stig_rhel9.yml

---
policy: 'Red Hat Enterprise Linux 9 Security Technical Implementation Guide'
title: 'Red Hat Enterprise Linux 9 Security Technical Implementation Guide'
id: stig_rhel9
source: https://www.cyber.mil/stigs/downloads/
version: V2R4
reference_type: stigid
product: rhel9

levels:
    - id: high
    - id: medium
    - id: low

controls:
    - id: needed_rules
      levels:
          - medium
      rules:
          - enable_authselect
          - var_authselect_profile=sssd

    - id: RHEL-09-171011
      levels:
          - medium
      rules:
          - dconf_gnome_login_banner_text
    - id: RHEL-09-211010
      levels:
          - high
      title: RHEL 9 must be a vendor-supported release.
      rules:
          - installed_OS_is_vendor_supported
      status: automated

    - id: RHEL-09-211015
      levels:
          - medium
      title: RHEL 9 vendor packaged system security patches and updates must be installed and up to date.
      rules:
          - security_patches_up_to_date
      status: automated

    - id: RHEL-09-211020
      levels:
          - medium
      title: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a command line user logon.
      rules:
          - banner_etc_issue
          - login_banner_text=dod_banners
      status: automated

    - id: RHEL-09-211030
      levels:
          - medium
      title: The graphical display manager must not be the default target on RHEL 9 unless approved.
      rules:
          - xwindows_runlevel_target
      status: automated

    - id: RHEL-09-211035
      levels:
          - low
      title: RHEL 9 must enable the hardware random number generator entropy gatherer service.
      related_rules:
          - service_rngd_enabled  # This rule is causing test failures, See https://github.com/ComplianceAsCode/content/pull/10153
      status: pending

    - id: RHEL-09-211040
      levels:
          - medium
      title: RHEL 9 systemd-journald service must be enabled.
      rules:
          - service_systemd-journald_enabled
      status: automated

    - id: RHEL-09-211045
      levels:
          - high
      title: The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
      rules:
          - disable_ctrlaltdel_burstaction
      status: automated

    - id: RHEL-09-211050
      levels:
          - high
      title: The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
      rules:
          - disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-09-211055
      levels:
          - medium
      title: RHEL 9 debug-shell systemd service must be disabled.
      status: automated
      rules:
          - service_debug-shell_disabled

    - id: RHEL-09-212010
      levels:
          - medium
      title: RHEL 9 must require a boot loader superuser password.
      rules:
          - grub2_password
      status: automated

    - id: RHEL-09-212015
      levels:
          - medium
      title: RHEL 9 must disable the ability of systemd to spawn an interactive boot process.
      rules:
          - grub2_disable_interactive_boot
      status: automated

    - id: RHEL-09-212020
      levels:
          - high
      title: RHEL 9 must require a unique superusers name upon booting into single-user and maintenance
          modes.
      rules:
          - grub2_admin_username
      status: automated

    - id: RHEL-09-212025
      levels:
          - medium
      title: RHEL 9 /boot/grub2/grub.cfg file must be group-owned by root.
      rules:
          - file_groupowner_grub2_cfg
      status: automated

    - id: RHEL-09-212030
      levels:
          - medium
      title: RHEL 9 /boot/grub2/grub.cfg file must be owned by root.
      rules:
          - file_owner_grub2_cfg
      status: automated

    - id: RHEL-09-212035
      levels:
          - medium
      title: RHEL 9 must disable virtual system calls.
      rules:
          - grub2_vsyscall_argument
      status: automated

    - id: RHEL-09-212040
      levels:
          - medium
      title: RHEL 9 must clear the page allocator to prevent use-after-free attacks.
      rules:
          - grub2_page_poison_argument
      status: automated

    - id: RHEL-09-212045
      levels:
          - medium
      title: RHEL 9 must clear SLUB/SLAB objects to prevent use-after-free attacks.
      rules:
          - grub2_init_on_free
      status: automated

    - id: RHEL-09-212050
      levels:
          - low
      title: RHEL 9 must enable mitigations against processor-based vulnerabilities.
      rules:
          - grub2_pti_argument
      status: automated

    - id: RHEL-09-212055
      levels:
          - low
      title: RHEL 9 must enable auditing of processes that start prior to the audit daemon.
      rules:
          - grub2_audit_argument
      status: automated

    - id: RHEL-09-213010
      levels:
          - medium
      title: RHEL 9 must restrict access to the kernel message buffer.
      rules:
          - sysctl_kernel_dmesg_restrict
      status: automated

    - id: RHEL-09-213015
      levels:
          - medium
      title: RHEL 9 must prevent kernel profiling by nonprivileged users.
      rules:
          - sysctl_kernel_perf_event_paranoid
      status: automated

    - id: RHEL-09-213020
      levels:
          - medium
      title: RHEL 9 must prevent the loading of a new kernel for later execution.
      rules:
          - sysctl_kernel_kexec_load_disabled
      status: automated

    - id: RHEL-09-213025
      levels:
          - medium
      title: RHEL 9 must restrict exposed kernel pointer addresses access.
      rules:
          - sysctl_kernel_kptr_restrict
      status: automated

    - id: RHEL-09-213030
      levels:
          - medium
      title: RHEL 9 must enable kernel parameters to enforce discretionary access control on hardlinks.
      rules:
          - sysctl_fs_protected_hardlinks
      status: automated

    - id: RHEL-09-213035
      levels:
          - medium
      title: RHEL 9 must enable kernel parameters to enforce discretionary access control on symlinks.
      rules:
          - sysctl_fs_protected_symlinks
      status: automated

    - id: RHEL-09-213040
      levels:
          - medium
      title: RHEL 9 must disable the kernel.core_pattern.
      rules:
          - sysctl_kernel_core_pattern
      status: automated

    - id: RHEL-09-213045
      levels:
          - medium
      title: RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.
      rules:
          - kernel_module_atm_disabled
      status: automated

    - id: RHEL-09-213050
      levels:
          - medium
      title: RHEL 9 must be configured to disable the Controller Area Network kernel module.
      rules:
          - kernel_module_can_disabled
      status: automated

    - id: RHEL-09-213055
      levels:
          - medium
      title: RHEL 9 must be configured to disable the FireWire kernel module.
      rules:
          - kernel_module_firewire-core_disabled
      status: automated

    - id: RHEL-09-213060
      levels:
          - medium
      title: RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
      rules:
          - kernel_module_sctp_disabled
      status: automated

    - id: RHEL-09-213065
      levels:
          - medium
      title: RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
      rules:
          - kernel_module_tipc_disabled
      status: automated

    - id: RHEL-09-213070
      levels:
          - medium
      title: RHEL 9 must implement address space layout randomization (ASLR) to protect its memory from
          unauthorized code execution.
      rules:
          - sysctl_kernel_randomize_va_space
      status: automated

    - id: RHEL-09-213075
      levels:
          - medium
      title: RHEL 9 must disable access to network bpf system call from nonprivileged processes.
      rules:
          - sysctl_kernel_unprivileged_bpf_disabled
      status: automated

    - id: RHEL-09-213080
      levels:
          - medium
      title: RHEL 9 must restrict usage of ptrace to descendant processes.
      rules:
          - sysctl_kernel_yama_ptrace_scope
      status: automated

    - id: RHEL-09-213085
      levels:
          - medium
      title: RHEL 9 must disable core dump backtraces.
      rules:
          - coredump_disable_backtraces
      status: automated

    - id: RHEL-09-213090
      levels:
          - medium
      title: RHEL 9 must disable storing core dumps.
      rules:
          - coredump_disable_storage
      status: automated

    - id: RHEL-09-213095
      levels:
          - medium
      title: RHEL 9 must disable core dumps for all users.
      rules:
          - disable_users_coredumps
      status: automated

    - id: RHEL-09-213100
      levels:
          - medium
      title: RHEL 9 must disable acquiring, saving, and processing core dumps.
      rules:
          - service_systemd-coredump_disabled
      status: automated

    - id: RHEL-09-213105
      levels:
          - medium
      title: RHEL 9 must disable the use of user namespaces.
      rules:
          - sysctl_user_max_user_namespaces_no_remediation
      status: automated

    - id: RHEL-09-213110
      levels:
          - medium
      title: RHEL 9 must implement nonexecutable data to protect its memory from unauthorized code execution.
      rules:
          - sysctl_kernel_exec_shield
      status: automated

    - id: RHEL-09-213115
      levels:
          - medium
      title: The kdump service on RHEL 9 must be disabled.
      rules:
          - service_kdump_disabled
      status: automated

    - id: RHEL-09-214010
      levels:
          - medium
      title: RHEL 9 must ensure cryptographic verification of vendor software packages.
      rules:
          - ensure_redhat_gpgkey_installed
      status: automated

    - id: RHEL-09-214015
      levels:
          - high
      title: RHEL 9 must check the GPG signature of software packages originating from external software
          repositories before installation.
      rules:
          - ensure_gpgcheck_globally_activated
      status: automated

    - id: RHEL-09-214020
      levels:
          - high
      title: RHEL 9 must check the GPG signature of locally installed software packages before installation.
      rules:
          - ensure_gpgcheck_local_packages
      status: automated

    - id: RHEL-09-214025
      levels:
          - high
      title: RHEL 9 must have GPG signature verification enabled for all software repositories.
      rules:
          - ensure_gpgcheck_never_disabled
      status: automated

    - id: RHEL-09-214030
      levels:
          - medium
      title: RHEL 9 must be configured so that the cryptographic hashes of system files match vendor
          values.
      related_rules:
          - rpm_verify_hashes  # Due to crypto policies this cannot be selected at this time
      status: pending

    - id: RHEL-09-214035
      levels:
          - low
      title: RHEL 9 must remove all software components after updated versions have been installed.
      rules:
          - clean_components_post_updating
      status: automated

    - id: RHEL-09-215010
      levels:
          - medium
      title: RHEL 9 subscription-manager package must be installed.
      rules:
          - package_subscription-manager_installed
      status: automated

    - id: RHEL-09-215015
      levels:
          - high
      title: RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
      rules:
          - package_vsftpd_removed
      status: automated

    - id: RHEL-09-215020
      levels:
          - medium
      title: RHEL 9 must not have the sendmail package installed.
      rules:
          - package_sendmail_removed
      status: automated

    - id: RHEL-09-215025
      levels:
          - medium
      title: RHEL 9 must not have the nfs-utils package installed.
      rules:
          - package_nfs-utils_removed
      status: automated

    - id: RHEL-09-215030
      levels:
          - medium
      title: RHEL 9 must not have the ypserv package installed.
      related_rules:
          - package_ypserv_removed
      status: not applicable  # The ypserv package is not available in RHEL 9

    - id: RHEL-09-215035
      levels:
          - medium
      title: RHEL 9 must not have the rsh-server package installed.
      related_rules:
          - package_rsh-server_removed
      status: not applicable  # The rsh-server package is not available in RHEL 9

    - id: RHEL-09-215040
      levels:
          - medium
      title: RHEL 9 must not have the telnet-server package installed.
      rules:
          - package_telnet-server_removed
      status: automated

    - id: RHEL-09-215045
      levels:
          - medium
      title: RHEL 9 must not have the gssproxy package installed.
      rules:
          - package_gssproxy_removed
      status: automated

    - id: RHEL-09-215050
      levels:
          - medium
      title: RHEL 9 must not have the iprutils package installed.
      rules:
          - package_iprutils_removed
      status: automated

    - id: RHEL-09-215055
      levels:
          - medium
      title: RHEL 9 must not have the tuned package installed.
      rules:
          - package_tuned_removed
      status: automated

    - id: RHEL-09-215060
      levels:
          - high
      title: RHEL 9 must not have a Trivial File Transfer Protocol (TFTP) server package installed.
      rules:
          - package_tftp-server_removed
      status: automated

    - id: RHEL-09-215065
      levels:
          - medium
      title: RHEL 9 must not have the quagga package installed.
      related_rules:
          - package_quagga_removed
      status: not applicable  # The quagga package is not available in RHEL 9

    - id: RHEL-09-215070
      levels:
          - medium
      title: A graphical display manager must not be installed on RHEL 9 unless approved.
      rules:
          - xwindows_remove_packages
      status: automated

    - id: RHEL-09-215075
      levels:
          - medium
      title: RHEL 9 must have the openssl-pkcs11 package installed.
      rules:
          - install_smartcard_packages
      status: automated

    - id: RHEL-09-215080
      levels:
          - medium
      title: RHEL 9 must have the gnutls-utils package installed.
      rules:
          - package_gnutls-utils_installed
      status: automated

    - id: RHEL-09-215085
      levels:
          - medium
      title: RHEL 9 must have the nss-tools package installed.
      rules:
          - package_nss-tools_installed
      status: automated

    - id: RHEL-09-215090
      levels:
          - medium
      title: RHEL 9 must have the rng-tools package installed.
      rules:
          - package_rng-tools_installed
      status: automated

    - id: RHEL-09-215095
      levels:
          - medium
      title: RHEL 9 must have the s-nail package installed.
      rules:
          - package_s-nail_installed
      status: automated

    - id: RHEL-09-215100
      levels:
          - medium
      title: RHEL 9 must have the crypto-policies package installed.
      rules:
          - package_crypto-policies_installed
      status: automated

    - id: RHEL-09-215101
      levels:
          - medium
      title: RHEL 9 must have the Postfix package installed.
      status: automated
      rules:
          - package_postfix_installed

    - id: RHEL-09-215105
      levels:
          - medium
      title: RHEL 9 must implement a FIPS 140-3 compliant systemwide cryptographic policy.
      rules:
          - configure_crypto_policy
          - fips_crypto_subpolicy
          - fips_custom_stig_sub_policy
      status: automated

    - id: RHEL-09-231010
      levels:
          - medium
      title: A separate RHEL 9 file system must be used for user home directories (such as /home or an
          equivalent).
      rules:
          - partition_for_home
      status: automated

    - id: RHEL-09-231015
      levels:
          - medium
      title: RHEL 9 must use a separate file system for /tmp.
      rules:
          - partition_for_tmp
      status: automated

    - id: RHEL-09-231020
      levels:
          - low
      title: RHEL 9 must use a separate file system for /var.
      rules:
          - partition_for_var
      status: automated

    - id: RHEL-09-231025
      levels:
          - low
      title: RHEL 9 must use a separate file system for /var/log.
      rules:
          - partition_for_var_log
      status: automated

    - id: RHEL-09-231030
      levels:
          - low
      title: RHEL 9 must use a separate file system for the system audit data path.
      rules:
          - partition_for_var_log_audit
      status: automated

    - id: RHEL-09-231035
      levels:
          - medium
      title: RHEL 9 must use a separate file system for /var/tmp.
      rules:
          - partition_for_var_tmp
      status: automated

    - id: RHEL-09-231040
      levels:
          - medium
      title: RHEL 9 file system automount function must be disabled unless required.
      rules:
          - service_autofs_disabled
      status: automated

    - id: RHEL-09-231045
      levels:
          - medium
      title: RHEL 9 must prevent device files from being interpreted on file systems that contain user
          home directories.
      rules:
          - mount_option_home_nodev
      status: automated

    - id: RHEL-09-231050
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file
          systems that contain user home directories.
      rules:
          - mount_option_home_nosuid
      status: automated

    - id: RHEL-09-231055
      levels:
          - medium
      title: RHEL 9 must prevent code from being executed on file systems that contain user home directories.
      rules:
          - mount_option_home_noexec
      status: automated

    - id: RHEL-09-231065
      levels:
          - medium
      title: RHEL 9 must prevent special devices on file systems that are imported via Network File System
          (NFS).
      rules:
          - mount_option_nodev_remote_filesystems
      status: automated

    - id: RHEL-09-231070
      levels:
          - medium
      title: RHEL 9  must prevent code from being executed on file systems that are imported via Network
          File System (NFS).
      rules:
          - mount_option_noexec_remote_filesystems
      status: automated

    - id: RHEL-09-231075
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file
          systems that are imported via Network File System (NFS).
      rules:
          - mount_option_nosuid_remote_filesystems
      status: automated

    - id: RHEL-09-231080
      levels:
          - medium
      title: RHEL 9 must prevent code from being executed on file systems that are used with removable
          media.
      rules:
          - mount_option_noexec_removable_partitions
      status: automated

    - id: RHEL-09-231085
      levels:
          - medium
      title: RHEL 9 must prevent special devices on file systems that are used with removable media.
      rules:
          - mount_option_nodev_removable_partitions
      status: automated

    - id: RHEL-09-231090
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file
          systems that are used with removable media.
      rules:
          - mount_option_nosuid_removable_partitions
      status: automated

    - id: RHEL-09-231095
      levels:
          - medium
      title: RHEL 9 must mount /boot with the nodev option.
      rules:
          - mount_option_boot_nodev
      status: automated

    - id: RHEL-09-231100
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the
          /boot directory.
      rules:
          - mount_option_boot_nosuid
      status: automated

    - id: RHEL-09-231105
      levels:
          - medium
      title: RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the
          /boot/efi directory.
      rules:
          - mount_option_boot_efi_nosuid
      status: automated

    - id: RHEL-09-231110
      levels:
          - medium
      title: RHEL 9 must mount /dev/shm with the nodev option.
      rules:
          - mount_option_dev_shm_nodev
      status: automated

    - id: RHEL-09-231115
      levels:
          - medium
      title: RHEL 9 must mount /dev/shm with the noexec option.
      rules:
          - mount_option_dev_shm_noexec
      status: automated

    - id: RHEL-09-231120
      levels:
          - medium
      title: RHEL 9 must mount /dev/shm with the nosuid option.
      rules:
          - mount_option_dev_shm_nosuid
      status: automated

    - id: RHEL-09-231125
      levels:
          - medium
      title: RHEL 9 must mount /tmp with the nodev option.
      rules:
          - mount_option_tmp_nodev
      status: automated

    - id: RHEL-09-231130
      levels:
          - medium
      title: RHEL 9 must mount /tmp with the noexec option.
      rules:
          - mount_option_tmp_noexec
      status: automated

    - id: RHEL-09-231135
      levels:
          - medium
      title: RHEL 9 must mount /tmp with the nosuid option.
      rules:
          - mount_option_tmp_nosuid
      status: automated

    - id: RHEL-09-231140
      levels:
          - medium
      title: RHEL 9 must mount /var with the nodev option.
      rules:
          - mount_option_var_nodev
      status: automated

    - id: RHEL-09-231145
      levels:
          - medium
      title: RHEL 9 must mount /var/log with the nodev option.
      rules:
          - mount_option_var_log_nodev
      status: automated

    - id: RHEL-09-231150
      levels:
          - medium
      title: RHEL 9 must mount /var/log with the noexec option.
      rules:
          - mount_option_var_log_noexec
      status: automated

    - id: RHEL-09-231155
      levels:
          - medium
      title: RHEL 9 must mount /var/log with the nosuid option.
      rules:
          - mount_option_var_log_nosuid
      status: automated

    - id: RHEL-09-231160
      levels:
          - medium
      title: RHEL 9 must mount /var/log/audit with the nodev option.
      rules:
          - mount_option_var_log_audit_nodev
      status: automated

    - id: RHEL-09-231165
      levels:
          - medium
      title: RHEL 9 must mount /var/log/audit with the noexec option.
      rules:
          - mount_option_var_log_audit_noexec
      status: automated

    - id: RHEL-09-231170
      levels:
          - medium
      title: RHEL 9 must mount /var/log/audit with the nosuid option.
      rules:
          - mount_option_var_log_audit_nosuid
      status: automated

    - id: RHEL-09-231175
      levels:
          - medium
      title: RHEL 9 must mount /var/tmp with the nodev option.
      rules:
          - mount_option_var_tmp_nodev
      status: automated

    - id: RHEL-09-231180
      levels:
          - medium
      title: RHEL 9 must mount /var/tmp with the noexec option.
      rules:
          - mount_option_var_tmp_noexec
      status: automated

    - id: RHEL-09-231185
      levels:
          - medium
      title: RHEL 9 must mount /var/tmp with the nosuid option.
      rules:
          - mount_option_var_tmp_nosuid
      status: automated

    - id: RHEL-09-231190
      levels:
          - high
      title: RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized
          disclosure or modification of all information that requires at rest protection.
      rules:
          - encrypt_partitions
      status: automated

    - id: RHEL-09-231195
      levels:
          - low
      title: RHEL 9 must disable mounting of cramfs.
      rules:
          - kernel_module_cramfs_disabled
      status: automated

    - id: RHEL-09-231200
      levels:
          - medium
      title: RHEL 9 must prevent special devices on non-root local partitions.
      rules:
          - mount_option_nodev_nonroot_local_partitions
      status: automated

    - id: RHEL-09-232010
      levels:
          - medium
      title: RHEL 9 system commands must have mode 755 or less permissive.
      rules:
          - file_permissions_binary_dirs
      status: automated

    - id: RHEL-09-232015
      levels:
          - medium
      title: RHEL 9 library directories must have mode 755 or less permissive.
      rules:
          - dir_permissions_library_dirs
      status: automated

    - id: RHEL-09-232020
      levels:
          - medium
      title: RHEL 9 library files must have mode 755 or less permissive.
      rules:
          - file_permissions_library_dirs
      status: automated

    - id: RHEL-09-232025
      levels:
          - medium
      title: RHEL 9 /var/log directory must have mode 0755 or less permissive.
      rules:
          - file_permissions_var_log
      status: automated

    - id: RHEL-09-232030
      levels:
          - medium
      title: RHEL 9 /var/log/messages file must have mode 0640 or less permissive.
      rules:
          - file_permissions_var_log_messages
      status: automated

    - id: RHEL-09-232035
      levels:
          - medium
      title: RHEL 9 audit tools must have a mode of 0755 or less permissive.
      rules:
          - file_audit_tools_permissions
      status: automated

    - id: RHEL-09-232040
      levels:
          - medium
      title: RHEL 9 cron configuration directories must have a mode of 0700 or less permissive.
      rules:
          - package_cron_installed
          - file_permissions_cron_d
          - file_permissions_cron_daily
          - file_permissions_cron_hourly
          - file_permissions_cron_monthly
          - file_permissions_cron_weekly
      status: automated

    - id: RHEL-09-232045
      levels:
          - medium
      title: All RHEL 9 local initialization files must have mode 0740 or less permissive.
      rules:
          - file_permission_user_init_files_root
          - var_user_initialization_files_regex=all_dotfiles
          - rootfiles_configured
      status: automated

    - id: RHEL-09-232050
      levels:
          - medium
      title: All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.
      rules:
          - file_permissions_home_directories
      status: automated

    - id: RHEL-09-232055
      levels:
          - medium
      title: RHEL 9 /etc/group file must have mode 0644 or less permissive to prevent unauthorized access.
      rules:
          - file_permissions_etc_group
      status: automated

    - id: RHEL-09-232060
      levels:
          - medium
      title: RHEL 9 /etc/group- file must have mode 0644 or less permissive to prevent unauthorized access.
      rules:
          - file_permissions_backup_etc_group
      status: automated

    - id: RHEL-09-232065
      levels:
          - medium
      title: RHEL 9 /etc/gshadow file must have mode 0000 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_etc_gshadow
      status: automated

    - id: RHEL-09-232070
      levels:
          - medium
      title: RHEL 9 /etc/gshadow- file must have mode 0000 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_backup_etc_gshadow
      status: automated

    - id: RHEL-09-232075
      levels:
          - medium
      title: RHEL 9 /etc/passwd file must have mode 0644 or less permissive to prevent unauthorized access.
      rules:
          - file_permissions_etc_passwd
      status: automated

    - id: RHEL-09-232080
      levels:
          - medium
      title: RHEL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_backup_etc_passwd
      status: automated

    - id: RHEL-09-232085
      levels:
          - medium
      title: RHEL 9 /etc/shadow- file must have mode 0000 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_backup_etc_shadow
      status: automated

    - id: RHEL-09-232090
      levels:
          - medium
      title: RHEL 9 /etc/group file must be owned by root.
      rules:
          - file_owner_etc_group
      status: automated

    - id: RHEL-09-232095
      levels:
          - medium
      title: RHEL 9 /etc/group file must be group-owned by root.
      rules:
          - file_groupowner_etc_group
      status: automated

    - id: RHEL-09-232100
      levels:
          - medium
      title: RHEL 9 /etc/group- file must be owned by root.
      rules:
          - file_owner_backup_etc_group

    - id: RHEL-09-232103
      title: RHEL 9 "/etc/audit/" must be owned by root.
      levels:
          - medium
      rules:
          - file_ownership_audit_configuration
      status: automated

    - id: RHEL-09-232104
      title: RHEL 9 "/etc/audit/" must be group-owned by root.
      levels:
          - medium
      rules:
          - file_groupownership_audit_configuration

    - id: RHEL-09-232105
      levels:
          - medium
      title: RHEL 9 /etc/group- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_group
      status: automated

    - id: RHEL-09-232110
      levels:
          - medium
      title: RHEL 9 /etc/gshadow file must be owned by root.
      rules:
          - file_owner_etc_gshadow
      status: automated

    - id: RHEL-09-232115
      levels:
          - medium
      title: RHEL 9 /etc/gshadow file must be group-owned by root.
      rules:
          - file_groupowner_etc_gshadow
      status: automated

    - id: RHEL-09-232120
      levels:
          - medium
      title: RHEL 9 /etc/gshadow- file must be owned by root.
      rules:
          - file_owner_backup_etc_gshadow
      status: automated

    - id: RHEL-09-232125
      levels:
          - medium
      title: RHEL 9 /etc/gshadow- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_gshadow
      status: automated

    - id: RHEL-09-232130
      levels:
          - medium
      title: RHEL 9 /etc/passwd file must be owned by root.
      rules:
          - file_owner_etc_passwd
      status: automated

    - id: RHEL-09-232135
      levels:
          - medium
      title: RHEL 9 /etc/passwd file must be group-owned by root.
      rules:
          - file_groupowner_etc_passwd
      status: automated

    - id: RHEL-09-232140
      levels:
          - medium
      title: RHEL 9 /etc/passwd- file must be owned by root.
      rules:
          - file_owner_backup_etc_passwd
      status: automated

    - id: RHEL-09-232145
      levels:
          - medium
      title: RHEL 9 /etc/passwd- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_passwd
      status: automated

    - id: RHEL-09-232150
      levels:
          - medium
      title: RHEL 9 /etc/shadow file must be owned by root.
      rules:
          - file_owner_etc_shadow
      status: automated

    - id: RHEL-09-232155
      levels:
          - medium
      title: RHEL 9 /etc/shadow file must be group-owned by root.
      rules:
          - file_groupowner_etc_shadow
      status: automated

    - id: RHEL-09-232160
      levels:
          - medium
      title: RHEL 9 /etc/shadow- file must be owned by root.
      rules:
          - file_owner_backup_etc_shadow
      status: automated

    - id: RHEL-09-232165
      levels:
          - medium
      title: RHEL 9 /etc/shadow- file must be group-owned by root.
      rules:
          - file_groupowner_backup_etc_shadow
      status: automated

    - id: RHEL-09-232170
      levels:
          - medium
      title: RHEL 9 /var/log directory must be owned by root.
      rules:
          - file_owner_var_log
      status: automated

    - id: RHEL-09-232175
      levels:
          - medium
      title: RHEL 9 /var/log directory must be group-owned by root.
      rules:
          - file_groupowner_var_log
      status: automated

    - id: RHEL-09-232180
      levels:
          - medium
      title: RHEL 9 /var/log/messages file must be owned by root.
      rules:
          - file_owner_var_log_messages
      status: automated

    - id: RHEL-09-232185
      levels:
          - medium
      title: RHEL 9 /var/log/messages file must be group-owned by root.
      rules:
          - file_groupowner_var_log_messages
      status: automated

    - id: RHEL-09-232190
      levels:
          - medium
      title: RHEL 9 system commands must be owned by root.
      rules:
          - file_ownership_binary_dirs
      status: automated

    - id: RHEL-09-232195
      levels:
          - medium
      title: RHEL 9 system commands must be group-owned by root or a system account.
      rules:
          - file_groupownership_system_commands_dirs
      status: automated

    - id: RHEL-09-232200
      levels:
          - medium
      title: RHEL 9 library files must be owned by root.
      rules:
          - file_ownership_library_dirs
      status: automated

    - id: RHEL-09-232205
      levels:
          - medium
      title: RHEL 9 library files must be group-owned by root or a system account.
      rules:
          - root_permissions_syslibrary_files
      status: automated

    - id: RHEL-09-232210
      levels:
          - medium
      title: RHEL 9 library directories must be owned by root.
      rules:
          - dir_ownership_library_dirs
      status: automated

    - id: RHEL-09-232215
      levels:
          - medium
      title: RHEL 9 library directories must be group-owned by root or a system account.
      rules:
          - dir_group_ownership_library_dirs
      status: automated

    - id: RHEL-09-232220
      levels:
          - medium
      title: RHEL 9 audit tools must be owned by root.
      rules:
          - file_audit_tools_ownership
      status: automated

    - id: RHEL-09-232225
      levels:
          - medium
      title: RHEL 9 audit tools must be group-owned by root.
      rules:
          - file_audit_tools_group_ownership
      status: automated

    - id: RHEL-09-232230
      levels:
          - medium
      title: RHEL 9 cron configuration files directory must be owned by root.
      rules:
          - file_owner_cron_d
          - file_owner_cron_daily
          - file_owner_cron_hourly
          - file_owner_cron_monthly
          - file_owner_cron_weekly
          - file_owner_crontab
          - file_owner_cron_deny
      status: automated

    - id: RHEL-09-232235
      levels:
          - medium
      title: RHEL 9 cron configuration files directory must be group-owned by root.
      rules:
          - file_groupowner_cron_d
          - file_groupowner_cron_daily
          - file_groupowner_cron_hourly
          - file_groupowner_cron_monthly
          - file_groupowner_cron_weekly
          - file_groupowner_crontab
          - file_groupowner_cron_deny
      status: automated

    - id: RHEL-09-232240
      levels:
          - medium
      title: All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application
          user.
      rules:
          - dir_perms_world_writable_root_owned
      status: automated

    - id: RHEL-09-232245
      levels:
          - medium
      title: A sticky bit must be set on all RHEL 9 public directories.
      rules:
          - dir_perms_world_writable_sticky_bits
      status: automated

    - id: RHEL-09-232250
      levels:
          - medium
      title: All RHEL 9 local files and directories must have a valid group owner.
      rules:
          - file_permissions_ungroupowned
      status: automated

    - id: RHEL-09-232255
      levels:
          - medium
      title: All RHEL 9 local files and directories must have a valid owner.
      rules:
          - no_files_unowned_by_user
      status: automated

    - id: RHEL-09-232260
      levels:
          - medium
      title: RHEL 9 must be configured so that all system device files are correctly labeled to prevent
          unauthorized modification.
      rules:
          - selinux_all_devicefiles_labeled
      status: automated

    - id: RHEL-09-232270
      levels:
          - medium
      title: RHEL 9 /etc/shadow file must have mode 0000 to prevent unauthorized access.
      rules:
          - file_permissions_etc_shadow
      status: automated

    - id: RHEL-09-251010
      levels:
          - medium
      title: RHEL 9 must have the firewalld package installed.
      rules:
          - package_firewalld_installed
      status: automated

    - id: RHEL-09-251015
      levels:
          - medium
      title: The firewalld service on RHEL 9 must be active.
      rules:
          - service_firewalld_enabled
      status: automated

    - id: RHEL-09-251020
      levels:
          - medium
      title: A RHEL 9 firewall must employ a deny-all, allow-by-exception policy for allowing connections
          to other systems.
      rules:
          - configured_firewalld_default_deny
      status: automated

    - id: RHEL-09-251030
      levels:
          - medium
      title: RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring
          rate-limiting measures on impacted network interfaces are implemented.
      rules:
          - firewalld-backend
      status: automated

    - id: RHEL-09-251035
      levels:
          - medium
      title: RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols,
          and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category
          Assignments List (CAL) and vulnerability assessments.
      rules:
          - firewalld_sshd_port_enabled
      status: automated

    - id: RHEL-09-251040
      levels:
          - medium
      title: RHEL 9 network interfaces must not be in promiscuous mode.
      rules:
          - network_sniffer_disabled
      status: automated

    - id: RHEL-09-251045
      levels:
          - medium
      title: RHEL 9 must enable hardening for the Berkeley Packet Filter just-in-time compiler.
      rules:
          - sysctl_net_core_bpf_jit_harden
      status: automated

    - id: RHEL-09-252010
      levels:
          - medium
      title: RHEL 9 must have the chrony package installed.
      rules:
          - package_chrony_installed
      status: automated

    - id: RHEL-09-252015
      levels:
          - medium
      title: RHEL 9 chronyd service must be enabled.
      rules:
          - service_chronyd_enabled
      status: automated

    - id: RHEL-09-252020
      levels:
          - medium
      title: RHEL 9 must securely compare internal information system clocks at least every 24 hours.
      rules:
          - chronyd_or_ntpd_set_maxpoll
          - chronyd_server_directive
          - chronyd_specify_remote_server
          - var_multiple_time_servers=stig
          - var_time_service_set_maxpoll=18_hours
      status: automated

    - id: RHEL-09-252025
      levels:
          - low
      title: RHEL 9 must disable the chrony daemon from acting as a server.
      rules:
          - chronyd_client_only
      status: automated

    - id: RHEL-09-252030
      levels:
          - low
      title: RHEL 9 must disable network management of the chrony daemon.
      rules:
          - chronyd_no_chronyc_network
      status: automated

    - id: RHEL-09-252035
      levels:
          - medium
      title: RHEL 9 systems using Domain Name Servers (DNS) resolution must have at least two name servers
          configured.
      rules:
          - network_configure_name_resolution
      status: automated

    - id: RHEL-09-252040
      levels:
          - medium
      title: RHEL 9 must configure a DNS processing mode set be Network Manager.
      rules:
          - networkmanager_dns_mode
          - var_networkmanager_dns_mode=explicit_default
      status: automated

    - id: RHEL-09-252045
      levels:
          - medium
      title: RHEL 9 must not have unauthorized IP tunnels configured.
      rules:
          - libreswan_approved_tunnels
      status: automated

    - id: RHEL-09-252050
      levels:
          - medium
      title: RHEL 9 must be configured to prevent unrestricted mail relaying.
      rules:
          - postfix_prevent_unrestricted_relay
      status: automated

    - id: RHEL-09-252060
      levels:
          - medium
      title: RHEL 9 must forward mail from postmaster to the root account using a postfix alias.
      rules:
          - postfix_client_configure_mail_alias_postmaster
      status: automated

    - id: RHEL-09-252065
      levels:
          - medium
      title: RHEL 9 libreswan package must be installed.
      rules:
          - package_libreswan_installed
      status: automated

    - id: RHEL-09-252070
      levels:
          - high
      title: There must be no shosts.equiv files on RHEL 9.
      rules:
          - no_host_based_files
      status: automated

    - id: RHEL-09-252075
      levels:
          - high
      title: There must be no .shosts files on RHEL 9.
      rules:
          - no_user_host_based_files
      status: automated

    - id: RHEL-09-253010
      levels:
          - medium
      title: RHEL 9 must be configured to use TCP syncookies.
      rules:
          - sysctl_net_ipv4_tcp_syncookies
      status: automated

    - id: RHEL-09-253015
      levels:
          - medium
      title: RHEL 9 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol
          (ICMP) redirect messages.
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
      status: automated

    - id: RHEL-09-253020
      levels:
          - medium
      title: RHEL 9 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
      status: automated

    - id: RHEL-09-253025
      levels:
          - medium
      title: RHEL 9 must log IPv4 packets with impossible addresses.
      rules:
          - sysctl_net_ipv4_conf_all_log_martians
      status: automated

    - id: RHEL-09-253030
      levels:
          - medium
      title: RHEL 9 must log IPv4 packets with impossible addresses by default.
      rules:
          - sysctl_net_ipv4_conf_default_log_martians
      status: automated

    - id: RHEL-09-253035
      levels:
          - medium
      title: RHEL 9 must use reverse path filtering on all IPv4 interfaces.
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
      status: automated

    - id: RHEL-09-253040
      levels:
          - medium
      title: RHEL 9 must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from
          being accepted.
      rules:
          - sysctl_net_ipv4_conf_default_accept_redirects
      status: automated

    - id: RHEL-09-253045
      levels:
          - medium
      title: RHEL 9 must not forward IPv4 source-routed packets by default.
      rules:
          - sysctl_net_ipv4_conf_default_accept_source_route
      status: automated

    - id: RHEL-09-253050
      levels:
          - medium
      title: RHEL 9 must use a reverse-path filter for IPv4 network traffic when possible by default.
      rules:
          - sysctl_net_ipv4_conf_default_rp_filter
      status: automated

    - id: RHEL-09-253055
      levels:
          - medium
      title: RHEL 9 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast
          address.
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
      status: automated

    - id: RHEL-09-253060
      levels:
          - medium
      title: RHEL 9 must limit the number of bogus Internet Control Message Protocol (ICMP) response
          errors logs.
      rules:
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
      status: automated

    - id: RHEL-09-253065
      levels:
          - medium
      title: RHEL 9 must not send Internet Control Message Protocol (ICMP) redirects.
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
      status: automated

    - id: RHEL-09-253070
      levels:
          - medium
      title: RHEL 9 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects
          by default.
      rules:
          - sysctl_net_ipv4_conf_default_send_redirects
      status: automated

    - id: RHEL-09-253075
      levels:
          - medium
      title: RHEL 9 must not enable IPv4 packet forwarding unless the system is a router.
      rules:
          - sysctl_net_ipv4_conf_all_forwarding
      status: automated

    - id: RHEL-09-254010
      levels:
          - medium
      title: RHEL 9 must not accept router advertisements on all IPv6 interfaces.
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
      status: automated

    - id: RHEL-09-254015
      levels:
          - medium
      title: RHEL 9 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
      rules:
          - sysctl_net_ipv6_conf_all_accept_redirects
      status: automated

    - id: RHEL-09-254020
      levels:
          - medium
      title: RHEL 9 must not forward IPv6 source-routed packets.
      rules:
          - sysctl_net_ipv6_conf_all_accept_source_route
      status: automated

    - id: RHEL-09-254025
      levels:
          - medium
      title: RHEL 9 must not enable IPv6 packet forwarding unless the system is a router.
      rules:
          - sysctl_net_ipv6_conf_all_forwarding
      status: automated

    - id: RHEL-09-254030
      levels:
          - medium
      title: RHEL 9 must not accept router advertisements on all IPv6 interfaces by default.
      rules:
          - sysctl_net_ipv6_conf_default_accept_ra
      status: automated

    - id: RHEL-09-254035
      levels:
          - medium
      title: RHEL 9 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from
          being accepted.
      rules:
          - sysctl_net_ipv6_conf_default_accept_redirects
      status: automated

    - id: RHEL-09-254040
      levels:
          - medium
      title: RHEL 9 must not forward IPv6 source-routed packets by default.
      rules:
          - sysctl_net_ipv6_conf_default_accept_source_route
      status: automated

    - id: RHEL-09-255010
      levels:
          - medium
      title: All RHEL 9 networked systems must have SSH installed.
      rules:
          - package_openssh-server_installed
      status: automated

    - id: RHEL-09-255015
      levels:
          - medium
      title: All RHEL 9 networked systems must have and implement SSH to protect the confidentiality
          and integrity of transmitted and received information, as well as information during preparation
          for transmission.
      rules:
          - service_sshd_enabled
      status: automated

    - id: RHEL-09-255020
      levels:
          - medium
      title: RHEL 9 must have the openssh-clients package installed.
      rules:
          - package_openssh-clients_installed
      status: automated

    - id: RHEL-09-255025
      levels:
          - medium
      title: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a SSH logon.
      rules:
          - sshd_enable_warning_banner
      status: automated

    - id: RHEL-09-255030
      levels:
          - medium
      title: RHEL 9 must log SSH connection attempts and failures to the server.
      rules:
          - sshd_set_loglevel_verbose
      status: automated

    - id: RHEL-09-255035
      levels:
          - medium
      title: RHEL 9 SSHD must accept public key authentication.
      rules:
          - sshd_enable_pubkey_auth
      status: automated

    - id: RHEL-09-255040
      levels:
          - high
      title: RHEL 9 SSHD must not allow blank passwords.
      rules:
          - sshd_disable_empty_passwords
      status: automated

    - id: RHEL-09-255045
      levels:
          - medium
      title: RHEL 9 must not permit direct logons to the root account using remote access via SSH.
      rules:
          - sshd_disable_root_login
      status: automated

    - id: RHEL-09-255050
      levels:
          - high
      title: RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.
      rules:
          - sshd_enable_pam
      status: automated

    - id: RHEL-09-255055
      levels:
          - medium
      title: RHEL 9 SSH daemon must be configured to use system-wide crypto policies.
      rules:
          - file_sshd_50_redhat_exists
          - sshd_include_crypto_policy
      status: automated

    - id: RHEL-09-255060
      levels:
          - medium
      title: RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of
          SSH client connections.
      rules:
          - sshd_include_crypto_policy
      status: automated
    - id: RHEL-09-255064
      title: The RHEL 9 SSH client must be configured to use only DOD-approved encryption ciphers employing
          FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client
          connections.
      levels:
          - medium
      rules:
          - harden_sshd_ciphers_openssh_conf_crypto_policy
          - sshd_approved_ciphers=stig_rhel9
    - id: RHEL-09-255065
      levels:
          - medium
      title: RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of
          SSH server connections.
      rules:
          - harden_sshd_ciphers_opensshserver_conf_crypto_policy
          - sshd_approved_ciphers=stig_rhel9
      status: automated
    - id: RHEL-09-255070
      levels:
          - medium
      title: The RHEL 9 SSH client must be configured to use only DOD-approved Message Authentication
          Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality
          of SSH client connections.
      rules:
          - harden_sshd_macs_openssh_conf_crypto_policy
          - sshd_approved_macs=stig_rhel9

    - id: RHEL-09-255075
      levels:
          - medium
      title: RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing
          FIPS 140-3 validated cryptographic hash algorithms.
      status: automated
      rules:
          - harden_sshd_macs_opensshserver_conf_crypto_policy
          - sshd_approved_macs=stig_rhel9

    - id: RHEL-09-255080
      levels:
          - medium
      title: RHEL 9 must not allow a noncertificate trusted host SSH logon to the system.
      rules:
          - disable_host_auth
      status: automated

    - id: RHEL-09-255085
      levels:
          - medium
      title: RHEL 9 must not allow users to override SSH environment variables.
      rules:
          - sshd_do_not_permit_user_env
      status: automated

    - id: RHEL-09-255090
      levels:
          - medium
      title: RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
      rules:
          - sshd_rekey_limit
          - var_rekey_limit_size=1G
          - var_rekey_limit_time=1hour
      status: automated

    - id: RHEL-09-255095
      levels:
          - medium
      title: RHEL 9 must be configured so that all network connections associated with SSH traffic terminate
          after becoming unresponsive.
      rules:
          - sshd_set_keepalive
          - var_sshd_set_keepalive=1
      status: automated

    - id: RHEL-09-255100
      levels:
          - medium
      title: RHEL 9 must be configured so that all network connections associated with SSH traffic are
          terminated after 10 minutes of becoming unresponsive.
      rules:
          - sshd_set_idle_timeout
          - sshd_idle_timeout_value=10_minutes
      status: automated

    - id: RHEL-09-255105
      levels:
          - medium
      title: RHEL 9 SSH server configuration file must be group-owned by root.
      rules:
          - file_groupowner_sshd_config
          - directory_groupowner_sshd_config_d
          - file_groupowner_sshd_drop_in_config
      status: automated

    - id: RHEL-09-255110
      levels:
          - medium
      title: RHEL 9 SSH server configuration file must be owned by root.
      rules:
          - file_owner_sshd_config
          - directory_owner_sshd_config_d
          - file_owner_sshd_drop_in_config
      status: automated

    - id: RHEL-09-255115
      levels:
          - medium
      title: RHEL 9 SSH server configuration file must have mode 0600 or less permissive.
      rules:
          - file_permissions_sshd_config
          - directory_permissions_sshd_config_d
          - file_permissions_sshd_drop_in_config
      status: automated

    - id: RHEL-09-255120
      levels:
          - medium
      title: RHEL 9 SSH private host key files must have mode 0640 or less permissive.
      rules:
          - file_permissions_sshd_private_key
      status: automated

    - id: RHEL-09-255125
      levels:
          - medium
      title: RHEL 9 SSH public host key files must have mode 0644 or less permissive.
      rules:
          - file_permissions_sshd_pub_key
      status: automated

    - id: RHEL-09-255130
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow compression or must only allow compression after successful
          authentication.
      rules:
          - sshd_disable_compression
          - var_sshd_disable_compression=no
      status: automated

    - id: RHEL-09-255135
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow GSSAPI authentication.
      rules:
          - sshd_disable_gssapi_auth
      status: automated

    - id: RHEL-09-255140
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow Kerberos authentication.
      rules:
          - sshd_disable_kerb_auth
      status: automated

    - id: RHEL-09-255145
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow rhosts authentication.
      rules:
          - sshd_disable_rhosts
      status: automated

    - id: RHEL-09-255150
      levels:
          - medium
      title: RHEL 9 SSH daemon must not allow known hosts authentication.
      rules:
          - sshd_disable_user_known_hosts
      status: automated

    - id: RHEL-09-255155
      levels:
          - medium
      title: RHEL 9 SSH daemon must disable remote X connections for interactive users.
      rules:
          - sshd_disable_x11_forwarding
      status: automated

    - id: RHEL-09-255160
      levels:
          - medium
      title: RHEL 9 SSH daemon must perform strict mode checking of home directory configuration files.
      rules:
          - sshd_enable_strictmodes
      status: automated

    - id: RHEL-09-255165
      levels:
          - medium
      title: RHEL 9 SSH daemon must display the date and time of the last successful account logon upon
          an SSH logon.
      rules:
          - sshd_print_last_log
      status: automated

    - id: RHEL-09-255175
      levels:
          - medium
      title: RHEL 9 SSH daemon must prevent remote hosts from connecting to the proxy display.
      rules:
          - sshd_x11_use_localhost
      status: automated

    - id: RHEL-09-271010
      levels:
          - medium
      title: RHEL 9 must display the Standard Mandatory DOD Notice and Consent Banner before granting
          local or remote access to the system via a graphical user logon.
      rules:
          - dconf_gnome_banner_enabled
      status: automated

    - id: RHEL-09-271015
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical
          user interface.
      rules:
          - dconf_gnome_banner_enabled
      status: automated

    - id: RHEL-09-271020
      levels:
          - medium
      title: RHEL 9 must disable the graphical user interface automount function unless required.
      rules:
          - dconf_gnome_disable_automount_open
      status: automated

    - id: RHEL-09-271025
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disabling of the graphical user interface
          automount function.
      rules:
          - dconf_gnome_disable_automount_open
      status: automated

    - id: RHEL-09-271030
      levels:
          - medium
      title: RHEL 9 must disable the graphical user interface autorun function unless required.
      rules:
          - dconf_gnome_disable_autorun
      status: automated

    - id: RHEL-09-271035
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disabling of the graphical user interface
          autorun function.
      rules:
          - dconf_gnome_disable_autorun
      status: automated

    - id: RHEL-09-271040
      levels:
          - high
      title: RHEL 9 must not allow unattended or automatic logon via the graphical user interface.
      rules:
          - gnome_gdm_disable_automatic_login
      status: automated

    - id: RHEL-09-271045
      levels:
          - medium
      title: RHEL 9 must be able to initiate directly a session lock for all connection types using smart
          card when the smart card is removed.
      rules:
          - dconf_gnome_lock_screen_on_smartcard_removal
      status: automated

    - id: RHEL-09-271050
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card
          removal action.
      rules:
          - dconf_gnome_lock_screen_on_smartcard_removal
      status: automated

    - id: RHEL-09-271055
      levels:
          - medium
      title: RHEL 9 must enable a user session lock until that user re-establishes access using established
          identification and authentication procedures for graphical user sessions.
      rules:
          - dconf_gnome_screensaver_lock_enabled
      status: automated

    - id: RHEL-09-271060
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the
          graphical user interface.
      rules:
          - dconf_gnome_screensaver_lock_enabled
      status: automated

    - id: RHEL-09-271065
      levels:
          - medium
      title: RHEL 9 must automatically lock graphical user sessions after 15 minutes of inactivity.
      rules:
          - dconf_gnome_screensaver_idle_delay
      status: automated

    - id: RHEL-09-271070
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical
          user interface.
      rules:
          - dconf_gnome_session_idle_user_locks
      status: automated

    - id: RHEL-09-271075
      levels:
          - medium
      title: RHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is
          activated.
      rules:
          - dconf_gnome_screensaver_lock_delay
      status: automated

    - id: RHEL-09-271080
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical
          user interface.
      rules:
          - dconf_gnome_screensaver_user_locks
      status: automated

    - id: RHEL-09-271085
      levels:
          - medium
      title: RHEL 9 must conceal, via the session lock, information previously visible on the display
          with a publicly viewable image.
      rules:
          - dconf_gnome_screensaver_mode_blank
      status: automated

    - id: RHEL-09-271090
      levels:
          - medium
      title: RHEL 9 effective dconf policy must match the policy keyfiles.
      rules:
          - dconf_db_up_to_date
      status: automated

    - id: RHEL-09-271095
      levels:
          - medium
      title: RHEL 9 must disable the ability of a user to restart the system from the login screen.
      rules:
          - dconf_gnome_disable_restart_shutdown
      status: automated

    - id: RHEL-09-271100
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical
          user interface.
      rules:
          - dconf_gnome_disable_restart_shutdown
      status: automated

    - id: RHEL-09-271105
      levels:
          - medium
      title: RHEL 9 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a
          system to shut down or reboot.
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-09-271110
      levels:
          - medium
      title: RHEL 9 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical
          user interface.
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot
      status: automated

    - id: RHEL-09-271115
      levels:
          - medium
      title: RHEL 9 must disable the user list at logon for graphical user interfaces.
      rules:
          - dconf_gnome_disable_user_list
      status: automated

    - id: RHEL-09-291010
      levels:
          - medium
      title: RHEL 9 must be configured to disable USB mass storage.
      rules:
          - kernel_module_usb-storage_disabled
      status: automated

    - id: RHEL-09-291015
      levels:
          - medium
      title: RHEL 9 must have the USBGuard package installed.
      rules:
          - package_usbguard_installed
      status: automated

    - id: RHEL-09-291020
      levels:
          - medium
      title: RHEL 9 must have the USBGuard package enabled.
      rules:
          - service_usbguard_enabled
      status: automated

    - id: RHEL-09-291025
      levels:
          - low
      title: RHEL 9 must enable Linux audit logging for the USBGuard daemon.
      rules:
          - configure_usbguard_auditbackend
      status: automated

    - id: RHEL-09-291030
      levels:
          - medium
      title: RHEL 9 must block unauthorized peripherals before establishing a connection.
      rules:
          - usbguard_generate_policy
      status: automated

    - id: RHEL-09-291035
      levels:
          - medium
      title: RHEL 9 Bluetooth must be disabled.
      rules:
          - kernel_module_bluetooth_disabled
      status: automated

    - id: RHEL-09-291040
      levels:
          - medium
      title: RHEL 9 wireless network adapters must be disabled.
      rules:
          - wireless_disable_interfaces
      status: automated

    - id: RHEL-09-411010
      levels:
          - medium
      title: RHEL 9 user account passwords for new users or password changes must have a 60-day maximum
          password lifetime restriction in /etc/login.defs.
      rules:
          - accounts_maximum_age_login_defs
      status: automated

    - id: RHEL-09-411015
      levels:
          - medium
      title: RHEL 9 user account passwords must have a 60-day maximum password lifetime restriction.
      rules:
          - accounts_password_set_max_life_existing
          - var_accounts_maximum_age_login_defs=60
      status: automated

    - id: RHEL-09-411020
      levels:
          - medium
      title: All RHEL 9 local interactive user accounts must be assigned a home directory upon creation.
      rules:
          - accounts_have_homedir_login_defs
      status: automated

    - id: RHEL-09-411025
      levels:
          - medium
      title: RHEL 9 must set the umask value to 077 for all local interactive user accounts.
      rules:
          - accounts_umask_interactive_users
          - var_accounts_user_umask=077
      status: automated

    - id: RHEL-09-411030
      levels:
          - medium
      title: RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
      rules:
          - account_unique_id
      status: automated

    - id: RHEL-09-411035
      levels:
          - medium
      title: RHEL 9 system accounts must not have an interactive login shell.
      rules:
          - no_shelllogin_for_systemaccounts
      status: automated

    - id: RHEL-09-411040
      levels:
          - medium
      title: RHEL 9 must automatically expire temporary accounts within 72 hours.
      rules:
          - account_temp_expire_date
      status: automated

    - id: RHEL-09-411045
      levels:
          - medium
      title: All RHEL 9 interactive users must have a primary group that exists.
      rules:
          - gid_passwd_group_same
      status: automated

    - id: RHEL-09-411050
      levels:
          - medium
      title: RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after
          35 days of inactivity.
      rules:
          - account_disable_post_pw_expiration
          - var_account_disable_post_pw_expiration=35
      status: automated

    - id: RHEL-09-411055
      levels:
          - medium
      title: Executable search paths within the initialization files of all local interactive RHEL 9
          users must only contain paths that resolve to the system default or the users home directory.
      rules:
          - accounts_user_home_paths_only
      status: automated

    - id: RHEL-09-411060
      levels:
          - medium
      title: All RHEL 9 local interactive users must have a home directory assigned in the /etc/passwd
          file.
      rules:
          - accounts_user_interactive_home_directory_defined
      status: automated

    - id: RHEL-09-411065
      levels:
          - medium
      title: All RHEL 9 local interactive user home directories defined in the /etc/passwd file must
          exist.
      rules:
          - accounts_user_interactive_home_directory_exists
      status: automated

    - id: RHEL-09-411070
      levels:
          - medium
      title: All RHEL 9 local interactive user home directories must be group-owned by the home directory
          owner's primary group.
      rules:
          - file_groupownership_home_directories
      status: automated

    - id: RHEL-09-411075
      levels:
          - medium
      title: RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.
      rules:
          - accounts_passwords_pam_faillock_deny
          - var_accounts_passwords_pam_faillock_deny=3
      status: automated

    - id: RHEL-09-411080
      levels:
          - medium
      title: RHEL 9 must automatically lock the root account until the root account is released by an
          administrator when three unsuccessful logon attempts occur during a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_deny_root
      status: automated

    - id: RHEL-09-411085
      levels:
          - medium
      title: RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during
          a 15-minute time period.
      rules:
          - accounts_passwords_pam_faillock_interval
          - var_accounts_passwords_pam_faillock_fail_interval=900
      status: automated

    - id: RHEL-09-411090
      levels:
          - medium
      title: RHEL 9 must maintain an account lock until the locked account is released by an administrator.
      rules:
          - accounts_passwords_pam_faillock_unlock_time
          - var_accounts_passwords_pam_faillock_unlock_time=never
      status: automated

    - id: RHEL-09-411095
      levels:
          - medium
      title: RHEL 9 must not have unauthorized accounts.
      rules:
          - accounts_authorized_local_users
          - var_accounts_authorized_local_users_regex=rhel9
      status: automated

    - id: RHEL-09-411100
      levels:
          - high
      title: The root account must be the only account having unrestricted access to RHEL 9 system.
      rules:
          - accounts_no_uid_except_zero
      status: automated

    - id: RHEL-09-411105
      levels:
          - medium
      title: RHEL 9 must ensure account lockouts persist.
      rules:
          - accounts_passwords_pam_faillock_dir
      status: automated

    - id: RHEL-09-411110
      levels:
          - medium
      title: RHEL 9 groups must have unique Group ID (GID).
      rules:
          - group_unique_id
      status: automated

    - id: RHEL-09-411115
      levels:
          - medium
      title: Local RHEL 9 initialization files must not execute world-writable programs.
      rules:
          - accounts_user_dot_no_world_writable_programs
      status: automated

    - id: RHEL-09-412035
      levels:
          - medium
      title: RHEL 9 must automatically exit interactive command shell user sessions after 15 minutes
          of inactivity.
      rules:
          - accounts_tmout
          - var_accounts_tmout=10_min
      status: automated

    - id: RHEL-09-412040
      levels:
          - low
      title: RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account
          types.
      rules:
          - accounts_max_concurrent_login_sessions
          - var_accounts_max_concurrent_login_sessions=10
      status: automated

    - id: RHEL-09-412045
      levels:
          - medium
      title: RHEL 9 must log username information when unsuccessful logon attempts occur.
      rules:
          - accounts_passwords_pam_faillock_audit
      status: automated

    - id: RHEL-09-412050
      levels:
          - medium
      title: RHEL 9 must enforce a delay of at least four seconds between logon prompts following a failed
          logon attempt.
      rules:
          - accounts_logon_fail_delay
          - var_accounts_fail_delay=4
      status: automated

    - id: RHEL-09-412055
      levels:
          - medium
      title: RHEL 9 must define default permissions for the bash shell.
      rules:
          - accounts_umask_etc_bashrc
      status: automated

    - id: RHEL-09-412060
      levels:
          - medium
      title: RHEL 9 must define default permissions for the c shell.
      rules:
          - accounts_umask_etc_csh_cshrc
      status: automated

    - id: RHEL-09-412065
      levels:
          - medium
      title: RHEL 9 must define default permissions for all authenticated users in such a way that the
          user can only read and modify their own files.
      rules:
          - accounts_umask_etc_login_defs
      status: automated

    - id: RHEL-09-412070
      levels:
          - medium
      title: RHEL 9 must define default permissions for the system default profile.
      rules:
          - accounts_umask_etc_profile
      status: automated

    - id: RHEL-09-412075
      levels:
          - low
      title: RHEL 9 must display the date and time of the last successful account logon upon logon.
      rules:
          - display_login_attempts
      status: automated

    - id: RHEL-09-412080
      levels:
          - medium
      title: RHEL 9 must terminate idle user sessions.
      rules:
          - logind_session_timeout
          - var_logind_session_timeout=15_minutes
      status: automated

    - id: RHEL-09-431010
      levels:
          - high
      title: RHEL 9 must use a Linux Security Module configured to enforce limits on system services.
      rules:
          - selinux_state
          - var_selinux_state=enforcing
      status: automated

    - id: RHEL-09-431015
      levels:
          - medium
      title: RHEL 9 must enable the SELinux targeted policy.
      rules:
          - selinux_policytype
          - var_selinux_policy_name=targeted
      status: automated

    - id: RHEL-09-431016
      title: 'RHEL 9 must elevate the SELinux context when an administrator calls the sudo command.'
      rules:
          - selinux_context_elevation_for_sudo
      status: automated

    - id: RHEL-09-431020
      levels:
          - medium
      title: RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally
          directory.
      rules:
          - account_password_selinux_faillock_dir
      status: automated

    - id: RHEL-09-431025
      levels:
          - medium
      title: RHEL 9 must have policycoreutils package installed.
      rules:
          - package_policycoreutils_installed
      status: automated

    - id: RHEL-09-431030
      levels:
          - medium
      title: RHEL 9 policycoreutils-python-utils package must be installed.
      rules:
          - package_policycoreutils-python-utils_installed
      status: automated

    - id: RHEL-09-432010
      levels:
          - medium
      title: RHEL 9 must have the sudo package installed.
      rules:
          - package_sudo_installed
      status: automated

    - id: RHEL-09-432015
      levels:
          - medium
      title: RHEL 9 must require reauthentication when using the "sudo" command.
      rules:
          - sudo_require_reauthentication
          - var_sudo_timestamp_timeout=always_prompt
      status: automated

    - id: RHEL-09-432020
      levels:
          - medium
      title: RHEL 9 must use the invoking user's password for privilege escalation when using "sudo".
      rules:
          - sudoers_validate_passwd
      status: automated

    - id: RHEL-09-432025
      levels:
          - medium
      title: RHEL 9 must require users to reauthenticate for privilege escalation.
      rules:
          - sudo_remove_no_authenticate
      status: automated

    - id: RHEL-09-432030
      levels:
          - medium
      title: RHEL 9 must restrict privilege elevation to authorized personnel.
      rules:
          - sudo_restrict_privilege_elevation_to_authorized
      status: automated

    - id: RHEL-09-432035
      levels:
          - medium
      title: RHEL 9 must restrict the use of the "su" command.
      rules:
          - use_pam_wheel_for_su
      status: automated

    - id: RHEL-09-433010
      levels:
          - medium
      title: RHEL 9 fapolicy module must be installed.
      rules:
          - package_fapolicyd_installed
      status: automated

    - id: RHEL-09-433015
      levels:
          - medium
      title: RHEL 9 fapolicy module must be enabled.
      rules:
          - service_fapolicyd_enabled
      status: automated

    - id: RHEL-09-433016
      levels:
          - medium
      title: The RHEL 9 fapolicy module must be configured to employ a deny-all, permit-by-exception
          policy to allow the execution of authorized software programs.
      rules:
          - fapolicy_default_deny
      status: automated

    - id: RHEL-09-611010
      levels:
          - medium
      title: RHEL 9 must ensure the password complexity module in the system-auth file is configured
          for three retries or less.
      rules:
          - accounts_password_pam_pwquality_retry
          - var_password_pam_retry=3
      status: automated

    - id: RHEL-09-611025
      levels:
          - high
      title: RHEL 9 must not allow blank or null passwords.
      rules:
          - no_empty_passwords
      status: automated

    - id: RHEL-09-611030
      levels:
          - medium
      title: RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth
          file.
      rules:
          - account_password_pam_faillock_system_auth
      status: automated

    - id: RHEL-09-611035
      levels:
          - medium
      title: RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth
          file.
      rules:
          - account_password_pam_faillock_password_auth
      status: automated

    - id: RHEL-09-611040
      levels:
          - medium
      title: RHEL 9 must ensure the password complexity module is enabled in the password-auth file.
      rules:
          - accounts_password_pam_pwquality_password_auth
      status: automated

    - id: RHEL-09-611045
      levels:
          - medium
      title: RHEL 9 must ensure the password complexity module is enabled in the system-auth file.
      rules:
          - accounts_password_pam_pwquality_system_auth
      status: automated

    - id: RHEL-09-611050
      levels:
          - medium
      title: RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
      rules:
          - accounts_password_pam_unix_rounds_password_auth
          - var_password_pam_unix_rounds=100000
      status: automated

    - id: RHEL-09-611055
      levels:
          - medium
      title: RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
      rules:
          - accounts_password_pam_unix_rounds_system_auth
      status: automated

    - id: RHEL-09-611060
      levels:
          - medium
      title: RHEL 9 must enforce password complexity rules for the root account.
      rules:
          - accounts_password_pam_enforce_root
      status: automated

    - id: RHEL-09-611065
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one lowercase character
          be used.
      rules:
          - accounts_password_pam_lcredit
          - var_password_pam_lcredit=1
      status: automated

    - id: RHEL-09-611070
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one numeric character
          be used.
      rules:
          - accounts_password_pam_dcredit
          - var_password_pam_dcredit=1
      status: automated

    - id: RHEL-09-611075
      levels:
          - medium
      title: RHEL 9 passwords for new users or password changes must have a 24 hours minimum password
          lifetime restriction in /etc/login.defs.
      rules:
          - accounts_minimum_age_login_defs
      status: automated

    - id: RHEL-09-611080
      levels:
          - medium
      title: RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.
      rules:
          - accounts_password_set_min_life_existing
          - var_accounts_minimum_age_login_defs=1
      status: automated

    - id: RHEL-09-611085
      levels:
          - medium
      title: RHEL 9 must require users to provide a password for privilege escalation.
      rules:
          - sudo_remove_nopasswd
      status: automated

    - id: RHEL-09-611090
      levels:
          - medium
      title: RHEL 9 passwords must be created with a minimum of 15 characters.
      rules:
          - accounts_password_pam_minlen
          - var_password_pam_minlen=15
      status: automated

    - id: RHEL-09-611100
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one special character
          be used.
      rules:
          - accounts_password_pam_ocredit
          - var_password_pam_ocredit=1
      status: automated

    - id: RHEL-09-611105
      levels:
          - medium
      title: RHEL 9 must prevent the use of dictionary words for passwords.
      rules:
          - accounts_password_pam_dictcheck
          - var_password_pam_dictcheck=1
      status: automated

    - id: RHEL-09-611110
      levels:
          - medium
      title: RHEL 9 must enforce password complexity by requiring that at least one uppercase character
          be used.
      rules:
          - accounts_password_pam_ucredit
          - var_password_pam_ucredit=1
      status: automated

    - id: RHEL-09-611115
      levels:
          - medium
      title: RHEL 9 must require the change of at least eight characters when passwords are changed.
      rules:
          - accounts_password_pam_difok
          - var_password_pam_difok=8
      status: automated

    - id: RHEL-09-611120
      levels:
          - medium
      title: RHEL 9 must require the maximum number of repeating characters of the same character class
          be limited to four when passwords are changed.
      rules:
          - accounts_password_pam_maxclassrepeat
          - var_password_pam_maxclassrepeat=4
      status: automated

    - id: RHEL-09-611125
      levels:
          - medium
      title: RHEL 9 must require the maximum number of repeating characters be limited to three when
          passwords are changed.
      rules:
          - accounts_password_pam_maxrepeat
          - var_password_pam_maxrepeat=3
      status: automated

    - id: RHEL-09-611130
      levels:
          - medium
      title: RHEL 9 must require the change of at least four character classes when passwords are changed.
      rules:
          - accounts_password_pam_minclass
          - var_password_pam_minclass=4
      status: automated

    - id: RHEL-09-611135
      levels:
          - medium
      title: RHEL 9 must be configured so that user and group account administration utilities are configured
          to store only encrypted representations of passwords.
      rules:
          - set_password_hashing_algorithm_libuserconf
          - var_password_hashing_algorithm_pam=sha512
      status: automated

    - id: RHEL-09-611140
      levels:
          - medium
      title: RHEL 9 must be configured to use the shadow file to store only encrypted representations
          of passwords.
      rules:
          - set_password_hashing_algorithm_logindefs
          - var_password_hashing_algorithm=SHA512
      status: automated

    - id: RHEL-09-611145
      levels:
          - medium
      title: RHEL 9 must not be configured to bypass password requirements for privilege escalation.
      rules:
          - disallow_bypass_password_sudo
      status: automated

    - id: RHEL-09-611155
      levels:
          - medium
      title: RHEL 9 must not have accounts configured with blank or null passwords.
      rules:
          - no_empty_passwords_etc_shadow
      status: automated

    - id: RHEL-09-611160
      levels:
          - medium
      title: RHEL 9 must use the CAC smart card driver.
      rules:
          - configure_opensc_card_drivers
          - var_smartcard_drivers=cac
      status: automated

    - id: RHEL-09-611165
      levels:
          - medium
      title: RHEL 9 must enable certificate based smart card authentication.
      rules:
          - sssd_enable_smartcards
      status: automated

    - id: RHEL-09-611170
      levels:
          - medium
      title: RHEL 9 must implement certificate status checking for multifactor authentication.
      rules:
          - sssd_certificate_verification
          - var_sssd_certificate_verification_digest_function=sha512
      status: automated

    - id: RHEL-09-611175
      levels:
          - medium
      title: RHEL 9 must have the pcsc-lite package installed.
      rules:
          - package_pcsc-lite_installed
      status: automated

    - id: RHEL-09-611180
      levels:
          - medium
      title: The pcscd service on RHEL 9 must be active.
      rules:
          - service_pcscd_enabled
      status: automated

    - id: RHEL-09-611185
      levels:
          - medium
      title: RHEL 9 must have the opensc package installed.
      rules:
          - package_opensc_installed
      status: automated

    - id: RHEL-09-611190
      levels:
          - medium
      title: RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding
          private key.
      rules:
          - ssh_keys_passphrase_protected
      status: automated

    - id: RHEL-09-611195
      levels:
          - medium
      title: RHEL 9 must require authentication to access emergency mode.
      rules:
          - require_emergency_target_auth
      status: automated

    - id: RHEL-09-611200
      levels:
          - medium
      title: RHEL 9 must require authentication to access single-user mode.
      rules:
          - require_singleuser_auth
      status: automated

    - id: RHEL-09-631010
      levels:
          - medium
      title: RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification
          path (which includes status information) to an accepted trust anchor.
      rules:
          - sssd_has_trust_anchor
      status: automated

    - id: RHEL-09-631015
      levels:
          - medium
      title: RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
      rules:
          - sssd_enable_certmap
      status: automated

    - id: RHEL-09-631020
      levels:
          - medium
      title: RHEL 9 must prohibit the use of cached authenticators after one day.
      rules:
          - sssd_offline_cred_expiration
      status: automated

    - id: RHEL-09-651010
      levels:
          - medium
      title: RHEL 9 must have the AIDE package installed.
      rules:
          - package_aide_installed
          - aide_build_database
      status: automated

    - id: RHEL-09-651015
      levels:
          - medium
      title: RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify
          the system administrator when anomalies in the operation of any security functions are discovered.
      rules:
          - aide_scan_notification
      status: automated

    - id: RHEL-09-651020
      levels:
          - medium
      title: RHEL 9 must use a file integrity tool that is configured to use FIPS 140-3-approved cryptographic
          hashes for validating file contents and directories.
      rules:
          - aide_use_fips_hashes
      status: automated

    - id: RHEL-09-651025
      levels:
          - medium
      title: RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
      rules:
          - aide_check_audit_tools
      status: automated

    - id: RHEL-09-651030
      levels:
          - low
      title: RHEL 9 must be configured so that the file integrity tool verifies Access Control Lists
          (ACLs).
      rules:
          - aide_verify_acls
      status: automated

    - id: RHEL-09-651035
      levels:
          - low
      title: RHEL 9 must be configured so that the file integrity tool verifies extended attributes.
      rules:
          - aide_verify_ext_attributes
      status: automated

    - id: RHEL-09-652010
      levels:
          - medium
      title: RHEL 9 must have the rsyslog package installed.
      rules:
          - package_rsyslog_installed
      status: automated

    - id: RHEL-09-652015
      levels:
          - medium
      title: RHEL 9 must have the packages required for encrypting offloaded audit logs installed.
      rules:
          - package_rsyslog-gnutls_installed
      status: automated

    - id: RHEL-09-652020
      levels:
          - medium
      title: The rsyslog service on RHEL 9 must be active.
      rules:
          - service_rsyslog_enabled
      status: automated

    - id: RHEL-09-652025
      levels:
          - medium
      title: RHEL 9 must be configured so that the rsyslog daemon does not accept log messages from other
          servers unless the server is being used for log aggregation.
      rules:
          - rsyslog_nolisten
      status: automated

    - id: RHEL-09-652030
      levels:
          - medium
      title: All RHEL 9 remote access methods must be monitored.
      rules:
          - rsyslog_remote_access_monitoring
      status: automated

    - id: RHEL-09-652040
      levels:
          - medium
      title: RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
      rules:
          - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
      status: automated

    - id: RHEL-09-652045
      levels:
          - medium
      title: RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media
          from the system being audited via rsyslog.
      rules:
          - rsyslog_encrypt_offload_actionsendstreamdrivermode
      status: automated

    - id: RHEL-09-652050
      levels:
          - medium
      title: RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different
          system or media from the system being audited via rsyslog.
      rules:
          - rsyslog_encrypt_offload_defaultnetstreamdriver
      status: automated

    - id: RHEL-09-652055
      levels:
          - medium
      title: RHEL 9 must be configured to forward audit records via TCP to a different system or media
          from the system being audited via rsyslog.
      rules:
          - rsyslog_remote_loghost
      status: automated

    - id: RHEL-09-652060
      levels:
          - medium
      title: RHEL 9 must use cron logging.
      rules:
          - rsyslog_cron_logging
      status: automated

    - id: RHEL-09-653010
      levels:
          - medium
      title: RHEL 9 audit package must be installed.
      rules:
          - package_audit_installed
      status: automated

    - id: RHEL-09-653015
      levels:
          - medium
      title: RHEL 9 audit service must be enabled.
      rules:
          - service_auditd_enabled
      status: automated

    - id: RHEL-09-653020
      levels:
          - medium
      title: RHEL 9 audit system must take appropriate action when an error writing to the audit storage
          volume occurs.
      rules:
          - auditd_data_disk_error_action_stig
          - var_auditd_disk_error_action=halt
      status: automated

    - id: RHEL-09-653025
      levels:
          - medium
      title: RHEL 9 audit system must take appropriate action when the audit storage volume is full.
      rules:
          - auditd_data_disk_full_action_stig
          - var_auditd_disk_full_action=halt
      status: automated

    - id: RHEL-09-653030
      levels:
          - medium
      title: RHEL 9 must allocate audit record storage capacity to store at least one week's worth of
          audit records.
      rules:
          - auditd_audispd_configure_sufficiently_large_partition
      status: automated

    - id: RHEL-09-653035
      levels:
          - medium
      title: RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of
          the repository maximum audit record storage capacity.
      rules:
          - auditd_data_retention_space_left_percentage
          - var_auditd_space_left_percentage=25pc
      status: automated

    - id: RHEL-09-653040
      levels:
          - medium
      title: RHEL 9 must notify the system administrator (SA) and information system security officer
          (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
      rules:
          - auditd_data_retention_space_left_action
          - var_auditd_space_left_action=email
      status: automated

    - id: RHEL-09-653045
      levels:
          - medium
      title: RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of
          the audit record storage capacity.
      rules:
          - auditd_data_retention_admin_space_left_percentage
          - var_auditd_admin_space_left_percentage=5pc
      status: automated

    - id: RHEL-09-653050
      levels:
          - medium
      title: RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of
          the repository maximum audit record storage capacity.
      rules:
          - auditd_data_retention_admin_space_left_action
          - var_auditd_admin_space_left_action=single
      status: automated

    - id: RHEL-09-653055
      levels:
          - medium
      title: RHEL 9 audit system must take appropriate action when the audit files have reached maximum
          size.
      rules:
          - auditd_data_retention_max_log_file_action_stig
          - var_auditd_max_log_file_action=rotate
      status: automated

    - id: RHEL-09-653060
      levels:
          - medium
      title: RHEL 9 must label all offloaded audit logs before sending them to the central log server.
      rules:
          - auditd_name_format
          - var_auditd_name_format=stig
      status: automated

    - id: RHEL-09-653065
      levels:
          - medium
      title: RHEL 9 must take appropriate action when the internal event queue is full.
      rules:
          - auditd_overflow_action
      status: automated

    - id: RHEL-09-653070
      levels:
          - medium
      title: RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a
          minimum) must be alerted of an audit processing failure event.
      rules:
          - auditd_data_retention_action_mail_acct
          - var_auditd_action_mail_acct=root
      status: automated

    - id: RHEL-09-653075
      levels:
          - medium
      title: RHEL 9 audit system must audit local events.
      rules:
          - auditd_local_events
      status: automated

    - id: RHEL-09-653080
      levels:
          - medium
      title: RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent
          unauthorized read access.
      rules:
          - directory_group_ownership_var_log_audit
      status: automated

    - id: RHEL-09-653085
      levels:
          - medium
      title: RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
      rules:
          - directory_ownership_var_log_audit
      status: automated

    - id: RHEL-09-653090
      levels:
          - medium
      title: RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access
          to the audit log.
      rules:
          - file_permissions_var_log_audit
      status: automated

    - id: RHEL-09-653095
      levels:
          - medium
      title: RHEL 9 must periodically flush audit records to disk to prevent the loss of audit records.
      rules:
          - auditd_freq
          - var_auditd_freq=100
      status: automated

    - id: RHEL-09-653100
      levels:
          - medium
      title: RHEL 9 must produce audit records containing information to establish the identity of any
          individual or process associated with the event.
      rules:
          - auditd_log_format
      status: automated

    - id: RHEL-09-653105
      levels:
          - medium
      title: RHEL 9 must write audit records to disk.
      rules:
          - auditd_write_logs
      status: automated

    - id: RHEL-09-653110
      levels:
          - medium
      title: RHEL 9 must allow only the information system security manager (ISSM) (or individuals or
          roles appointed by the ISSM) to select which auditable events are to be audited.
      rules:
          - file_permissions_audit_configuration
      status: automated

    - id: RHEL-09-653115
      levels:
          - medium
      title: RHEL 9 /etc/audit/auditd.conf file must have 0640 or less permissive to prevent unauthorized
          access.
      rules:
          - file_permissions_etc_audit_auditd
      status: automated

    - id: RHEL-09-653120
      levels:
          - low
      title: RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that
          start prior to the audit daemon.
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192
      status: automated

    - id: RHEL-09-653125
      levels:
          - medium
      title: RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and
          system administrator (SA) (at a minimum) in the event of an audit processing failure.
      rules:
          - postfix_client_configure_mail_alias
      status: automated

    - id: RHEL-09-653130
      levels:
          - medium
      title: RHEL 9 audispd-plugins package must be installed.
      rules:
          - package_audispd-plugins_installed
      status: automated

    - id: RHEL-09-654010
      levels:
          - medium
      title: RHEL 9 must audit uses of the "execve" system call.
      rules:
          - audit_rules_suid_privilege_function
      status: automated

    - id: RHEL-09-654015
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
      rules:
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
      status: automated

    - id: RHEL-09-654020
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
      rules:
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_lchown
      status: automated

    - id: RHEL-09-654025
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr,
          and lremovexattr system calls.
      rules:
          - audit_rules_dac_modification_setxattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_lremovexattr
      status: automated

    - id: RHEL-09-654030
      levels:
          - medium
      title: RHEL 9 must audit all uses of umount system calls.
      rules:
          - audit_rules_privileged_commands_umount
      status: automated

    - id: RHEL-09-654035
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chacl command.
      rules:
          - audit_rules_execution_chacl
      status: automated

    - id: RHEL-09-654040
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setfacl command.
      rules:
          - audit_rules_execution_setfacl
      status: automated

    - id: RHEL-09-654045
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chcon command.
      rules:
          - audit_rules_execution_chcon
      status: automated

    - id: RHEL-09-654050
      levels:
          - medium
      title: RHEL 9 must audit all uses of the semanage command.
      rules:
          - audit_rules_execution_semanage
      status: automated

    - id: RHEL-09-654055
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setfiles command.
      rules:
          - audit_rules_execution_setfiles
      status: automated

    - id: RHEL-09-654060
      levels:
          - medium
      title: RHEL 9 must audit all uses of the setsebool command.
      rules:
          - audit_rules_execution_setsebool
      status: automated

    - id: RHEL-09-654065
      levels:
          - medium
      title: RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_rmdir
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_unlinkat
      status: automated

    - id: RHEL-09-654070
      levels:
          - medium
      title: RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at
          system calls.
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_unsuccessful_file_modification_ftruncate
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_open_by_handle_at
      status: automated

    - id: RHEL-09-654075
      levels:
          - medium
      title: RHEL 9 must audit all uses of the delete_module system call.
      rules:
          - audit_rules_kernel_module_loading_delete
      status: automated

    - id: RHEL-09-654080
      levels:
          - medium
      title: RHEL 9 must audit all uses of the init_module and finit_module system calls.
      rules:
          - audit_rules_kernel_module_loading_finit
          - audit_rules_kernel_module_loading_init
      status: automated

    - id: RHEL-09-654085
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chage command.
      rules:
          - audit_rules_privileged_commands_chage
      status: automated

    - id: RHEL-09-654090
      levels:
          - medium
      title: RHEL 9 must audit all uses of the chsh command.
      rules:
          - audit_rules_privileged_commands_chsh
      status: automated

    - id: RHEL-09-654095
      levels:
          - medium
      title: RHEL 9 must audit all uses of the crontab command.
      rules:
          - audit_rules_privileged_commands_crontab
      status: automated

    - id: RHEL-09-654096
      title: RHEL 9 must audit any script or executable called by cron as root or by any privileged user.
      rules:
          - audit_rules_etc_cron_d
          - audit_rules_var_spool_cron
      status: automated

    - id: RHEL-09-654100
      levels:
          - medium
      title: RHEL 9 must audit all uses of the gpasswd command.
      rules:
          - audit_rules_privileged_commands_gpasswd
      status: automated

    - id: RHEL-09-654105
      levels:
          - medium
      title: RHEL 9 must audit all uses of the kmod command.
      rules:
          - audit_rules_privileged_commands_kmod
      status: automated

    - id: RHEL-09-654110
      levels:
          - medium
      title: RHEL 9 must audit all uses of the newgrp command.
      rules:
          - audit_rules_privileged_commands_newgrp
      status: automated

    - id: RHEL-09-654115
      levels:
          - medium
      title: RHEL 9 must audit all uses of the pam_timestamp_check command.
      rules:
          - audit_rules_privileged_commands_pam_timestamp_check
      status: automated

    - id: RHEL-09-654120
      levels:
          - medium
      title: RHEL 9 must audit all uses of the passwd command.
      rules:
          - audit_rules_privileged_commands_passwd
      status: automated

    - id: RHEL-09-654125
      levels:
          - medium
      title: RHEL 9 must audit all uses of the postdrop command.
      rules:
          - audit_rules_privileged_commands_postdrop
      status: automated

    - id: RHEL-09-654130
      levels:
          - medium
      title: RHEL 9 must audit all uses of the postqueue command.
      rules:
          - audit_rules_privileged_commands_postqueue
      status: automated

    - id: RHEL-09-654135
      levels:
          - medium
      title: RHEL 9 must audit all uses of the ssh-agent command.
      rules:
          - audit_rules_privileged_commands_ssh_agent
      status: automated

    - id: RHEL-09-654140
      levels:
          - medium
      title: RHEL 9 must audit all uses of the ssh-keysign command.
      rules:
          - audit_rules_privileged_commands_ssh_keysign
      status: automated

    - id: RHEL-09-654145
      levels:
          - medium
      title: RHEL 9 must audit all uses of the su command.
      rules:
          - audit_rules_privileged_commands_su
      status: automated

    - id: RHEL-09-654150
      levels:
          - medium
      title: RHEL 9 must audit all uses of the sudo command.
      rules:
          - audit_rules_privileged_commands_sudo
      status: automated

    - id: RHEL-09-654155
      levels:
          - medium
      title: RHEL 9 must audit all uses of the sudoedit command.
      rules:
          - audit_rules_privileged_commands_sudoedit
      status: automated

    - id: RHEL-09-654160
      levels:
          - medium
      title: RHEL 9 must audit all uses of the unix_chkpwd command.
      rules:
          - audit_rules_privileged_commands_unix_chkpwd
      status: automated

    - id: RHEL-09-654165
      levels:
          - medium
      title: RHEL 9 must audit all uses of the unix_update command.
      rules:
          - audit_rules_privileged_commands_unix_update
      status: automated

    - id: RHEL-09-654170
      levels:
          - medium
      title: RHEL 9 must audit all uses of the userhelper command.
      rules:
          - audit_rules_privileged_commands_userhelper
      status: automated

    - id: RHEL-09-654175
      levels:
          - medium
      title: RHEL 9 must audit all uses of the usermod command.
      rules:
          - audit_rules_privileged_commands_usermod
      status: automated

    - id: RHEL-09-654180
      levels:
          - medium
      title: RHEL 9 must audit all uses of the mount command.
      rules:
          - audit_rules_privileged_commands_mount
      status: automated

    - id: RHEL-09-654185
      levels:
          - medium
      title: Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_init
      status: automated

    - id: RHEL-09-654190
      levels:
          - medium
      title: Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_poweroff
      status: automated

    - id: RHEL-09-654195
      levels:
          - medium
      title: Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_reboot
      status: automated

    - id: RHEL-09-654200
      levels:
          - medium
      title: Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.
      rules:
          - audit_privileged_commands_shutdown
      status: automated

    - id: RHEL-09-654205
      levels:
          - medium
      title: Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit
          record.
      rules:
          - audit_rules_dac_modification_umount
      status: automated

    - id: RHEL-09-654210
      levels:
          - medium
      title: Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit
          record.
      rules:
          - audit_rules_dac_modification_umount2
      status: automated

    - id: RHEL-09-654215
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/sudoers.
      rules:
          - audit_rules_sudoers
      status: automated

    - id: RHEL-09-654220
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/sudoers.d/ directory.
      rules:
          - audit_rules_sudoers_d
      status: automated

    - id: RHEL-09-654225
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/group.
      rules:
          - audit_rules_usergroup_modification_group
      status: automated

    - id: RHEL-09-654230
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/gshadow.
      rules:
          - audit_rules_usergroup_modification_gshadow
      status: automated

    - id: RHEL-09-654235
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/opasswd.
      rules:
          - audit_rules_usergroup_modification_opasswd
      status: automated

    - id: RHEL-09-654240
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/passwd.
      rules:
          - audit_rules_usergroup_modification_passwd
      status: automated

    - id: RHEL-09-654245
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /etc/shadow.
      rules:
          - audit_rules_usergroup_modification_shadow
      status: automated

    - id: RHEL-09-654250
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /var/log/faillock.
      rules:
          - audit_rules_login_events_faillock
      status: automated

    - id: RHEL-09-654255
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /var/log/lastlog.
      rules:
          - audit_rules_login_events_lastlog
      status: automated

    - id: RHEL-09-654260
      levels:
          - medium
      title: RHEL 9 must generate audit records for all account creations, modifications, disabling,
          and termination events that affect /var/log/tallylog.
      rules:
          - audit_rules_login_events_tallylog
      status: automated

    - id: RHEL-09-654265
      levels:
          - medium
      title: RHEL 9 must take appropriate action when a critical audit processing failure occurs.
      rules:
          - audit_rules_system_shutdown
      status: automated

    - id: RHEL-09-654270
      levels:
          - medium
      title: RHEL 9 audit system must protect logon UIDs from unauthorized change.
      rules:
          - audit_rules_immutable_login_uids
      status: automated

    - id: RHEL-09-654275
      levels:
          - medium
      title: RHEL 9 audit system must protect auditing rules from unauthorized change.
      rules:
          - audit_rules_immutable
      status: automated

    - id: RHEL-09-671010
      levels:
          - high
      title: RHEL 9 must enable FIPS mode.
      rules:
          - enable_fips_mode
          - sysctl_crypto_fips_enabled
          - var_system_crypto_policy=fips_stig
          - enable_dracut_fips_module
      status: automated

    - id: RHEL-09-671015
      levels:
          - medium
      title: RHEL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.
      rules:
          - accounts_password_all_shadowed_sha512
      status: automated

    - id: RHEL-09-671020
      levels:
          - medium
      title: RHEL 9 IP tunnels must use FIPS 140-2/140-3 approved cryptographic algorithms.
      rules:
          - configure_libreswan_crypto_policy
      status: automated

    - id: RHEL-09-671025
      levels:
          - medium
      title: RHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3
          approved cryptographic hashing algorithm for system authentication.
      rules:
          - set_password_hashing_algorithm_passwordauth
      status: automated

    - id: RHEL-09-672015
      levels:
          - high
      title: RHEL 9 crypto policy files must match files shipped with the operating system.
      status: pending

    - id: RHEL-09-672020
      levels:
          - medium
      title: RHEL 9 crypto policy must not be overridden.
      status: pending

    - id: RHEL-09-672025
      levels:
          - medium
      title: RHEL 9 must use mechanisms meeting the requirements of applicable federal laws, executive
          orders, directives, policies, regulations, standards, and guidance for authentication to a
          cryptographic module.
      rules:
          - configure_kerberos_crypto_policy
      status: automated

    - id: RHEL-09-672030
      levels:
          - high
      title: RHEL 9 must implement DOD-approved TLS encryption in the GnuTLS package.
      rules:
          - configure_crypto_policy
      status: automated

    - id: RHEL-09-672050
      levels:
          - medium
      title: RHEL 9 must implement DOD-approved encryption in the bind package.
      rules:
          - configure_bind_crypto_policy
      status: automated