---
policy: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG)
title: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG)
id: stig_ubuntu2404
version: V1R1
source: https://www.cyber.mil/stigs/downloads/

levels:
    - id: high
    - id: medium
    - id: low

reference_type: stigid
product: ubuntu2404

controls:
    - id: UBTU-24-100010
      title: Ubuntu 24.04 LTS must not have the "systemd-timesyncd" package installed.
      levels:
          - low
      rules:
          - package_timesyncd_removed
      status: automated

    - id: UBTU-24-100020
      title: Ubuntu 24.04 LTS must not have the "ntp" package installed.
      levels:
          - low
      rules:
          - package_ntp_removed
      status: automated

    - id: UBTU-24-100030
      title: Ubuntu 24.04 LTS must not have the telnet package installed.
      levels:
          - high
      rules:
          - package_telnetd_removed
      status: automated

    - id: UBTU-24-100040
      title: Ubuntu 24.04 LTS must not have the rsh-server package installed.
      levels:
          - high
      rules:
          - package_rsh-server_removed
      status: automated

    - id: UBTU-24-100100
      title: Ubuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security
          functions.
      levels:
          - medium
      rules:
          - package_aide_installed
      status: automated

    - id: UBTU-24-100110
      title: Ubuntu 24.04 LTS must configure AIDE to preform file integrity checking on the file system.
      levels:
          - medium
      rules:
          - aide_build_database
      status: automated

    - id: UBTU-24-100120
      title: Ubuntu 24.04 LTS must be configured so that the script which runs each 30 days or less to
          check file integrity is the default one.
      levels:
          - medium
      rules:
          - aide_periodic_checking_systemd_timer
          - aide_periodic_cron_checking
      status: automated

    - id: UBTU-24-100130
      title: Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed
          in an unauthorized manner. The file integrity tool must notify the system administrator (SA)
          when changes to the baseline configuration or anomalies in the operation of any security functions
          are discovered.
      levels:
          - medium
      rules:
          - aide_disable_silentreports
      status: automated

    - id: UBTU-24-100200
      title: Ubuntu 24.04 LTS must be configured to preserve log records from failure events.
      levels:
          - medium
      rules:
          - service_rsyslog_enabled
      status: automated

    - id: UBTU-24-100300
      title: Ubuntu 24.04 LTS must have an application firewall installed in order to control remote
          access methods.
      levels:
          - medium
      rules:
          - var_network_filtering_service=ufw
          - package_ufw_installed
      status: automated

    - id: UBTU-24-100310
      title: Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).
      levels:
          - medium
      rules:
          - check_ufw_active
      status: automated

    - id: UBTU-24-100400
      title: Ubuntu 24.04 LTS must have the "auditd" package installed.
      levels:
          - medium
      rules:
          - package_audit_installed
      status: automated

    - id: UBTU-24-100410
      title: Ubuntu 24.04 LTS must produce audit records and reports containing information to establish
          when, where, what type, the source, and the outcome for all DOD-defined auditable events and
          actions in near real time.
      levels:
          - medium
      rules:
          - service_auditd_enabled
      status: automated

    - id: UBTU-24-100450
      title: Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a
          different system or storage media from the system being audited.
      levels:
          - low
      rules:
      #- var_audispd_remote_server=192.168.122.126
          - auditd_audispd_configure_remote_server
          - package_audit-audispd-plugins_installed
      status: automated

    - id: UBTU-24-100500
      title: Ubuntu 24.04 LTS must have AppArmor installed.
      levels:
          - medium
      rules:
          - package_apparmor_installed
      status: automated

    - id: UBTU-24-100510
      title: Ubuntu 24.04 LTS must be configured to use AppArmor.
      levels:
          - medium
      rules:
          - apparmor_configured
      status: automated

    - id: UBTU-24-100600
      title: Ubuntu 24.04 LTS must have the "libpam-pwquality" package installed.
      levels:
          - medium
      rules:
          - package_pam_pwquality_installed
      status: automated

    - id: UBTU-24-100650
      title: Ubuntu 24.04 LTS must have the "SSSD" package installed.
      levels:
          - medium
      rules:
          - package_nss_sss_installed
          - package_pam_sss_installed
          - package_sssd_installed
      status: automated

    - id: UBTU-24-100660
      title: Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.
      levels:
          - medium
      rules:
          - service_sssd_enabled
      status: automated

    - id: UBTU-24-100700
      title: Ubuntu 24.04 LTS must have the "chrony" package installed.
      levels:
          - low
      rules:
          - var_timesync_service=chronyd
          - package_chrony_installed
      status: automated

    - id: UBTU-24-100800
      title: Ubuntu 24.04 LTS must have SSH installed.
      levels:
          - high
      rules:
          - package_openssh-server_installed
      status: automated

    - id: UBTU-24-100810
      title: Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted
          information.
      levels:
          - high
      rules:
          - service_sshd_enabled
      status: automated

    - id: UBTU-24-100820
      title: Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent
          the unauthorized disclosure of information and/or detect changes to information during transmission.
      levels:
          - medium
      rules:
          - sshd_use_approved_ciphers_ordered_stig
      status: automated

    - id: UBTU-24-100830
      title: Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs)
          employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of
          information and/or detect changes to information during transmission.
      levels:
          - medium
      rules:
          - sshd_use_approved_macs_ordered_stig
      status: automated

    - id: UBTU-24-100840
      title: Ubuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange
          algorithms.
      levels:
          - medium
      rules:
          - sshd_use_approved_kex_ordered_stig
      status: automated

    - id: UBTU-24-100850
      title: Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent
          the unauthorized disclosure of information and/or detect changes to information during transmission.
      levels:
          - medium
      rules:
          - ssh_client_use_approved_ciphers_ordered_stig
      status: automated

    - id: UBTU-24-100860
      title: Ubuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes
          (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
      levels:
          - medium
      rules:
          - ssh_approved_macs=stig_ubuntu2404
          - ssh_use_approved_macs_ordered_stig
      status: automated

    - id: UBTU-24-100900
      title: Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials.
      levels:
          - medium
      rules:
          - package_opensc_installed
      status: automated

    - id: UBTU-24-100910
      title: Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through
          the Privileged Access Management (PAM) framework.
      levels:
          - medium
      rules:
          - install_smartcard_packages
      status: automated

    - id: UBTU-24-101000
      title: Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection
          types.
      levels:
          - medium
      rules:
          - vlock_installed
      status: automated

    - id: UBTU-24-102000
      title: Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and
          maintenance modes.
      levels:
          - high
      rules:
          - grub2_password
          - grub2_uefi_password
      status: automated

    - id: UBTU-24-102010
      title: Ubuntu 24.04 LTS must initiate session audits at system startup.
      levels:
          - medium
      rules:
          - grub2_audit_argument
      status: automated

    - id: UBTU-24-200000
      title: Ubuntu 24.04 LTS must limit the number of concurrent sessions to 10 for all accounts and/or
          account types.
      levels:
          - low
      rules:
          - var_accounts_max_concurrent_login_sessions=10
          - accounts_max_concurrent_login_sessions
      status: automated

    - id: UBTU-24-200020
      title: Ubuntu 24.04 LTS must initiate a graphical session lock after 10 minutes of inactivity.
      levels:
          - medium
      rules:
          - inactivity_timeout_value=10_minutes
          - var_screensaver_lock_delay=immediate
          - dconf_gnome_screensaver_idle_delay
          - dconf_gnome_screensaver_lock_delay
      status: automated

    - id: UBTU-24-200040
      title: Ubuntu 24.04 LTS must retain a user's session lock until the user reestablishes access using
          established identification and authentication procedures.
      levels:
          - medium
      rules:
          - dconf_gnome_screensaver_lock_enabled
      status: automated

    - id: UBTU-24-200060
      title: Ubuntu 24.04 LTS must automatically terminate a user session after inactivity timeouts have
          expired.
      levels:
          - medium
      rules:
          - var_accounts_tmout=10_min
          - accounts_tmout
      status: automated

    - id: UBTU-24-200090
      title: Ubuntu 24.04 LTS must monitor remote access methods.
      levels:
          - medium
      rules:
          - rsyslog_remote_access_monitoring
      status: automated

    - id: UBTU-24-200250
      title: Ubuntu 24.04 LTS must automatically remove or disable emergency accounts after 72 hours.
      levels:
          - medium
      rules:
          - account_temp_expire_date
      status: automated

    - id: UBTU-24-200260
      title: Ubuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices)
          after 35 days of inactivity.
      levels:
          - medium
      rules:
          - account_disable_post_pw_expiration
      status: automated

    - id: UBTU-24-200280
      title: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/passwd.
      levels:
          - medium
      rules:
          - audit_rules_usergroup_modification_passwd
      status: automated

    - id: UBTU-24-200290
      title: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/group.
      levels:
          - medium
      rules:
          - audit_rules_usergroup_modification_group
      status: automated

    - id: UBTU-24-200300
      title: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/shadow.
      levels:
          - medium
      rules:
          - audit_rules_usergroup_modification_shadow
      status: automated

    - id: UBTU-24-200310
      title: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/gshadow.
      levels:
          - medium
      rules:
          - audit_rules_usergroup_modification_gshadow
      status: automated

    - id: UBTU-24-200320
      title: Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/opasswd.
      levels:
          - medium
      rules:
          - audit_rules_usergroup_modification_opasswd
      status: automated

    - id: UBTU-24-200580
      title: Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than
          users executing the software and the audit system must be configured to audit the execution
          of privileged functions.
      levels:
          - medium
      rules:
          - audit_rules_suid_privilege_function
      status: automated

    - id: UBTU-24-200610
      title: Ubuntu 24.04 LTS must automatically lock an account until the locked account is released
          by an administrator when three unsuccessful logon attempts have been made.
      levels:
          - low
      rules:
          - var_accounts_passwords_pam_faillock_deny=3
          - var_accounts_passwords_pam_faillock_fail_interval=900
          - var_accounts_passwords_pam_faillock_unlock_time=never
          - accounts_passwords_pam_faillock_audit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_silent
          - accounts_passwords_pam_faillock_unlock_time
      status: automated

    - id: UBTU-24-200640
      title: Ubuntu 24.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before
          granting access to via an SSH logon.
      levels:
          - medium
      rules:
          - remote_login_banner_text=dod_banners
          - sshd_enable_warning_banner_net
          - banner_etc_issue_net
      status: automated

    - id: UBTU-24-200650
      title: Ubuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory
          DOD Notice and Consent Banner before granting local access to the system via a graphical user
          logon.
      levels:
          - medium
      rules:
          - dconf_gnome_banner_enabled
      status: automated

    - id: UBTU-24-200660
      title: Ubuntu 24.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before
          granting local access to the system via a graphical user logon.
      levels:
          - medium
      rules:
          - login_banner_text=dod_banners
          - dconf_gnome_login_banner_text
      status: automated

    - id: UBTU-24-200680
      title: Ubuntu 24.04 LTS must be configured to enforce the acknowledgement of the Standard Mandatory
          DOD Notice and Consent Banner for all SSH connections.
      levels:
          - medium
      rules:
          - banner_etc_profiled_ssh_confirm
          - var_ssh_confirm_text=dod_default
      status: automated

    - id: UBTU-24-300001
      title: Ubuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation
          of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification
          they have been digitally signed using a certificate that is recognized and approved by the
          organization.
      levels:
          - low
      rules:
          - apt_conf_disallow_unauthenticated
      status: automated

    - id: UBTU-24-300006
      title: Ubuntu 24.04 LTS library files must have mode 0755 or less permissive.
      levels:
          - medium
      rules:
          - file_permissions_library_dirs
      status: automated

    - id: UBTU-24-300007
      title: Ubuntu 24.04 LTS library files must be owned by root.
      levels:
          - medium
      rules:
          - file_ownership_library_dirs
      status: automated

    - id: UBTU-24-300008
      title: Ubuntu 24.04 LTS library directories must be owned by root.
      levels:
          - medium
      rules:
          - dir_ownership_library_dirs
      status: automated

    - id: UBTU-24-300009
      title: Ubuntu 24.04 LTS library files must be group-owned by root or a system account.
      levels:
          - medium
      rules:
          - root_permissions_syslibrary_files
      status: automated

    - id: UBTU-24-300010
      title: Ubuntu 24.04 LTS library directories must be group-owned by root.
      levels:
          - medium
      rules:
          - dir_group_ownership_library_dirs
      status: automated

    - id: UBTU-24-300011
      title: Ubuntu 24.04 LTS must have system commands set to a mode of 0755 or less permissive.
      levels:
          - medium
      rules:
          - file_permissions_binary_dirs
      status: automated

    - id: UBTU-24-300012
      title: Ubuntu 24.04 LTS must have system commands owned by root or a system account.
      levels:
          - medium
      rules:
          - file_ownership_binary_dirs
      status: automated

    - id: UBTU-24-300013
      title: Ubuntu 24.04 LTS must have system commands group-owned by root or a system account.
      levels:
          - medium
      rules:
          - file_groupownership_system_commands_dirs
      status: automated

    - id: UBTU-24-300014
      title: Ubuntu 24.04 LTS must prevent the use of dictionary words for passwords.
      levels:
          - medium
      rules:
          - var_password_pam_dictcheck=1
          - accounts_password_pam_dictcheck
      status: automated

    - id: UBTU-24-300016
      title: Ubuntu 24.04 LTS must be configured so that when passwords are changed or new passwords
          are established, pwquality must be used.
      levels:
          - medium
      rules:
          - var_password_pam_retry=3
          - accounts_password_pam_enforcing
          - accounts_password_pam_retry
      status: automated

    - id: UBTU-24-300017
      title: Ubuntu 24.04 LTS must enforce a delay of at least four seconds between logon prompts following
          a failed logon attempt.
      levels:
          - low
      rules:
          - var_password_pam_delay=4000000
          - accounts_passwords_pam_faildelay_delay
      status: automated

    - id: UBTU-24-300021
      title: Ubuntu 24.04 LTS must require users to reauthenticate for privilege escalation or when changing
          roles.
      levels:
          - medium
      rules:
          - sudo_require_authentication
      status: automated

    - id: UBTU-24-300022
      title: Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to
          fulfill documented and validated mission requirements.
      levels:
          - high
      rules:
          - sshd_disable_x11_forwarding
      status: automated

    - id: UBTU-24-300023
      title: Ubuntu 24.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display.
      levels:
          - medium
      rules:
          - sshd_x11_use_localhost
      status: automated

    - id: UBTU-24-300024
      title: Ubuntu 24.04 LTS must display the date and time of the last successful account logon upon
          logon.
      levels:
          - low
      rules:
          - display_login_attempts
      status: automated

    - id: UBTU-24-300025
      title: Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface
          is installed.
      levels:
          - high
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot
      status: automated

    - id: UBTU-24-300026
      title: Ubuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence.
      levels:
          - high
      rules:
          - disable_ctrlaltdel_reboot
      status: automated

    - id: UBTU-24-300027
      title: Ubuntu 24.04 LTS must not have accounts configured with blank or null passwords.
      levels:
          - high
      rules:
          - no_empty_passwords_etc_shadow
      status: automated

    - id: UBTU-24-300028
      title: Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules
          (PAM) with blank or null passwords.
      levels:
          - high
      rules:
          - no_empty_passwords
      status: automated

    - id: UBTU-24-300029
      title: Ubuntu 24.04 LTS must generate audit records for all events that affect the systemd journal
          files.
      levels:
          - medium
      rules:
          - audit_rules_var_log_journal
      status: automated

    - id: UBTU-24-300030
      title: Ubuntu 24.04 LTS default filesystem permissions must be defined in such a way that all authenticated
          users can read and modify only their own files.
      levels:
          - medium
      rules:
          - var_accounts_user_umask=077
          - accounts_umask_etc_login_defs
      status: automated

    - id: UBTU-24-300031
      title: Ubuntu 24.04 LTS must not allow unattended or automatic login via SSH.
      levels:
          - high
      rules:
          - sshd_disable_empty_passwords
          - sshd_do_not_permit_user_env
      status: automated

    - id: UBTU-24-300039
      title: Ubuntu 24.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage
          driver.
      levels:
          - medium
      rules:
          - kernel_module_usb-storage_disabled
      status: automated

    - id: UBTU-24-300041
      title: Ubuntu 24.04 LTS must be configured to prohibit or restrict the use of functions, ports,
          protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category
          Assurance List (PPSM CAL) and vulnerability assessments.
      levels:
          - medium
      rules:
          - ufw_only_required_services
      status: automated

    - id: UBTU-24-400000
      title: Ubuntu 24.04 LTS must uniquely identify interactive users.
      levels:
          - medium
      rules:
          - no_duplicate_uids
      status: automated

    - id: UBTU-24-400020
      title: Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local
          and network access to privileged and nonprivileged accounts.
      levels:
          - medium
      rules:
          - smartcard_pam_enabled
      status: automated

    - id: UBTU-24-400030
      title: Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local
          and network access to privileged and nonprivileged accounts over SSH.
      levels:
          - medium
      rules:
          - sshd_enable_pubkey_auth
      status: automated

    - id: UBTU-24-400060
      title: Ubuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials.
      levels:
          - medium
      rules:
          - smartcard_configure_cert_checking
      status: automated

    - id: UBTU-24-400110
      title: Ubuntu 24.04 LTS must prevent direct login to the root account.
      levels:
          - medium
      rules:
          - prevent_direct_root_logins
      status: automated

    - id: UBTU-24-400220
      title: Ubuntu 24.04 LTS must store only encrypted representations of passwords.
      levels:
          - medium
      rules:
          - var_password_pam_unix_rounds=100000
          - set_password_hashing_algorithm_auth_stig
          - accounts_password_pam_unix_rounds_password_auth
      status: automated

    - id: UBTU-24-400260
      title: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one uppercase
          character be used.
      levels:
          - medium
      rules:
          - var_password_pam_ucredit=1
          - accounts_password_pam_ucredit
      status: automated

    - id: UBTU-24-400270
      title: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one lowercase
          character be used.
      levels:
          - medium
      rules:
          - var_password_pam_lcredit=1
          - accounts_password_pam_lcredit
      status: automated

    - id: UBTU-24-400280
      title: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one numeric
          character be used.
      levels:
          - medium
      rules:
          - var_password_pam_dcredit=1
          - accounts_password_pam_dcredit
      status: automated

    - id: UBTU-24-400290
      title: Ubuntu 24.04 LTS must require the change of at least eight characters when passwords are
          changed.
      levels:
          - medium
      rules:
          - var_password_pam_difok=8
          - accounts_password_pam_difok
      status: automated

    - id: UBTU-24-400300
      title: Ubuntu 24.04 LTS must enforce 24 hours/1 day as the minimum password lifetime. Passwords
          for new users must have a 24 hours/1 day minimum password lifetime restriction.
      levels:
          - medium
      rules:
          - var_accounts_minimum_age_login_defs=1
          - accounts_minimum_age_login_defs
      status: automated

    - id: UBTU-24-400310
      title: Ubuntu 24.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords
          for new users must have a 60-day maximum password lifetime restriction.
      levels:
          - medium
      rules:
          - var_accounts_maximum_age_login_defs=60
          - accounts_maximum_age_login_defs
      status: automated

    - id: UBTU-24-400320
      title: Ubuntu 24.04 LTS must enforce a minimum 15-character password length.
      levels:
          - medium
      rules:
          - var_password_pam_minlen=15
          - accounts_password_pam_minlen
      status: automated

    - id: UBTU-24-400330
      title: Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one special
          character be used.
      levels:
          - medium
      rules:
          - var_password_pam_ocredit=1
          - accounts_password_pam_ocredit
      status: automated

    - id: UBTU-24-400340
      title: Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits
          the use of cached authentications after one day.
      levels:
          - low
      rules:
          - sssd_offline_cred_expiration
      status: automated

    - id: UBTU-24-400360
      title: Ubuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing
          a certification path (which includes status information) to an accepted trust anchor.
      levels:
          - medium
      rules:
          - sssd_enable_pam_services
          - sssd_enable_smartcards
          - sssd_certification_path_trust_anchor
      status: automated

    - id: UBTU-24-400370
      title: Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based
          authentication.
      levels:
          - high
      rules:
          - sssd_enable_user_cert
      status: automated

    - id: UBTU-24-400375
      title: Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must
          validate certificates by constructing a certification path (which includes status information)
          to an accepted trust anchor.
      levels:
          - medium
      rules:
          - smartcard_configure_ca
      status: automated

    - id: UBTU-24-400380
      title: Ubuntu 24.04 LTS for PKI-based authentication, must implement a local cache of revocation
          data in case of the inability to access revocation information via the network.
      levels:
          - medium
      rules:
          - smartcard_configure_crl
      status: automated

    - id: UBTU-24-400400
      title: Ubuntu 24.04 LTS must encrypt all stored passwords with a FIPS 140-3 approved cryptographic
          hashing algorithm.
      levels:
          - medium
      rules:
          - set_password_hashing_algorithm_logindefs
      status: automated

    - id: UBTU-24-500010
      title: Ubuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance,
          diagnostic sessions, and other system-level access.
      levels:
          - medium
      rules:
          - audit_sudo_log_events
      status: automated

    - id: UBTU-24-500050
      title: Ubuntu 24.04 LTS must use strong authenticators in establishing nonlocal maintenance and
          diagnostic sessions.
      levels:
          - medium
      rules:
          - sshd_enable_pam
      status: automated

    - id: UBTU-24-600000
      title: Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH
          traffic after a period of inactivity.
      levels:
          - medium
      rules:
          - var_sshd_set_keepalive=1
          - sshd_set_keepalive
      status: automated

    - id: UBTU-24-600010
      title: Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH
          traffic at the end of the session or after 10 minutes of inactivity.
      levels:
          - medium
      rules:
          - sshd_idle_timeout_value=10_minutes
          - sshd_set_idle_timeout
      status: automated

    - id: UBTU-24-600030
      title: 'Ubuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified
          information and for the following: To provision digital signatures, to generate cryptographic
          hashes, and to protect unclassified information requiring confidentiality and cryptographic
          protection in accordance with applicable federal laws, Executive Orders, directives, policies,
          regulations, and standards.'
      levels:
          - high
      rules:
          - is_fips_mode_enabled
      status: automated

    - id: UBTU-24-600060
      title: Ubuntu 24.04 LTS must use DOD PKI-established certificate authorities (CAs) for verification
          of the establishment of protected sessions.
      levels:
          - medium
      rules:
          - only_allow_dod_certs
      status: automated

    - id: UBTU-24-600070
      title: Ubuntu 24.04 LTS must disable kernel core dumps.
      levels:
          - medium
      rules:
          - service_kdump_disabled
      status: automated

    - id: UBTU-24-600090
      title: Ubuntu 24.04 LTS handling data requiring "data at rest" protections must employ cryptographic
          mechanisms to prevent unauthorized disclosure and modification of the information at rest.
      levels:
          - medium
      rules:
          - encrypt_partitions
      status: automated

    - id: UBTU-24-600130
      title: Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of
          sudo group.
      levels:
          - high
      rules:
          - ensure_sudo_group_restricted
      status: automated

    - id: UBTU-24-600140
      title: Ubuntu 24.04 LTS must restrict access to the kernel message buffer.
      levels:
          - low
      rules:
          - sysctl_kernel_dmesg_restrict
      status: automated

    - id: UBTU-24-600150
      title: Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized
          and unintended information transferred via shared system resources.
      levels:
          - medium
      rules:
          - dir_perms_world_writable_sticky_bits
      status: automated

    - id: UBTU-24-600160
      title: Ubuntu 24.04 LTS must compare internal information system clocks at least every 24 hours
          with an authoritative time server.
      levels:
          - low
      rules:
          - var_time_service_set_maxpoll=18_hours
          - var_multiple_time_servers=stig
          - chronyd_specify_remote_server
          - chronyd_or_ntpd_set_maxpoll
          - chronyd_server_directive
      status: automated

    - id: UBTU-24-600180
      title: Ubuntu 24.04 LTS must synchronize internal information system clocks to the authoritative
          time source when the time difference is greater than one second.
      levels:
          - low
      rules:
          - chronyd_sync_clock
      status: automated

    - id: UBTU-24-600190
      title: Ubuntu 24.04 LTS must be configured to use TCP syncookies.
      levels:
          - medium
      rules:
          - sysctl_net_ipv4_tcp_syncookies
      status: automated

    - id: UBTU-24-600200
      title: Ubuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network
          interfaces.
      levels:
          - medium
      rules:
          - ufw_rate_limit
      status: automated

    - id: UBTU-24-600230
      title: Ubuntu 24.04 LTS must disable all wireless network adapters.
      levels:
          - medium
      rules:
          - wireless_disable_interfaces
      status: automated

    - id: UBTU-24-700010
      title: Ubuntu 24.04 LTS must generate error messages that provide information necessary for corrective
          actions without revealing information that could be exploited by adversaries.
      levels:
          - medium
      rules:
          - file_permissions_var_log_stig
      status: automated

    - id: UBTU-24-700020
      title: Ubuntu 24.04 LTS must generate system journal entries without revealing information that
          could be exploited by adversaries.
      levels:
          - medium
      rules:
          - dir_permissions_system_journal
          - file_permissions_system_journal
      status: automated

    - id: UBTU-24-700030
      title: Ubuntu 24.04 LTS must be configured so that the "journalctl" command is not accessible by
          unauthorized users.
      levels:
          - medium
      rules:
          - file_permissions_journalctl
      status: automated

    - id: UBTU-24-700040
      title: Ubuntu 24.04 LTS must be configured so that the "journalctl" command is owned by "root".
      levels:
          - medium
      rules:
          - file_owner_journalctl
      status: automated

    - id: UBTU-24-700050
      title: Ubuntu 24.04 LTS must be configured so that the "journalctl" command is group-owned by "root".
      levels:
          - medium
      rules:
          - file_groupowner_journalctl
      status: automated

    - id: UBTU-24-700060
      title: Ubuntu 24.04 LTS must configure the directories used by the system journal to be group-owned
          by "systemd-journal".
      levels:
          - medium
      rules:
          - dir_groupowner_system_journal
      status: automated

    - id: UBTU-24-700070
      title: Ubuntu 24.04 LTS must configure the files used by the system journal to be group-owned by
          "systemd-journal".
      levels:
          - medium
      rules:
          - file_groupowner_system_journal
      status: automated

    - id: UBTU-24-700080
      title: Ubuntu 24.04 LTS must configure the directories used by the system journal to be owned by
          "root".
      levels:
          - medium
      rules:
          - dir_owner_system_journal
      status: automated

    - id: UBTU-24-700090
      title: Ubuntu 24.04 LTS must configure the files used by the system journal to be owned by "root"
      levels:
          - medium
      rules:
          - file_owner_system_journal
      status: automated

    - id: UBTU-24-700100
      title: Ubuntu 24.04 LTS must configure the /var/log directory to be group-owned by syslog.
      levels:
          - medium
      rules:
          - file_groupowner_var_log
      status: automated

    - id: UBTU-24-700110
      title: Ubuntu 24.04 LTS must configure the /var/log directory to be owned by root.
      levels:
          - medium
      rules:
          - file_owner_var_log
      status: automated

    - id: UBTU-24-700120
      title: Ubuntu 24.04 LTS must configure the /var/log directory to have mode "0755" or less permissive.
      levels:
          - medium
      rules:
          - file_permissions_var_log
      status: automated

    - id: UBTU-24-700130
      title: Ubuntu 24.04 LTS must configure the /var/log/syslog file to be group-owned by adm.
      levels:
          - medium
      rules:
          - file_groupowner_var_log_syslog
      status: automated

    - id: UBTU-24-700140
      title: Ubuntu 24.04 LTS must configure /var/log/syslog file to be owned by syslog.
      levels:
          - medium
      rules:
          - file_owner_var_log_syslog
      status: automated

    - id: UBTU-24-700150
      title: Ubuntu 24.04 LTS must configure /var/log/syslog file with mode "0640" or less permissive.
      levels:
          - medium
      rules:
          - file_permissions_var_log_syslog
      status: automated

    - id: UBTU-24-700300
      title: Ubuntu 24.04 LTS must implement nonexecutable data to protect its memory from unauthorized
          code execution.
      levels:
          - medium
      rules:
          - bios_enable_execution_restrictions
      status: automated

    - id: UBTU-24-700310
      title: Ubuntu 24.04 LTS must implement address space layout randomization to protect its memory
          from unauthorized code execution.
      levels:
          - medium
      rules:
          - sysctl_kernel_randomize_va_space
      status: automated

    - id: UBTU-24-700320
      title: Ubuntu 24.04 LTS must be configured so that Advance Package Tool (APT) removes all software
          components after updated versions have been installed.
      levels:
          - medium
      rules:
          - clean_components_post_updating
      status: automated

    - id: UBTU-24-700400
      title: Ubuntu 24.04 LTS must be a vendor-supported release.
      levels:
          - medium
      rules:
          - installed_OS_is_vendor_supported
      status: automated

    - id: UBTU-24-900040
      title: Ubuntu 24.04 LTS must be configured so that audit configuration files are not write-accessible
          by unauthorized users.
      levels:
          - medium
      rules:
          - file_permissions_etc_audit_auditd
          - file_permissions_etc_audit_rules
          - file_permissions_etc_audit_rulesd
      status: automated

    - id: UBTU-24-900050
      title: Ubuntu 24.04 LTS must permit only authorized accounts to own the audit configuration files.
      levels:
          - medium
      rules:
          - file_ownership_audit_configuration
      status: automated

    - id: UBTU-24-900060
      title: Ubuntu 24.04 LTS must permit only authorized groups to own the audit configuration files.
      levels:
          - medium
      rules:
          - file_groupownership_audit_configuration
      status: automated

    - id: UBTU-24-900070
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the su
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_su
      status: automated

    - id: UBTU-24-900080
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chfn
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_chfn
      status: automated

    - id: UBTU-24-900090
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the mount
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_mount
      status: automated

    - id: UBTU-24-900100
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the umount
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_umount
      status: automated

    - id: UBTU-24-900110
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_ssh_agent
      status: automated

    - id: UBTU-24-900120
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_ssh_keysign
      status: automated

    - id: UBTU-24-900130
      title: Ubuntu 24.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr,
          removexattr, fremovexattr, and lremovexattr system calls.
      levels:
          - medium
      rules:
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr
      status: automated

    - id: UBTU-24-900140
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chown,
          fchown, fchownat, and lchown system calls.
      levels:
          - medium
      rules:
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_lchown
      status: automated

    - id: UBTU-24-900150
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chmod,
          fchmod, and fchmodat system calls.
      levels:
          - medium
      rules:
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
      status: automated

    - id: UBTU-24-900160
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the creat,
          open, openat, open_by_handle_at, truncate, and ftruncate system calls.
      levels:
          - medium
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_ftruncate
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_open_by_handle_at
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_truncate
      status: automated

    - id: UBTU-24-900170
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudo
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_sudo
      status: automated

    - id: UBTU-24-900180
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_sudoedit
      status: automated

    - id: UBTU-24-900190
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chsh
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_chsh
      status: automated

    - id: UBTU-24-900200
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_newgrp
      status: automated

    - id: UBTU-24-900210
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chcon
          command.
      levels:
          - medium
      rules:
          - audit_rules_execution_chcon
      status: automated

    - id: UBTU-24-900220
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_apparmor_parser
      status: automated

    - id: UBTU-24-900230
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl
          command.
      levels:
          - medium
      rules:
          - audit_rules_execution_setfacl
      status: automated

    - id: UBTU-24-900240
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chacl
          command.
      levels:
          - medium
      rules:
          - audit_rules_execution_chacl
      status: automated

    - id: UBTU-24-900250
      title: Ubuntu 24.04 LTS must generate audit records for the use and modification of faillog file.
      levels:
          - medium
      rules:
          - audit_rules_login_events_faillog
      status: automated

    - id: UBTU-24-900260
      title: Ubuntu 24.04 LTS must generate audit records for the use and modification of the lastlog
          file.
      levels:
          - medium
      rules:
          - audit_rules_login_events_lastlog
      status: automated

    - id: UBTU-24-900270
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the passwd
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_passwd
      status: automated

    - id: UBTU-24-900280
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_unix_update
      status: automated

    - id: UBTU-24-900290
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_gpasswd
      status: automated

    - id: UBTU-24-900300
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chage
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_chage
      status: automated

    - id: UBTU-24-900310
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the usermod
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_usermod
      status: automated

    - id: UBTU-24-900320
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the crontab
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_crontab
      status: automated

    - id: UBTU-24-900330
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check
          command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_pam_timestamp_check
      status: automated

    - id: UBTU-24-900340
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the init_module
          and finit_module syscalls.
      levels:
          - medium
      rules:
          - audit_rules_kernel_module_loading_finit
          - audit_rules_kernel_module_loading_init
      status: automated

    - id: UBTU-24-900350
      title: Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module
          syscall.
      levels:
          - medium
      rules:
          - audit_rules_kernel_module_loading_delete
      status: automated

    - id: UBTU-24-900510
      title: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify
          the /etc/sudoers file occur.
      levels:
          - medium
      rules:
          - audit_rules_sudoers
      status: automated

    - id: UBTU-24-900520
      title: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify
          the /etc/sudoers.d directory occur.
      levels:
          - medium
      rules:
          - audit_rules_sudoers_d
      status: automated

    - id: UBTU-24-900540
      title: Ubuntu 24.04 LTS must generate audit records for any successful/unsuccessful use of unlink,
          unlinkat, rename, renameat, and rmdir system calls.
      levels:
          - medium
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_rmdir
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_unlinkat
      status: automated

    - id: UBTU-24-900590
      title: Ubuntu 24.04 LTS must generate audit records for the /var/log/wtmp file.
      levels:
          - medium
      rules:
          - audit_rules_session_events_wtmp
      status: automated

    - id: UBTU-24-900600
      title: Ubuntu 24.04 LTS must generate audit records for the /var/run/utmp file.
      levels:
          - medium
      rules:
          - audit_rules_session_events_utmp
      status: automated

    - id: UBTU-24-900610
      title: Ubuntu 24.04 LTS must generate audit records for the /var/log/btmp file.
      levels:
          - medium
      rules:
          - audit_rules_session_events_btmp
      status: automated

    - id: UBTU-24-900730
      title: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use
          modprobe command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_modprobe
      status: automated

    - id: UBTU-24-900740
      title: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use
          the kmod command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_kmod
      status: automated

    - id: UBTU-24-900750
      title: Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use
          the fdisk command.
      levels:
          - medium
      rules:
          - audit_rules_privileged_commands_fdisk
      status: automated

    - id: UBTU-24-900920
      title: Ubuntu 24.04 LTS must allocate audit record storage capacity to store at least one week's
          worth of audit records, when audit records are not immediately sent to a central audit record
          storage facility.
      levels:
          - low
      rules:
          - auditd_audispd_configure_sufficiently_large_partition
      status: automated

    - id: UBTU-24-900950
      title: Ubuntu 24.04 LTS must have a crontab script running weekly to offload audit events of standalone
          systems.
      levels:
          - low
      rules:
          - auditd_offload_logs
      status: automated

    - id: UBTU-24-900960
      title: Ubuntu 24.04 LTS must immediately notify the system administrator (SA) and information system
          security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75
          percent of the repository maximum audit record storage capacity.
      levels:
          - low
      rules:
          - var_auditd_space_left_percentage=25pc
          - var_auditd_space_left_action=email
          - auditd_data_retention_space_left_action
          - auditd_data_retention_space_left_percentage
      status: automated

    - id: UBTU-24-900980
      title: Ubuntu 24.04 LTS must alert the system administrator (SA) and information system security
          officer (ISSO) (at a minimum) in the event of an audit processing failure.
      levels:
          - low
      rules:
          - var_auditd_action_mail_acct=root
          - auditd_data_retention_action_mail_acct
      status: automated

    - id: UBTU-24-901220
      title: Ubuntu 24.04 LTS must record time stamps for audit records that can be mapped to Coordinated
          Universal Time (UTC) or Greenwich Mean Time (GMT).
      levels:
          - low
      rules:
          - ensure_rtc_utc_configuration
      status: automated

    - id: UBTU-24-901230
      title: Ubuntu 24.04 LTS must configure audit tools with a mode of "0755" or less permissive.
      levels:
          - medium
      rules:
          - file_permissions_audit_binaries
      status: automated

    - id: UBTU-24-901240
      title: Ubuntu 24.04 LTS must configure audit tools to be owned by root.
      levels:
          - medium
      rules:
          - file_ownership_audit_binaries
      status: automated

    - id: UBTU-24-901250
      title: Ubuntu 24.04 LTS must configure the audit tools to be group-owned by root.
      levels:
          - medium
      rules:
          - file_groupownership_audit_binaries
      status: automated

    - id: UBTU-24-901260
      title: Ubuntu 24.04 LTS must have directories that contain system commands set to a mode of "0755"
          or less permissive.
      levels:
          - medium
      rules:
          - dir_permissions_binary_dirs
      status: automated

    - id: UBTU-24-901270
      title: Ubuntu 24.04 LTS must have directories that contain system commands owned by root.
      levels:
          - medium
      rules:
          - dir_ownership_binary_dirs
      status: automated

    - id: UBTU-24-901280
      title: Ubuntu 24.04 LTS must have directories that contain system commands group-owned by root.
      levels:
          - medium
      rules:
          - dir_groupownership_binary_dirs
      status: automated

    - id: UBTU-24-901300
      title: Ubuntu 24.04 LTS must be configured so that audit log files are not read or write-accessible
          by unauthorized users.
      levels:
          - medium
      rules:
          - file_permissions_var_log_audit_stig
      status: automated

    - id: UBTU-24-901310
      title: Ubuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit
          log files.
      levels:
          - medium
      rules:
          - file_ownership_var_log_audit_stig
      status: automated

    - id: UBTU-24-901350
      title: Ubuntu 24.04 LTS must permit only authorized groups ownership of the audit log files.
      levels:
          - medium
      rules:
          - file_group_ownership_var_log_audit_stig
      status: automated

    - id: UBTU-24-901380
      title: Ubuntu 24.04 LTS must be configured so that the audit log directory is not write-accessible
          by unauthorized users.
      levels:
          - medium
      rules:
          - directory_permissions_var_log_audit
      status: automated

    - id: UBTU-24-90890
      title: Ubuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.
      levels:
          - medium
      rules:
          - aide_check_audit_tools
      status: automated

    - id: UBTU-24-909000
      title: Ubuntu 24.04 LTS audit system must protect auditing rules from unauthorized change.
      levels:
          - medium
      rules:
          - audit_rules_immutable
      status: automated
