CIS Red Hat Enterprise Linux 9 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /tmp Is a Separate Partition may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt /tmp
# Should show /tmp as a mounted partition
systemctl is-enabled tmp.mount

systemctl unmask tmp.mount
systemctl enable --now tmp.mount
# Or add to /etc/fstab:
# tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec 0 0

This recommendation verifies that nodev,nosuid,noexec Options on /tmp on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nodev,nosuid,noexec Options on /tmp may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n /tmp | grep -E 'nodev|nosuid|noexec'

# In /etc/fstab for /tmp:
tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec 0 0
mount -o remount /tmp

This recommendation verifies that /var Is a Separate Partition on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /var Is a Separate Partition may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt /var

Create a dedicated partition for /var during OS installation or migrate with LVM.

This recommendation verifies that /var/log and /var/log/audit Are Separate Partitions on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /var/log and /var/log/audit Are Separate Partitions may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt /var/log
findmnt /var/log/audit

Create dedicated partitions during installation. Prevents log data from filling the root filesystem.

This recommendation verifies that /home Is a Separate Partition on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /home Is a Separate Partition may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt /home

Create a dedicated partition for /home with nodev and nosuid mount options.

This recommendation addresses the proper configuration of GPG Keys on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of GPG Keys can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'

rpm --import https://www.redhat.com/security/team/key/

This recommendation verifies that gpgcheck Is Globally Activated on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to gpgcheck Is Globally Activated may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep ^gpgcheck /etc/dnf/dnf.conf
# Should be gpgcheck=1

grep -r ^gpgcheck /etc/yum.repos.d/

sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/dnf/dnf.conf

This recommendation addresses the proper configuration of Package Manager Repositories on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Package Manager Repositories can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

dnf repolist
# Verify only authorized repositories are listed

Remove unauthorized repositories from /etc/yum.repos.d/ and ensure all repos use HTTPS with GPG validation.

This recommendation verifies that SELinux Is Installed on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sELinux Is Installed may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q libselinux

dnf install libselinux

This recommendation verifies that SELinux Is Enforcing on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sELinux Is Enforcing may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

getenforce
# Should return: Enforcing

grep -E '^\s*SELINUX=' /etc/selinux/config
# Should be SELINUX=enforcing

# /etc/selinux/config:
SELINUX=enforcing
SELINUXTYPE=targeted

# Apply immediately:
setenforce 1

This recommendation verifies that SELinux Policy Is targeted on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sELinux Policy Is targeted may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sestatus | grep 'Loaded policy'
# Should show: targeted

# /etc/selinux/config:
SELINUXTYPE=targeted

This recommendation verifies that No Unconfined Services is present on the RHEL 9 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Unconfined Services leaves the RHEL 9 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

ps -eZ | grep unconfined_service_t
# Should return empty

Create or modify SELinux policies for unconfined services. Use audit2allow to generate custom policies.

This recommendation verifies that GRUB Bootloader Password Is Set on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to gRUB Bootloader Password Is Set may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^GRUB2_PASSWORD' /boot/grub2/user.cfg 2>/dev/null || \
grep '^password' /boot/grub2/grub.cfg

grub2-setpassword
# Enter password when prompted
grub2-mkconfig -o /boot/grub2/grub.cfg

This recommendation addresses the proper configuration of Permissions on Bootloader Config on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Permissions on Bootloader Config can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

stat -c '%a %U %G' /boot/grub2/grub.cfg
# Should be 600 root root

chmod 600 /boot/grub2/grub.cfg
chown root:root /boot/grub2/grub.cfg

This recommendation addresses the proper configuration of chrony on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of chrony can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

systemctl is-enabled chronyd
chronyc sources
grep -E '^(server|pool)' /etc/chrony.conf

dnf install chrony
systemctl enable --now chronyd

# /etc/chrony.conf:
pool 2.rhel.pool.ntp.org iburst

This recommendation verifies that chrony Runs as Non-Root User on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to chrony Runs as Non-Root User may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^user' /etc/chrony.conf
# Should be: user chrony
ps -ef | grep chronyd

# /etc/chrony.conf:
user chrony

X Window System should not be installed on the RHEL 9 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If X Window System remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dnf list installed xorg-x11-server* 2>/dev/null
# Should return no packages

dnf remove xorg-x11-server*

Avahi, CUPS, DHCP, DNS, FTP, NFS, Samba, HTTP, IMAP/POP3, Squid, SNMP, TFTP should not be installed on the RHEL 9 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If Avahi, CUPS, DHCP, DNS, FTP, NFS, Samba, HTTP, IMAP/POP3, Squid, SNMP, TFTP remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dnf list installed avahi cups dhcp-server bind vsftpd \
  nfs-utils samba httpd dovecot squid net-snmp tftp-server 2>/dev/null

dnf remove avahi cups dhcp-server bind vsftpd \
  nfs-utils samba httpd dovecot squid net-snmp tftp-server

This recommendation verifies that Mail Transfer Agent Is Local-Only on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mail Transfer Agent Is Local-Only may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ss -lntu | grep ':25\b'
# Should only show 127.0.0.1:25 or [::1]:25

# /etc/postfix/main.cf:
inet_interfaces = loopback-only

systemctl restart postfix

This setting controls whether IP Forwarding is disabled on the RHEL 9 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving IP Forwarding enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the RHEL 9 operating system.

sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding
# Both should be 0

# /etc/sysctl.d/60-netipv4.conf:
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv6.conf.all.forwarding=0

This recommendation verifies that Source Routed Packets Are Not Accepted on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to source Routed Packets Are Not Accepted may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_source_route
sysctl net.ipv4.conf.default.accept_source_route
# Both should be 0

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

This recommendation verifies that ICMP Redirects Are Not Accepted on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iCMP Redirects Are Not Accepted may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
# Both should be 0

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

This recommendation ensures that Suspicious Packets events are logged on the RHEL 9 operating system. Comprehensive logging enables detection of security incidents, supports forensic investigation, and satisfies compliance and audit requirements.

Without adequate logging of Suspicious Packets, security incidents may go undetected and forensic investigation becomes difficult or impossible. Comprehensive audit trails are essential for compliance and incident response.

sysctl net.ipv4.conf.all.log_martians
sysctl net.ipv4.conf.default.log_martians
# Both should be 1

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

This setting controls whether TCP SYN Cookies is enabled on the RHEL 9 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via system configuration files, sysctl, or systemd settings.

Without TCP SYN Cookies enabled, the RHEL 9 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

sysctl net.ipv4.tcp_syncookies
# Should be 1

net.ipv4.tcp_syncookies = 1

This recommendation verifies that firewalld Is Installed and Running on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to firewalld Is Installed and Running may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q firewalld
systemctl is-enabled firewalld
systemctl is-active firewalld

dnf install firewalld
systemctl enable --now firewalld

This recommendation verifies that nftables/iptables Are Not Enabled Alongside firewalld on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nftables/iptables Are Not Enabled Alongside firewalld may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemctl is-enabled nftables 2>/dev/null
systemctl is-enabled iptables 2>/dev/null
# Should be disabled or masked

systemctl --now mask nftables
systemctl --now mask iptables

This recommendation verifies that Default Zone Is Set on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Zone Is Set may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

firewall-cmd --get-default-zone
# Should be a restrictive zone like "drop" or "public"

firewall-cmd --set-default-zone=public

This recommendation verifies that rsyslog Is Installed and Enabled on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rsyslog Is Installed and Enabled may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q rsyslog
systemctl is-enabled rsyslog

dnf install rsyslog
systemctl enable --now rsyslog

File and directory permissions for rsyslog Default File should be set to 0640. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the RHEL 9 operating system.

Incorrect permissions on rsyslog Default File could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

grep '^\$FileCreateMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
# Should be 0640

# /etc/rsyslog.conf:
$FileCreateMode 0640

This recommendation verifies that rsyslog Is Configured to Send Logs to Remote Server on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rsyslog Is Configured to Send Logs to Remote Server may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*([^#]+\s+)?@@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf

# /etc/rsyslog.d/remote.conf:
*.* @@loghost.example.com:514

This recommendation verifies that auditd Is Installed and Enabled on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to auditd Is Installed and Enabled may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q audit audit-libs
systemctl is-enabled auditd

dnf install audit audit-libs
systemctl enable --now auditd

This recommendation addresses the proper configuration of Audit Log Storage Size on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Audit Log Storage Size can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep max_log_file /etc/audit/auditd.conf
# Recommended: max_log_file = 256

# /etc/audit/auditd.conf:
max_log_file = 256
max_log_file_action = keep_logs

This recommendation verifies that Events for Identity Changes Are Collected on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to events for Identity Changes Are Collected may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'identity|passwd|shadow|group|gshadow|opasswd'

# /etc/audit/rules.d/identity.rules:
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

This recommendation verifies that Login and Logout Events Are Collected on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to login and Logout Events Are Collected may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'logins|faillog|lastlog|tallylog'

# /etc/audit/rules.d/logins.rules:
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock -p wa -k logins

This recommendation addresses the proper configuration of Permissions on /etc/ssh/sshd_config on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Permissions on /etc/ssh/sshd_config can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

stat -c '%a %U %G' /etc/ssh/sshd_config
# Should be 600 root root

chmod 600 /etc/ssh/sshd_config
chown root:root /etc/ssh/sshd_config

This setting controls whether SSH Root Login is disabled on the RHEL 9 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSH Root Login enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the RHEL 9 operating system.

sshd -T | grep permitrootlogin
# Should be: permitrootlogin no

# /etc/ssh/sshd_config:
PermitRootLogin no

systemctl restart sshd

This recommendation configures SSH Protocol to 2 on the RHEL 9 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for SSH Protocol could weaken security controls or allow unintended behavior. Setting this to 2 ensures the RHEL 9 operating system operates within a well-defined security boundary.

sshd -T | grep protocol
# RHEL 9 OpenSSH defaults to protocol 2 only

# /etc/ssh/sshd_config (if needed):
Protocol 2

This recommendation configures SSH MaxAuthTries to 4 or Less on the RHEL 9 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for SSH MaxAuthTries could weaken security controls or allow unintended behavior. Setting this to 4 or Less ensures the RHEL 9 operating system operates within a well-defined security boundary.

sshd -T | grep maxauthtries
# Should be 4 or less

MaxAuthTries 4

This setting controls whether SSH PermitEmptyPasswords is disabled on the RHEL 9 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSH PermitEmptyPasswords enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the RHEL 9 operating system.

sshd -T | grep permitemptypasswords
# Should be: no

PermitEmptyPasswords no

This recommendation verifies that Strong SSH Ciphers and MACs on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to strong SSH Ciphers and MACs may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep ciphers
sshd -T | grep macs
sshd -T | grep kexalgorithms

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

This recommendation verifies that Password Minimum Length Is 14 or More on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Minimum Length Is 14 or More may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*minlen' /etc/security/pwquality.conf
# Should be minlen = 14 or more

# /etc/security/pwquality.conf:
minlen = 14

This recommendation addresses the proper configuration of Password Complexity on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Password Complexity can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E '^\s*(dcredit|ucredit|lcredit|ocredit)' /etc/security/pwquality.conf

# /etc/security/pwquality.conf:
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1

This recommendation configures the expiration for Password on the RHEL 9 operating system. Appropriate expiration values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to password Expiration Is 365 Days or Less may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep PASS_MAX_DAYS /etc/login.defs
# Should be 365 or less

# /etc/login.defs:
PASS_MAX_DAYS 365
PASS_MIN_DAYS 7
PASS_WARN_AGE 7

This recommendation addresses the proper configuration of Account Lockout on the RHEL 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Account Lockout can lead to security gaps that may be exploited by attackers. A properly configured RHEL 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E 'pam_faillock' /etc/pam.d/system-auth /etc/pam.d/password-auth
grep -E 'deny|unlock_time' /etc/security/faillock.conf

# /etc/security/faillock.conf:
deny = 5
unlock_time = 900
fail_interval = 900

This recommendation verifies that Root Account Login Is Tracked on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to root Account Login Is Tracked may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*SULOG_FILE' /etc/login.defs
# Review /var/log/secure for su/sudo activity

Ensure all root access is through sudo and monitored. Disable direct root login via TTY and SSH.

This recommendation verifies that Default Group for Root Is GID 0 on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Group for Root Is GID 0 may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^root:' /etc/passwd | cut -d: -f4
# Should be 0

usermod -g 0 root

This recommendation verifies that No Accounts Have Empty Passwords on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no Accounts Have Empty Passwords may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "") {print $1}' /etc/shadow
# Should return empty

Set passwords or lock accounts with empty passwords: passwd -l <username>

This recommendation configures the timeout for Default User Shell on the RHEL 9 operating system. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to default User Shell Timeout Is 900 Seconds may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*TMOUT' /etc/profile /etc/profile.d/*.sh /etc/bashrc
# Should be 900 or less

# /etc/profile.d/tmout.sh:
readonly TMOUT=900
export TMOUT

This recommendation verifies that Permissions on /etc/passwd Are 644 on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to permissions on /etc/passwd Are 644 may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/passwd
# Should be 644 root root

chmod 644 /etc/passwd
chown root:root /etc/passwd

This recommendation verifies that Permissions on /etc/shadow Are 0000 on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to permissions on /etc/shadow Are 0000 may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/shadow
# Should be 0 root root

chmod 0000 /etc/shadow
chown root:root /etc/shadow

This recommendation verifies that No World-Writable Files is present on the RHEL 9 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No World-Writable Files leaves the RHEL 9 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

find / -xdev -type f -perm -0002 -print 2>/dev/null
# Should return empty

Remove world-writable permission: chmod o-w <file>

This recommendation verifies that No SUID/SGID Files Are Unauthorized on the RHEL 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no SUID/SGID Files Are Unauthorized may leave the RHEL 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# SUID files:
find / -xdev -type f -perm -4000 -print 2>/dev/null

# SGID files:
find / -xdev -type f -perm -2000 -print 2>/dev/null

Review each file. Remove SUID/SGID bits from unauthorized files: chmod u-s <file> or chmod g-s <file>

This recommendation verifies that No Duplicate UIDs is present on the RHEL 9 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Duplicate UIDs leaves the RHEL 9 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

cut -d: -f3 /etc/passwd | sort | uniq -d
# Should return empty

Assign unique UIDs to accounts with duplicates using usermod -u <new-uid> <user>.

This recommendation verifies that No Duplicate GIDs is present on the RHEL 9 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Duplicate GIDs leaves the RHEL 9 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

cut -d: -f3 /etc/group | sort | uniq -d
# Should return empty

Assign unique GIDs using groupmod -g <new-gid> <group>.

This recommendation verifies that All Users' Home Directories is present on the RHEL 9 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of All Users' Home Directories leaves the RHEL 9 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

awk -F: '($3 >= 1000 && $7 != "/sbin/nologin") {print $1":"$6}' /etc/passwd | \
  while IFS=: read user dir; do
    [ ! -d "$dir" ] && echo "Missing: $user -> $dir"
  done

Create missing home directories with appropriate ownership and permissions.