC-000390 | V2R6 | Windows Server 2022 must prevent attachments from being downloaded from RSS feeds. | Microsoft Windows Server 2022 |
| WN22-CC-000440 | V2R6 | Windows Server 2022 users must be notified if a web-based program attempts to install software. | Microsoft Windows Server 2022 |
| WN22-DC-000150 | V2R6 | Windows Server 2022 directory data (outside the root DSE) of a nonpublic directory must be configured to prevent anonymous access. | Microsoft Windows Server 2022 |
| WN22-DC-000330 | V2R6 | Windows Server 2022 domain controllers must be configured to allow reset of machine account passwords. | Microsoft Windows Server 2022 |
| WN22-DC-000430 | V2R6 | The password for the krbtgt account on a domain must be reset at least every 180 days. | Microsoft Windows Server 2022 |
| WN22-MS-000050 | V2R6 | Windows Server 2022 must limit the caching of logon credentials to four or less on domain-joined member servers. | Microsoft Windows Server 2022 |
| WN22-MS-000140 | V2R6 | Windows Server 2022 must be running Credential Guard on domain-joined member servers. | Microsoft Windows Server 2022 |
| WN22-SO-000020 | V2R6 | Windows Server 2022 must prevent local accounts with blank passwords from being used from the network. | Microsoft Windows Server 2022 |
| WN22-SO-000030 | V2R6 | Windows Server 2022 built-in administrator account must be renamed. | Microsoft Windows Server 2022 |
| WN22-SO-000040 | V2R6 | Windows Server 2022 built-in guest account must be renamed. | Microsoft Windows Server 2022 |
| WN22-SO-000100 | V2R6 | Windows Server 2022 maximum age for machine account passwords must be configured to 30 days or less. | Microsoft Windows Server 2022 |
| WN22-SO-000150 | V2R6 | Windows Server 2022 Smart Card removal option must be configured to Force Logoff or Lock Workstation. | Microsoft Windows Server 2022 |
| WN22-SO-000210 | V2R6 | Windows Server 2022 must not allow anonymous SID/Name translation. | Microsoft Windows Server 2022 |
| WN22-SO-000220 | V2R6 | Windows Server 2022 must not allow anonymous enumeration of Security Account Manager (SAM) accounts. | Microsoft Windows Server 2022 |
| WN22-SO-000240 | V2R6 | Windows Server 2022 must be configured to prevent anonymous users from having the same permissions as the Everyone group. | Microsoft Windows Server 2022 |
| WN22-SO-000260 | V2R6 | Windows Server 2022 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously. | Microsoft Windows Server 2022 |
| WN22-SO-000270 | V2R6 | Windows Server 2022 must prevent NTLM from falling back to a Null session. | Microsoft Windows Server 2022 |
| WN22-SO-000280 | V2R6 | Windows Server 2022 must prevent PKU2U authentication using online identities. | Microsoft Windows Server 2022 |
| WN22-SO-000310 | V2R6 | Windows Server 2022 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. | Microsoft Windows Server 2022 |
| WN22-SO-000320 | V2R6 | Windows Server 2022 must be configured to at least negotiate signing for LDAP client signing. | Microsoft Windows Server 2022 |
| WN22-SO-000330 | V2R6 | Windows Server 2022 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption. | Microsoft Windows Server 2022 |
| WN22-SO-000340 | V2R6 | Windows Server 2022 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption. | Microsoft Windows Server 2022 |
| WN22-SO-000370 | V2R6 | Windows Server 2022 default permissions of global system objects must be strengthened. | Microsoft Windows Server 2022 |
| WN22-UC-000010 | V2R6 | Windows Server 2022 must preserve zone information when saving attachments. | Microsoft Windows Server 2022 |