---
policy: 'Red Hat Enterprise Linux 9 Security Technical Implementation Guide'
title: 'Red Hat Enterprise Linux 9 Security Technical Implementation Guide'
id: stig_rhel9
source: https://www.cyber.mil/stigs/downloads/
version: V2R4
reference_type: stigid
product: rhel9

levels:
    - id: high
    - id: medium
    - id: low

controls:
    - id: needed_rules
      levels:
          - medium
      rules:
          - enable_authselect
          - var_authselect_profile=sssd

    - id: RHEL-09-171011
      levels:
          - medium
      rules:
          - dconf_gnome_login_banner_text
    - id: RHEL-09-211010
      levels:
          - high
      title: RHEL 9 must be a vendor-supported release.
      rules:
          - installed_OS_is_vendor_supported
      status: automated

    - id: RHEL-09-211015
      levels:
          - medium
      title: RHEL 9 vendor packaged system security patches and updates must be installed and up to date.
      rules:
          - security_patches_up_to_date
      status: automated

    - id: RHEL-09-211020
      levels:
          - medium
      title: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a command line user logon.
      rules:
          - banner_etc_issue
          - login_banner_text=dod_banners
      status: automated

    - id: RHEL-09-211030
      levels:
          - medium
      title: The graphical display manager must not be the default target on RHEL 9 unless approved.
      rules:
          - xwindows_runlevel_target
      status: automated

    - id: RHEL-09-211035
      levels:
          - low
      title: RHEL 9 must enable the hardware random number generator entropy gatherer service.
      related_rules:
          - service_rngd_enabled  # This rule is causing test failures, See https://github.com/ComplianceAsCode/content/pull/10153
      status: pending

    - id: RHEL-09-211040
      levels:
          - medium
      title: RHEL 9 systemd-journald service must be enabled.
      rules:
          - service_systemd-journald_enabled
      status: automated

    - id: RHEL-09-211045
      levels:
          - high
      title: The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
      rules:
          - disable_ctrlaltdel_burstaction
      status: automated

    - id: RHEL-09-211050
      levels:
          - high
      title: The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
      rules:
          - disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-09-211055
      levels:
          - medium
      title: RHEL 9 debug-shell systemd service must be disabled.
      status: automated
      rules:
          - service_debug-shell_disabled

    - id: RHEL-09-212010
      levels:
          - medium
      title: RHEL 9 must require a boot loader superuser password.
      rules:
          - grub2_password
      status: automated

    - id: RHEL-09-212015
      levels:
          - medium
      title: RHEL 9 must disable the ability of systemd to spawn an interactive boot process.
      rules:
          - grub2_disable_interactive_boot
      status: automated

    - id: RHEL-09-212020
      levels:
          - high
      title: RHEL 9 must require a unique superusers name upon booting into single-user and maintenance
          modes.
      rules:
          - grub2_admin_username
      status: automated

    - id: RHEL-09-212025
      levels:
          - medium
      title: RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.
      rules:
          - file_groupowner_grub2_cfg
      status: automated

    - id: RHEL-09-212030
      levels:
          - medium
      title: RHEL 9 /boot/grub2/grub.cfg file must be owned by root.
      rules:
          - file_owner_grub2_cfg
      status: automated

    - id: RHEL-09-212035
      levels:
          - medium
      title: RHEL 9 must disable virtual system calls.
      rules:
          - grub2_vsyscall_argument
      status: automated

    - id: RHEL-09-212040
      levels:
          - medium
      title: RHEL 9 must clear the page allocator to prevent use-after-free attacks.
      rules:
          - grub2_page_poison_argument
      status: automated

    - id: RHEL-09-212045
      levels:
          - medium
      title: RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.
      rules:
          - grub2_init_on_free
      status: automated

    - id: RHEL-09-212050
      levels:
          - low
      title: RHEL 9 must enable mitigations against processor-based vulnerabilities.
      rules:
          - grub2_pti_argument
      status: automated

    - id: RHEL-09-212055
      levels:
          - low
      title: RHEL 9 must enable auditing of processes that start prior to the audit daemon.
      rules:
          - grub2_audit_argument
      status: automated

    - id: RHEL-09-213010
      levels:
          - medium
      title: RHEL 9 must restrict access to the kernel message buffer.
      rules:
          - sysctl_kernel_dmesg_restrict
      status: automated

    - id: RHEL-09-213015
      levels:
          - medium
      title: RHEL 9 must prevent kernel profiling by nonprivileged users.
      rules:
          - sysctl_kernel_perf_event_paranoid
      status: automated

    - id: RHEL-09-213020
      levels:
          - medium
      title: RHEL 9 must prevent the loading of a new kernel for later execution.
      rules:
          - sysctl_kernel_kexec_load_disabled
      status: automated

    - id: RHEL-09-213025
      levels:
          - medium
      title: RHEL 9 must restrict exposed kernel pointer addresses access.
      rules:
          - sysctl_kernel_kptr_restrict
      status: automated

    - id: RHEL-09-213030
      levels:
          - medium
      title: RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.
      rules:
          - sysctl_fs_protected_hardlinks
      status: automated

    - id: RHEL-09-213035
      levels:
          - medium
      title: RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.
      rules:
          - sysctl_fs_protected_symlinks
      status: automated

    - id: RHEL-09-213040
      levels:
          - medium
      title: RHEL 9 must disable the kernel.core_pattern.
      rules:
          - sysctl_kernel_core_pattern
      status: automated

    - id: RHEL-09-213045
      levels:
          - medium
      title: RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.
      rules:
          - kernel_module_atm_disabled
      status: automated

    - id: RHEL-09-213050
      levels:
          - medium
      title: RHEL 9 must be configured to disable the Controller Area Network kernel module.
      rules:
          - kernel_module_can_disabled
      status: automated

    - id: RHEL-09-213055
      levels:
          - medium
      title: RHEL 9 must be configured to disable the FireWire kernel module.
      rules:
          - kernel_module_firewire-core_disabled
      status: automated

    - id: RHEL-09-213060
      levels:
          - medium
      title: RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
      rules:
          - kernel_module_sctp_disabled
      status: automated

    - id: RHEL-09-213065
      levels:
          - medium
      title: RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
      rules:
          - kernel_module_tipc_disabled
      status: automated

    - id: RHEL-09-213070
      levels:
          - medium
      title: RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from
          unauthorized code execution.
      rules:
          - sysctl_kernel_randomize_va_space
      status: automated

    - id: RHEL-09-213075
      levels:
          - medium
      title: RHEL 9 must disable access to network bpf system call from nonprivileged processes.
      rules:
          - sysctl_kernel_unprivileged_bpf_disabled
      status: automated

    - id: RHEL-09-213080
      levels:
          - medium
      title: RHEL 9 must restrict usage of ptrace to descendant processes.
      rules:
          - sysctl_kernel_yama_ptrace_scope
      status: automated

    - id: RHEL-09-213085
      levels:
          - medium
      title: RHEL 9 must disable core dump backtraces.
      rules:
          - coredump_disable_backtraces
      status: automated

    - id: RHEL-09-213090
      levels:
          - medium
      title: RHEL 9 must disable storing core dumps.
      rules:
          - coredump_disable_storage
      status: automated

    - id: RHEL-09-213095
      levels:
          - medium
      title: RHEL 9 must disable core dumps for all users.
      rules:
          - disable_users_coredumps
      status: automated

    - id: RHEL-09-213100
      levels:
          - medium
      title: RHEL 9 must disable acquiring, saving, and processing core dumps.
      rules:
          - service_systemd-coredump_disabled
      status: automated

    - id: RHEL-09-213105
      levels:
          - medium
      title: RHEL 9 must disable the use of user namespaces.
      rules:
          - sysctl_user_max_user_namespaces_no_remediation
      status: automated

    - id: RHEL-09-213110
      levels:
          - medium
      title: RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.
      rules:
          - sysctl_kernel_exec_shield
      status: automated

    - id: RHEL-09-213115
      levels:
          - medium
      title: The kdump service on RHEL 9 must be disabled.
      rules:
          - service_kdump_disabled
      status: automated

    - id: RHEL-09-214010
      levels:
          - medium
      title: RHEL 9 must ensure cryptographic verification of vendor software packages.
      rules:
          - ensure_redhat_gpgkey_installed
      status: automated

    - id: RHEL-09-214015
      levels:
          - high
      title: RHEL 9 must check the GPG signature of software packages originating from external software
          repositories before installation.
      rules:
          - ensure_gpgcheck_globally_activated
      status: automated

    - id: RHEL-09-214020
      levels:
          - high
      title: RHEL 9 must check the GPG signature of locally installed software packages before installation.
      rules:
          - ensure_gpgcheck_local_packages
      status: automated

    - id: RHEL-09-214025
      levels:
          - high
      title: RHEL 9 must have GPG signature verification enabled for all software repositories.
      rules:
          - ensure_gpgcheck_never_disabled
      status: automated

    - id: RHEL-09-214030
      levels:
          - medium
      title: RHEL 9 must be configured so that the cryptographic hashes of system files match vendor
          values.
      related_rules:
          - rpm_verify_hashes  # Due to crypto policies this cannot be selected at this time
      status: pending

    - id: RHEL-09-214035
      levels:
          - low
      title: RHEL 9 must remove all software components after updated versions have been installed.
      rules:
          - clean_components_post_updating
      status: automated

    - id: RHEL-09-215010
      levels:
          - medium
      title: RHEL 9 subscription-manager package must be installed.
      rules:
          - package_subscription-manager_installed
      status: automated

    - id: RHEL-09-215015
      levels:
          - high
      title: RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
      rules:
          - package_vsftpd_removed
      status: automated

    - id: RHEL-09-215020
      levels:
          - medium
      title: RHEL 9 must not have the sendmail package installed.
      rules:
          - package_sendmail_removed
      status: automated

    - id: RHEL-09-215025
      levels:
          - medium
      title: RHEL 9 must not have the nfs-utils package installed.
      rules:
          - package_nfs-utils_removed
      status: automated

    - id: RHEL-09-215030
      levels:
          - medium
      title: RHEL 9 must not have the ypserv package installed.
      related_rules:
          - package_ypserv_removed
      status: not applicable  # The ypserv package is not available in RHEL 9

    - id: RHEL-09-215035
      levels:
          - medium
      title: RHEL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.
      rules:
          - ensure_epel_repos_disabled
      status: automated

    - id: RHEL-09-215040
      levels:
          - medium
      title: RHEL 9 must not have the telnet-server package installed.
      rules:
          - package_telnet-server_removed
      status: automated

    - id: RHEL-09-215045
      levels:
          - medium
      title: RHEL 9 must not have the gssproxy package installed.
      rules:
          - package_gssproxy_removed
      status: automated

    - id: RHEL-09-215050
      levels:
          - medium
      title: RHEL 9 must not have the iprutils package installed.
      rules:
          - package_iprutils_removed
      status: automated

    - id: RHEL-09-215055
      levels:
          - medium
      title: RHEL 9 must not have the tuned package installed.
      rules:
          - package_tuned_removed
      status: automated

    - id: RHEL-09-215060
      levels:
          - high
      title: RHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
      rules:
          - package_tftp-server_removed
      status: automated

    - id: RHEL-09-215065
      levels:
          - medium
      title: RHEL 9 must not have the quagga package installed.
      related_rules:
          - package_quagga_removed
      status: not applicable  # The quagga package is not available in RHEL 9

    - id: RHEL-09-215070
      levels:
          - medium
      title: A graphical display manager must not be installed on RHEL 9 unless approved.
      rules:
          - xwindows_remove_packages
      status: automated

    - id: RHEL-09-215075
      levels:
          - medium
      title: RHEL 9 must have the openssl-pkcs11 package installed.
      rules:
          - install_smartcard_packages
      status: automated

    - id: RHEL-09-215080
      levels:
          - medium
      title: RHEL 9 must have the gnutls-utils package installed.
      rules:
          - package_gnutls-utils_installed
      status: automated

    - id: RHEL-09-215085
      levels:
          - medium
      title: RHEL 9 must have the nss-tools package installed.
      rules:
          - package_nss-tools_installed
      status: automated

    - id: RHEL-09-215090
      levels:
          - medium
      title: RHEL 9 must have the rng-tools package installed.
      rules:
          - package_rng-tools_installed
      status: automated

    - id: RHEL-09-215095
      levels:
          - medium
      title: RHEL 9 must have the s-nail package installed.
      rules:
          - package_s-nail_installed
      status: automated

    - id: RHEL-09-215100
      levels:
          - medium
      title: RHEL 9 must have the crypto-policies package installed.
      rules:
          - package_crypto-policies_installed
      status: automated

    - id: RHEL-09-215101
      levels:
          - medium
      title: RHEL 9 must have the Postfix package installed.
      status: automated
      rules:
          - package_postfix_installed

    - id: RHEL-09-215105
      levels:
          - medium
      title: RHEL 9 must implement a FIPS 140-3 compliant systemwide cryptographic policy.
      rules:
          - configure_crypto_policy
          - fips_crypto_subpolicy
          - fips_custom_stig_sub_policy
      status: automated

    - id: RHEL-09-231010
      levels:
          - medium
      title: A separate RHEL 9 file system must be used for user home directories (such as /home or an
          equivalent).
      rules:
          - partition_for_home
      status: automated

    - id: RHEL-09-231015
      levels:
          - medium
      title: RHEL 9 must use a separate file system for /tmp.
      rules:
          - partition_for_tmp
      status: automated

    - id: RHEL-09-231020
      levels:
          - low
      title: RHEL 9 must use a separate file system for /var.
      rules:
          - partition_for_var
      status: automated

    - id: RHEL-09-231025
      levels:
          - low
      title: RHEL 9 must use a separate file system for /var/log.
      rules:
          - partition_for_var_log
      status: automated

    - id: RHEL-09-231030
      levels:
          - low
      title: RHEL 9 must use a separate file system for the system audit data path.
      rules:
          - partition_for_var_log_audit
      status: automated

    - id: RHEL-09-231035
      levels:
          - medium
      title: RHEL 9 must use a separate file system for /var/tmp.
      rules:
          - partition_for_var_tmp
      status: automated

    - id: RHEL-09-231040
      levels:
          - medium
      title: RHEL 9 file system automount function must be disabled unless required.
      rules:
          - service_autofs_disabled
      status: automated

    - id: RHEL-09-231045
      levels:
          - medium
      title: RHEL 9 must prevent device files from being interpreted on file systems that contain user
          home directories.
      rules:
          - mount_option_home_nodev
      status: automated

    - id: RHEL-09-231050
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file
          systems that contain user home directories.
      rules:
          - mount_option_home_nosuid
      status: automated

    - id: RHEL-09-231055
      levels:
          - medium
      title: RHEL 9 must prevent code from being executed on file systems that contain user home directories.
      rules:
          - mount_option_home_noexec
      status: automated

    - id: RHEL-09-231065
      levels:
          - medium
      title: RHEL 9 must prevent special devices on file systems that are imported via Network File System
          (NFS).
      rules:
          - mount_option_nodev_remote_filesystems
      status: automated

    - id: RHEL-09-231070
      levels:
          - medium
      title: RHEL 9  must prevent code from being executed on file systems that are imported via Network
          File System (NFS).
      rules:
          - mount_option_noexec_remote_filesystems
      status: automated

    - id: RHEL-09-231075
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file
          systems that are imported via Network File System (NFS).
      rules:
          - mount_option_nosuid_remote_filesystems
      status: automated

    - id: RHEL-09-231080
      levels:
          - medium
      title: RHEL 9 must prevent code from being executed on file systems that are used with removable
          media.
      rules:
          - mount_option_noexec_removable_partitions
      status: automated

    - id: RHEL-09-231085
      levels:
          - medium
      title: RHEL 9 must prevent special devices on file systems that are used with removable media.
      rules:
          - mount_option_nodev_removable_partitions
      status: automated

    - id: RHEL-09-231090
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file
          systems that are used with removable media.
      rules:
          - mount_option_nosuid_removable_partitions
      status: automated

    - id: RHEL-09-231095
      levels:
          - medium
      title: RHEL 9 must mount /boot with the nodev option.
      rules:
          - mount_option_boot_nodev
      status: automated

    - id: RHEL-09-231100
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the
          /boot directory.
      rules:
          - mount_option_boot_nosuid
      status: automated

    - id: RHEL-09-231105
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the
          /boot/efi directory.
      rules:
          - mount_option_boot_efi_nosuid
      status: automated

    - id: RHEL-09-231110
      levels:
          - medium
      title: RHEL 9 must mount /dev/shm with the nodev option.
      rules:
          - mount_option_dev_shm_nodev
      status: automated

    - id: RHEL-09-231115
      levels:
          - medium
      title: RHEL 9 must mount /dev/shm with the noexec option.
      rules:
          - mount_option_dev_shm_noexec
      status: automated

    - id: RHEL-09-231120
      levels:
          - medium
      title: RHEL 9 must mount /dev/shm with the nosuid option.
      rules:
          - mount_option_dev_shm_nosuid
      status: automated

    - id: RHEL-09-231125
      levels:
          - medium
      title: RHEL 9 must mount /tmp with the nodev option.
      rules:
          - mount_option_tmp_nodev
      status: automated

    - id: RHEL-09-231130
      levels:
          - medium
      title: RHEL 9 must mount /tmp with the noexec option.
      rules:
          - mount_option_tmp_noexec
      status: automated

    - id: RHEL-09-231135
      levels:
          - medium
      title: RHEL 9 must mount /tmp with the nosuid option.
      rules:
          - mount_option_tmp_nosuid
      status: automated

    - id: RHEL-09-231140
      levels:
          - medium
      title: RHEL 9 must mount /var with the nodev option.
      rules:
          - mount_option_var_nodev
      status: automated

    - id: RHEL-09-231145
      levels:
          - medium
      title: RHEL 9 must mount /var/log with the nodev option.
      rules:
          - mount_option_var_log_nodev
      status: automated

    - id: RHEL-09-231150
      levels:
          - medium
      title: RHEL 9 must mount /var/log with the noexec option.
      rules:
          - mount_option_var_log_noexec
      status: automated

    - id: RHEL-09-231155
      levels:
          - medium
      title: RHEL 9 must mount /var/log with the nosuid option.
      rules:
          - mount_option_var_log_nosuid
      status: automated

    - id: RHEL-09-231160
      levels:
          - medium
      title: RHEL 9 must mount /var/log/audit with the nodev option.
      rules:
          - mount_option_var_log_audit_nodev
      status: automated

    - id: RHEL-09-231165
      levels:
          - medium
      title: RHEL 9 must mount /var/log/audit with the noexec option.
      rules:
          - mount_option_var_log_audit_noexec
      status: automated

    - id: RHEL-09-231170
      levels:
          - medium
      title: RHEL 9 must mount /var/log/audit with the nosuid option.
      rules:
          - mount_option_var_log_audit_nosuid
      status: automated

    - id: RHEL-09-231175
      levels:
          - medium
      title: RHEL 9 must mount /var/tmp with the nodev option.
      rules:
          - mount_option_var_tmp_nodev
      status: automated

    - id: RHEL-09-231180
      levels:
          - medium
      title: RHEL 9 must mount /var/tmp with the noexec option.
      rules:
          - mount_option_var_tmp_noexec
      status: automated

    - id: RHEL-09-231185
      levels:
          - medium
      title: RHEL 9 must mount /var/tmp with the nosuid option.
      rules:
          - mount_option_var_tmp_nosuid
      status: automated

    - id: RHEL-09-231190
      levels:
          - high
      title: RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized
          disclosure or modification of all information that requires at rest protection.
      rules:
          - encrypt_partitions
      status: automated

    - id: RHEL-09-231195
      levels:
          - low
      title: RHEL 9 must disable mounting of cramfs.
      rules:
          - kernel_module_cramfs_disabled
      status: automated

    - id: RHEL-09-231200
      levels:
          - medium
      title: RHEL 9 must prevent special devices on non-root local partitions.
      rules:
          - mount_option_nodev_nonroot_local_partitions
      status: automated

    - id: RHEL-09-232010
      levels:
          - medium
      title: RHEL 9 system commands must have mode 755 or less permissive.
      rules:
          - file_permissions_binary_dirs
      status: automated

    - id: RHEL-09-232015
      levels:
          - medium
      title: RHEL 9 library directories must have mode 755 or less permissive.
      rules:
          - dir_permissions_library_dirs
      status: automated

    - id: RHEL-09-232020
      levels:
          - medium
      title: RHEL 9 library files must have mode 755 or less permissive.
      rules:
          - file_permissions_library_dirs
      status: automated

    - id: RHEL-09-232025
      levels:
          - medium
      title: RHEL 9 /var/log directory must have mode 0755 or less permissive.
      rules:
          - file_permissions_var_log
      status: automated

    - id: RHEL-09-232030
      levels:
          - medium
      title: RHEL 9 /var/log/messages file must have mode 0640 or less permissive.
      rules:
          - file_permissions_var_log_messages
      status: automated

    - id: RHEL-09-232035
      levels:
          - medium
      title: RHEL 9 audit tools must have a mode of 0755 or less permissive.
      rules:
          - file_audit_tools_permissions
      status: automated

    - id: RHEL-09-232040
      levels:
          - medium
      title: RHEL 9 cron configuration directories must have a mode of 0700 or less permissive.
      rules:
          - package_cron_installed
          - file_permissions_cron_d
          - file_permissions_cron_daily
          - file_permissions_cron_hourly
          - file_permissions_cron_monthly
          - file_permissions_cron_weekly
      status: automated

    - id: RHEL-09-232045
      levels:
          - medium
      title: All RHEL 9 local initialization files must have mode 0740 or less permissive.
      rules:
          - file_permission_user_init_files_root
          - var_user_initialization_files_regex=all_dotfiles
          - rootfiles_configured
      status: automated

    - id: RHEL-09-232050
      levels:
          - medium
      title: All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.
      rules:
          - file_permissions_home_directories
      status: automated

    - id: RHEL-09-232055
      levels:
          - medium
      title: RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
      rules:
          - file_permissions_etc_group
      status: automated

    - id: RHEL-09-232060
      levels:
          - medium
      title: RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
      rules:
          - file_permissions_backup_etc_group
      status: automated

    - id: RHEL-09-232065
      levels:
          - medium
      title: RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_etc_gshadow
      status: automated

    - id: RHEL-09-232070
      levels:
          - medium
      title: RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_backup_etc_gshadow
      status: automated

    - id: RHEL-09-232075
      levels:
          - medium
      title: RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
      rules:
          - file_permissions_etc_passwd
      status: automated

    - id: RHEL-09-232080
      levels:
          - medium
      title: RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_backup_etc_passwd
      status: automated

    - id: RHEL-09-232085
      levels:
          - medium
      title: RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_backup_etc_shadow
      status: automated

    - id: RHEL-09-232090
      levels:
          - medium
      title: RHEL 9 /etc/group file must be owned by root.
      rules:
          - file_owner_etc_group
      status: automated

    - id: RHEL-09-232095
      levels:
          - medium
      title: RHEL 9 /etc/group file must be group-owned by root.
      rules:
          - file_groupowner_etc_group
      status: automated

    - id: RHEL-09-232100
      levels:
          - medium
      title: RHEL 9 /etc/group- file must be owned by root.
      rules:
          - file_owner_backup_etc_group

    - id: RHEL-09-232103
      title: RHEL 9 "/etc/audit/" must be owned by root.
      levels:
          - medium
      rules:
          - file_ownership_audit_configuration
      status: automated

    - id: RHEL-09-232104
      title: RHEL 9 "/etc/audit/" must be group-owned by root.
      levels:
          - medium
      rules:
          - file_groupownership_audit_configuration

    - id: RHEL-09-232105
      levels:
          - medium
      title: RHEL 9 /etc/group- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_group
      status: automated

    - id: RHEL-09-232110
      levels:
          - medium
      title: RHEL 9 /etc/gshadow file must be owned by root.
      rules:
          - file_owner_etc_gshadow
      status: automated

    - id: RHEL-09-232115
      levels:
          - medium
      title: RHEL 9 /etc/gshadow file must be group-owned by root.
      rules:
          - file_groupowner_etc_gshadow
      status: automated

    - id: RHEL-09-232120
      levels:
          - medium
      title: RHEL 9 /etc/gshadow- file must be owned by root.
      rules:
          - file_owner_backup_etc_gshadow
      status: automated

    - id: RHEL-09-232125
      levels:
          - medium
      title: RHEL 9 /etc/gshadow- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_gshadow
      status: automated

    - id: RHEL-09-232130
      levels:
          - medium
      title: RHEL 9 /etc/passwd file must be owned by root.
      rules:
          - file_owner_etc_passwd
      status: automated

    - id: RHEL-09-232135
      levels:
          - medium
      title: RHEL 9 /etc/passwd file must be group-owned by root.
      rules:
          - file_groupowner_etc_passwd
      status: automated

    - id: RHEL-09-232140
      levels:
          - medium
      title: RHEL 9 /etc/passwd- file must be owned by root.
      rules:
          - file_owner_backup_etc_passwd
      status: automated

    - id: RHEL-09-232145
      levels:
          - medium
      title: RHEL 9 /etc/passwd- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_passwd
      status: automated

    - id: RHEL-09-232150
      levels:
          - medium
      title: RHEL 9 /etc/shadow file must be owned by root.
      rules:
          - file_owner_etc_shadow
      status: automated

    - id: RHEL-09-232155
      levels:
          - medium
      title: RHEL 9 /etc/shadow file must be group-owned by root.
      rules:
          - file_groupowner_etc_shadow
      status: automated

    - id: RHEL-09-232160
      levels:
          - medium
      title: RHEL 9 /etc/shadow- file must be owned by root.
      rules:
          - file_owner_backup_etc_shadow
      status: automated

    - id: RHEL-09-232165
      levels:
          - medium
      title: RHEL 9 /etc/shadow- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_shadow
      status: automated

    - id: RHEL-09-232170
      levels:
          - medium
      title: RHEL 9 /var/log directory must be owned by root.
      rules:
          - file_owner_var_log
      status: automated

    - id: RHEL-09-232175
      levels:
          - medium
      title: RHEL 9 /var/log directory must be group-owned by root.
      rules:
          - file_groupowner_var_log
      status: automated

    - id: RHEL-09-232180
      levels:
          - medium
      title: RHEL 9 /var/log/messages file must be owned by root.
      rules:
          - file_owner_var_log_messages
      status: automated

    - id: RHEL-09-232185
      levels:
          - medium
      title: RHEL 9 /var/log/messages file must be group-owned by root.
      rules:
          - file_groupowner_var_log_messages
      status: automated

    - id: RHEL-09-232190
      levels:
          - medium
      title: RHEL 9 system commands must be owned by root.
      rules:
          - file_ownership_binary_dirs
      status: automated

    - id: RHEL-09-232195
      levels:
          - medium
      title: RHEL 9 system commands must be group-owned by root or a system account.
      rules:
          - file_groupownership_system_commands_dirs
      status: automated

    - id: RHEL-09-232200
      levels:
          - medium
      title: RHEL 9 library files must be owned by root.
      rules:
          - file_ownership_library_dirs
      status: automated

    - id: RHEL-09-232205
      levels:
          - medium
      title: RHEL 9 library files must be group-owned by root or a system account.
      rules:
          - root_permissions_syslibrary_files
      status: automated

    - id: RHEL-09-232210
      levels:
          - medium
      title: RHEL 9 library directories must be owned by root.
      rules:
          - dir_ownership_library_dirs
      status: automated

    - id: RHEL-09-232215
      levels:
          - medium
      title: RHEL 9 library directories must be group-owned by root or a system account.
      rules:
          - dir_group_ownership_library_dirs
      status: automated

    - id: RHEL-09-232220
      levels:
          - medium
      title: RHEL 9 audit tools must be owned by root.
      rules:
          - file_audit_tools_ownership
      status: automated

    - id: RHEL-09-232225
      levels:
          - medium
      title: RHEL 9 audit tools must be group-owned by root.
      rules:
          - file_audit_tools_group_ownership
      status: automated

    - id: RHEL-09-232230
      levels:
          - medium
      title: RHEL 9 cron configuration files directory must be owned by root.
      rules:
          - file_owner_cron_d
          - file_owner_cron_daily
          - file_owner_cron_hourly
          - file_owner_cron_monthly
          - file_owner_cron_weekly
          - file_owner_crontab
          - file_owner_cron_deny
      status: automated

    - id: RHEL-09-232235
      levels:
          - medium
      title: RHEL 9 cron configuration files directory must be group-owned by root.
      rules:
          - file_groupowner_cron_d
          - file_groupowner_cron_daily
          - file_groupowner_cron_hourly
          - file_groupowner_cron_monthly
          - file_groupowner_cron_weekly
          - file_groupowner_crontab
          - file_groupowner_cron_deny
      status: automated

    - id: RHEL-09-232240
      levels:
          - medium
      title: All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application
          user.
      rules:
          - dir_perms_world_writable_root_owned
      status: automated

    - id: RHEL-09-232245
      levels:
          - medium
      title: A sticky bit must be set on all RHEL 9 public directories.
      rules:
          - dir_perms_world_writable_sticky_bits
      status: automated

    - id: RHEL-09-232250
      levels:
          - medium
      title: All RHEL 9 local files and directories must have a valid group owner.
      rules:
          - file_permissions_ungroupowned
      status: automated

    - id: RHEL-09-232255
      levels:
          - medium
      title: All RHEL 9 local files and directories must have a valid owner.
      rules:
          - no_files_unowned_by_user
      status: automated

    - id: RHEL-09-232260
      levels:
          - medium
      title: RHEL 9 must be configured so that all system device files are correctly labeled to prevent
          unauthorized modification.
      rules:
          - selinux_all_devicefiles_labeled
      status: automated

    - id: RHEL-09-232270
      levels:
          - medium
      title: RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.
      rules:
          - file_permissions_etc_shadow
      status: automated

    - id: RHEL-09-251010
      levels:
          - medium
      title: RHEL 9 must have the firewalld package installed.
      rules:
          - package_firewalld_installed
      status: automated

    - id: RHEL-09-251015
      levels:
          - medium
      title: The firewalld service on RHEL 9 must be active.
      rules:
          - service_firewalld_enabled
      status: automated

    - id: RHEL-09-251020
      levels:
          - medium
      title: A RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections
          to other systems.
      rules:
          - configured_firewalld_default_deny
      status: automated

    - id: RHEL-09-251030
      levels:
          - medium
      title: RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring
          rate-limiting measures on impacted network interfaces are implemented.
      rules:
          - firewalld-backend
      status: automated

    - id: RHEL-09-251035
      levels:
          - medium
      title: RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols,
          and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category
          Assignments List (CAL) and vulnerability assessments.
      rules:
          - firewalld_sshd_port_enabled
      status: automated

    - id: RHEL-09-251040
      levels:
          - medium
      title: RHEL 9 network interfaces must not be in promiscuous mode.
      rules:
          - network_sniffer_disabled
      status: automated

    - id: RHEL-09-251045
      levels:
          - medium
      title: RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler.
      rules:
          - sysctl_net_core_bpf_jit_harden
      status: automated

    - id: RHEL-09-252010
      levels:
          - medium
      title: RHEL 9 must have the chrony package installed.
      rules:
          - package_chrony_installed
      status: automated

    - id: RHEL-09-252015
      levels:
          - medium
      title: RHEL 9 chronyd service must be enabled.
      rules:
          - service_chronyd_enabled
      status: automated

    - id: RHEL-09-252020
      levels:
          - medium
      title: RHEL 9 must securely compare internal information system clocks at least every 24 hours.
      rules:
          - chronyd_or_ntpd_set_maxpoll
          - chronyd_server_directive
          - chronyd_specify_remote_server
          - var_multiple_time_servers=stig
          - var_time_service_set_maxpoll=18_hours
      status: automated

    - id: RHEL-09-252025
      levels:
          - low
      title: RHEL 9 must disable the chrony daemon from acting as a server.
      rules:
          - chronyd_client_only
      status: automated

    - id: RHEL-09-252030
      levels:
          - low
      title: RHEL 9 must disable network management of the chrony daemon.
      rules:
          - chronyd_no_chronyc_network
      status: automated

    - id: RHEL-09-252035
      levels:
          - medium
      title: RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers
          configured.
      rules:
          - network_configure_name_resolution
      status: automated

    - id: RHEL-09-252040
      levels:
          - medium
      title: RHEL 9 must configure a DNS processing mode set be Network Manager.
      rules:
          - networkmanager_dns_mode
          - var_networkmanager_dns_mode=explicit_default
      status: automated

    - id: RHEL-09-252045
      levels:
          - medium
      title: RHEL 9 must not have unauthorized IP tunnels configured.
      rules:
          - libreswan_approved_tunnels
      status: automated

    - id: RHEL-09-252050
      levels:
          - medium
      title: RHEL 9 must be configured to prevent unrestricted mail relaying.
      rules:
          - postfix_prevent_unrestricted_relay
      status: automated

    - id: RHEL-09-252060
      levels:
          - medium
      title: RHEL 9 must forward mail from postmaster to the root account using a postfix alias.
      rules:
          - postfix_client_configure_mail_alias_postmaster
      status: automated

    - id: RHEL-09-252065
      levels:
          - medium
      title: RHEL 9 libreswan package must be installed.
      rules:
          - package_libreswan_installed
      status: automated

    - id: RHEL-09-252070
      levels:
          - high
      title: There must be no shosts.equiv files on RHEL 9.
      rules:
          - no_host_based_files
      status: automated

    - id: RHEL-09-252075
      levels:
          - high
      title: There must be no .shosts files on RHEL 9.
      rules:
          - no_user_host_based_files
      status: automated

    - id: RHEL-09-253010
      levels:
          - medium
      title: RHEL 9 must be configured to use TCP syncookies.
      rules:
          - sysctl_net_ipv4_tcp_syncookies
      status: automated

    - id: RHEL-09-253015
      levels:
          - medium
      title: RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol
          (ICMP) redirect messages.
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
      status: automated

    - id: RHEL-09-253020
      levels:
          - medium
      title: RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
      status: automated

    - id: RHEL-09-253025
      levels:
          - medium
      title: RHEL 9 must log IPv4 packets with impossible addresses.
      rules:
          - sysctl_net_ipv4_conf_all_log_martians
      status: automated

    - id: RHEL-09-253030
      levels:
          - medium
      title: RHEL 9 must log IPv4 packets with impossible addresses by default.
      rules:
          - sysctl_net_ipv4_conf_default_log_martians
      status: automated

    - id: RHEL-09-253035
      levels:
          - medium
      title: RHEL 9 must use reverse path filtering on all IPv4 interfaces.
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
      status: automated

    - id: RHEL-09-253040
      levels:
          - medium
      title: RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from
          being accepted.
      rules:
          - sysctl_net_ipv4_conf_default_accept_redirects
      status: automated

    - id: RHEL-09-253045
      levels:
          - medium
      title: RHEL 9 must not forward IPv4 source-routed packets by default.
      rules:
          - sysctl_net_ipv4_conf_default_accept_source_route
      status: automated

    - id: RHEL-09-253050
      levels:
          - medium
      title: RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default.
      rules:
          - sysctl_net_ipv4_conf_default_rp_filter
      status: automated

    - id: RHEL-09-253055
      levels:
          - medium
      title: RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast
          address.
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
      status: automated

    - id: RHEL-09-253060
      levels:
          - medium
      title: RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response
          errors logs.
      rules:
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
      status: automated

    - id: RHEL-09-253065
      levels:
          - medium
      title: RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects.
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
      status: automated

    - id: RHEL-09-253070
      levels:
          - medium
      title: RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects
          by default.
      rules:
          - sysctl_net_ipv4_conf_default_send_redirects
      status: automated

    - id: RHEL-09-253075
      levels:
          - medium
      title: RHEL 9 must not enable IPv4 packet forwarding unless the system is a router.
      rules:
          - sysctl_net_ipv4_conf_all_forwarding
      status: automated

    - id: RHEL-09-254010
      levels:
          - medium
      title: RHEL 9 must not accept router advertisements on all IPv6 interfaces.
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
      status: automated

    - id: RHEL-09-254015
      levels:
          - medium
      title: RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
      rules:
          - sysctl_net_ipv6_conf_all_accept_redirects
      status: automated

    - id: RHEL-09-254020
      levels:
          - medium
      title: RHEL 9 must not forward IPv6 source-routed packets.
      rules:
          - sysctl_net_ipv6_conf_all_accept_source_route
      status: automated

    - id: RHEL-09-254025
      levels:
          - medium
      title: RHEL 9 must not enable IPv6 packet forwarding unless the system is a router.
      rules:
          - sysctl_net_ipv6_conf_all_forwarding
      status: automated

    - id: RHEL-09-254030
      levels:
          - medium
      title: RHEL 9 must not accept router advertisements on all IPv6 interfaces by default.
      rules:
          - sysctl_net_ipv6_conf_default_accept_ra
      status: automated

    - id: RHEL-09-254035
      levels:
          - medium
      title: RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from
          being accepted.
      rules:
          - sysctl_net_ipv6_conf_default_accept_redirects
      status: automated

    - id: RHEL-09-254040
      levels:
          - medium
      title: RHEL 9 must not forward IPv6 source-routed packets by default.
      rules:
          - sysctl_net_ipv6_conf_default_accept_source_route
      status: automated

    - id: RHEL-09-255010
      levels:
          - medium
      title: All RHEL 9 networked systems must have SSH installed.
      rules:
          - package_openssh-server_installed
      status: automated

    - id: RHEL-09-255015
      levels:
          - medium
      title: All RHEL 9 networked systems must have and implement SSH to protect the confidentiality
          and integrity of transmitted and received information, as well as information during preparation
          for transmission.
      rules:
          - service_sshd_enabled
      status: automated

    - id: RHEL-09-255020
      levels:
          - medium
      title: RHEL 9 must have the openssh-clients package installed.
      rules:
          - package_openssh-clients_installed
      status: automated

    - id: RHEL-09-255025
      levels:
          - medium
      title: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a SSH logon.
      rules:
          - sshd_enable_warning_banner
      status: automated

    - id: RHEL-09-255030
      levels:
          - medium
      title: RHEL 9 must log SSH connection attempts and failures to the server.
      rules:
          - sshd_set_loglevel_verbose
      status: automated

    - id: RHEL-09-255035
      levels:
          - medium
      title: RHEL 9 SSHD must accept public key authentication.
      rules:
          - sshd_enable_pubkey_auth
      status: automated

    - id: RHEL-09-255040
      levels:
          - high
      title: RHEL 9 SSHD must not allow blank passwords.
      rules:
          - sshd_disable_empty_passwords
      status: automated

    - id: RHEL-09-255045
      levels:
          - medium
      title: RHEL 9 must not permit direct logons to the root account using remote access via SSH.
      rules:
          - sshd_disable_root_login
      status: automated

    - id: RHEL-09-255050
      levels:
          - high
      title: RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
      rules:
          - sshd_enable_pam
      status: automated

    - id: RHEL-09-255055
      levels:
          - medium
      title: RHEL 9 SSH daemon must be configured to use system-wide crypto policies.
      rules:
          - file_sshd_50_redhat_exists
          - sshd_include_crypto_policy
      status: automated

    - id: RHEL-09-255060
      levels:
          - medium
      title: RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of
          SSH client connections.
      rules:
          - sshd_include_crypto_policy
      status: automated
    - id: RHEL-09-255064
      title: The RHEL 9 SSH client must be configured to use only DOD-approved encryption ciphers employing
          FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client
          connections.
      levels:
          - medium
      rules:
          - harden_sshd_ciphers_openssh_conf_crypto_policy
          - sshd_approved_ciphers=stig_rhel9
    - id: RHEL-09-255065
      levels:
          - medium
      title: RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of
          SSH server connections.
      rules:
          - harden_sshd_ciphers_opensshserver_conf_crypto_policy
          - sshd_approved_ciphers=stig_rhel9
      status: automated
    - id: RHEL-09-255070
      levels:
          - medium
      title: The RHEL 9 SSH client must be configured to use only DOD-approved Message Authentication
          Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality
          of SSH client connections.
      rules:
          - harden_sshd_macs_openssh_conf_crypto_policy
          - sshd_approved_macs=stig_rhel9

    - id: RHEL-09-255075
      levels:
          - medium
      title: RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing
          FIPS 140-3 validated cryptographic hash algorithms.
      status: automated
      rules:
          - harden_sshd_macs_opensshserver_conf_crypto_policy
          - sshd_approved_macs=stig_rhel9

    - id: RHEL-09-255080
      levels:
          - medium
      title: RHEL 9 must not allow a noncertificate trusted host SSH logon to the system.
      rules:
          - disable_host_auth
      status: automated

    - id: RHEL-09-255085
      levels:
          - medium
      title: RHEL 9 must not allow users to override SSH environment variables.
      rules:
          - sshd_do_not_permit_user_env
      status: automated

    - id: RHEL-09-255090
      levels:
          - medium
      title: RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
      rules:
          - sshd_rekey_limit
          - var_rekey_limit_size=1G
          - var_rekey_limit_time=1hour
      status: automated

    - id: RHEL-09-255095
      levels:
          - medium
      title: RHEL 9 must be configured so that all network connections associated with SSH traffic terminate
          after becoming unresponsive.
      rules:
          - sshd_set_keepalive
          - var_sshd_set_keepalive=1
      status: automated

    - id: RHEL-09-255100
      levels:
          - medium
      title: RHEL 9 must be configured so that all network connections associated with SSH traffic are
          terminated after 10 minutes of becoming unresponsive.
      rules:
          - sshd_set_idle_timeout
          - sshd_idle_timeout_value=10_minutes
      status: automated

    - id: RHEL-09-255105
      levels:
          - medium
      title: RHEL 9 SSH server configuration file must be group-owned by root.
      rules:
          - file_groupowner_sshd_config
          - directory_groupowner_sshd_config_d
          - file_groupowner_sshd_drop_in_config
      status: automated

    - id: RHEL-09-255110
      levels:
          - medium
      title: RHEL 9 SSH server configuration file must be owned by root.
      rules:
          - file_owner_sshd_config
          - directory_owner_sshd_config_d
          - file_owner_sshd_drop_in_config
      status: automated

    - id: RHEL-09-255115
      levels:
          - medium
      title: RHEL 9 SSH server configuration file must have mode 0600 or less permissive.
      rules:
          - file_permissions_sshd_config
          - directory_permissions_sshd_config_d
          - file_permissions_sshd_drop_in_config
      status: automated

    - id: RHEL-09-255120
      levels:
          - medium
      title: RHEL 9 SSH private host key files must have mode 0640 or less permissive.
      rules:
          - file_permissions_sshd_private_key
      status: automated

    - id: RHEL-09-255125
      levels:
          - medium
      title: RHEL 9 SSH public host key files must have mode 0644 or less permissive.
      rules:
          - file_permissions_sshd_pub_key
      status: automated

    - id: RHEL-09-255130
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow compression or must only allow compression after successful
          authentication.
      rules:
          - sshd_disable_compression
          - var_sshd_disable_compression=no
      status: automated

    - id: RHEL-09-255135
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow GSSAPI authentication.
      rules:
          - sshd_disable_gssapi_auth
      status: automated

    - id: RHEL-09-255140
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow Kerberos authentication.
      rules:
          - sshd_disable_kerb_auth
      status: automated

    - id: RHEL-09-255145
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow rhosts authentication.
      rules:
          - sshd_disable_rhosts
      status: automated

    - id: RHEL-09-255150
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow known hosts authentication.
      rules:
          - sshd_disable_user_known_hosts
      status: automated

    - id: RHEL-09-255155
      levels:
          - medium
      title: RHEL 9 SSH daemon must disable remote X connections for interactive users.
      rules:
          - sshd_disable_x11_forwarding
      status: automated

    - id: RHEL-09-255160
      levels:
          - medium
      title: RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files.
      rules:
          - sshd_enable_strictmodes
      status: automated

    - id: RHEL-09-255165
      levels:
          - medium
      title: RHEL 9 SSH daemon must display the date and time of the last successful account logon upon
          an SSH logon.
      rules:
          - sshd_print_last_log
      status: automated

    - id: RHEL-09-255175
      levels:
          - medium
      title: RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.
      rules:
          - sshd_x11_use_localhost
      status: automated

    - id: RHEL-09-271010
      levels:
          - medium
      title: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a graphical user logon.
      rules:
          - dconf_gnome_banner_enabled
      status: automated

    - id: RHEL-09-271015
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical
          user interface.
      rules:
          - dconf_gnome_banner_enabled
      status: automated

    - id: RHEL-09-271020
      levels:
          - medium
      title: RHEL 9 must disable the graphical user interface automount function unless required.
      rules:
          - dconf_gnome_disable_automount_open
      status: automated

    - id: RHEL-09-271025
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disabling of the graphical user interface
          automount function.
      rules:
          - dconf_gnome_disable_automount_open
      status: automated

    - id: RHEL-09-271030
      levels:
          - medium
      title: RHEL 9 must disable the graphical user interface autorun function unless required.
      rules:
          - dconf_gnome_disable_autorun
      status: automated

    - id: RHEL-09-271035
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disabling of the graphical user interface
          autorun function.
      rules:
          - dconf_gnome_disable_autorun
      status: automated

    - id: RHEL-09-271040
      levels:
          - high
      title: RHEL 9 must not allow unattended or automatic logon via the graphical user interface.
      rules:
          - gnome_gdm_disable_automatic_login
      status: automated

    - id: RHEL-09-271045
      levels:
          - medium
      title: RHEL 9 must be able to initiate directly a session lock for all connection types using smart
          card when the smart card is removed.
      rules:
          - dconf_gnome_lock_screen_on_smartcard_removal
      status: automated

    - id: RHEL-09-271050
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card
          removal action.
      rules:
          - dconf_gnome_lock_screen_on_smartcard_removal
      status: automated

    - id: RHEL-09-271055
      levels:
          - medium
      title: RHEL 9 must enable a user session lock until that user re-establishes access using established
          identification and authentication procedures for graphical user sessions.
      rules:
          - dconf_gnome_screensaver_lock_enabled
      status: automated

    - id: RHEL-09-271060
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the
          graphical user interface.
      rules:
          - dconf_gnome_screensaver_lock_enabled
      status: automated

    - id: RHEL-09-271065
      levels:
          - medium
      title: RHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity.
      rules:
          - dconf_gnome_screensaver_idle_delay
      status: automated

    - id: RHEL-09-271070
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical
          user interface.
      rules:
          - dconf_gnome_session_idle_user_locks
      status: automated

    - id: RHEL-09-271075
      levels:
          - medium
      title: RHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is
          activated.
      rules:
          - dconf_gnome_screensaver_lock_delay
      status: automated

    - id: RHEL-09-271080
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical
          user interface.
      rules:
          - dconf_gnome_screensaver_user_locks
      status: automated

    - id: RHEL-09-271085
      levels:
          - medium
      title: RHEL 9 must conceal, via the session lock, information previously visible on the display
          with a publicly viewable image.
      rules:
          - dconf_gnome_screensaver_mode_blank
      status: automated

    - id: RHEL-09-271090
      levels:
          - medium
      title: RHEL 9 effective dconf policy must match the policy keyfiles.
      rules:
          - dconf_db_up_to_date
      status: automated

    - id: RHEL-09-271095
      levels:
          - medium
      title: RHEL 9 must disable the ability of a user to restart the system from the login screen.
      rules:
          - dconf_gnome_disable_restart_shutdown
      status: automated

    - id: RHEL-09-271100
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical
          user interface.
      rules:
          - dconf_gnome_disable_restart_shutdown
      status: automated

    - id: RHEL-09-271105
      levels:
          - medium
      title: RHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a
          system to shut down or reboot.
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-09-271110
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical
          user interface.
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-09-271115
      levels:
          - medium
      title: RHEL 9 must disable the user list at logon for graphical user interfaces.
      rules:
          - dconf_gnome_disable_user_list
      status: automated

    - id: RHEL-09-291010
      levels:
          - medium
      title: RHEL 9 must be configured to disable USB mass storage.
      rules:
          - kernel_module_usb-storage_disabled
      status: automated

    - id: RHEL-09-291015
      levels:
          - medium
      title: RHEL 9 must have the USBGuard package installed.
      rules:
          - package_usbguard_installed
      status: automated

    - id: RHEL-09-291020
      levels:
          - medium
      title: RHEL 9 must have the USBGuard package enabled.
      rules:
          - service_usbguard_enabled
      status: automated

    - id: RHEL-09-291025
      levels:
          - low
      title: RHEL 9 must enable Linux audit logging for the USBGuard daemon.
      rules:
          - configure_usbguard_auditbackend
      status: automated

    - id: RHEL-09-291030
      levels:
          - medium
      title: RHEL 9 must block unauthorized peripherals before establishing a connection.
      rules:
          - usbguard_generate_policy
      status: automated

    - id: RHEL-09-291035
      levels:
          - medium
      title: RHEL 9 Bluetooth must be disabled.
      rules:
          - kernel_module_bluetooth_disabled
      status: automated

    - id: RHEL-09-291040
      levels:
          - medium
      title: RHEL 9 wireless network adapters must be disabled.
      rules:
          - wireless_disable_interfaces
      status: automated

    - id: RHEL-09-411010
      levels:
          - medium
      title: RHEL 9 user account passwords for new users or password changes must have a 60-day maximum
          password lifetime restriction in /etc/login.defs.
      rules:
          - accounts_maximum_age_login_defs
      status: automated

    - id: RHEL-09-411015
      levels:
          - medium
      title: RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.
      rules:
          - accounts_password_set_max_life_existing
          - var_accounts_maximum_age_login_defs=60
      status: automated

    - id: RHEL-09-411020
      levels:
          - medium
      title: All RHEL 9 local interactive user accounts must be assigned a home directory upon creation.
      rules:
          - accounts_have_homedir_login_defs
      status: automated

    - id: RHEL-09-411025
      levels:
          - medium
      title: RHEL 9 must set the umask value to 077 for all local interactive user accounts.
      rules:
          - accounts_umask_interactive_users
          - var_accounts_user_umask=077
      status: automated

    - id: RHEL-09-411030
      levels:
          - medium
      title: RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
      rules:
          - account_unique_id
      status: automated

    - id: RHEL-09-411035
      levels:
          - medium
      title: RHEL 9 system accounts must not have an interactive login shell.
      rules:
          - no_shelllogin_for_systemaccounts
      status: automated

    - id: RHEL-09-411040
      levels:
          - medium
      title: RHEL 9 must automatically expire temporary accounts within 72 hours.
      rules:
          - account_temp_expire_date
      status: automated

    - id: RHEL-09-411045
      levels:
          - medium
      title: All RHEL 9 interactive users must have a primary group that exists.
      rules:
          - gid_passwd_group_same
      status: automated

    - id: RHEL-09-411050
      levels:
          - medium
      title: RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after
          35 days of inactivity.
      rules:
          - account_disable_post_pw_expiration
          - var_account_disable_post_pw_expiration=35
      status: automated

    - id: RHEL-09-411055
      levels:
          - medium
      title: Executable search paths within the initialization files of all local interactive RHEL 9
          users must only contain paths that resolve to the system default or the users home directory.
      rules:
          - accounts_user_home_paths_only
      status: automated

    - id: RHEL-09-411060
      levels:
          - medium
      title: All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd
          file.
      rules:
          - accounts_user_interactive_home_directory_defined
      status: automated

    - id: RHEL-09-411065
      levels:
          - medium
      title: All RHEL 9 local interactive user home directories defined in the /etc/passwd file must
          exist.
      rules:
          - accounts_user_interactive_home_directory_exists
      status: automated

    - id: RHEL-09-411070
      levels:
          - medium
      title: All RHEL 9 local interactive user home directories must be group-owned by the home directory
          owner's primary group.
      rules:
          - file_groupownership_home_directories
      status: automated

    - id: RHEL-09-411075
      levels:
          - medium
      title: RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.
      rules:
          - accounts_passwords_pam_faillock_deny
          - var_accounts_passwords_pam_faillock_deny=3
      status: automated

    - id: RHEL-09-411080
      levels:
          - medium
      title: RHEL 9 must automatically lock the root account until the root account is released by an
          administrator when three unsuccessful logon attempts occur during a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_deny_root
      status: automated

    - id: RHEL-09-411085
      levels:
          - medium
      title: RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during
          a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_interval
          - var_accounts_passwords_pam_faillock_fail_interval=900
      status: automated

    - id: RHEL-09-411090
      levels:
          - medium
      title: RHEL 9 must maintain an account lock until the locked account is released by an administrator.
      rules:
          - accounts_passwords_pam_faillock_unlock_time
          - var_accounts_passwords_pam_faillock_unlock_time=never
      status: automated

    - id: RHEL-09-411095
      levels:
          - medium
      title: RHEL 9 must not have unauthorized accounts.
      rules:
          - accounts_authorized_local_users
          - var_accounts_authorized_local_users_regex=rhel9
      status: automated

    - id: RHEL-09-411100
      levels:
          - high
      title: The root account must be the only account having unrestricted access to RHEL 9 system.
      rules:
          - accounts_no_uid_except_zero
      status: automated

    - id: RHEL-09-411105
      levels:
          - medium
      title: RHEL 9 must ensure account lockouts persist.
      rules:
          - accounts_passwords_pam_faillock_dir
      status: automated

    - id: RHEL-09-411110
      levels:
          - medium
      title: RHEL 9 groups must have unique Group ID (GID).
      rules:
          - group_unique_id
      status: automated

    - id: RHEL-09-411115
      levels:
          - medium
      title: Local RHEL 9 initialization files must not execute world-writable programs.
      rules:
          - accounts_user_dot_no_world_writable_programs
      status: automated

    - id: RHEL-09-412035
      levels:
          - medium
      title: RHEL 9 must automatically exit interactive command shell user sessions after 15 minutes
          of inactivity.
      rules:
          - accounts_tmout
          - var_accounts_tmout=10_min
      status: automated

    - id: RHEL-09-412040
      levels:
          - low
      title: RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account
          types.
      rules:
          - accounts_max_concurrent_login_sessions
          - var_accounts_max_concurrent_login_sessions=10
      status: automated

    - id: RHEL-09-412045
      levels:
          - medium
      title: RHEL 9 must log username information when unsuccessful logon attempts occur.
      rules:
          - accounts_passwords_pam_faillock_audit
      status: automated

    - id: RHEL-09-412050
      levels:
          - medium
      title: RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed
          logon attempt.
      rules:
          - accounts_logon_fail_delay
          - var_accounts_fail_delay=4
      status: automated

    - id: RHEL-09-412055
      levels:
          - medium
      title: RHEL 9 must define default permissions for the bash shell.
      rules:
          - accounts_umask_etc_bashrc
      status: automated

    - id: RHEL-09-412060
      levels:
          - medium
      title: RHEL 9 must define default permissions for the c shell.
      rules:
          - accounts_umask_etc_csh_cshrc
      status: automated

    - id: RHEL-09-412065
      levels:
          - medium
      title: RHEL 9 must define default permissions for all authenticated users in such a way that the
          user can only read and modify their own files.
      rules:
          - accounts_umask_etc_login_defs
      status: automated

    - id: RHEL-09-412070
      levels:
          - medium
      title: RHEL 9 must define default permissions for the system default profile.
      rules:
          - accounts_umask_etc_profile
      status: automated

    - id: RHEL-09-412075
      levels:
          - low
      title: RHEL 9 must display the date and time of the last successful account logon upon logon.
      rules:
          - display_login_attempts
      status: automated

    - id: RHEL-09-412080
      levels:
          - medium
      title: RHEL 9 must terminate idle user sessions.
      rules:
          - logind_session_timeout
          - var_logind_session_timeout=15_minutes
      status: automated

    - id: RHEL-09-431010
      levels:
          - high
      title: RHEL 9 must use a Linux Security Module configured to enforce limits on system services.
      rules:
          - selinux_state
          - var_selinux_state=enforcing
      status: automated

    - id: RHEL-09-431015
      levels:
          - medium
      title: RHEL 9 must enable the SELinux targeted policy.
      rules:
          - selinux_policytype
          - var_selinux_policy_name=targeted
      status: automated

    - id: RHEL-09-431016
      title: 'RHEL 9 must elevate the SELinux context when an administrator calls the sudo command.'
      rules:
          - selinux_context_elevation_for_sudo
      status: automated

    - id: RHEL-09-431020
      levels:
          - medium
      title: RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally
          directory.
      rules:
          - account_password_selinux_faillock_dir
      status: automated

    - id: RHEL-09-431025
      levels:
          - medium
      title: RHEL 9 must have policycoreutils package installed.
      rules:
          - package_policycoreutils_installed
      status: automated

    - id: RHEL-09-431030
      levels:
          - medium
      title: RHEL 9 policycoreutils-python-utils package must be installed.
      rules:
          - package_policycoreutils-python-utils_installed
      status: automated

    - id: RHEL-09-432010
      levels:
          - medium
      title: RHEL 9 must have the sudo package installed.
      rules:
          - package_sudo_installed
      status: automated

    - id: RHEL-09-432015
      levels:
          - medium
      title: RHEL 9 must require reauthentication when using the "sudo" command.
      rules:
          - sudo_require_reauthentication
          - var_sudo_timestamp_timeout=always_prompt
      status: automated

    - id: RHEL-09-432020
      levels:
          - medium
      title: RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".
      rules:
          - sudoers_validate_passwd
      status: automated

    - id: RHEL-09-432025
      levels:
          - medium
      title: RHEL 9 must require users to reauthenticate for privilege escalation.
      rules:
          - sudo_remove_no_authenticate
      status: automated

    - id: RHEL-09-432030
      levels:
          - medium
      title: RHEL 9 must restrict privilege elevation to authorized personnel.
      rules:
          - sudo_restrict_privilege_elevation_to_authorized
      status: automated

    - id: RHEL-09-432035
      levels:
          - medium
      title: RHEL 9 must restrict the use of the "su" command.
      rules:
          - use_pam_wheel_for_su
      status: automated

    - id: RHEL-09-433010
      levels:
          - medium
      title: RHEL 9 fapolicy module must be installed.
      rules:
          - package_fapolicyd_installed
      status: automated

    - id: RHEL-09-433015
      levels:
          - medium
      title: RHEL 9 fapolicy module must be enabled.
      rules:
          - service_fapolicyd_enabled
      status: automated

    - id: RHEL-09-433016
      levels:
          - medium
      title: The RHEL 9 fapolicy module must be configured to employ a deny-all, permit-by-exception
          policy to allow the execution of authorized software programs.
      rules:
          - fapolicy_default_deny
      status: automated

    - id: RHEL-09-611010
      levels:
          - medium
      title: RHEL 9 must ensure the password complexity module in the system-auth file is configured
          for three retries or less.
      rules:
          - accounts_password_pam_pwquality_retry
          - var_password_pam_retry=3
      status: automated

    - id: RHEL-09-611025
      levels:
          - high
      title: RHEL 9 must not allow blank or null passwords.
      rules:
          - no_empty_passwords
      status: automated

    - id: RHEL-09-611030
      levels:
          - medium
      title: RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth
          file.
      rules:
          - account_password_pam_faillock_system_auth
      status: automated

    - id: RHEL-09-611035
      levels:
          - medium
      title: RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth
          file.
      rules:
          - account_password_pam_faillock_password_auth
      status: automated

    - id: RHEL-09-611040
      levels:
          - medium
      title: RHEL 9 must ensure the password complexity module is enabled in the password-auth file.
      rules:
          - accounts_password_pam_pwquality_password_auth
      status: automated

    - id: RHEL-09-611045
      levels:
          - medium
      title: RHEL 9 must ensure the password complexity module is enabled in the system-auth file.
      rules:
          - accounts_password_pam_pwquality_system_auth
      status: automated

    - id: RHEL-09-611050
      levels:
          - medium
      title: RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
      rules:
          - accounts_password_pam_unix_rounds_password_auth
          - var_password_pam_unix_rounds=100000
      status: automated

    - id: RHEL-09-611055
      levels:
          - medium
      title: RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
      rules:
          - accounts_password_pam_unix_rounds_system_auth
      status: automated

    - id: RHEL-09-611060
      levels:
          - medium
      title: RHEL 9 must enforce password complexity rules for the root account.
      rules:
          - accounts_password_pam_enforce_root
      status: automated

    - id: RHEL-09-611065
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one lowercase character
          be used.
      rules:
          - accounts_password_pam_lcredit
          - var_password_pam_lcredit=1
      status: automated

    - id: RHEL-09-611070
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one numeric character
          be used.
      rules:
          - accounts_password_pam_dcredit
          - var_password_pam_dcredit=1
      status: automated

    - id: RHEL-09-611075
      levels:
          - medium
      title: RHEL 9 passwords for new users or password changes must have a 24 hours minimum password
          lifetime restriction in /etc/login.defs.
      rules:
          - accounts_minimum_age_login_defs
      status: automated

    - id: RHEL-09-611080
      levels:
          - medium
      title: RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.
      rules:
          - accounts_password_set_min_life_existing
          - var_accounts_minimum_age_login_defs=1
      status: automated

    - id: RHEL-09-611085
      levels:
          - medium
      title: RHEL 9 must require users to provide a password for privilege escalation.
      rules:
          - sudo_remove_nopasswd
      status: automated

    - id: RHEL-09-611090
      levels:
          - medium
      title: RHEL 9 passwords must be created with a minimum of 15 characters.
      rules:
          - accounts_password_pam_minlen
          - var_password_pam_minlen=15
      status: automated

    - id: RHEL-09-611100
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one special character
          be used.
      rules:
          - accounts_password_pam_ocredit
          - var_password_pam_ocredit=1
      status: automated

    - id: RHEL-09-611105
      levels:
          - medium
      title: RHEL 9 must prevent the use of dictionary words for passwords.
      rules:
          - accounts_password_pam_dictcheck
          - var_password_pam_dictcheck=1
      status: automated

    - id: RHEL-09-611110
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one uppercase character
          be used.
      rules:
          - accounts_password_pam_ucredit
          - var_password_pam_ucredit=1
      status: automated

    - id: RHEL-09-611115
      levels:
          - medium
      title: RHEL 9 must require the change of at least eight characters when passwords are changed.
      rules:
          - accounts_password_pam_difok
          - var_password_pam_difok=8
      status: automated

    - id: RHEL-09-611120
      levels:
          - medium
      title: RHEL 9 must require the maximum number of repeating characters of the same character class
          be limited to four when passwords are changed.
      rules:
          - accounts_password_pam_maxclassrepeat
          - var_password_pam_maxclassrepeat=4
      status: automated

    - id: RHEL-09-611125
      levels:
          - medium
      title: RHEL 9 must require the maximum number of repeating characters be limited to three when
          passwords are changed.
      rules:
          - accounts_password_pam_maxrepeat
          - var_password_pam_maxrepeat=3
      status: automated

    - id: RHEL-09-611130
      levels:
          - medium
      title: RHEL 9 must require the change of at least four character classes when passwords are changed.
      rules:
          - accounts_password_pam_minclass
          - var_password_pam_minclass=4
      status: automated

    - id: RHEL-09-611135
      levels:
          - medium
      title: RHEL 9 must be configured so that user and group account administration utilities are configured
          to store only encrypted representations of passwords.
      rules:
          - set_password_hashing_algorithm_libuserconf
          - var_password_hashing_algorithm_pam=sha512
      status: automated

    - id: RHEL-09-611140
      levels:
          - medium
      title: RHEL 9 must be configured to use the shadow file to store only encrypted representations
          of passwords.
      rules:
          - set_password_hashing_algorithm_logindefs
          - var_password_hashing_algorithm=SHA512
      status: automated

    - id: RHEL-09-611145
      levels:
          - medium
      title: RHEL 9 must not be configured to bypass password requirements for privilege escalation.
      rules:
          - disallow_bypass_password_sudo
      status: automated

    - id: RHEL-09-611155
      levels:
          - medium
      title: RHEL 9 must not have accounts configured with blank or null passwords.
      rules:
          - no_empty_passwords_etc_shadow
      status: automated

    - id: RHEL-09-611160
      levels:
          - medium
      title: RHEL 9 must use the CAC smart card driver.
      rules:
          - configure_opensc_card_drivers
          - var_smartcard_drivers=cac
      status: automated

    - id: RHEL-09-611165
      levels:
          - medium
      title: RHEL 9 must enable certificate based smart card authentication.
      rules:
          - sssd_enable_smartcards
      status: automated

    - id: RHEL-09-611170
      levels:
          - medium
      title: RHEL 9 must implement certificate status checking for multifactor authentication.
      rules:
          - sssd_certificate_verification
          - var_sssd_certificate_verification_digest_function=sha512
      status: automated

    - id: RHEL-09-611175
      levels:
          - medium
      title: RHEL 9 must have the pcsc-lite package installed.
      rules:
          - package_pcsc-lite_installed
      status: automated

    - id: RHEL-09-611180
      levels:
          - medium
      title: The pcscd service on RHEL 9 must be active.
      rules:
          - service_pcscd_enabled
      status: automated

    - id: RHEL-09-611185
      levels:
          - medium
      title: RHEL 9 must have the opensc package installed.
      rules:
          - package_opensc_installed
      status: automated

    - id: RHEL-09-611190
      levels:
          - medium
      title: RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding
          private key.
      rules:
          - ssh_keys_passphrase_protected
      status: automated

    - id: RHEL-09-611195
      levels:
          - medium
      title: RHEL 9 must require authentication to access emergency mode.
      rules:
          - require_emergency_target_auth
      status: automated

    - id: RHEL-09-611200
      levels:
          - medium
      title: RHEL 9 must require authentication to access single-user mode.
      rules:
          - require_singleuser_auth
      status: automated

    - id: RHEL-09-631010
      levels:
          - medium
      title: RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification
          path (which includes status information) to an accepted trust anchor.
      rules:
          - sssd_has_trust_anchor
      status: automated

    - id: RHEL-09-631015
      levels:
          - medium
      title: RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
      rules:
          - sssd_enable_certmap
      status: automated

    - id: RHEL-09-631020
      levels:
          - medium
      title: RHEL 9 must prohibit the use of cached authenticators after one day.
      rules:
          - sssd_offline_cred_expiration
      status: automated

    - id: RHEL-09-651010
      levels:
          - medium
      title: RHEL 9 must have the AIDE package installed.
      rules:
          - package_aide_installed
          - aide_build_database
      status: automated

    - id: RHEL-09-651015
      levels:
          - medium
      title: RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify
          the system administrator when anomalies in the operation of any security functions are discovered.
      rules:
          - aide_scan_notification
      status: automated

    - id: RHEL-09-651020
      levels:
          - medium
      title: RHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic
          hashes for validating file contents and directories.
      rules:
          - aide_use_fips_hashes
      status: automated

    - id: RHEL-09-651025
      levels:
          - medium
      title: RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
      rules:
          - aide_check_audit_tools
      status: automated

    - id: RHEL-09-651030
      levels:
          - low
      title: RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists
          (ACLs).
      rules:
          - aide_verify_acls
      status: automated

    - id: RHEL-09-651035
      levels:
          - low
      title: RHEL 9 must be configured so that the file integrity tool verifies extended attributes.
      rules:
          - aide_verify_ext_attributes
      status: automated

    - id: RHEL-09-652010
      levels:
          - medium
      title: RHEL 9 must have the rsyslog package installed.
      rules:
          - package_rsyslog_installed
      status: automated

    - id: RHEL-09-652015
      levels:
          - medium
      title: RHEL 9 must have the packages required for encrypting offloaded audit logs installed.
      rules:
          - package_rsyslog-gnutls_installed
      status: automated

    - id: RHEL-09-652020
      levels:
          - medium
      title: The rsyslog service on RHEL 9 must be active.
      rules:
          - service_rsyslog_enabled
      status: automated

    - id: RHEL-09-652025
      levels:
          - medium
      title: RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other
          servers unless the server is being used for log aggregation.
      rules:
          - rsyslog_nolisten
      status: automated

    - id: RHEL-09-652030
      levels:
          - medium
      title: All RHEL 9 remote access methods must be monitored.
      rules:
          - rsyslog_remote_access_monitoring
      status: automated

    - id: RHEL-09-652040
      levels:
          - medium
      title: RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
      rules:
          - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
      status: automated

    - id: RHEL-09-652045
      levels:
          - medium
      title: RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media
          from the system being audited via rsyslog.
      rules:
          - rsyslog_encrypt_offload_actionsendstreamdrivermode
      status: automated

    - id: RHEL-09-652050
      levels:
          - medium
      title: RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different
          system or media from the system being audited via rsyslog.
      rules:
          - rsyslog_encrypt_offload_defaultnetstreamdriver
      status: automated

    - id: RHEL-09-652055
      levels:
          - medium
      title: RHEL 9 must be configured to forward audit records via TCP to a different system or media
          from the system being audited via rsyslog.
      rules:
          - rsyslog_remote_loghost
      status: automated

    - id: RHEL-09-652060
      levels:
          - medium
      title: RHEL 9 must use cron logging.
      rules:
          - rsyslog_cron_logging
      status: automated

    - id: RHEL-09-653010
      levels:
          - medium
      title: RHEL 9 audit package must be installed.
      rules:
          - package_audit_installed
      status: automated

    - id: RHEL-09-653015
      levels:
          - medium
      title: RHEL 9 audit service must be enabled.
      rules:
          - service_auditd_enabled
      status: automated

    - id: RHEL-09-653020
      levels:
          - medium
      title: RHEL 9 audit system must take appropriate action when an error writing to the audit storage
          volume occurs.
      rules:
          - auditd_data_disk_error_action_stig
          - var_auditd_disk_error_action=halt
      status: automated

    - id: RHEL-09-653025
      levels:
          - medium
      title: RHEL 9 audit system must take appropriate action when the audit storage volume is full.
      rules:
          - auditd_data_disk_full_action_stig
          - var_auditd_disk_full_action=halt
      status: automated

    - id: RHEL-09-653030
      levels:
          - medium
      title: RHEL 9 must allocate audit record storage capacity to store at least one week's worth of
          audit records.
      rules:
          - auditd_audispd_configure_sufficiently_large_partition
      status: automated

    - id: RHEL-09-653035
      levels:
          - medium
      title: RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of
          the repository maximum audit record storage capacity.
      rules:
          - auditd_data_retention_space_left_percentage
          - var_auditd_space_left_percentage=25pc
      status: automated

    - id: RHEL-09-653040
      levels:
          - medium
      title: RHEL 9 must notify the system administrator (SA) and information system security officer
          (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
      rules:
          - auditd_data_retention_space_left_action
          - var_auditd_space_left_action=email
      status: automated

    - id: RHEL-09-653045
      levels:
          - medium
      title: RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of
          the audit record storage capacity.
      rules:
          - auditd_data_retention_admin_space_left_percentage
          - var_auditd_admin_space_left_percentage=5pc
      status: automated

    - id: RHEL-09-653050
      levels:
          - medium
      title: RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of
          the repository maximum audit record storage capacity.
      rules:
          - auditd_data_retention_admin_space_left_action
          - var_auditd_admin_space_left_action=single
      status: automated

    - id: RHEL-09-653055
      levels:
          - medium
      title: RHEL 9 audit system must take appropriate action when the audit files have reached maximum
          size.
      rules:
          - auditd_data_retention_max_log_file_action_stig
          - var_auditd_max_log_file_action=rotate
      status: automated

    - id: RHEL-09-653060
      levels:
          - medium
      title: RHEL 9 must label all offloaded audit logs before sending them to the central log server.
      rules:
          - auditd_name_format
          - var_auditd_name_format=stig
      status: automated

    - id: RHEL-09-653065
      levels:
          - medium
      title: RHEL 9 must take appropriate action when the internal event queue is full.
      rules:
          - auditd_overflow_action
      status: automated

    - id: RHEL-09-653070
      levels:
          - medium
      title: RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a
          minimum) must be alerted of an audit processing failure event.
      rules:
          - auditd_data_retention_action_mail_acct
          - var_auditd_action_mail_acct=root
      status: automated

    - id: RHEL-09-653075
      levels:
          - medium
      title: RHEL 9 audit system must audit local events.
      rules:
          - auditd_local_events
      status: automated

    - id: RHEL-09-653080
      levels:
          - medium
      title: RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent
          unauthorized read access.
      rules:
          - directory_group_ownership_var_log_audit
      status: automated

    - id: RHEL-09-653085
      levels:
          - medium
      title: RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
      rules:
          - directory_ownership_var_log_audit
      status: automated

    - id: RHEL-09-653090
      levels:
          - medium
      title: RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access
          to the audit log.
      rules:
          - file_permissions_var_log_audit
      status: automated

    - id: RHEL-09-653095
      levels:
          - medium
      title: RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.
      rules:
          - auditd_freq
          - var_auditd_freq=100
      status: automated

    - id: RHEL-09-653100
      levels:
          - medium
      title: RHEL 9 must produce audit records containing information to establish the identity of any
          individual or process associated with the event.
      rules:
          - auditd_log_format
      status: automated

    - id: RHEL-09-653105
      levels:
          - medium
      title: RHEL 9 must write audit records to disk.
      rules:
          - auditd_write_logs
      status: automated

    - id: RHEL-09-653110
      levels:
          - medium
      title: RHEL 9 must allow only the information system security manager (ISSM) (or individuals or
          roles appointed by the ISSM) to select which auditable events are to be audited.
      rules:
          - file_permissions_audit_configuration
      status: automated

    - id: RHEL-09-653115
      levels:
          - medium
      title: RHEL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_etc_audit_auditd
      status: automated

    - id: RHEL-09-653120
      levels:
          - low
      title: RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that
          start prior to the audit daemon.
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192
      status: automated

    - id: RHEL-09-653125
      levels:
          - medium
      title: RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and
          system administrator (SA) (at a minimum) in the event of an audit processing failure.
      rules:
          - postfix_client_configure_mail_alias
      status: automated

    - id: RHEL-09-653130
      levels:
          - medium
      title: RHEL 9 audispd-plugins package must be installed.
      rules:
          - package_audispd-plugins_installed
      status: automated

    - id: RHEL-09-654010
      levels:
          - medium
      title: RHEL 9 must audit uses of the "execve" system call.
      rules:
          - audit_rules_suid_privilege_function
      status: automated

    - id: RHEL-09-654015
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
      rules:
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
      status: automated

    - id: RHEL-09-654020
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
      rules:
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_lchown
      status: automated

    - id: RHEL-09-654025
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr,
          and lremovexattr system calls.
      rules:
          - audit_rules_dac_modification_setxattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_lremovexattr
      status: automated

    - id: RHEL-09-654030
      levels:
          - medium
      title: RHEL 9 must audit all uses of umount system calls.
      rules:
          - audit_rules_privileged_commands_umount
      status: automated

    - id: RHEL-09-654035
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chacl command.
      rules:
          - audit_rules_execution_chacl
      status: automated

    - id: RHEL-09-654040
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setfacl command.
      rules:
          - audit_rules_execution_setfacl
      status: automated

    - id: RHEL-09-654045
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chcon command.
      rules:
          - audit_rules_execution_chcon
      status: automated

    - id: RHEL-09-654050
      levels:
          - medium
      title: RHEL 9 must audit all uses of the semanage command.
      rules:
          - audit_rules_execution_semanage
      status: automated

    - id: RHEL-09-654055
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setfiles command.
      rules:
          - audit_rules_execution_setfiles
      status: automated

    - id: RHEL-09-654060
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setsebool command.
      rules:
          - audit_rules_execution_setsebool
      status: automated

    - id: RHEL-09-654065
      levels:
          - medium
      title: RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_rmdir
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_unlinkat
      status: automated

    - id: RHEL-09-654070
      levels:
          - medium
      title: RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at
          system calls.
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_unsuccessful_file_modification_ftruncate
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_open_by_handle_at
      status: automated

    - id: RHEL-09-654075
      levels:
          - medium
      title: RHEL 9 must audit all uses of the delete_module system call.
      rules:
          - audit_rules_kernel_module_loading_delete
      status: automated

    - id: RHEL-09-654080
      levels:
          - medium
      title: RHEL 9 must audit all uses of the init_module and finit_module system calls.
      rules:
          - audit_rules_kernel_module_loading_finit
          - audit_rules_kernel_module_loading_init
      status: automated

    - id: RHEL-09-654085
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chage command.
      rules:
          - audit_rules_privileged_commands_chage
      status: automated

    - id: RHEL-09-654090
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chsh command.
      rules:
          - audit_rules_privileged_commands_chsh
      status: automated

    - id: RHEL-09-654095
      levels:
          - medium
      title: RHEL 9 must audit all uses of the crontab command.
      rules:
          - audit_rules_privileged_commands_crontab
      status: automated

    - id: RHEL-09-654100
      levels:
          - medium
      title: RHEL 9 must audit all uses of the gpasswd command.
      rules:
          - audit_rules_privileged_commands_gpasswd
      status: automated

    - id: RHEL-09-654105
      levels:
          - medium
      title: RHEL 9 must audit all uses of the kmod command.
      rules:
          - audit_rules_privileged_commands_kmod
      status: automated

    - id: RHEL-09-654110
      levels:
          - medium
      title: RHEL 9 must audit all uses of the newgrp command.
      rules:
          - audit_rules_privileged_commands_newgrp
      status: automated

    - id: RHEL-09-654115
      levels:
          - medium
      title: RHEL 9 must audit all uses of the pam_timestamp_check command.
      rules:
          - audit_rules_privileged_commands_pam_timestamp_check
      status: automated

    - id: RHEL-09-654120
      levels:
          - medium
      title: RHEL 9 must audit all uses of the passwd command.
      rules:
          - audit_rules_privileged_commands_passwd
      status: automated

    - id: RHEL-09-654125
      levels:
          - medium
      title: RHEL 9 must audit all uses of the postdrop command.
      rules:
          - audit_rules_privileged_commands_postdrop
      status: automated

    - id: RHEL-09-654130
      levels:
          - medium
      title: RHEL 9 must audit all uses of the postqueue command.
      rules:
          - audit_rules_privileged_commands_postqueue
      status: automated

    - id: RHEL-09-654135
      levels:
          - medium
      title: RHEL 9 must audit all uses of the ssh-agent command.
      rules:
          - audit_rules_privileged_commands_ssh_agent
      status: automated

    - id: RHEL-09-654140
      levels:
          - medium
      title: RHEL 9 must audit all uses of the ssh-keysign command.
      rules:
          - audit_rules_privileged_commands_ssh_keysign
      status: automated

    - id: RHEL-09-654145
      levels:
          - medium
      title: RHEL 9 must audit all uses of the su command.
      rules:
          - audit_rules_privileged_commands_su
      status: automated

    - id: RHEL-09-654150
      levels:
          - medium
      title: RHEL 9 must audit all uses of the sudo command.
      rules:
          - audit_rules_privileged_commands_sudo
      status: automated

    - id: RHEL-09-654155
      levels:
          - medium
      title: RHEL 9 must audit all uses of the sudoedit command.
      rules:
          - audit_rules_privileged_commands_sudoedit
      status: automated

    - id: RHEL-09-654160
      levels:
          - medium
      title: RHEL 9 must audit all uses of the unix_chkpwd command.
      rules:
          - audit_rules_privileged_commands_unix_chkpwd
      status: automated

    - id: RHEL-09-654165
      levels:
          - medium
      title: RHEL 9 must audit all uses of the unix_update command.
      rules:
          - audit_rules_privileged_commands_unix_update
      status: automated

    - id: RHEL-09-654170
      levels:
          - medium
      title: RHEL 9 must audit all uses of the userhelper command.
      rules:
          - audit_rules_privileged_commands_userhelper
      status: automated

    - id: RHEL-09-654175
      levels:
          - medium
      title: RHEL 9 must audit all uses of the usermod command.
      rules:
          - audit_rules_privileged_commands_usermod
      status: automated

    - id: RHEL-09-654180
      levels:
          - medium
      title: RHEL 9 must audit all uses of the mount command.
      rules:
          - audit_rules_privileged_commands_mount
      status: automated

    - id: RHEL-09-654185
      levels:
          - medium
      title: Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_init
      status: automated

    - id: RHEL-09-654190
      levels:
          - medium
      title: Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_poweroff
      status: automated

    - id: RHEL-09-654195
      levels:
          - medium
      title: Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_reboot
      status: automated

    - id: RHEL-09-654200
      levels:
          - medium
      title: Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_shutdown
      status: automated

    - id: RHEL-09-654205
      levels:
          - medium
      title: Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit
          record.
      rules:
          - audit_rules_dac_modification_umount
      status: automated

    - id: RHEL-09-654210
      levels:
          - medium
      title: Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit
          record.
      rules:
          - audit_rules_dac_modification_umount2
      status: automated

    - id: RHEL-09-654215
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/sudoers.
      rules:
          - audit_rules_sudoers
      status: automated

    - id: RHEL-09-654220
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/sudoers.d/ directory.
      rules:
          - audit_rules_sudoers_d
      status: automated

    - id: RHEL-09-654225
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/group.
      rules:
          - audit_rules_usergroup_modification_group
      status: automated

    - id: RHEL-09-654230
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/gshadow.
      rules:
          - audit_rules_usergroup_modification_gshadow
      status: automated

    - id: RHEL-09-654235
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/opasswd.
      rules:
          - audit_rules_usergroup_modification_opasswd
      status: automated

    - id: RHEL-09-654240
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/passwd.
      rules:
          - audit_rules_usergroup_modification_passwd
      status: automated

    - id: RHEL-09-654245
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/shadow.
      rules:
          - audit_rules_usergroup_modification_shadow
      status: automated

    - id: RHEL-09-654250
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /var/log/faillock.
      rules:
          - audit_rules_login_events_faillock
      status: automated

    - id: RHEL-09-654255
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /var/log/lastlog.
      rules:
          - audit_rules_login_events_lastlog
      status: automated

    - id: RHEL-09-654265
      levels:
          - medium
      title: RHEL 9 must take appropriate action when a critical audit processing failure occurs.
      rules:
          - audit_rules_system_shutdown
      status: automated

    - id: RHEL-09-654270
      levels:
          - medium
      title: RHEL 9 audit system must protect logon UIDs from unauthorized change.
      rules:
          - audit_rules_immutable_login_uids
      status: automated

    - id: RHEL-09-654275
      levels:
          - medium
      title: RHEL 9 audit system must protect auditing rules from unauthorized change.
      rules:
          - audit_rules_immutable
      status: automated

    - id: RHEL-09-671010
      levels:
          - high
      title: RHEL 9 must enable FIPS mode.
      rules:
          - enable_fips_mode
          - sysctl_crypto_fips_enabled
          - var_system_crypto_policy=fips_stig
          - enable_dracut_fips_module
      status: automated

    - id: RHEL-09-671015
      levels:
          - medium
      title: RHEL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.
      rules:
          - accounts_password_all_shadowed_sha512
      status: automated

    - id: RHEL-09-671020
      levels:
          - medium
      title: RHEL 9 IP tunnels must use FIPS 140-2/140-3 approved cryptographic algorithms.
      rules:
          - configure_libreswan_crypto_policy
      status: automated

    - id: RHEL-09-671025
      levels:
          - medium
      title: RHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3
          approved cryptographic hashing algorithm for system authentication.
      rules:
          - set_password_hashing_algorithm_passwordauth
      status: automated

    - id: RHEL-09-672015
      levels:
          - high
      title: RHEL 9 crypto policy files must match files shipped with the operating system.
      status: pending

    - id: RHEL-09-672020
      levels:
          - medium
      title: RHEL 9 crypto policy must not be overridden.
      notes: Rules for this control are intentionally not implemented. Checking whether files under /etc/crypto-policies/back-ends/
          are symlinks is not an appropriate way to verify the consistency of the system's cryptographic settings.
          The suggested fix mentioned in the STIG does not fully satisfy its own requirements, as it also symlinks the nss.config file.
          Furthermore, running sudo 'update-crypto-policies --set FIPS' is not a reliable way to ensure FIPS compliance. Customers should
          refer to the official Red Hat Documentation and use the 'fips=1' kernel option during system installation to ensure the system is
          in FIPS mode.
          More information can be found at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening
      status: pending

    - id: RHEL-09-672025
      levels:
          - medium
      title: RHEL 9 must use mechanisms meeting the requirements of applicable federal laws, executive
          orders, directives, policies, regulations, standards, and guidance for authentication to a
          cryptographic module.
      rules:
          - configure_kerberos_crypto_policy
      status: automated

    - id: RHEL-09-672030
      levels:
          - high
      title: RHEL 9 must implement DOD-approved TLS encryption in the GnuTLS package.
      rules:
          - configure_crypto_policy
      status: automated

    - id: RHEL-09-672050
      levels:
          - medium
      title: RHEL 9 must implement DOD-approved encryption in the bind package.
      rules:
          - configure_bind_crypto_policy
      status: automated
