---
policy: Red Hat Enterprise Linux 8 Security Technical Implementation Guide
title: Red Hat Enterprise Linux 8 Security Technical Implementation Guide
id: stig_rhel8
version: V2R5
source: https://www.cyber.mil/stigs/downloads
reference_type: stigid
product: rhel8

levels:
    - id: high
    - id: medium
    - id: low

controls:
    - id: needed_rules
      title: 'Variables and needed rules'
      levels:
          - high
          - medium
          - low
      rules:
            # Variables
          - var_rekey_limit_size=1G
          - var_rekey_limit_time=1hour
          - var_accounts_user_umask=077
          - var_password_pam_difok=8
          - var_password_pam_maxrepeat=3
          - var_password_hashing_algorithm=SHA512
          - var_password_hashing_algorithm_pam=sha512
          - var_password_pam_maxclassrepeat=4
          - var_password_pam_minclass=4
          - var_accounts_minimum_age_login_defs=1
          - var_accounts_max_concurrent_login_sessions=10
          - var_password_pam_remember=5
          - var_password_pam_remember_control_flag=requisite_or_required
          - var_selinux_state=enforcing
          - var_selinux_policy_name=targeted
          - var_password_hashing_min_rounds_login_defs=100000
          - var_password_pam_minlen=15
          - var_password_pam_ocredit=1
          - var_password_pam_dcredit=1
          - var_password_pam_dictcheck=1
          - var_password_pam_ucredit=1
          - var_password_pam_lcredit=1
          - var_password_pam_retry=3
          - var_password_pam_minlen=15
          - var_sshd_set_keepalive=1
          - sshd_approved_macs=stig_extended
          - sshd_approved_ciphers=stig_extended
          - sshd_idle_timeout_value=10_minutes
          - var_accounts_authorized_local_users_regex=rhel8
          - var_accounts_passwords_pam_faillock_deny=3
          - var_accounts_passwords_pam_faillock_fail_interval=900
          - var_accounts_passwords_pam_faillock_unlock_time=never
          - var_ssh_client_rekey_limit_size=1G
          - var_ssh_client_rekey_limit_time=1hour
          - var_accounts_fail_delay=4
          - var_account_disable_post_pw_expiration=35
          - var_auditd_action_mail_acct=root
          - var_time_service_set_maxpoll=18_hours
          - var_accounts_maximum_age_login_defs=60
          - var_auditd_space_left_percentage=25pc
          - var_auditd_space_left_action=email
          - var_auditd_disk_error_action=rhel8
          - var_auditd_max_log_file_action=syslog
          - var_auditd_disk_full_action=rhel8
          - var_sssd_certificate_verification_digest_function=sha1
          - login_banner_text=dod_banners
          - var_authselect_profile=sssd
          - var_multiple_time_servers=stig
          - var_time_service_set_maxpoll=18_hours
            # Enable / Configure FIPS
          - enable_fips_mode
          - var_system_crypto_policy=fips
          - configure_crypto_policy
          - configure_bind_crypto_policy
          - configure_libreswan_crypto_policy
          - configure_kerberos_crypto_policy
          - enable_dracut_fips_module
            # Other needed rules
          - enable_authselect

    - id: RHEL-08-010000
      levels:
          - high
      title: RHEL 8 must be a vendor-supported release.
      rules:
          - installed_OS_is_vendor_supported
      status: automated

    - id: RHEL-08-010010
      levels:
          - medium
      title: RHEL 8 vendor packaged system security patches and updates must be installed and up to date.
      rules:
          - security_patches_up_to_date
      status: automated

    - id: RHEL-08-010020
      levels:
          - high
      title: 'RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision
          digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest
          protections in accordance with applicable federal laws, Executive Orders, directives, policies,
          regulations, and standards.'
      rules:
          - configure_bind_crypto_policy
          - configure_crypto_policy
          - configure_kerberos_crypto_policy
          - configure_libreswan_crypto_policy
          - enable_dracut_fips_module
          - enable_fips_mode
          - fips_crypto_subpolicy
          - harden_sshd_ciphers_openssh_conf_crypto_policy
          - harden_sshd_macs_openssh_conf_crypto_policy
          - sysctl_crypto_fips_enabled
      status: automated

    - id: RHEL-08-010030
      levels:
          - high
      title: All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized
          disclosure or modification of all information that requires at rest protection.
      rules:
          - encrypt_partitions
      status: automated

    - id: RHEL-08-010040
      levels:
          - medium
      title: RHEL 8 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a ssh logon.
      rules:
          - sshd_enable_warning_banner
      status: automated

    - id: RHEL-08-010050
      levels:
          - medium
      title: RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting
          local or remote access to the system via a graphical user logon.
      rules:
          - dconf_gnome_login_banner_text
      status: automated

    - id: RHEL-08-010060
      levels:
          - medium
      title: RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting
          local or remote access to the system via a command line user logon.
      rules:
          - banner_etc_issue
      status: automated

    - id: RHEL-08-010070
      levels:
          - medium
      title: All RHEL 8 remote access methods must be monitored.
      rules:
          - rsyslog_remote_access_monitoring
      status: automated

    - id: RHEL-08-010090
      levels:
          - medium
      title: RHEL 8, for PKI-based authentication, must validate certificates by constructing a certification
          path (which includes status information) to an accepted trust anchor.
      rules:
          - sssd_has_trust_anchor
      status: automated

    - id: RHEL-08-010100
      levels:
          - medium
      title: RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding
          private key.
      rules:
          - ssh_keys_passphrase_protected
      status: automated

    - id: RHEL-08-010110
      levels:
          - medium
      title: RHEL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing
          algorithm.
      rules:
          - set_password_hashing_algorithm_logindefs
      status: automated

    - id: RHEL-08-010120
      levels:
          - medium
      title: RHEL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords.
      rules:
          - accounts_password_all_shadowed_sha512
      status: automated

    - id: RHEL-08-010130
      levels:
          - medium
      title: The RHEL 8 shadow password suite must be configured to use a sufficient number of hashing
          rounds.
      rules:
          - set_password_hashing_min_rounds_logindefs
      status: automated

    - id: RHEL-08-010140
      levels:
          - high
      title: RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require
          authentication upon booting into single-user mode and maintenance.
      rules:
          - grub2_uefi_password
      status: automated

    - id: RHEL-08-010150
      levels:
          - high
      title: RHEL 8 operating systems booted with a BIOS must require authentication upon booting into
          single-user and maintenance modes.
      rules:
          - grub2_password
      status: automated

    - id: RHEL-08-010151
      levels:
          - medium
      title: RHEL 8 operating systems must require authentication upon booting into rescue mode.
      rules:
          - require_singleuser_auth
      status: automated

    - id: RHEL-08-010160
      levels:
          - medium
      title: The RHEL 8 pam_unix.so module must be configured in the password-auth file to use a FIPS
          140-2 approved cryptographic hashing algorithm for system authentication.
      rules:
          - set_password_hashing_algorithm_passwordauth
      status: automated

    - id: RHEL-08-010161
      levels:
          - medium
      title: RHEL 8 must prevent system daemons from using Kerberos for authentication.
      rules:
          - kerberos_disable_no_keytab
      status: automated

    - id: RHEL-08-010162
      levels:
          - medium
      title: The krb5-workstation package must not be installed on RHEL 8.
      rules:
          - package_krb5-workstation_removed
      status: automated

    - id: RHEL-08-010170
      levels:
          - medium
      title: RHEL 8 must use a Linux Security Module configured to enforce limits on system services.
      rules:
          - selinux_state
      status: automated

    - id: RHEL-08-010171
      levels:
          - low
      title: RHEL 8 must have policycoreutils package installed.
      rules:
          - package_policycoreutils_installed
      status: automated

    - id: RHEL-08-010190
      levels:
          - medium
      title: A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized and unintended
          information transferred via shared system resources.
      rules:
          - dir_perms_world_writable_sticky_bits
      status: automated

    - id: RHEL-08-010200
      levels:
          - medium
      title: RHEL 8 must be configured so that all network connections associated with SSH traffic terminate
          after becoming unresponsive.
      rules:
          - sshd_set_keepalive
      status: automated

    - id: RHEL-08-010210
      levels:
          - medium
      title: The RHEL 8 /var/log/messages file must have mode 0640 or less permissive.
      rules:
          - file_permissions_var_log_messages
      status: automated

    - id: RHEL-08-010220
      levels:
          - medium
      title: The RHEL 8 /var/log/messages file must be owned by root.
      rules:
          - file_owner_var_log_messages
      status: automated

    - id: RHEL-08-010230
      levels:
          - medium
      title: The RHEL 8 /var/log/messages file must be group-owned by root.
      rules:
          - file_groupowner_var_log_messages
      status: automated

    - id: RHEL-08-010240
      levels:
          - medium
      title: The RHEL 8 /var/log directory must have mode 0755 or less permissive.
      rules:
          - file_permissions_var_log
      status: automated

    - id: RHEL-08-010250
      levels:
          - medium
      title: The RHEL 8 /var/log directory must be owned by root.
      rules:
          - file_owner_var_log
      status: automated

    - id: RHEL-08-010260
      levels:
          - medium
      title: The RHEL 8 /var/log directory must be group-owned by root.
      rules:
          - file_groupowner_var_log
      status: automated

    - id: RHEL-08-010290
      levels:
          - medium
      title: The RHEL 8 SSH server must be configured to use only Message Authentication Codes (MACs)
          employing FIPS 140-3 validated cryptographic hash algorithms.
      rules:
          - harden_sshd_macs_opensshserver_conf_crypto_policy
      status: automated

    - id: RHEL-08-010291
      levels:
          - medium
      title: The RHEL 8 operating system must implement DOD-approved encryption to protect the confidentiality
          of SSH server connections.
      rules:
          - harden_sshd_ciphers_opensshserver_conf_crypto_policy
      status: automated

    - id: RHEL-08-010292
      levels:
          - low
      title: RHEL 8 must ensure the SSH server uses strong entropy.
      rules:
          - sshd_use_strong_rng
      status: automated

    - id: RHEL-08-010293
      levels:
          - medium
      title: The RHEL 8 operating system must implement DoD-approved encryption in the OpenSSL package.
      rules:
          - configure_openssl_crypto_policy
      status: automated

    - id: RHEL-08-010294
      levels:
          - medium
      title: The RHEL 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package.
      rules:
          - configure_openssl_tls_crypto_policy
      status: automated

    - id: RHEL-08-010295
      levels:
          - medium
      title: The RHEL 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package.
      rules:
          - configure_gnutls_tls_crypto_policy
      status: automated

    - id: RHEL-08-010300
      levels:
          - medium
      title: RHEL 8 system commands must have mode 755 or less permissive.
      rules:
          - file_permissions_binary_dirs
      status: automated

    - id: RHEL-08-010310
      levels:
          - medium
      title: RHEL 8 system commands must be owned by root.
      rules:
          - file_ownership_binary_dirs
      status: automated

    - id: RHEL-08-010320
      levels:
          - medium
      title: RHEL 8 system commands must be group-owned by root or a system account.
      rules:
          - file_groupownership_system_commands_dirs
      status: automated

    - id: RHEL-08-010330
      levels:
          - medium
      title: RHEL 8 library files must have mode 755 or less permissive.
      rules:
          - file_permissions_library_dirs
      status: automated

    - id: RHEL-08-010340
      levels:
          - medium
      title: RHEL 8 library files must be owned by root.
      rules:
          - file_ownership_library_dirs
      status: automated

    - id: RHEL-08-010350
      levels:
          - medium
      title: RHEL 8 library files must be group-owned by root or a system account.
      rules:
          - root_permissions_syslibrary_files
      status: automated

    - id: RHEL-08-010360
      levels:
          - medium
      title: The RHEL 8 file integrity tool must notify the system administrator when changes to the
          baseline configuration or anomalies in the operation of any security functions are discovered
          within an organizationally defined frequency.
      rules:
          - aide_scan_notification
      status: automated

    - id: RHEL-08-010370
      levels:
          - high
      title: RHEL 8 must prevent the installation of software, patches, service packs, device drivers,
          or operating system components from a repository without verification they have been digitally
          signed using a certificate that is issued by a Certificate Authority (CA) that is recognized
          and approved by the organization.
      rules:
          - enable_gpgcheck_for_all_repositories
      status: automated

    - id: RHEL-08-010371
      levels:
          - high
      title: RHEL 8 must prevent the installation of software, patches, service packs, device drivers,
          or operating system components of local packages without verification they have been digitally
          signed using a certificate that is issued by a Certificate Authority (CA) that is recognized
          and approved by the organization.
      rules:
          - ensure_gpgcheck_local_packages
      status: automated

    - id: RHEL-08-010372
      levels:
          - medium
      title: RHEL 8 must prevent the loading of a new kernel for later execution.
      rules:
          - sysctl_kernel_kexec_load_disabled
      status: automated

    - id: RHEL-08-010373
      levels:
          - medium
      title: RHEL 8 must enable kernel parameters to enforce discretionary access control on symlinks.
      rules:
          - sysctl_fs_protected_symlinks
      status: automated

    - id: RHEL-08-010374
      levels:
          - medium
      title: RHEL 8 must enable kernel parameters to enforce discretionary access control on hardlinks.
      rules:
          - sysctl_fs_protected_hardlinks
      status: automated

    - id: RHEL-08-010375
      levels:
          - low
      title: RHEL 8 must restrict access to the kernel message buffer.
      rules:
          - sysctl_kernel_dmesg_restrict
      status: automated

    - id: RHEL-08-010376
      levels:
          - low
      title: RHEL 8 must prevent kernel profiling by unprivileged users.
      rules:
          - sysctl_kernel_perf_event_paranoid
      status: automated

    - id: RHEL-08-010380
      levels:
          - medium
      title: RHEL 8 must require users to provide a password for privilege escalation.
      rules:
          - sudo_remove_nopasswd
      status: automated

    - id: RHEL-08-010381
      levels:
          - medium
      title: RHEL 8 must require users to reauthenticate for privilege escalation.
      rules:
          - sudo_remove_no_authenticate
      status: automated

    - id: RHEL-08-010390
      levels:
          - medium
      title: RHEL 8 must have the packages required for multifactor authentication installed.
      rules:
          - install_smartcard_packages
      status: automated

    - id: RHEL-08-010400
      levels:
          - medium
      title: RHEL 8 must implement certificate status checking for multifactor authentication.
      rules:
          - sssd_certificate_verification
      status: automated

    - id: RHEL-08-010410
      levels:
          - medium
      title: RHEL 8 must accept Personal Identity Verification (PIV) credentials.
      rules:
          - package_opensc_installed
      status: automated

    - id: RHEL-08-010420
      levels:
          - medium
      title: RHEL 8 must implement non-executable data to protect its memory from unauthorized code execution.
      rules:
          - bios_enable_execution_restrictions
      status: automated

    - id: RHEL-08-010421
      levels:
          - medium
      title: RHEL 8 must clear the page allocator to prevent use-after-free attacks.
      rules:
          - grub2_page_poison_argument
      status: automated

    - id: RHEL-08-010422
      levels:
          - medium
      title: RHEL 8 must disable virtual syscalls.
      rules:
          - grub2_vsyscall_argument
      status: automated

    - id: RHEL-08-010423
      levels:
          - medium
      title: RHEL 8 must clear memory when it is freed to prevent use-after-free attacks.
      rules:
          - grub2_init_on_free
      status: automated

    - id: RHEL-08-010430
      levels:
          - medium
      title: RHEL 8 must implement address space layout randomization (ASLR) to protect its memory from
          unauthorized code execution.
      rules:
          - sysctl_kernel_randomize_va_space
      status: automated

    - id: RHEL-08-010440
      levels:
          - low
      title: YUM must remove all software components after updated versions have been installed on RHEL
          8.
      rules:
          - clean_components_post_updating
      status: automated

    - id: RHEL-08-010450
      levels:
          - medium
      title: RHEL 8 must enable the SELinux targeted policy.
      rules:
          - selinux_policytype
      status: automated

    - id: RHEL-08-010460
      levels:
          - high
      title: There must be no shosts.equiv files on the RHEL 8 operating system.
      rules:
          - no_host_based_files
      status: automated

    - id: RHEL-08-010470
      levels:
          - high
      title: There must be no .shosts files on the RHEL 8 operating system.
      rules:
          - no_user_host_based_files
      status: automated

    - id: RHEL-08-010471
      levels:
          - low
      title: RHEL 8 must enable the hardware random number generator entropy gatherer service.
      rules:
          - service_rngd_enabled
      status: automated

    - id: RHEL-08-010480
      levels:
          - medium
      title: The RHEL 8 SSH public host key files must have mode 0644 or less permissive.
      rules:
          - file_permissions_sshd_pub_key
      status: automated

    - id: RHEL-08-010490
      levels:
          - medium
      title: The RHEL 8 SSH private host key files must have mode 0640 or less permissive.
      rules:
          - file_permissions_sshd_private_key
      status: automated

    - id: RHEL-08-010500
      levels:
          - medium
      title: The RHEL 8 SSH daemon must perform strict mode checking of home directory configuration
          files.
      rules:
          - sshd_enable_strictmodes
      status: automated

    - id: RHEL-08-010520
      levels:
          - medium
      title: "The RHEL 8 SSH daemon must not allow authentication using known host’s authentication."
      rules:
          - sshd_disable_user_known_hosts
      status: automated

    - id: RHEL-08-010521
      levels:
          - medium
      title: The RHEL 8 SSH daemon must not allow Kerberos authentication, except to fulfill documented
          and validated mission requirements.
      rules:
          - sshd_disable_kerb_auth
      status: automated

    - id: RHEL-08-010540
      levels:
          - low
      title: RHEL 8 must use a separate file system for /var.
      rules:
          - partition_for_var
      status: automated

    - id: RHEL-08-010541
      levels:
          - low
      title: RHEL 8 must use a separate file system for /var/log.
      rules:
          - partition_for_var_log
      status: automated

    - id: RHEL-08-010542
      levels:
          - low
      title: RHEL 8 must use a separate file system for the system audit data path.
      rules:
          - partition_for_var_log_audit
      status: automated

    - id: RHEL-08-010543
      levels:
          - medium
      title: A separate RHEL 8 filesystem must be used for the /tmp directory.
      rules:
          - partition_for_tmp
      status: automated

    - id: RHEL-08-010550
      levels:
          - medium
      title: RHEL 8 must not permit direct logons to the root account using remote access via SSH.
      rules:
          - sshd_disable_root_login
      status: automated

    - id: RHEL-08-010561
      levels:
          - medium
      title: The rsyslog service must be running in RHEL 8.
      rules:
          - service_rsyslog_enabled
      status: automated

    - id: RHEL-08-010570
      levels:
          - medium
      title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file
          systems that contain user home directories.
      rules:
          - mount_option_home_nosuid
      status: automated

    - id: RHEL-08-010571
      levels:
          - medium
      title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the
          /boot directory.
      rules:
          - mount_option_boot_nosuid
      status: automated

    - id: RHEL-08-010580
      levels:
          - medium
      title: RHEL 8 must prevent special devices on non-root local partitions.
      rules:
          - mount_option_nodev_nonroot_local_partitions
      status: automated

    - id: RHEL-08-010590
      levels:
          - medium
      title: RHEL 8 must prevent code from being executed on file systems that contain user home directories.
      rules:
          - mount_option_home_noexec
      status: automated

    - id: RHEL-08-010600
      levels:
          - medium
      title: RHEL 8 must prevent special devices on file systems that are used with removable media.
      rules:
          - mount_option_nodev_removable_partitions
      status: automated

    - id: RHEL-08-010610
      levels:
          - medium
      title: RHEL 8 must prevent code from being executed on file systems that are used with removable
          media.
      rules:
          - mount_option_noexec_removable_partitions
      status: automated

    - id: RHEL-08-010620
      levels:
          - medium
      title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file
          systems that are used with removable media.
      rules:
          - mount_option_nosuid_removable_partitions
      status: automated

    - id: RHEL-08-010630
      levels:
          - medium
      title: RHEL 8 must prevent code from being executed on file systems that are imported via Network
          File System (NFS).
      rules:
          - mount_option_noexec_remote_filesystems
      status: automated

    - id: RHEL-08-010640
      levels:
          - medium
      title: RHEL 8 must prevent special devices on file systems that are imported via Network File System
          (NFS).
      rules:
          - mount_option_nodev_remote_filesystems
      status: automated

    - id: RHEL-08-010650
      levels:
          - medium
      title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed on file
          systems that are imported via Network File System (NFS).
      rules:
          - mount_option_nosuid_remote_filesystems
      status: automated

    - id: RHEL-08-010660
      levels:
          - medium
      title: Local RHEL 8 initialization files must not execute world-writable programs.
      rules:
          - accounts_user_dot_no_world_writable_programs
      status: automated

    - id: RHEL-08-010670
      levels:
          - medium
      title: RHEL 8 must disable kernel dumps unless needed.
      rules:
          - service_kdump_disabled
      status: automated

    - id: RHEL-08-010671
      levels:
          - medium
      title: RHEL 8 must disable the kernel.core_pattern.
      rules:
          - sysctl_kernel_core_pattern
      status: automated

    - id: RHEL-08-010672
      levels:
          - medium
      title: RHEL 8 must disable acquiring, saving, and processing core dumps.
      rules:
          - service_systemd-coredump_disabled
      status: automated

    - id: RHEL-08-010673
      levels:
          - medium
      title: RHEL 8 must disable core dumps for all users.
      rules:
          - disable_users_coredumps
      status: automated

    - id: RHEL-08-010674
      levels:
          - medium
      title: RHEL 8 must disable storing core dumps.
      rules:
          - coredump_disable_storage
      status: automated

    - id: RHEL-08-010675
      levels:
          - medium
      title: RHEL 8 must disable core dump backtraces.
      rules:
          - coredump_disable_backtraces
      status: automated

    - id: RHEL-08-010680
      levels:
          - medium
      title: For RHEL 8 systems using Domain Name Servers (DNS) resolution, at least two name servers
          must be configured.
      rules:
          - network_configure_name_resolution
      status: automated

    - id: RHEL-08-010690
      levels:
          - medium
      title: Executable search paths within the initialization files of all local interactive RHEL 8
          users must only contain paths that resolve to the system default or the users home directory.
      rules:
          - accounts_user_home_paths_only
      status: automated

    - id: RHEL-08-010700
      levels:
          - medium
      title: All RHEL 8 world-writable directories must be owned by root, sys, bin, or an application
          user.
      rules:
          - dir_perms_world_writable_root_owned
      status: automated

    - id: RHEL-08-010710
      levels:
          - medium
      title: All RHEL 8 world-writable directories must be group-owned by root, sys, bin, or an application
          group.
      rules:
          - dir_perms_world_writable_system_owned_group
      status: automated

    - id: RHEL-08-010720
      levels:
          - medium
      title: All RHEL 8 local interactive users must have a home directory assigned in the /etc/passwd
          file.
      rules:
          - accounts_user_interactive_home_directory_defined
      status: automated

    - id: RHEL-08-010730
      levels:
          - medium
      title: All RHEL 8 local interactive user home directories must have mode 0750 or less permissive.
      rules:
          - file_permissions_home_directories
      status: automated

    - id: RHEL-08-010740
      levels:
          - medium
      title: "All RHEL 8 local interactive user home directories must be group-owned by the home directory\
          \ owner’s primary group."
      rules:
          - file_groupownership_home_directories
      status: automated

    - id: RHEL-08-010750
      levels:
          - medium
      title: All RHEL 8 local interactive user home directories defined in the /etc/passwd file must
          exist.
      rules:
          - accounts_user_interactive_home_directory_exists
      status: automated

    - id: RHEL-08-010760
      levels:
          - medium
      title: All RHEL 8 local interactive user accounts must be assigned a home directory upon creation.
      rules:
          - accounts_have_homedir_login_defs
      status: automated

    - id: RHEL-08-010770
      levels:
          - medium
      title: All RHEL 8 local initialization files must have mode 0740 or less permissive.
      rules:
          - file_permission_user_init_files_root
          - rootfiles_configured
          - var_user_initialization_files_regex=all_dotfiles
      status: automated

    - id: RHEL-08-010780
      levels:
          - medium
      title: All RHEL 8 local files and directories must have a valid owner.
      rules:
          - no_files_unowned_by_user
      status: automated

    - id: RHEL-08-010790
      levels:
          - medium
      title: All RHEL 8 local files and directories must have a valid group owner.
      rules:
          - file_permissions_ungroupowned
      status: automated

    - id: RHEL-08-010800
      levels:
          - medium
      title: A separate RHEL 8 filesystem must be used for user home directories (such as /home or an
          equivalent).
      rules:
          - partition_for_home
      status: automated

    - id: RHEL-08-010820
      levels:
          - high
      title: Unattended or automatic logon via the RHEL 8 graphical user interface must not be allowed.
      rules:
          - gnome_gdm_disable_automatic_login
      status: automated

    - id: RHEL-08-010830
      levels:
          - medium
      title: RHEL 8 must not allow users to override SSH environment variables.
      rules:
          - sshd_do_not_permit_user_env
      status: automated

    - id: RHEL-08-020000
      levels:
          - medium
      title: RHEL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or
          less.
      rules:
          - account_temp_expire_date
      status: automated

    - id: RHEL-08-020010
      levels:
          - medium
      title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.
      rules: []
      status: pending

    - id: RHEL-08-020011
      levels:
          - medium
      title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur.
      rules:
          - accounts_passwords_pam_faillock_deny
      status: automated

    - id: RHEL-08-020012
      levels:
          - medium
      title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during
          a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_interval
      status: automated

    - id: RHEL-08-020013
      levels:
          - medium
      title: RHEL 8 must automatically lock an account when three unsuccessful logon attempts occur during
          a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_interval
      status: automated

    - id: RHEL-08-020014
      levels:
          - medium
      title: RHEL 8 must automatically lock an account until the locked account is released by an administrator
          when three unsuccessful logon attempts occur during a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_unlock_time
      status: automated

    - id: RHEL-08-020015
      levels:
          - medium
      title: RHEL 8 must automatically lock an account until the locked account is released by an administrator
          when three unsuccessful logon attempts occur during a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_unlock_time
      status: automated

    - id: RHEL-08-020016
      levels:
          - medium
      title: RHEL 8 must ensure account lockouts persist.
      rules:
          - accounts_passwords_pam_faillock_dir
      status: automated

    - id: RHEL-08-020017
      levels:
          - medium
      title: RHEL 8 must ensure account lockouts persist.
      rules:
          - accounts_passwords_pam_faillock_dir
      status: automated

    - id: RHEL-08-020018
      levels:
          - medium
      title: RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts
          occur.
      rules:
          - accounts_passwords_pam_faillock_silent
      status: automated

    - id: RHEL-08-020019
      levels:
          - medium
      title: RHEL 8 must prevent system messages from being presented when three unsuccessful logon attempts
          occur.
      rules:
          - accounts_passwords_pam_faillock_silent
      status: automated

    - id: RHEL-08-020020
      levels:
          - medium
      title: RHEL 8 must log user name information when unsuccessful logon attempts occur.
      rules: []
      status: pending

    - id: RHEL-08-020021
      levels:
          - medium
      title: RHEL 8 must log user name information when unsuccessful logon attempts occur.
      rules:
          - accounts_passwords_pam_faillock_audit
      status: automated

    - id: RHEL-08-020022
      levels:
          - medium
      title: RHEL 8 must include root when automatically locking an account until the locked account
          is released by an administrator when three unsuccessful logon attempts occur during a 15-minute
          time period.
      rules: []
      status: pending

    - id: RHEL-08-020023
      levels:
          - medium
      title: RHEL 8 must include root when automatically locking an account until the locked account
          is released by an administrator when three unsuccessful logon attempts occur during a 15-minute
          time period.
      rules:
          - accounts_passwords_pam_faillock_deny_root
      status: automated

    - id: RHEL-08-020024
      levels:
          - low
      title: RHEL 8 must limit the number of concurrent sessions to ten for all accounts and/or account
          types.
      rules:
          - accounts_max_concurrent_login_sessions
      status: automated

    - id: RHEL-08-020030
      levels:
          - medium
      title: RHEL 8 must enable a user session lock until that user re-establishes access using established
          identification and authentication procedures for graphical user sessions.
      rules:
          - dconf_gnome_screensaver_lock_enabled
      status: automated

    - id: RHEL-08-020050
      levels:
          - medium
      title: RHEL 8 must be able to initiate directly a session lock for all connection types using smartcard
          when the smartcard is removed.
      rules:
          - dconf_gnome_lock_screen_on_smartcard_removal
      status: automated

    - id: RHEL-08-020060
      levels:
          - medium
      title: RHEL 8 must automatically lock graphical user sessions after 15 minutes of inactivity.
      rules:
          - dconf_gnome_screensaver_idle_delay
      status: automated

    - id: RHEL-08-020080
      levels:
          - medium
      title: RHEL 8 must prevent a user from overriding the session lock-delay setting for the graphical
          user interface.
      rules:
          - dconf_gnome_screensaver_user_locks
      status: automated

    - id: RHEL-08-020090
      levels:
          - medium
      title: RHEL 8 must map the authenticated identity to the user or group account for PKI-based authentication.
      rules:
          - sssd_enable_certmap
      status: automated

    - id: RHEL-08-020100
      levels:
          - medium
      title: RHEL 8 must ensure the password complexity module is enabled in the password-auth file.
      rules:
          - accounts_password_pam_pwquality_password_auth
      status: automated

    - id: RHEL-08-020110
      levels:
          - medium
      title: RHEL 8 must enforce password complexity by requiring that at least one uppercase character
          be used.
      rules:
          - accounts_password_pam_ucredit
      status: automated

    - id: RHEL-08-020120
      levels:
          - medium
      title: RHEL 8 must enforce password complexity by requiring that at least one lower-case character
          be used.
      rules:
          - accounts_password_pam_lcredit
      status: automated

    - id: RHEL-08-020130
      levels:
          - medium
      title: RHEL 8 must enforce password complexity by requiring that at least one numeric character
          be used.
      rules:
          - accounts_password_pam_dcredit
      status: automated

    - id: RHEL-08-020140
      levels:
          - medium
      title: RHEL 8 must require the maximum number of repeating characters of the same character class
          be limited to four when passwords are changed.
      rules:
          - accounts_password_pam_maxclassrepeat
      status: automated

    - id: RHEL-08-020150
      levels:
          - medium
      title: RHEL 8 must require the maximum number of repeating characters be limited to three when
          passwords are changed.
      rules:
          - accounts_password_pam_maxrepeat
      status: automated

    - id: RHEL-08-020160
      levels:
          - medium
      title: RHEL 8 must require the change of at least four character classes when passwords are changed.
      rules:
          - accounts_password_pam_minclass
      status: automated

    - id: RHEL-08-020170
      levels:
          - medium
      title: RHEL 8 must require the change of at least 8 characters when passwords are changed.
      rules:
          - accounts_password_pam_difok
      status: automated

    - id: RHEL-08-020180
      levels:
          - medium
      title: RHEL 8 passwords must have a 24 hours/1 day minimum password lifetime restriction in /etc/shadow.
      rules:
          - accounts_password_set_min_life_existing
      status: automated

    - id: RHEL-08-020190
      levels:
          - medium
      title: RHEL 8 passwords for new users or password changes must have a 24 hours/1 day minimum password
          lifetime restriction in /etc/login.defs.
      rules:
          - accounts_minimum_age_login_defs
      status: automated

    - id: RHEL-08-020200
      levels:
          - medium
      title: RHEL 8 user account passwords must have a 60-day maximum password lifetime restriction.
      rules:
          - accounts_maximum_age_login_defs
      status: automated

    - id: RHEL-08-020210
      levels:
          - medium
      title: RHEL 8 user account passwords must be configured so that existing passwords are restricted
          to a 60-day maximum lifetime.
      rules:
          - accounts_password_set_max_life_existing
      status: automated

    - id: RHEL-08-020230
      levels:
          - medium
      title: RHEL 8 passwords must have a minimum of 15 characters.
      rules:
          - accounts_password_pam_minlen
      status: automated

    - id: RHEL-08-020231
      levels:
          - medium
      title: RHEL 8 passwords for new users must have a minimum of 15 characters.
      rules:
          - accounts_password_minlen_login_defs
      status: automated

    - id: RHEL-08-020240
      levels:
          - medium
      title: RHEL 8 duplicate User IDs (UIDs) must not exist for interactive users.
      rules:
          - account_unique_id
      status: automated

    - id: RHEL-08-020250
      levels:
          - medium
      title: RHEL 8 must implement smart card logon for multifactor authentication for access to interactive
          accounts.
      rules:
          - sssd_enable_smartcards
      status: automated

    - id: RHEL-08-020260
      levels:
          - medium
      title: RHEL 8 account identifiers (individuals, groups, roles, and devices) must be disabled after
          35 days of inactivity.
      rules:
          - account_disable_post_pw_expiration
      status: automated

    - id: RHEL-08-020270
      levels:
          - medium
      title: RHEL 8 must automatically expire temporary accounts within 72 hours.
      rules:
          - account_temp_expire_date
      status: automated

    - id: RHEL-08-020280
      levels:
          - medium
      title: All RHEL 8 passwords must contain at least one special character.
      rules:
          - accounts_password_pam_ocredit
      status: automated

    - id: RHEL-08-020290
      levels:
          - medium
      title: RHEL 8 must prohibit the use of cached authentications after one day.
      rules:
          - sssd_offline_cred_expiration
      status: automated

    - id: RHEL-08-020300
      levels:
          - medium
      title: RHEL 8 must prevent the use of dictionary words for passwords.
      rules:
          - accounts_password_pam_dictcheck
      status: automated

    - id: RHEL-08-020310
      levels:
          - medium
      title: RHEL 8 must enforce a delay of at least four seconds between logon prompts following a failed
          logon attempt.
      rules:
          - accounts_logon_fail_delay
      status: automated

    - id: RHEL-08-020320
      levels:
          - medium
      title: RHEL 8 must not have unnecessary accounts.
      rules:
          - accounts_authorized_local_users
      status: automated

    - id: RHEL-08-020330
      levels:
          - high
      title: RHEL 8 must not allow accounts configured with blank or null passwords.
      rules:
          - sshd_disable_empty_passwords
      status: automated

    - id: RHEL-08-020340
      levels:
          - low
      title: RHEL 8 must display the date and time of the last successful account logon upon logon.
      rules:
          - display_login_attempts
      status: automated

    - id: RHEL-08-020350
      levels:
          - medium
      title: RHEL 8 must display the date and time of the last successful account logon upon an SSH logon.
      rules:
          - sshd_print_last_log
      status: automated

    - id: RHEL-08-020351
      levels:
          - medium
      title: RHEL 8 must define default permissions for all authenticated users in such a way that the
          user can only read and modify their own files.
      rules:
          - accounts_umask_etc_login_defs
      status: automated

    - id: RHEL-08-020352
      levels:
          - medium
      title: RHEL 8 must set the umask value to 077 for all local interactive user accounts.
      rules:
          - accounts_umask_interactive_users
      status: automated

    - id: RHEL-08-020353
      levels:
          - medium
      title: RHEL 8 must define default permissions for logon and non-logon shells.
      rules:
          - accounts_umask_etc_bashrc
          - accounts_umask_etc_csh_cshrc
          - accounts_umask_etc_profile
      status: automated

    - id: RHEL-08-030000
      levels:
          - medium
      title: The RHEL 8 audit system must be configured to audit the execution of privileged functions
          and prevent all software from executing at higher privilege levels than users executing the
          software.
      rules:
          - audit_rules_suid_privilege_function
      status: automated

    - id: RHEL-08-030010
      levels:
          - medium
      title: Cron logging must be implemented in RHEL 8.
      rules:
          - rsyslog_cron_logging
      status: automated

    - id: RHEL-08-030020
      levels:
          - medium
      title: The RHEL 8 System Administrator (SA) and Information System Security Officer (ISSO) (at
          a minimum) must be alerted of an audit processing failure event.
      rules:
          - auditd_data_retention_action_mail_acct
      status: automated

    - id: RHEL-08-030030
      levels:
          - medium
      title: The RHEL 8 Information System Security Officer (ISSO) and System Administrator (SA) (at
          a minimum) must have mail aliases to be notified of an audit processing failure.
      rules:
          - package_postfix_installed
          - postfix_client_configure_mail_alias_postmaster
      status: automated

    - id: RHEL-08-030040
      levels:
          - medium
      title: The RHEL 8 System must take appropriate action when an audit processing failure occurs.
      rules:
          - auditd_data_disk_error_action
      status: automated

    - id: RHEL-08-030060
      levels:
          - medium
      title: The RHEL 8 audit system must take appropriate action when the audit storage volume is full.
      rules:
          - auditd_data_disk_full_action
      status: automated

    - id: RHEL-08-030061
      levels:
          - medium
      title: The RHEL 8 audit system must audit local events.
      rules:
          - auditd_local_events
      status: automated

    - id: RHEL-08-030062
      levels:
          - medium
      title: RHEL 8 must label all off-loaded audit logs before sending them to the central log server.
      rules:
          - auditd_name_format
          - var_auditd_name_format=stig
      status: automated

    - id: RHEL-08-030063
      levels:
          - low
      title: RHEL 8 must resolve audit information before writing to disk.
      rules:
          - auditd_log_format
      status: automated

    - id: RHEL-08-030070
      levels:
          - medium
      title: RHEL 8 audit logs must have a mode of 0600 or less permissive to prevent unauthorized read
          access.
      rules:
          - file_permissions_var_log_audit
      status: automated

    - id: RHEL-08-030080
      levels:
          - medium
      title: RHEL 8 audit logs must be owned by root to prevent unauthorized read access.
      rules:
          - file_ownership_var_log_audit_stig
      status: automated

    - id: RHEL-08-030090
      levels:
          - medium
      title: RHEL 8 audit logs must be group-owned by root to prevent unauthorized read access.
      rules:
          - file_group_ownership_var_log_audit
      status: automated

    - id: RHEL-08-030100
      levels:
          - medium
      title: RHEL 8 audit log directory must be owned by root to prevent unauthorized read access.
      rules:
          - directory_ownership_var_log_audit
      status: automated

    - id: RHEL-08-030110
      levels:
          - medium
      title: RHEL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
      rules:
          - directory_group_ownership_var_log_audit
      status: automated

    - id: RHEL-08-030120
      levels:
          - medium
      title: RHEL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized
          read access.
      rules:
          - directory_permissions_var_log_audit
      status: automated

    - id: RHEL-08-030121
      levels:
          - medium
      title: RHEL 8 audit system must protect auditing rules from unauthorized change.
      rules:
          - audit_rules_immutable
      status: automated

    - id: RHEL-08-030122
      levels:
          - medium
      title: RHEL 8 audit system must protect logon UIDs from unauthorized change.
      rules:
          - audit_rules_immutable_login_uids
      status: automated

    - id: RHEL-08-030130
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/shadow.
      rules:
          - audit_rules_usergroup_modification_shadow
      status: automated

    - id: RHEL-08-030140
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/security/opasswd.
      rules:
          - audit_rules_usergroup_modification_opasswd
      status: automated

    - id: RHEL-08-030150
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/passwd.
      rules:
          - audit_rules_usergroup_modification_passwd
      status: automated

    - id: RHEL-08-030160
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/gshadow.
      rules:
          - audit_rules_usergroup_modification_gshadow
      status: automated

    - id: RHEL-08-030170
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/group.
      rules:
          - audit_rules_usergroup_modification_group
      status: automated

    - id: RHEL-08-030171
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/sudoers.
      rules:
          - audit_rules_sudoers
      status: automated

    - id: RHEL-08-030172
      levels:
          - medium
      title: RHEL 8 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/sudoers.d/.
      rules:
          - audit_rules_sudoers_d
      status: automated

    - id: RHEL-08-030180
      levels:
          - medium
      title: The RHEL 8 audit package must be installed.
      rules:
          - package_audit_installed
      status: automated

    - id: RHEL-08-030190
      levels:
          - medium
      title: Successful/unsuccessful uses of the su command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_su
      status: automated

    - id: RHEL-08-030200
      levels:
          - medium
      title: The RHEL 8 audit system must be configured to audit any usage of the setxattr, fsetxattr,
          lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
      rules:
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr
      status: automated

    - id: RHEL-08-030250
      levels:
          - medium
      title: Successful/unsuccessful uses of the chage command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_chage
      status: automated

    - id: RHEL-08-030260
      levels:
          - medium
      title: Successful/unsuccessful uses of the chcon command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_execution_chcon
      status: automated

    - id: RHEL-08-030280
      levels:
          - medium
      title: Successful/unsuccessful uses of the ssh-agent in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_ssh_agent
      status: automated

    - id: RHEL-08-030290
      levels:
          - medium
      title: Successful/unsuccessful uses of the passwd command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_passwd
      status: automated

    - id: RHEL-08-030300
      levels:
          - medium
      title: Successful/unsuccessful uses of the mount command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_mount
      status: automated

    - id: RHEL-08-030301
      levels:
          - medium
      title: Successful/unsuccessful uses of the umount command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_umount
      status: automated

    - id: RHEL-08-030302
      levels:
          - medium
      title: Successful/unsuccessful uses of the mount syscall in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_media_export
      status: automated

    - id: RHEL-08-030310
      levels:
          - medium
      title: Successful/unsuccessful uses of the unix_update in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_unix_update
      status: automated

    - id: RHEL-08-030311
      levels:
          - medium
      title: Successful/unsuccessful uses of postdrop in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_postdrop
      status: automated

    - id: RHEL-08-030312
      levels:
          - medium
      title: Successful/unsuccessful uses of postqueue in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_postqueue
      status: automated

    - id: RHEL-08-030313
      levels:
          - medium
      title: Successful/unsuccessful uses of semanage in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_execution_semanage
      status: automated

    - id: RHEL-08-030314
      levels:
          - medium
      title: Successful/unsuccessful uses of setfiles in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_execution_setfiles
      status: automated

    - id: RHEL-08-030315
      levels:
          - medium
      title: Successful/unsuccessful uses of userhelper in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_userhelper
      status: automated

    - id: RHEL-08-030316
      levels:
          - medium
      title: Successful/unsuccessful uses of setsebool in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_execution_setsebool
      status: automated

    - id: RHEL-08-030317
      levels:
          - medium
      title: Successful/unsuccessful uses of unix_chkpwd in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_unix_chkpwd
      status: automated

    - id: RHEL-08-030320
      levels:
          - medium
      title: Successful/unsuccessful uses of the ssh-keysign in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_ssh_keysign
      status: automated

    - id: RHEL-08-030330
      levels:
          - medium
      title: Successful/unsuccessful uses of the setfacl command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_execution_setfacl
      status: automated

    - id: RHEL-08-030340
      levels:
          - medium
      title: Successful/unsuccessful uses of the pam_timestamp_check command in RHEL 8 must generate
          an audit record.
      rules:
          - audit_rules_privileged_commands_pam_timestamp_check
      status: automated

    - id: RHEL-08-030350
      levels:
          - medium
      title: Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_newgrp
      status: automated

    - id: RHEL-08-030360
      levels:
          - medium
      title: Successful/unsuccessful uses of the init_module and finit_module system calls in RHEL 8
          must generate an audit record.
      rules:
          - audit_rules_kernel_module_loading_finit
          - audit_rules_kernel_module_loading_init
      status: automated

    - id: RHEL-08-030361
      levels:
          - medium
      title: Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system
          calls in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_rmdir
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_unlinkat
      status: automated

    - id: RHEL-08-030370
      levels:
          - medium
      title: Successful/unsuccessful uses of the gpasswd command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_gpasswd
      status: automated

    - id: RHEL-08-030390
      levels:
          - medium
      title: Successful/unsuccessful uses of the delete_module command in RHEL 8 must generate an audit
          record.
      rules:
          - audit_rules_kernel_module_loading_delete
      status: automated

    - id: RHEL-08-030400
      levels:
          - medium
      title: Successful/unsuccessful uses of the crontab command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_crontab
      status: automated

    - id: RHEL-08-030410
      levels:
          - medium
      title: Successful/unsuccessful uses of the chsh command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_chsh
      status: automated

    - id: RHEL-08-030420
      levels:
          - medium
      title: Successful/unsuccessful uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at
          system calls in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_ftruncate
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_open_by_handle_at
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_truncate
      status: automated

    - id: RHEL-08-030480
      levels:
          - medium
      title: Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in
          RHEL 8 must generate an audit record.
      rules:
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_lchown
      status: automated

    - id: RHEL-08-030490
      levels:
          - medium
      title: Successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls in RHEL 8 must
          generate an audit record.
      rules:
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
      status: automated

    - id: RHEL-08-030550
      levels:
          - medium
      title: Successful/unsuccessful uses of the sudo command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_sudo
      status: automated

    - id: RHEL-08-030560
      levels:
          - medium
      title: Successful/unsuccessful uses of the usermod command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_usermod
      status: automated

    - id: RHEL-08-030570
      levels:
          - medium
      title: Successful/unsuccessful uses of the chacl command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_execution_chacl
      status: automated

    - id: RHEL-08-030580
      levels:
          - medium
      title: Successful/unsuccessful uses of the kmod command in RHEL 8 must generate an audit record.
      rules:
          - audit_rules_privileged_commands_kmod
      status: automated

    - id: RHEL-08-030590
      levels:
          - medium
      title: Successful/unsuccessful modifications to the faillock log file in RHEL 8 must generate an
          audit record.
      rules:
          - audit_rules_login_events_faillock
      status: automated

    - id: RHEL-08-030600
      levels:
          - medium
      title: Successful/unsuccessful modifications to the lastlog file in RHEL 8 must generate an audit
          record.
      rules:
          - audit_rules_login_events_lastlog
      status: automated

    - id: RHEL-08-030601
      levels:
          - low
      title: RHEL 8 must enable auditing of processes that start prior to the audit daemon.
      rules:
          - grub2_audit_argument
      status: automated

    - id: RHEL-08-030602
      levels:
          - low
      title: RHEL 8 must allocate an audit_backlog_limit of sufficient size to capture processes that
          start prior to the audit daemon.
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192
      status: automated

    - id: RHEL-08-030603
      levels:
          - low
      title: RHEL 8 must enable Linux audit logging for the USBGuard daemon.
      rules:
          - configure_usbguard_auditbackend
      status: automated

    - id: RHEL-08-030610
      levels:
          - medium
      title: RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or
          roles appointed by the ISSM) to select which auditable events are to be audited.
      rules:
          - file_permissions_etc_audit_auditd
          - file_permissions_etc_audit_rulesd
      status: automated

    - id: RHEL-08-030620
      levels:
          - medium
      title: RHEL 8 audit tools must have a mode of 0755 or less permissive.
      rules:
          - file_audit_tools_permissions
      status: automated

    - id: RHEL-08-030630
      levels:
          - medium
      title: RHEL 8 audit tools must be owned by root.
      rules:
          - file_audit_tools_ownership
      status: automated

    - id: RHEL-08-030640
      levels:
          - medium
      title: RHEL 8 audit tools must be group-owned by root.
      rules:
          - file_audit_tools_group_ownership
      status: automated

    - id: RHEL-08-030650
      levels:
          - medium
      title: RHEL 8 must use cryptographic mechanisms to protect the integrity of audit tools.
      rules:
          - aide_check_audit_tools
      status: automated

    - id: RHEL-08-030655
      levels:
          - medium
      title: RHEL 8 must audit any script or executable called by cron as root or by any privileged user.
      rules:
          - audit_rules_etc_cron_d
          - audit_rules_var_spool_cron


    - id: RHEL-08-030660
      levels:
          - medium
      title: RHEL 8 must allocate audit record storage capacity to store at least one week of audit records,
          when audit records are not immediately sent to a central audit record storage facility.
      rules:
          - auditd_audispd_configure_sufficiently_large_partition
      status: automated

    - id: RHEL-08-030670
      levels:
          - medium
      title: RHEL 8 must have the packages required for offloading audit logs installed.
      rules:
          - package_rsyslog_installed
      status: automated

    - id: RHEL-08-030680
      levels:
          - medium
      title: RHEL 8 must have the packages required for encrypting offloaded audit logs installed.
      rules:
          - package_rsyslog-gnutls_installed
      status: automated

    - id: RHEL-08-030690
      levels:
          - medium
      title: The RHEL 8 audit records must be off-loaded onto a different system or storage media from
          the system being audited.
      rules:
          - rsyslog_remote_loghost
      status: automated

    - id: RHEL-08-030700
      levels:
          - medium
      title: RHEL 8 must take appropriate action when the internal event queue is full.
      rules:
          - auditd_overflow_action
      status: automated

    - id: RHEL-08-030710
      levels:
          - medium
      title: RHEL 8 must encrypt the transfer of audit records off-loaded onto a different system or
          media from the system being audited.
      rules:
          - rsyslog_encrypt_offload_actionsendstreamdrivermode
          - rsyslog_encrypt_offload_defaultnetstreamdriver
      status: automated

    - id: RHEL-08-030720
      levels:
          - medium
      title: RHEL 8 must authenticate the remote logging server for off-loading audit logs.
      rules:
          - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
      status: automated

    - id: RHEL-08-030730
      levels:
          - medium
      title: RHEL 8 must take action when allocated audit record storage volume reaches 75 percent of
          the repository maximum audit record storage capacity.
      rules:
          - auditd_data_retention_space_left_percentage
      status: automated

    - id: RHEL-08-030740
      levels:
          - medium
      title: RHEL 8 must securely compare internal information system clocks at least every 24 hours
          with a server synchronized to an authoritative time source, such as the United States Naval
          Observatory (USNO) time servers, or a time server designated for the appropriate DoD network
          (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
      rules:
          - chronyd_or_ntpd_set_maxpoll
          - chronyd_server_directive
          - chronyd_specify_remote_server
      status: automated

    - id: RHEL-08-030741
      levels:
          - low
      title: RHEL 8 must disable the chrony daemon from acting as a server.
      rules:
          - chronyd_client_only
      status: automated

    - id: RHEL-08-030742
      levels:
          - low
      title: RHEL 8 must disable network management of the chrony daemon.
      rules:
          - chronyd_no_chronyc_network
      status: automated

    - id: RHEL-08-040000
      levels:
          - high
      title: RHEL 8 must not have the telnet-server package installed.
      rules:
          - package_telnet-server_removed
      status: automated

    - id: RHEL-08-040001
      levels:
          - medium
      title: RHEL 8 must not have any automated bug reporting tools installed.
      rules:
          - package_abrt-addon-ccpp_removed
          - package_abrt-addon-kerneloops_removed
          - package_abrt-cli_removed
          - package_abrt-plugin-sosreport_removed
          - package_abrt_removed
          - package_libreport-plugin-logger_removed
          - package_libreport-plugin-rhtsupport_removed
          - package_python3-abrt-addon_removed
      status: automated

    - id: RHEL-08-040002
      levels:
          - medium
      title: RHEL 8 must not have the sendmail package installed.
      rules:
          - package_sendmail_removed
      status: automated

    - id: RHEL-08-040004
      levels:
          - low
      title: RHEL 8 must enable mitigations against processor-based vulnerabilities.
      rules:
          - grub2_pti_argument
      status: automated

    - id: RHEL-08-040010
      levels:
          - high
      title: RHEL 8 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.
      rules:
          - ensure_epel_repos_disabled
      status: automated

    - id: RHEL-08-040020
      levels:
          - medium
      title: RHEL 8 must cover or disable the built-in or attached camera when not in use.
      rules:
          - kernel_module_uvcvideo_disabled
      status: automated

    - id: RHEL-08-040021
      levels:
          - low
      title: RHEL 8 must disable the asynchronous transfer mode (ATM) protocol.
      rules:
          - kernel_module_atm_disabled
      status: automated

    - id: RHEL-08-040022
      levels:
          - low
      title: RHEL 8 must disable the controller area network (CAN) protocol.
      rules:
          - kernel_module_can_disabled
      status: automated

    - id: RHEL-08-040023
      levels:
          - low
      title: RHEL 8 must disable the stream control transmission protocol (SCTP).
      rules:
          - kernel_module_sctp_disabled
      status: automated

    - id: RHEL-08-040024
      levels:
          - low
      title: RHEL 8 must disable the transparent inter-process communication (TIPC) protocol.
      rules:
          - kernel_module_tipc_disabled
      status: automated

    - id: RHEL-08-040025
      levels:
          - low
      title: RHEL 8 must disable mounting of cramfs.
      rules:
          - kernel_module_cramfs_disabled
      status: automated

    - id: RHEL-08-040026
      levels:
          - low
      title: RHEL 8 must disable IEEE 1394 (FireWire) Support.
      rules:
          - kernel_module_firewire-core_disabled
      status: automated

    - id: RHEL-08-040030
      levels:
          - medium
      title: RHEL 8 must be configured to prohibit or restrict the use of functions, ports, protocols,
          and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category
          Assignments List (CAL) and vulnerability assessments.
      rules:
          - configure_firewalld_ports
      status: automated

    - id: RHEL-08-040070
      levels:
          - medium
      title: The RHEL 8 file system automounter must be disabled unless required.
      rules:
          - service_autofs_disabled
      status: automated

    - id: RHEL-08-040080
      levels:
          - medium
      title: RHEL 8 must be configured to disable USB mass storage.
      rules:
          - kernel_module_usb-storage_disabled
      status: automated

    - id: RHEL-08-040090
      levels:
          - medium
      title: A RHEL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections
          to other systems.
      rules:
          - configured_firewalld_default_deny
          - set_firewalld_default_zone
      status: automated

    - id: RHEL-08-040100
      levels:
          - medium
      title: A firewall must be installed on RHEL 8.
      rules:
          - package_firewalld_installed
      status: automated

    - id: RHEL-08-040110
      levels:
          - medium
      title: RHEL 8 wireless network adapters must be disabled.
      rules:
          - wireless_disable_interfaces
      status: automated

    - id: RHEL-08-040111
      levels:
          - medium
      title: RHEL 8 Bluetooth must be disabled.
      rules:
          - kernel_module_bluetooth_disabled
      status: automated

    - id: RHEL-08-040120
      levels:
          - medium
      title: RHEL 8 must mount /dev/shm with the nodev option.
      rules:
          - mount_option_dev_shm_nodev
      status: automated

    - id: RHEL-08-040121
      levels:
          - medium
      title: RHEL 8 must mount /dev/shm with the nosuid option.
      rules:
          - mount_option_dev_shm_nosuid
      status: automated

    - id: RHEL-08-040122
      levels:
          - medium
      title: RHEL 8 must mount /dev/shm with the noexec option.
      rules:
          - mount_option_dev_shm_noexec
      status: automated

    - id: RHEL-08-040123
      levels:
          - medium
      title: RHEL 8 must mount /tmp with the nodev option.
      rules:
          - mount_option_tmp_nodev
      status: automated

    - id: RHEL-08-040124
      levels:
          - medium
      title: RHEL 8 must mount /tmp with the nosuid option.
      rules:
          - mount_option_tmp_nosuid
      status: automated

    - id: RHEL-08-040125
      levels:
          - medium
      title: RHEL 8 must mount /tmp with the noexec option.
      rules:
          - mount_option_tmp_noexec
      status: automated

    - id: RHEL-08-040126
      levels:
          - medium
      title: RHEL 8 must mount /var/log with the nodev option.
      rules:
          - mount_option_var_log_nodev
      status: automated

    - id: RHEL-08-040127
      levels:
          - medium
      title: RHEL 8 must mount /var/log with the nosuid option.
      rules:
          - mount_option_var_log_nosuid
      status: automated

    - id: RHEL-08-040128
      levels:
          - medium
      title: RHEL 8 must mount /var/log with the noexec option.
      rules:
          - mount_option_var_log_noexec
      status: automated

    - id: RHEL-08-040129
      levels:
          - medium
      title: RHEL 8 must mount /var/log/audit with the nodev option.
      rules:
          - mount_option_var_log_audit_nodev
      status: automated

    - id: RHEL-08-040130
      levels:
          - medium
      title: RHEL 8 must mount /var/log/audit with the nosuid option.
      rules:
          - mount_option_var_log_audit_nosuid
      status: automated

    - id: RHEL-08-040131
      levels:
          - medium
      title: RHEL 8 must mount /var/log/audit with the noexec option.
      rules:
          - mount_option_var_log_audit_noexec
      status: automated

    - id: RHEL-08-040132
      levels:
          - medium
      title: RHEL 8 must mount /var/tmp with the nodev option.
      rules:
          - mount_option_var_tmp_nodev
      status: automated

    - id: RHEL-08-040133
      levels:
          - medium
      title: RHEL 8 must mount /var/tmp with the nosuid option.
      rules:
          - mount_option_var_tmp_nosuid
      status: automated

    - id: RHEL-08-040134
      levels:
          - medium
      title: RHEL 8 must mount /var/tmp with the noexec option.
      rules:
          - mount_option_var_tmp_noexec
      status: automated

    - id: RHEL-08-040135
      levels:
          - medium
      title: The RHEL 8 fapolicy module must be installed.
      rules:
          - package_fapolicyd_installed
      status: automated

    - id: RHEL-08-040140
      levels:
          - medium
      title: RHEL 8 must block unauthorized peripherals before establishing a connection.
      rules:
          - usbguard_generate_policy
      status: automated

    - id: RHEL-08-040150
      levels:
          - medium
      title: A firewall must be able to protect against or limit the effects of Denial of Service (DoS)
          attacks by ensuring RHEL 8 can implement rate-limiting measures on impacted network interfaces.
      rules:
          - firewalld-backend
      status: automated

    - id: RHEL-08-040160
      levels:
          - medium
      title: All RHEL 8 networked systems must have and implement SSH to protect the confidentiality
          and integrity of transmitted and received information, as well as information during preparation
          for transmission.
      rules:
          - service_sshd_enabled
      status: automated

    - id: RHEL-08-040161
      levels:
          - medium
      title: RHEL 8 must force a frequent session key renegotiation for SSH connections to the server.
      rules:
          - sshd_rekey_limit
      status: automated

    - id: RHEL-08-040170
      levels:
          - high
      title: The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 8.
      rules:
          - disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-08-040171
      levels:
          - high
      title: The x86 Ctrl-Alt-Delete key sequence in RHEL 8 must be disabled if a graphical user interface
          is installed.
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-08-040172
      levels:
          - high
      title: The systemd Ctrl-Alt-Delete burst key sequence in RHEL 8 must be disabled.
      rules:
          - disable_ctrlaltdel_burstaction
      status: automated

    - id: RHEL-08-040180
      levels:
          - medium
      title: The debug-shell systemd service must be disabled on RHEL 8.
      rules:
          - service_debug-shell_disabled
      status: automated

    - id: RHEL-08-040190
      levels:
          - high
      title: The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required
          for RHEL 8 operational support.
      rules:
          - package_tftp-server_removed
      status: automated

    - id: RHEL-08-040200
      levels:
          - high
      title: The root account must be the only account having unrestricted access to the RHEL 8 system.
      rules:
          - accounts_no_uid_except_zero
      status: automated

    - id: RHEL-08-040210
      levels:
          - medium
      title: RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from
          being accepted.
      rules:
          - sysctl_net_ipv6_conf_default_accept_redirects
      status: automated

    - id: RHEL-08-040220
      levels:
          - medium
      title: RHEL 8 must not send Internet Control Message Protocol (ICMP) redirects.
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
      status: automated

    - id: RHEL-08-040230
      levels:
          - medium
      title: RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast
          address.
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
      status: automated

    - id: RHEL-08-040240
      levels:
          - medium
      title: RHEL 8 must not forward IPv6 source-routed packets.
      rules:
          - sysctl_net_ipv6_conf_all_accept_source_route
      status: automated

    - id: RHEL-08-040250
      levels:
          - medium
      title: RHEL 8 must not forward IPv6 source-routed packets by default.
      rules:
          - sysctl_net_ipv6_conf_default_accept_source_route
      status: automated

    - id: RHEL-08-040260
      levels:
          - medium
      title: RHEL 8 must not enable IPv6 packet forwarding unless the system is a router.
      rules:
          - sysctl_net_ipv6_conf_all_forwarding
      status: automated

    - id: RHEL-08-040261
      levels:
          - medium
      title: RHEL 8 must not accept router advertisements on all IPv6 interfaces.
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
      status: automated

    - id: RHEL-08-040262
      levels:
          - medium
      title: RHEL 8 must not accept router advertisements on all IPv6 interfaces by default.
      rules:
          - sysctl_net_ipv6_conf_default_accept_ra
      status: automated

    - id: RHEL-08-040270
      levels:
          - medium
      title: RHEL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects
          by default.
      rules:
          - sysctl_net_ipv4_conf_default_send_redirects
      status: automated

    - id: RHEL-08-040280
      levels:
          - medium
      title: RHEL 8 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
      rules:
          - sysctl_net_ipv6_conf_all_accept_redirects
      status: automated

    - id: RHEL-08-040281
      levels:
          - medium
      title: RHEL 8 must disable access to network bpf syscall from unprivileged processes.
      rules:
          - sysctl_kernel_unprivileged_bpf_disabled
      status: automated

    - id: RHEL-08-040282
      levels:
          - medium
      title: RHEL 8 must restrict usage of ptrace to descendant  processes.
      rules:
          - sysctl_kernel_yama_ptrace_scope
      status: automated

    - id: RHEL-08-040283
      levels:
          - medium
      title: RHEL 8 must restrict exposed kernel pointer addresses access.
      rules:
          - sysctl_kernel_kptr_restrict
      status: automated

    - id: RHEL-08-040284
      levels:
          - medium
      title: RHEL 8 must disable the use of user namespaces.
      rules:
          - sysctl_user_max_user_namespaces_no_remediation
      status: automated

    - id: RHEL-08-040285
      levels:
          - medium
      title: RHEL 8 must use reverse path filtering on all IPv4 interfaces.
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
      status: automated

    - id: RHEL-08-040290
      levels:
          - medium
      title: RHEL 8 must be configured to prevent unrestricted mail relaying.
      rules:
          - postfix_prevent_unrestricted_relay
      status: automated

    - id: RHEL-08-040300
      levels:
          - low
      title: The RHEL 8 file integrity tool must be configured to verify extended attributes.
      rules:
          - aide_verify_ext_attributes
      status: automated

    - id: RHEL-08-040310
      levels:
          - low
      title: The RHEL 8 file integrity tool must be configured to verify Access Control Lists (ACLs).
      rules:
          - aide_verify_acls
      status: automated

    - id: RHEL-08-040320
      levels:
          - medium
      title: The graphical display manager must not be installed on RHEL 8 unless approved.
      rules:
          - xwindows_remove_packages
      status: automated

    - id: RHEL-08-040330
      levels:
          - medium
      title: RHEL 8 network interfaces must not be in promiscuous mode.
      rules:
          - network_sniffer_disabled
      status: automated

    - id: RHEL-08-040340
      levels:
          - medium
      title: RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented
          and validated mission requirements.
      rules:
          - sshd_disable_x11_forwarding
      status: automated

    - id: RHEL-08-040341
      levels:
          - medium
      title: The RHEL 8 SSH daemon must prevent remote hosts from connecting to the proxy display.
      rules:
          - sshd_x11_use_localhost
      status: automated

    - id: RHEL-08-040350
      levels:
          - medium
      title: If the Trivial File Transfer Protocol (TFTP) server is required, the RHEL 8 TFTP daemon
          must be configured to operate in secure mode.
      rules:
          - tftp_uses_secure_mode_systemd
      status: automated

    - id: RHEL-08-040360
      levels:
          - high
      title: A File Transfer Protocol (FTP) server package must not be installed unless mission essential
          on RHEL 8.
      rules:
          - package_vsftpd_removed
      status: automated

    - id: RHEL-08-040370
      levels:
          - medium
      title: The gssproxy package must not be installed unless mission essential on RHEL 8.
      rules:
          - package_gssproxy_removed
      status: automated

    - id: RHEL-08-040380
      levels:
          - medium
      title: The iprutils package must not be installed unless mission essential on RHEL 8.
      rules:
          - package_iprutils_removed
      status: automated

    - id: RHEL-08-040390
      levels:
          - medium
      title: The tuned package must not be installed unless mission essential on RHEL 8.
      rules:
          - package_tuned_removed
      status: automated

    - id: RHEL-08-010163
      levels:
          - medium
      title: The krb5-server package must not be installed on RHEL 8.
      rules:
          - package_krb5-server_removed
      status: automated

    - id: RHEL-08-010382
      levels:
          - medium
      title: RHEL 8 must restrict privilege elevation to authorized personnel.
      rules:
          - sudo_restrict_privilege_elevation_to_authorized
      status: automated

    - id: RHEL-08-010383
      levels:
          - medium
      title: RHEL 8 must use the invoking user's password for privilege escalation when using "sudo".
      rules:
          - sudoers_validate_passwd
      status: automated

    - id: RHEL-08-010384
      levels:
          - medium
      title: RHEL 8 must require re-authentication when using the "sudo" command.
      rules:
          - sudo_require_reauthentication
          - var_sudo_timestamp_timeout=always_prompt
      status: automated

    - id: RHEL-08-010049
      levels:
          - medium
      title: RHEL 8 must display a banner before granting local or remote access to the system via a
          graphical user logon.
      rules:
          - dconf_gnome_banner_enabled
      status: automated

    - id: RHEL-08-010141
      levels:
          - medium
      title: RHEL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require
          a unique superusers name upon booting into single-user mode and maintenance.
      rules:
          - grub2_uefi_admin_username
      status: automated

    - id: RHEL-08-010149
      levels:
          - medium
      title: RHEL 8 operating systems booted with a BIOS must require  a unique superusers name upon
          booting into single-user and maintenance modes.
      rules:
          - grub2_admin_username
      status: automated

    - id: RHEL-08-010152
      levels:
          - medium
      title: RHEL 8 operating systems must require authentication upon booting into emergency mode.
      rules:
          - require_emergency_target_auth
      status: automated

    - id: RHEL-08-010159
      levels:
          - medium
      title: The RHEL 8 pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2
          approved cryptographic hashing algorithm for system authentication.
      rules:
          - set_password_hashing_algorithm_systemauth
      status: automated

    - id: RHEL-08-010201
      levels:
          - medium
      title: RHEL 8 must be configured so that all network connections associated with SSH traffic are
          terminated after 10 minutes of becoming unresponsive.
      rules:
          - sshd_set_idle_timeout
      status: automated

    - id: RHEL-08-010287
      levels:
          - medium
      title: The RHEL 8 SSH daemon must be configured to use system-wide crypto policies.
      rules:
          - configure_ssh_crypto_policy
      status: automated

    - id: RHEL-08-010472
      levels:
          - low
      title: RHEL 8 must have the packages required to use the hardware random number generator entropy
          gatherer service.
      rules:
          - package_rng-tools_installed
      status: automated

    - id: RHEL-08-010522
      levels:
          - medium
      title: The RHEL 8 SSH daemon must not allow GSSAPI authentication, except to fulfill documented
          and validated mission requirements.
      rules:
          - sshd_disable_gssapi_auth
      status: automated

    - id: RHEL-08-010544
      levels:
          - medium
      title: RHEL 8 must use a separate file system for /var/tmp.
      rules:
          - partition_for_var_tmp
      status: automated

    - id: RHEL-08-010572
      levels:
          - medium
      title: RHEL 8 must prevent files with the setuid and setgid bit set from being executed on the
          /boot/efi directory.
      rules:
          - mount_option_boot_efi_nosuid
      status: automated

    - id: RHEL-08-010731
      levels:
          - medium
      title: All RHEL 8 local interactive user home directory files must have mode 0750 or less permissive.
      rules:
          - accounts_users_home_files_permissions
      status: automated

    - id: RHEL-08-010741
      levels:
          - medium
      title: RHEL 8 must be configured so that all files and directories contained in local interactive
          user home directories are group-owned by a group of which the home directory owner is a member.
      rules:
          - accounts_users_home_files_groupownership
      status: automated

    - id: RHEL-08-020025
      levels:
          - medium
      title: RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth
          file.
      rules:
          - account_password_pam_faillock_system_auth
      status: automated

    - id: RHEL-08-020026
      levels:
          - medium
      title: RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth
          file.
      rules:
          - account_password_pam_faillock_password_auth
      status: automated

    - id: RHEL-08-020031
      levels:
          - medium
      title: RHEL 8 must initiate a session lock for graphical user interfaces when the screensaver is
          activated.
      rules:
          - dconf_gnome_screensaver_lock_delay
          - var_screensaver_lock_delay=5_seconds
      status: automated

    - id: RHEL-08-020032
      levels:
          - medium
      title: RHEL 8 must disable the user list at logon for graphical user interfaces.
      rules:
          - dconf_gnome_disable_user_list
      status: automated

    - id: RHEL-08-020081
      levels:
          - medium
      title: RHEL 8 must prevent a user from overriding the session idle-delay setting for the graphical
          user interface.
      rules:
          - dconf_gnome_session_idle_user_locks
      status: automated

    - id: RHEL-08-020082
      levels:
          - medium
      title: RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting for the
          graphical user interface.
      rules:
          - dconf_gnome_screensaver_lock_locked
      status: automated

    - id: RHEL-08-020332
      levels:
          - high
      title: RHEL 8 must not allow blank or null passwords in the password-auth file.
      rules:
          - no_empty_passwords
      status: automated

    - id: RHEL-08-030181
      levels:
          - medium
      title: RHEL 8 audit records must contain information to establish what type of events occurred,
          the source of events, where events occurred, and the outcome of events.
      rules:
          - service_auditd_enabled
      status: automated

    - id: RHEL-08-030731
      levels:
          - medium
      title: RHEL 8 must notify the System Administrator (SA) and Information System Security Officer
          (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
      rules:
          - auditd_data_retention_space_left_action
      status: automated

    - id: RHEL-08-040101
      levels:
          - medium
      title: A firewall must be active on RHEL 8.
      rules:
          - service_firewalld_enabled
      status: automated

    - id: RHEL-08-040136
      levels:
          - medium
      title: The RHEL 8 fapolicy module must be enabled.
      rules:
          - service_fapolicyd_enabled
      status: automated

    - id: RHEL-08-040137
      levels:
          - medium
      title: The RHEL 8 fapolicy module must be configured to employ a deny-all, permit-by-exception
          policy to allow the execution of authorized software programs.
      rules:
          - fapolicy_default_deny
      status: automated

    - id: RHEL-08-040139
      levels:
          - medium
      title: RHEL 8 must have the USBGuard installed.
      rules:
          - package_usbguard_installed
      status: automated

    - id: RHEL-08-040141
      levels:
          - medium
      title: RHEL 8 must enable the USBGuard.
      rules:
          - service_usbguard_enabled
      status: automated

    - id: RHEL-08-040159
      levels:
          - medium
      title: All RHEL 8 networked systems must have SSH installed.
      rules:
          - package_openssh-server_installed
      status: automated

    - id: RHEL-08-040209
      levels:
          - medium
      title: RHEL 8 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from
          being accepted.
      rules:
          - sysctl_net_ipv4_conf_default_accept_redirects
      status: automated

    - id: RHEL-08-040239
      levels:
          - medium
      title: RHEL 8 must not forward IPv4 source-routed packets.
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
      status: automated

    - id: RHEL-08-040249
      levels:
          - medium
      title: RHEL 8 must not forward IPv4 source-routed packets by default.
      rules:
          - sysctl_net_ipv4_conf_default_accept_source_route
      status: automated

    - id: RHEL-08-040279
      levels:
          - medium
      title: RHEL 8 must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
      status: automated

    - id: RHEL-08-040286
      levels:
          - medium
      title: RHEL 8 must enable hardening for the Berkeley Packet Filter Just-in-time compiler.
      rules:
          - sysctl_net_core_bpf_jit_harden
      status: automated

    - id: RHEL-08-020027
      levels:
          - medium
      title: RHEL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the
          use of a non-default faillock tally directory.
      rules:
          - account_password_selinux_faillock_dir
      status: automated

    - id: RHEL-08-020028
      levels:
          - medium
      title: RHEL 8 systems below version 8.2 must configure SELinux context type to allow the use of
          a non-default faillock tally directory.
      rules:
          - account_password_selinux_faillock_dir
      status: automated

    - id: RHEL-08-040259
      levels:
          - medium
      title: RHEL 8 must not enable IPv4 packet forwarding unless the system is a router.
      rules:
          - sysctl_net_ipv4_conf_all_forwarding
      status: automated

    - id: RHEL-08-010121
      levels:
          - high
      title: The RHEL 8 operating system must not have accounts configured with blank or null passwords.
      rules:
          - no_empty_passwords_etc_shadow
      status: automated

    - id: RHEL-08-010331
      levels:
          - medium
      title: RHEL 8 library directories must have mode 755 or less permissive.
      rules:
          - dir_permissions_library_dirs
      status: automated

    - id: RHEL-08-010341
      levels:
          - medium
      title: RHEL 8 library directories must be owned by root.
      rules:
          - dir_ownership_library_dirs
      status: automated

    - id: RHEL-08-010351
      levels:
          - medium
      title: RHEL 8 library directories must be group-owned by root or a system account.
      rules:
          - dir_group_ownership_library_dirs
      status: automated

    - id: RHEL-08-010359
      levels:
          - medium
      title: The RHEL 8 operating system must use a file integrity tool to verify correct operation of
          all security functions.
      rules:
          - aide_build_database
          - package_aide_installed
      status: automated

    - id: RHEL-08-010379
      levels:
          - medium
      title: RHEL 8 must specify the default "include" directory for the /etc/sudoers file.
      rules:
          - sudoers_default_includedir
      status: automated

    - id: RHEL-08-010385
      levels:
          - medium
      title: The RHEL 8 operating system must not be configured to bypass password requirements for privilege
          escalation.
      rules:
          - disallow_bypass_password_sudo
      status: automated

    - id: RHEL-08-020101
      levels:
          - medium
      title: RHEL 8 must ensure the password complexity module is enabled in the system-auth file.
      rules:
          - accounts_password_pam_pwquality_system_auth
      status: automated

    - id: RHEL-08-020104
      levels:
          - medium
      title: RHEL 8 systems, version 8.4 and above, must ensure the password complexity module is configured
          for three retries or less.
      rules:
          - accounts_password_pam_retry
      status: automated

    - id: RHEL-08-040321
      levels:
          - medium
      title: The graphical display manager must not be the default target on RHEL 8 unless approved.
      rules:
          - xwindows_runlevel_target
      status: automated

    - id: RHEL-08-040400
      levels:
          - medium
      title: RHEL 8 must prevent nonprivileged users from executing privileged functions, including disabling,
          circumventing, or altering implemented security safeguards/countermeasures.
      rules:
          - selinux_user_login_roles
      status: automated

    - id: RHEL-08-040342
      levels:
          - medium
      title: RHEL 8 SSH server must be configured to use only FIPS-validated key exchange algorithms.
      rules:
          - sshd_use_approved_kex_ordered_stig
      status: automated

    - id: RHEL-08-010019
      levels:
          - medium
      title: RHEL 8 must ensure cryptographic verification of vendor software packages.
      rules:
          - ensure_redhat_gpgkey_installed
      status: automated

    - id: RHEL-08-010358
      levels:
          - medium
      title: RHEL 8 must be configured to allow sending email notifications of unauthorized configuration
          changes to designated personnel.
      rules:
          - package_mailx_installed
      status: automated

    - id: RHEL-08-020035
      levels:
          - medium
      title: RHEL 8.7 and higher must terminate idle user sessions.
      rules:
          - logind_session_timeout
          - var_logind_session_timeout=10_minutes
      status: automated

    - id: RHEL-08-020331
      levels:
          - high
      title: RHEL 8 must not allow blank or null passwords in the system-auth file.
      rules:
          - no_empty_passwords
      status: automated

    - id: RHEL-08-010296
      levels:
          - medium
      title: RHEL 8 SSH client must be configured to use only Message Authentication Codes (MACs) employing
          FIPS 140-3 validated cryptographic hash algorithms.
      rules:
          - harden_sshd_ciphers_openssh_conf_crypto_policy
          - harden_sshd_macs_openssh_conf_crypto_policy
      status: automated

    - id: RHEL-08-010297
      levels:
          - medium
      title: RHEL 8 SSH client must be configured to use only ciphers employing FIPS 140-3 validated
          cryptographic hash algorithms.
      rules: []
      status: pending

    - id: RHEL-08-010455
      levels:
          - medium
      title: RHEL 8 must elevate the SELinux context when an administrator calls the sudo command.
      rules:
          - selinux_context_elevation_for_sudo
      status: automated
