root/trunk/RHEL5/kickstart/clip.ks

Revision 274, 92.0 kB (checked in by bwhalen, 3 months ago)

Fix bug in clip that prevented cron from being able to run.

http://oss.tresys.com/projects/clip/ticket/33

Line 
1 ## Version .04  January 2008 ##
2 #
3 #  Date Created  : 2007-02-06 #
4 #
5 #  CHANGELOG:
6 #  - 2007-02-07:  Finished Mapping existing STIG scripts to DCID 6/3
7 #                 Sections. [St. Laurent]
8 #  - 2007-12-xx:  Initiated updates to reflect DCID PL4 Requirements
9 #                 [Tresys]
10 #  - 2008-01-xx:  Added/updated STIG scripts. Finalized kickstart
11 #                 procedures. [Tresys]
12 #
13 #
14 #  Profile Name: dcid-6-3-PL4-ks.1.0.txt
15 #  Profile Label: dcid-6-3-PL4-ks.1.0.txt
16 #
17 # Details: This KickStart file lists out DCID 6/3 Policy at the PL4
18 #          Confidentiality level.  Security settings are applied and
19 #          mapped to each specific PL4 section in DCID 6/3.
20 #
21 #          By setting these security features in a KickStart file
22 #          allows for an auditor to have a high degree of assurance
23 #          that a system is being setup meeting the security
24 #          requirements the same (correct way) every time.
25 #
26 #          A SHA-1 should be created to ensure a degree of
27 #          resistance to unauthorized modification.
28 #
29 ## Version .02  February 2007 ##
30 ## Version .03  December 2007 ##
31 ## Version .04  January 2008 ##
32
33
34
35 # The "install" command tells the system to install a fresh system
36 # rather than upgrade an existing system.  You must specify the type
37 # of installation in the form of:  cdrom, harddrive, nfs, url (ftp
38 # http installation).  The "install" command and the installation
39 # method command must be on separate lines. Examples:
40 # url --url http://<server>/<dir>
41 #     --url ftp://<username>:<password>@<server>/<dir>   
42 #           Passwd is in CLEAR with ftp!!!  Not to be used.
43 # harddrive --partition=hda2--dir=/path/to/install-tree
44 # nfs --server=nfsserver.example.com --dir=/path/to/install-tree
45 install
46
47 # Perform the kickstart install in Text Mode.  Installs are
48 # performed in graphical mode by default.
49 text
50
51 # Defaults to a CD based install - disable if using URL or someother media
52 # Use the network option if installing from a remote installation tree.
53 cdrom
54
55 # Configure network information for the system.  The "network"
56 # option configures networking information for installations from an
57 # installation tree on a remote server via NFS, FTP, or HTTP. DHCP
58 # uses a DHCP server to get the network configuration information.
59 #network --bootproto dhcp
60
61 # Perform a remote install.
62 # The network option is required if performing a remote install
63 #url --url http://<server>/<dir>
64 #url --ftp ftp://<username>:<password>@<server>/<dir>
65
66
67 # The "lang" command sets the language to use during installation.
68 lang en_US
69
70 # The "langsupport" to install on the system.  The --default switch
71 # must be used if more than one language is specified.
72 langsupport --default en_US en_US
73
74 # The "keyboard" command is required to set the system keyboard type.
75 keyboard us
76
77 # The "mouse" command is required to configure the mouse type.
78 # Giving no options will attempt to automatically detect the mouse.
79 mouse
80
81
82 ##### WARNING: THIS WILL ERASE YOUR SYSTEM #####
83 # A full backup should be performed before installation.
84 zerombr yes
85 clearpart --all
86
87
88 # PARTITION NOTES
89 # The following options are required under 'Disk Partition Information'
90 # section in ks.cfg file, for creating the Logical Volume Manager (LVM)
91 # partitions using kickstart.
92  
93    #Disk partitioning information
94    #part pv.<id>
95    #volgroup <name> <partition>
96    #logvol <mountpoint> --vgname=<volume_group_name> --size=<size> --name=<name>
97
98    #EXAMPLE using LVM
99    #part /boot --fstype ext3 --size=150
100    #part swap --size=1024
101    #part pv.01 --size=1 --grow
102    #volgroup vg_root pv.01
103    #logvol  /  --vgname=vg_root  --size=8192  --name=lv_root
104    #logvol  /var  --vgname=vg_root  --size=4096  --name=lv_var
105    #logvol  /tmp  --vgname=vg_root  --size=2048  --name=lv_tmp
106    #logvol  /spare  --vgname=vg_root  --size=1  --grow  --name=lv_spare
107
108 partition /boot --fstype "ext3" --size=128
109 partition pv.2 --size=0 --grow
110 volgroup VolGroup00 pv.2
111 logvol swap --fstype swap --name=swapVol --vgname=VolGroup00 --size=512
112 logvol / --fstype ext3 --name=rootVol --vgname=VolGroup00 --size=1024 --grow
113 logvol /var --fstype ext3 --name=varVol --vgname=VolGroup00 --size=1024 --grow
114 logvol /home --fstype ext3 --name=homeVol --vgname=VolGroup00 --size=256 --grow
115 logvol /tmp --fstype ext3 --name=tmpVol --vgname=VolGroup00 --size=1024
116
117
118 # Specifies how the GRUB bootloader should be installed.
119 # Set a password to prevent any non-stadard boot options.
120 # The password should be changed after installation.
121 bootloader --location mbr --password 123)(*qweASD
122
123 # Set the root password.
124 # This should be changed after installation.
125 rootpw 123)(*qweASD
126
127 # Set the authentication options for the system.
128 # Similar to the authconfig command.
129 auth --enablemd5 --enableshadow
130
131 # Set the timezone
132 timezone --utc America/New_York
133
134 # Enable selinux
135 selinux --enforcing
136
137 # Enable the firewall
138 firewall --enabled --port=22:tcp --port=161:tcp --port=1002:tcp
139
140 # Reboot after installation is complete
141 reboot
142
143
144
145
146 # Install Packages.  This is site specific.
147 %packages --resolvedeps
148 @base
149 policycoreutils-newrole
150 aide
151 sysstat
152 setools
153 audit
154 #####################################
155 # Remove tcpdump per STIG gen003865 #
156 #####################################
157 -tcpdump
158
159 #####################################
160 # Remove Packages for PL4 compliance#
161 #####################################
162 -xdelta
163 -nmap
164 -emacspeak
165 -byacc
166 -gimp-help
167 -splint
168 -perl-Crypt-SSLeay
169 -units
170 -perl-XML-Grove
171 -perl-XML-LibXML-Common
172 -perl-XML-SAX
173 -perl-XML-Twig
174 -valgrind
175 -valgrind-callgrind
176 -gimp-gap
177 -cdecl
178 -perl-XML-Dumper
179 -kernel-smp-devel
180 -blas
181 -lapack
182 -java-1.4.2-gcj-compat
183 -kernel-hugemem-devel
184 -kernel-devel
185 -perl-XML-Encoding
186 -gnome-games
187 -isdn4k-utils
188 -vnc
189 -vnc-server
190 #e2fsprogs
191 #kernel-smp
192 -tog-pegasus
193 -tog-pegasus-devel
194 -ethereal
195 -ethereal-gnome
196 -xchat
197 -vino
198 -gaim
199 -gnome-pilot
200 -bluez-utils
201 -bluez-utils-cups
202 -bluez-hcidump
203 -bluez-gnome
204 -yum-updatesd
205 -wpa_supplicant
206 -ypbind
207 -NetworkManager
208 -NetworkManagerDispatcher
209 -setools
210 -telnet
211 -wireless-tools
212 #@ office
213 #@ admin-tools
214 #@ editors
215 #@ system-tools
216 #@ gnome-desktop
217 #@ dialup
218 #@ base-x
219 #@ printing
220 #@ server-cfg
221 #@ graphical-internet
222 #kernel
223 -python-ldap
224 -httpd-suexec
225 -system-config-httpd
226 -psgml
227 -emacs-leim
228 -gimp-data-extras
229 -xcdroast
230 -perl-XML-LibXML
231 -gimp-print-plugin
232 -xsane-gimp
233 -gimp
234 #lvm2
235 -zsh
236 #net-snmp-utils
237 -rhythmbox
238 -gcc-g77
239 #grub
240 -texinfo
241 -octave
242 -dia
243 -perl-LDAP
244 -oprofile
245 -emacs
246 #system-config-printer-gui
247 -doxygen
248 -planner
249 -tux
250 -indent
251 -cdparanoia
252 -gcc-java
253 -gnomemeeting
254 #openoffice.org-i18n
255 #openoffice.org-libs
256 #openoffice.org
257 #firefox
258 -evolution
259 -xsane
260 -ctags
261 -cscope
262 -sane-frontends
263 -perl-XML-Parser
264 -php-mysql
265 -rcs
266 -perl-XML-NamespaceSupport
267 #get rid of rlogin
268 -rsh
269
270 # needed to compile policy
271 rpm-build
272 gcc
273 checkpolicy
274
275 %pre
276
277
278
279 ##### No changes should be made beyond this point #####
280
281
282
283 %post
284 # Log %post errors
285 ##########################################################################
286 # The post section of this kickstart file takes care of the secure
287 # configuraton of Red Hat according to DCID 6/3.
288 #
289 # Levels of Concern:
290 # Confidentiality PL4
291 # [ PL4 ]
292 ##########################################################################
293
294
295 # The Red Hat provided GPG key Red Hat uses to sign all of our RPM packages
296 rpm --import /usr/share/rhn/RPM-GPG-KEY
297
298
299
300
301
302 ##########################################################################
303 # UNIX STIG v5r1
304 ##########################################################################
305
306 ## (GEN000020: CAT II) (Previously – G001) The IAO and SA will ensure, if
307 ## configurable, the UNIX host is configured to require a password for access
308 ## to single-user and maintenance modes.
309 echo "" >> /etc/inittab
310 echo "#Require password in single-user mode" >> /etc/inittab
311 echo "~~:S:wait:/sbin/sulogin" >> /etc/inittab
312
313 ## (GEN000400: CAT II) (Previously – G010) The SA will ensure a logon-warning banner is
314 ## displayed on all devices and sessions at the initial logon.
315 cat <<-EOF > /etc/issue
316         You are accessing a U.S. Government (USG) information system (IS) that is
317         provided for USG-authorized use only.
318
319         By using this IS, you consent to the following conditions:
320
321         -The USG routinely monitors communications occurring on this IS, and any
322         device attached to this IS, for purposes including, but not limited to,
323         penetration testing, COMSEC monitoring, network defense, quality control,
324         and employee misconduct, law enforcement, and counterintelligence
325         investigations.
326         -At any time, the USG may inspect and/or seize data stored on this IS and
327         any device attached to this IS.
328         -Communications occurring on or data stored on this IS, or any device
329         attached to this IS, are not private. They are subject to routine
330         monitoring and search.
331         -Any communications occurring on or data stored on this IS, or any device
332         attached to this IS, may be disclosed or used for any USG-authorized purpose.
333         -Security protections may be utilized on this IS to protect certain interests
334         that are important to the USG. For example, passwords, access cards,
335         encryption or biometric access controls provide security for the benefit of
336         the USG. These protections are not provided for your benefit or privacy and
337         may be modified or elimiated at the USG's discretion.
338
339 EOF
340 sed -i "/^#Banner/ c\Banner /etc/issue" /etc/ssh/sshd_config
341 sed -i  "s/^\(PATH=.*\)/\/usr\/bin\/gdialog --yesno \"\`cat \/etc\/issue\`\"\nif( test 1 -eq \$\? ); then\n  \/usr\/bin\/gdialog --infobox \"Logging out in 10 Seconds\" 1 20 \&\n  sleep 10\n  exit 1\nfi\n\n\1/" /etc/gdm/PreSession/Default
342
343 ## (GEN000440: CAT II) (Previously – G012) The SA will ensure all logon attempts (both
344 ## successful and unsuccessful) are logged to a system log file.
345 echo "auth.*                                                    /var/log/authlog" >> /etc/syslog.conf
346
347 ## (GEN000460: CAT II) (Previously – G013) The SA will ensure, after three consecutive
348 ## failed logon attempts for an account, the account is locked for 15 minutes or until
349 ## the SA unlocks the account.
350 cat <<-EOF > /etc/pam.d/system-auth
351 #%PAM-1.0
352 auth        required      pam_tally.so deny=3 onerr=fail unlock_time=900 quiet
353
354 auth        required      pam_env.so
355 auth        required      pam_unix.so nullok try_first_pass audit
356
357 account     required      pam_unix.so
358 account     required      pam_tally.so
359 password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2
360 password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12
361
362 session     optional      pam_keyinit.so revoke
363 session     required      pam_limits.so
364 session     required      pam_unix.so
365 EOF
366 chmod ugo-x /usr/sbin/authconfig
367
368 ## (GEN000480: CAT II) (Previously – G015) The SA will ensure the logon delay between
369 ## logon prompts after a failed logon is set to at least four seconds.
370 echo "FAIL_DELAY                      4" >> /etc/login.defs
371
372 ## (GEN000500: CAT II) (Previously – G605) The SA will configure systems to log
373 ## out interactive processes (i.e., terminal sessions, ssh sessions, etc.,)
374 ## after 15 minutes of inactivity or ensure a password protected screen lock
375 ## mechanism is used and is set to lock the screen after 15 minutes of
376 ## inactivity.
377 echo "TMOUT=900" >> /etc/profile
378
379 ## (GEN000540: CAT II) (Previously – G004) The SA will ensure passwords are
380 ## not changed more than once a day.
381 sed -i '/^PASS_MIN_DAYS/ c\PASS_MIN_DAYS\t1' /etc/login.defs
382
383 ## (GEN000560: CAT I) (Previously – G018) The SA will ensure each account in
384 ## the /etc/passwd file has a password assigned or is disabled in the
385 ## password, shadow, or equivalent, file by disabling the password and/or by
386 ## assigning a false shell in the password file.
387 for USERINFO in `cat /etc/shadow`; do
388 if [ -z "`echo $USERINFO | cut -d: -f2`" ]
389 then
390         /usr/sbin/usermod -L -s /dev/null `echo $USERINFO | cut -d: -f1`
391 fi
392 done;
393
394 ## (GEN000580: CAT II) (Previously – G019) The IAO will ensure all passwords contain a
395 ## minimum of eight characters.
396 sed -i "s/PASS_MIN_LEN[ \t]*[0-9]*/PASS_MIN_LEN\t8/" /etc/login.defs
397
398 ## (GEN000600: CAT II) (Previously – G019) The IAO will ensure passwords include at
399 ## least two alphabetic characters, one of which must be capitalized.
400 # See GEN000460
401
402 ## (GEN000700: CAT II) (Previously – G020) The SA will ensure passwords are
403 ## changed at least every 90 days.
404 sed -i '/^PASS_MAX_DAYS/ c\PASS_MAX_DAYS\t90' /etc/login.defs
405
406 ## (GEN000800: CAT II) (Previously – G606) The SA will ensure passwords will not be
407 ## reused within the last ten changes.
408 # See GEN000460
409
410 ## (GEN000920: CAT II) (Previously – G023) The SA will ensure the root account
411 ## home directory (other than ‘/’) has permissions of 700. Do not change the
412 ## permissions of the ‘/’ directory to anything other than 0755.
413 chmod 700 /root
414
415 ## (GEN000980: CAT II) (Previously – G026) The SA will ensure root can only log
416 ## on as root from the system console, and then only when necessary to perform
417 ## system maintenance.
418 echo "console" > /etc/securetty
419
420 ## (GEN001020: CAT II) The IAO will enforce users requiring root privileges to
421 ## log on to their personal account and invoke the /bin/su - command to switch
422 ## user to root.
423 # Configure sshd and login to consult pam_access.so
424 sed -i '/^account.*auth$/ a\account\t\trequired\tpam_access.so' /etc/pam.d/sshd
425 sed -i '/^account.*auth$/ a\account\t\trequired\tpam_access.so' /etc/pam.d/login
426 cat <<-EOF >> /etc/security/access.conf
427 #only access for root is cron
428 +:root: cron crond
429 -:ALL EXCEPT users :ALL
430 EOF
431 adduser -G users,wheel clipuser
432 echo "123)(*qweASD" | passwd --stdin clipuser
433
434 ## (GEN001080: CAT III) (Previously – G229) The SA will ensure the root shell
435 ## is not located in /usr if /usr is partitioned.
436 /usr/sbin/usermod -s /bin/bash root
437
438 ## (GEN001120: CAT II) (Previously – G500) The SA will configure the
439 ## encryption program for direct root access only from the system console.
440 sed -i "/^#PermitRootLogin/ c\PermitRootLogin no" /etc/ssh/sshd_config
441
442 ## (GEN001260: CAT II) (Previously – G037) The SA will ensure all system log
443 ## files have permissions of 640, or more restrictive.
444 find /var/log/ -type f -exec chmod 640 '{}' \;
445 sed -i "s/chmod 0664/chmod 0640/" /etc/rc.d/rc.sysinit
446
447 ## (GEN001280: CAT III) (Previously – G042) The SA will ensure all manual page
448 ## files (i.e.,files in the man and cat directories) have permissions of 644,
449 ## or more restrictive.
450 find /usr/share/man -type f -not -perm 644 -exec chmod 644 {} \;
451
452 ## (GEN001380: CAT II) (Previously – G048) The SA will ensure the /etc/passwd
453 ## file has permissions of 644, or more restrictive.
454 chmod 644 /etc/passwd
455
456 ## (GEN001400: CAT I) (Previously – G047) The SA will ensure the owner of the
457 ## /etc/passwd and /etc/shadow files (or equivalent) is root.
458 chown root /etc/passwd
459 chown root /etc/shadow
460
461 ## (GEN001420: CAT II) (Previously – G050) The SA will ensure the /etc/shadow
462 ## file (or equivalent) has permissions of 400.
463 chmod 400 /etc/shadow
464
465 ## (GEN001460: CAT IV) (Previously – G052) The SA will ensure all home
466 ## directories defined in the /etc/passwd file exist.
467 for HOMEDIR in `cut -d: -f6 /etc/passwd`; do
468 if [  ! -d $HOMEDIR ]
469 then
470         mkdir $HOMEDIR
471 fi
472 done;
473
474 ## (GEN001560: CAT II) (Previously – G068) The user, application developers,
475 ## and the SA will ensure user files and directories will have an initial
476 ## permission no more permissive than 700, and never more permissive than 750.
477 for BASEDIR  in /home/* /root
478 do
479         find $BASEDIR -type f -exec chmod 600 '{}' \;
480         find $BASEDIR -type d -exec chmod 700 '{}' \;
481 done
482
483 ## (GEN001580: CAT II) (Previously – G058) The SA will ensure run control
484 ## scripts have permissions of 755, or more restrictive.
485 chmod 755 /etc/rc.d/init.d/*
486
487 ## (GEN001620: CAT II) (Previously – G061) The SA will ensure run control
488 ## scripts files do not have the suid or sgid bit set.
489 chmod ug-s /etc/rc.d/init.d/*
490
491 ## (GEN001660: CAT II) (Previously – G611) The SA will ensure the owner of run
492 ## control scripts is root.
493 chown root /etc/rc.d/init.d/*
494
495 ## (GEN001680: CAT II) (Previously – G612) The SA will ensure the group owner
496 ## of run control scripts is root, sys, bin, other, or the system default.
497 chgrp root /etc/rc.d/init.d/*
498
499 ## (GEN001720: CAT II) The SA will ensure global initialization files have
500 ## permissions of 644, or more restrictive.
501 chmod 644 /etc/{profile,bashrc,environment}
502
503 ## (GEN001740: CAT II) The SA will ensure the owner of global initialization
504 ## files is root.
505 chown root /etc/{profile,bashrc,environment}
506
507 ## (GEN001760: CAT II) The SA will ensure the group owner of global
508 ## initialization files is root, sys, bin, other, or the system default.
509 chgrp root /etc/{profile,bashrc,environment}
510
511 ## (GEN001780: CAT III) (Previously – G112) The SA will ensure global
512 ## initialization files contain the command mesg –n.
513 for FILE in /etc/{profile,bashrc,environment}; do
514         echo "mesg n" >> $FILE
515 done;
516
517 ## (GEN001800: CAT II) (Previously – G038) The SA will ensure all
518 ## default/skeleton dot files have permissions of 644, or more restrictive.
519 find /etc/skel -type f -exec chmod 644 '{}' \;
520
521 ## (GEN001820: CAT II) The SA will ensure the owner of all default/skeleton
522 ## dot files is root or bin.
523 find /etc/skel -type f -exec chown root '{}' \;
524
525 ## (GEN002040: CAT I) The SA will ensure .rhosts, .shosts, hosts.equiv, nor
526 ## shosts.equiv are used, unless justified and documented with the IAO.
527 for file in /root/.rhosts /root/.shosts /etc/hosts.equiv
528 do
529         rm -f $file
530         ln -s /dev/null $file
531 done
532
533 ## (GEN002120: CAT II) (Previously – G069) The SA will ensure the /etc/shells
534 ## (or equivalent) file exits.
535 cat <<-EOF > /etc/shells
536 /bin/sh
537 /bin/bash
538 /sbin/nologin
539 /bin/tcsh
540 /bin/csh
541 /bin/ksh
542 EOF
543
544 ## (GEN002160: CAT I) (Previously – G072) The SA will ensure no shell has the
545 ## suid bit set.
546 for SHELL in `cat /etc/shells`; do
547         chmod u-s $SHELL
548 done
549
550 ## (GEN002180: CAT II) (Previously – G073) The SA will ensure no shell has the
551 ## sgid bit set.
552 for SHELL in `cat /etc/shells`; do
553         chmod g-s $SHELL
554 done
555
556 ## (GEN002200: CAT II) (Previously – G074) The SA will ensure the owner of all
557 ## shells is root or bin.
558 for SHELL in `cat /etc/shells`; do
559         chown root $SHELL
560 done
561
562 ## (GEN002220: CAT II) (Previously – G075) The SA will ensure all shells
563 ## (excluding /dev/null and sdshell) have permissions of 755, or more
564 ## restrictive.
565 for SHELL in `cat /etc/shells`; do
566         chmod 755 $SHELL
567 done
568
569 ## (GEN002320: CAT II) (Previously – G501) The SA will ensure the audio devices
570 ## have permissions of 644, or more restrictive.
571 sed -i -r "/sound|snd|mixer/ d" /etc/security/console.perms.d/50-default.perms
572 echo "SUBSYSTEM==\"sound|snd\", OWNER=\"root\", GROUP=\"root\", MODE=\"0644\"" > /etc/udev/rules.d/55-audio-perms.rules
573
574 ## (GEN002340: CAT II) (Previously – G502) The SA will ensure the owner of
575 ## audio devices is root.
576 # see GEN002320
577
578 ## (GEN002360: CAT II) (Previously – G504) The SA will ensure the group owner
579 ## of audio devices is root, sys, or bin.
580 # see GEN002320
581
582 ## (GEN002420: CAT II) (Previously – G086) The SA will ensure user filesystems,
583 ## removable media, and remote filesystems will be mounted with the nosuid
584 ## option.
585 FSTAB=/etc/fstab
586 SED=/bin/sed
587 #nosuid and acl on /home
588 if [ $(grep " \/home " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then
589         MNT_OPTS=$(grep " \/home " ${FSTAB} | awk '{print $4}')
590         ${SED} -i "s/\( \/home.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB}
591 fi
592 #nosuid and acl on /sys
593 if [ $(grep " \/sys " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then
594         MNT_OPTS=$(grep " \/sys " ${FSTAB} | awk '{print $4}')
595         ${SED} -i "s/\( \/sys.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB}
596 fi
597 #nosuid and acl on /boot
598 if [ $(grep " \/boot " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then
599         MNT_OPTS=$(grep " \/boot " ${FSTAB} | awk '{print $4}')
600         ${SED} -i "s/\( \/boot.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB}
601 fi
602 #nodev and acl on /usr
603 if [ $(grep " \/usr " ${FSTAB} | grep -c "nodev") -eq 0 ]; then
604         MNT_OPTS=$(grep " \/usr " ${FSTAB} | awk '{print $4}')
605                 ${SED} -i "s/\( \/usr.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB}
606 fi
607 #nodev and acl on /home
608 if [ $(grep " \/home " ${FSTAB} | grep -c "nodev") -eq 0 ]; then
609         MNT_OPTS=$(grep " \/home " ${FSTAB} | awk '{print $4}')
610         ${SED} -i "s/\( \/home.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB}
611 fi
612 #nodev and acl on /usr/local
613 if [ $(grep " \/usr\/local " ${FSTAB} | grep -c "nodev") -eq 0 ]; then
614         MNT_OPTS=$(grep " \/usr\/local " ${FSTAB} | awk '{print $4}')
615         ${SED} -i "s/\( \/usr\/local.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB}
616 fi
617
618 ## (GEN002560: CAT II) (Previously – G089) The SA will ensure the system and
619 ## user umask is 077.
620 echo "umask 077" >> /etc/bashrc
621
622 ## (GEN002640: CAT II) (Previously – G092) The SA will ensure logon capability
623 ## to default system accounts (e.g., bin, lib, uucp, news, sys, guest, daemon,
624 ## and any default account not normally logged onto) will be disabled by
625 ## making the default shell /bin/false, /usr/bin/false, /sbin/false,
626 ## /sbin/nologin, or /dev/null, and by locking the password.
627 for NAME in `cut -d: -f1 /etc/passwd`; do
628         NAMEID=`id -u $NAME`
629         if [ $NAMEID -lt 500 -a $NAME != 'root' ]; then
630                 /usr/sbin/usermod -L -s /dev/null $NAME
631         fi
632 done
633
634 ## (GEN002660: CAT II) (Previously – G093) The SA will configure and implement
635 ## auditing.
636 chkconfig auditd on
637 cat <<-EOF > /etc/audit/audit.rules
638         # Remove any existing rules
639         -D
640
641         # Enable auditing
642         -e 1
643
644         # Increase buffer size to handle the increased number of messages.
645         -b 8192
646
647         # Failure of auditd causes a kernel panic
648         -f 2
649
650 EOF
651
652 ## (GEN002680: CAT II) (Previously – G094) The SA will ensure audit data files
653 ## and directories will be readable only by personnel authorized by the IAO.
654 chmod 700 /var/log/audit
655
656 ## (GEN002700: CAT I) (Previously – G095) The SA will ensure audit data files
657 ## have permissions of 640, or more restrictive.
658 touch /var/log/audit/audit.log
659 chmod 640 /var/log/audit/*
660 chmod 640 /etc/audit/audit.rules
661
662 ## (GEN002720: CAT II) The SA will configure the auditing system to audit
663 ## logon (unsuccessful and successful) and logout (successful)
664 cat <<-EOF >> /etc/audit/audit.rules
665         -w /bin/login -p x
666         -w /bin/logout -p x
667
668 EOF
669
670 ## (GEN002740: CAT II) The SA will configure the auditing system to audit
671 ## discretionary access control permission modification (unsuccessful and
672 ## successful use of chown/chmod)
673 cat <<-EOF >> /etc/audit/audit.rules
674         # DAC permission changes
675         -a exit,always -S chmod -S chown -S chown32 -S fchmod -S fchown -S fchown32 -S lchown -S lchown32
676
677 EOF
678
679 ## (GEN002760: CAT II) The SA will configure the auditing system to audit
680 ## unauthorized access attempts to files (unsuccessful)
681 cat <<-EOF >> /etc/audit/audit.rules
682         # unauthorized file access attempts
683         -a exit,always -F success=0 -S open -S mknod -S pipe -S mkdir -S creat -S truncate -S truncate64 -S ftruncate -S ftruncate64
684
685 EOF
686
687 ## (GEN002780: CAT II) The SA will configure the auditing system to audit
688 ## use of privileged commands (unsuccessful and successful)
689 cat <<-EOF >> /etc/audit/audit.rules
690         # privileged commands
691         -a exit,always -S chroot -S mount -S umount -S umount2 -S adjtimex -S kill
692         -w /usr/sbin/pwck
693         -w /bin/chgrp
694         -w /usr/bin/newgrp
695         -w /usr/sbin/groupadd
696         -w /usr/sbin/groupmod
697         -w /usr/sbin/groupdel
698         -w /usr/sbin/useradd
699         -w /usr/sbin/userdel
700         -w /usr/sbin/usermod
701         -w /usr/bin/chage
702         -w /usr/bin/setfacl
703         -w /usr/bin/chacl
704
705 EOF
706
707 ## (GEN002800: CAT II) The SA will configure the auditing system to audit
708 ## files and programs deleted by the user (successful and unsuccessful)
709 cat <<-EOF >> /etc/audit/audit.rules
710         # deleting files
711         -a exit,always -S unlink -S rmdir
712
713 EOF
714
715 ## (GEN002820: CAT II) The SA will configure the auditing system to audit
716 ## all system administration actions
717 cat <<-EOF >> /etc/audit/audit.rules
718         # system administration actions
719         # these two lines could be the cause of problems with filling audit logs and preventing system usage after installation
720         -w /var/log/audit/audit.log
721         -w /var/log/audit/audit[1-4].log
722         -w /var/log/messages
723         -w /var/log/lastlog
724         -w /var/log/faillog
725         -w /etc/audit/auditd.conf -p wa
726         -w /etc/audit/audit.rules -p wa
727         -w /etc/selinux/config -p wa
728         -w /etc/passwd -p wa
729         -w /etc/shadow -p wa
730         -w /etc/group  -p wa
731         -w /etc/ssh/sshd_config
732         -w /etc/pam.d
733         -w /etc/login.defs
734         -w /etc/rc.d/init.d
735         -w /etc/inittab -p wa
736         -w /var/run/utmp
737         -w /var/run/wtmp
738         -a exit,always -S acct -S reboot -S sched_setparam -S sched_setscheduler -S setdomainname -S setrlimit -S settimeofday -S stime -S swapon
739
740 EOF
741
742 ## (GEN002840: CAT II) The SA will configure the auditing system to audit
743 ## all security personnel actions
744 cat <<-EOF >> /etc/audit/audit.rules
745         # security personnel actions
746         -a exit,always -S init_module -S delete_module -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr
747         -w /bin/su
748
749 EOF
750
751 ## (GEN002860: CAT II) (Previously – G674) The SA and/or IAO will ensure old
752 ## audit logs are closed and new audit logs are started daily.
753 cat <<-EOF > /etc/logrotate.d/audit
754         /var/log/audit/audit.log
755         {
756             daily
757             notifempty
758             missingok
759             postrotate
760             /sbin/service auditd restart 2> /dev/null > /dev/null || true
761             endscript
762         }
763 EOF
764
765 ## (GEN002980: CAT II) The SA will ensure the cron.allow
766 ## file has permissions of 600, or more restrictive.
767 chmod 600 /etc/cron.allow
768
769 ## (GEN003040: CAT II) The SA will ensure the owner of crontabs is root or the
770 ## crontab creator.
771 chown root /etc/cron.hourly/*
772 chown root /etc/cron.daily/*
773 chown root /etc/cron.weekly/*
774 chown root /etc/cron.monthly/*
775 chown root /etc/cron.d/*
776 chown root /var/spool/cron/*
777
778 ## (GEN003060: CAT II) The SA will ensure default system accounts (with the
779 ## possible exception of root) will not be listed in the cron.allow file. If
780 ## there is only a cron.deny file, the default accounts (with the possible
781 ## exception of root) will be listed there.
782 echo 'root' > /etc/cron.allow
783 awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny
784
785 ## (GEN003080: CAT II) (Previously – G205) The SA will ensure crontabs have
786 ## permissions of 600, or more restrictive, (700 for some Linux crontabs, which
787 ## is detailed in the UNIX Checklist).
788 chmod -R 600 /etc/cron.daily
789 chmod -R 600 /etc/cron.hourly
790 chmod -R 600 /etc/cron.weekly
791 chmod -R 600 /etc/cron.monthly
792 chmod 600 /etc/crontab
793 chmod -R 600 /etc/cron.d
794
795 ## (GEN003100: CAT II) (Previously – G206) The SA will ensure cron and crontab
796 ## directories have permissions of 755, or more restrictive.
797 chmod 755 /etc/cron.hourly
798 chmod 755 /etc/cron.daily
799 chmod 755 /etc/cron.weekly
800 chmod 755 /etc/cron.monthly
801 chmod 755 /etc/cron.d
802 chmod 755 /var/spool/cron
803
804 ## (GEN003120: CAT II) (Previously – G207) The SA will ensure the owner of the
805 ## cron and crontab directories is root or bin.
806 chown root /etc/cron.hourly
807 chown root /etc/cron.daily
808 chown root /etc/cron.weekly
809 chown root /etc/cron.monthly
810 chown root /etc/cron.d
811 chown root /var/spool/cron
812
813 ## (GEN003140: CAT II) (Previously – G208) The SA will ensure the group owner
814 ## of the cron and crontab directories is root, sys, or bin.
815 chgrp root /etc/cron.hourly
816 chgrp root /etc/cron.daily
817 chgrp root /etc/cron.weekly
818 chgrp root /etc/cron.monthly
819 chgrp root /etc/cron.d
820 chgrp root /var/spool/cron
821
822 ## (GEN003180: CAT II) (Previously – G210) The SA will ensure cron logs have
823 ## permissions of 600, or more restrictive.
824 touch /var/log/cron
825 chmod 600 /var/log/cron
826
827 ## (GEN003200: CAT II)  The SA will ensure the cron.deny
828 ## file has permissions of 600, or more restrictive.
829 chmod 600 /etc/cron.deny
830
831 ## (GEN003240: CAT II) The SA will ensure the owner and
832 ## group owner of the cron.allow file is root.
833 chown root:root /etc/cron.allow
834
835 ## (GEN003260: CAT II) The SA will ensure the owner and
836 ## group owner of the cron.deny file is root.
837 chown root:root /etc/cron.deny
838
839 ## (GEN003300: CAT II) (Previously – G212) The SA will ensure the at.deny file
840 ## is not empty.
841 awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/at.deny
842
843 ## (GEN003320: CAT II) (Previously – G213) The SA will ensure default system
844 ## accounts (with the possible exception of root) are not listed in the
845 ## at.allow file. If there is only an at.deny file, the default accounts
846 ## (with the possible exception of root) will be listed there.
847 echo "root" > /etc/at.allow
848
849 ## (GEN003340: CAT II) (Previously – G214) The SA will ensure the at.allow and
850 ## at.deny files have permissions of 600, or more restrictive.
851 chmod 600 /etc/at.allow
852 chmod 600 /etc/at.deny
853
854 ## (GEN003400: CAT II) (Previously – G625) The SA will ensure the at (or
855 ## equivalent) directory has permissions of 755, or more restrictive.
856 chmod 755 /var/spool/at/spool
857
858 ## (GEN003420: CAT II) (Previously – G626) The SA will ensure the owner and
859 ## group owner of the at (or equivalent) directory is root, sys, bin, or daemon.
860 chown root:root /var/spool/at/spool
861
862 ## (GEN003460: CAT II) (Previously – G629) The SA will ensure the owner and
863 ## group owner of the at.allow file is root.
864 chown root:root /etc/at.allow
865
866 ## (GEN003480: CAT II) (Previously – G630) The SA will ensure the owner and
867 ## group owner of the at.deny file is root.
868 chown root:root /etc/at.deny
869
870 ## (GEN003500: CAT III) The SA will ensure core dumps are disabled or
871 ## restricted.
872 echo "* - core 0" >> /etc/security/limits.conf
873
874 ## (GEN003520: CAT III) The SA will ensure the owner and group owner of the
875 ## core dump  data directory is root with permissions of 700, or more
876 ## restrictive.
877 chown root:root /var/crash
878 chmod -R 700 /var/crash
879
880 ## (GEN003600: CAT II) The SA will ensure network parameters are securely set.
881 sed -i "/net\.ipv4\.conf\.default\.rp_filter/ c\net.ipv4.conf.default.rp_filter = 1" /etc/sysctl.conf
882 sed -i "/net\.ipv4\.conf\.default\.accept_source_route/ c\net.ipv4.conf.default.accept_source_route = 0" /etc/sysctl.conf
883 cat <<-EOF >> /etc/sysctl.conf
884         net.ipv4.tcp_max_syn_backlog = 1280
885         net.ipv4.icmp_echo_ignore_broadcasts = 1
886         net.ipv4.icmp_echo_ignore_all = 1
887 EOF
888
889 ## (GEN003660: CAT II) The SA will ensure the authentication notice and
890 ## informational data is logged.
891 echo "auth.notice                                               /var/log/messages" >> /etc/syslog.conf
892
893 ## (GEN003700: CAT II) The SA will ensure inetd (xinetd for Linux) is disabled
894 ## if all inetd/xinetd based services are disabled.
895 /sbin/chkconfig bluetooth off
896 /sbin/chkconfig irda off
897 /sbin/chkconfig lm_sensors off
898 /sbin/chkconfig portmap off
899 /sbin/chkconfig rawdevices off
900 /sbin/chkconfig rpcgssd off
901 /sbin/chkconfig rpcidmapd off
902 /sbin/chkconfig rpcsvcgssd off
903 /sbin/chkconfig sendmail off
904 /sbin/chkconfig xinetd off
905 /sbin/chkconfig cups off
906 /sbin/chkconfig rhnsd off
907 /sbin/chkconfig autofs off
908
909 ## (GEN003740: CAT II) (Previously – G108) The SA will ensure the inetd.conf
910 ## (xinetd.conf for Linux) file has permissions of 440, or more restrictive.
911 ## The Linux xinetd.d directory will have permissions of 755, or more
912 ## restrictive. This is to include any directories defined in the includedir
913 ## parameter.
914 chmod 755 /etc/xinetd.d
915 chmod 440 /etc/xinetd.conf
916
917 ## (GEN003760: CAT II) (Previously – G109) The SA will ensure the owner of the
918 ## services file is root or bin.
919 chown root /etc/services
920
921 ## (GEN003780: CAT II) (Previously – G110) The SA will ensure the services
922 ## file has permissions of 644, or more restrictive.
923 chmod 644 /etc/services
924
925 ## (GEN003860: CAT III) (Previously – V046) The SA will ensure finger is not
926 ## enabled.
927 /sbin/chkconfig finger off
928
929 ## (GEN003960: CAT II) (Previously – G631) The SA will ensure the owner of
930 ## the traceroute command is root.
931 chown root /bin/traceroute
932
933 ## (GEN003980: CAT II) (Previously – G632) The SA will ensure the group
934 ## owner of the traceroute command is root, sys, or bin.
935 chgrp root /bin/traceroute
936
937 ## (GEN004000: CAT II) (Previously – G633) The SA will ensure the traceroute
938 ## command has permissions of 700, or more restrictive.
939 chmod 700 /bin/traceroute
940
941 ## (GEN004360: CAT II) (Previously – G127) The SA will ensure the aliases file
942 ## is owned by root.
943 chown root /etc/aliases
944
945 ## (GEN004380: CAT II) (Previously – G128) The SA will ensure the aliases file
946 ## has permissions of 644, or more restrictive.
947 chmod 644 /etc/aliases
948
949 ## (GEN004440: CAT IV) (Previously – G133) The SA will ensure the sendmail
950 ## logging level (the detail level of e-mail tracing and debugging
951 ## information) in the sendmail.cf file is set to a value no lower than
952 ## nine (9).
953 sed -i '/LogLevel/ c\O LogLevel=9' /etc/mail/sendmail.cf
954
955 ## (GEN004480: CAT II) (Previously – G135) The SA will ensure the owner of the
956 ## critical sendmail log file is root.
957 chown root /var/log/maillog
958
959 ## (GEN004500: CAT II) (Previously – G136) The SA will ensure the critical
960 ## sendmail log file has permissions of 644, or more restrictive.
961 chmod 644 /var/log/maillog
962
963 ## (GEN004540: CAT II) The SA will ensure the help sendmail command is
964 ## disabled.
965 mv /etc/mail/helpfile /etc/mail/helpfile.bak
966 echo "" > /etc/mail/helpfile
967
968 ## (GEN004560: CAT II) (Previously – G646) To help mask the e-mail version,
969 ## the SA will use the following in place of the original sendmail greeting
970 ## message:
971 ##   O SmtpGreetingMessage= Mail Server Ready ; $b
972 sed -i '/SmtpGreetingMessage/ c\O SmtpGreetingMessage= Mail Server Ready ; $b' /etc/mail/sendmail.cf
973
974 ## (GEN004580: CAT I) (Previously – G647) The SA will ensure .forward files
975 ## are not used.
976 for HOMEDIR in `cut -d: -f6 /etc/passwd`; do
977 if [ -f $HOMEDIR/.forward ]
978 then
979         rm $HOMEDIR/.forward
980 fi
981 done;
982
983 ## (GEN004640: CAT I) (Previously – V126) The SA will ensure the decode entry
984 ## is disabled (deleted or commented out) from the alias file.
985 sed --in-place s/^decode\:/\#decode\:/ /etc/aliases
986 /usr/bin/newaliases
987
988 ## (GEN004880: CAT II) (Previously – G140) The SA will ensure the ftpusers
989 ## file exists.
990 touch /etc/ftpusers
991
992 ## (GEN004900: CAT II) (Previously – G141) The SA will ensure the ftpusers
993 ## file contains the usernames of users not allowed to use FTP, and contains,
994 ## at a minimum, the system pseudo-users usernames and root.
995 echo -n > /etc/ftpusers
996 for NAME in `cut -d: -f1 /etc/passwd`; do
997         NAMEID=`id -u $NAME`
998         if [ $NAMEID -lt 500 ]; then
999                 echo $NAME >> /etc/ftpusers
1000         fi
1001 done;
1002
1003 ## (GEN004920: CAT II) (Previously – G142) The SA will ensure the owner of the
1004 ## ftpusers file is root.
1005 chown root /etc/ftpusers
1006
1007 ## (GEN004940: CAT II) (Previously – G143) The SA will ensure the ftpusers
1008 ## file has permissions of 640, or more restrictive.
1009 chmod 640 /etc/ftpusers
1010
1011 ## (GEN005000: CAT I) (Previously – G649) The SA will implement the anonymous
1012 ## FTP account with a non-functional shell such as /bin/false.
1013 /usr/sbin/usermod -s /dev/null ftp
1014
1015 ## (GEN005360: CAT II) The SA will ensure the owner of the snmpd.conf file is root with a group
1016 ## owner of sys and the owner of MIB files is root with a group owner of sys or the application.
1017 chown root:sys /etc/snmp/snmpd.conf
1018
1019 ## (GEN005400: CAT II) (Previously – G656) The SA will ensure the owner of the
1020 ## /etc/syslog.conf file is root with permissions of 640, or more restrictive.
1021 chown root /etc/syslog.conf
1022 chmod 640 /etc/syslog.conf
1023
1024 ## (GEN005420: CAT II) (Previously – G657) The SA will ensure the group owner
1025 ## of the /etc/syslog.conf file is root, sys, or bin.
1026 chgrp root /etc/syslog.conf
1027
1028 ## (GEN005500: CAT I) (Previously – G701) The IAO and SA will ensure SSH
1029 ## Protocol version 1 is not used, nor will Protocol version 1 compatibility
1030 ## mode be used.
1031 if [ `grep -c "^Protocol" /etc/ssh/sshd_config` -gt 0 ]
1032 then
1033         sed -i "/^Protocol/ c\Protocol 2" /etc/ssh/sshd_config
1034 else
1035         echo "Protocol 2" >> /etc/ssh/sshd_config
1036 fi
1037 echo 'Ciphers aes256-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,aes128-cbc,3des-cbc' >> /etc/ssh/ssh_config
1038
1039 ## (GEN005600: CAT II) The SA will ensure IP forwarding is disabled if the
1040 ## system is not dedicated as a router.
1041 sed -i "/net\.ipv4\.ip_forward/ c\net.ipv4.ip_forward = 0" /etc/sysctl.conf
1042
1043 ## (GEN005740: CAT II) (Previously – G178) The SA will ensure the owner of the
1044 ## export configuration file is root.
1045 chown root /etc/exports
1046
1047 ## (GEN005760: CAT III) (Previously – G179) The SA will ensure the export
1048 ## configuration file has permissions of 644, or more restrictive.
1049 chmod 644 /etc/exports
1050
1051 ## (GEN006100: CAT II) (Previously – L050) The SA will ensure the owner of
1052 ## the/etc/samba/smb.conf file is root.
1053 chown root /etc/samba/smb.conf
1054
1055 ## (GEN006120: CAT II) (Previously – L051) The SA will ensure the group owner
1056 ## of the /etc/samba/smb.conf file is root.
1057 chgrp root /etc/samba/smb.conf
1058
1059 ## (GEN006140: CAT II) (Previously – L052) The SA will ensure the
1060 ## /etc/samba/smb.conf file has permissions of 644, or more restrictive.
1061 chmod 644 /etc/samba/smb.conf
1062
1063 ## (GEN006160: CAT II) (Previously – L054) The SA will ensure the owner of
1064 ## smbpasswd is root.
1065 chown root /usr/bin/smbpasswd
1066
1067 ## (GEN006180: CAT II) (Previously – L055) The SA will ensure group owner of
1068 ## smbpasswd is root.
1069 chgrp root /usr/bin/smbpasswd
1070
1071 ## (GEN006200: CAT II) (Previously – L057) The SA will configure permissions
1072 ## for smbpasswd to 600, or more restrictive.
1073 chmod 600 /usr/bin/smbpasswd
1074
1075 ## (GEN006260: CAT II) (Previously – L154) The SA will ensure the
1076 ## /etc/news/hosts.nntp file has permissions of 600, or more restrictive.
1077 chmod 600 /etc/news/hosts.nntp
1078
1079 ## (GEN006300: CAT II) (Previously – L158) The SA will ensure the
1080 ## /etc/news/nnrp.access file has permissions of 600, or more restrictive.
1081 chmod 600 /etc/news/nnrp.access
1082
1083 ## (GEN006320: CAT II) (Previously – L160) The SA will ensure the
1084 ## /etc/news/passwd.nntp file has permissions of 600, or more restrictive.
1085 chmod 600 /etc/news/passwd.nntp
1086
1087 ## (GEN006340: CAT II) (Previously – L162) The SA will ensure the owner of all
1088 ## files under the /etc/news subdirectory is root or news.
1089 chown -R root /etc/news/*
1090
1091 ## (GEN006360: CAT II) (Previously – L164) The SA will ensure the group owner
1092 ## of all files in /etc/news is root or news.
1093 chgrp -R root /etc/news/*
1094
1095 ## (GEN006280: CAT II) (Previously – L156) The SA will ensure the
1096 ## /etc/news/hosts.nntp.nolimit file has permissions of 600, or more
1097 ## restrictive.
1098 chmod 600 /etc/news/hosts.nntp.nolimit
1099
1100 ## (GEN006520: CAT II) (Previously – G189) The SA will ensure security tools
1101 ## and databases have permissions of 740, or more restrictive.
1102 chmod 740 /etc/rc.d/init.d/iptables
1103 chmod 740 /sbin/iptables
1104 chmod 740 /usr/share/logwatch/scripts/services/iptables
1105
1106 ## (GEN006620: CAT II) The SA will ensure an access control program (e.g.,
1107 ## TCP_WRAPPERS) hosts.deny and hosts.allow files (or equivalent) are used to
1108 ## grant or deny system access to specific hosts.
1109 echo "ALL: ALL" > /etc/hosts.deny
1110
1111 ## (LNX00160: CAT II) (Previously – L074) The SA will ensure the grub.conf
1112 ## file has permissions of 600, or more restrictive.
1113 chmod 600 /boot/grub/grub.conf
1114
1115 ## (LNX00220: CAT II) (Previously – L080) The SA will ensure the lilo.conf
1116 ## file has permissions of 600 or more restrictive.
1117 chmod 600 /etc/lilo.conf
1118
1119 ## (LNX00320: CAT I) (Previously – L140) The SA will delete accounts that
1120 ## provide a special privilege such as shutdown and halt.
1121 /usr/sbin/userdel shutdown
1122 /usr/sbin/userdel halt
1123 /usr/sbin/userdel sync
1124
1125 ## (LNX00340: CAT II) (Previously – L142) The SA will delete accounts that
1126 ## provide no operational purpose, such as games or operator, and will delete
1127 ## the associated software.
1128 /usr/sbin/userdel news
1129 /usr/sbin/userdel operator
1130 /usr/sbin/userdel games
1131 /usr/sbin/userdel gopher
1132 /usr/sbin/userdel nfsnobody
1133
1134 ## (LNX00360: CAT II) (Previously – L032) The SA will enable the X server
1135 ## –audit (at level 4) and –s option (with 15 minutes as the timeout time)
1136 ## options.
1137 cat <<-EOF >> /etc/gdm/custom.conf
1138         [server-Standard]
1139         name=Standard server
1140         command=/usr/bin/Xorg -br -audit 4 -s 15
1141         flexible=true
1142 EOF
1143
1144 ## (LNX00400: CAT II) (Previously – L044) The SA will ensure the owner of the
1145 ## /etc/login.access or /etc/security/access.conf file is root.
1146 chown root /etc/security/access.conf
1147
1148 ## (LNX00420: CAT II) (Previously – L045) The SA will ensure the group owner
1149 ## of the /etc/login.access or /etc/security/access.conf file is root.
1150 chgrp root /etc/security/access.conf
1151
1152 ## (LNX00440: CAT II) (Previously – L046) The SA will ensure /etc/login.access
1153 ## or /etc/security/access.conf file will be 640, or more restrictive.
1154 chmod 640 /etc/security/access.conf
1155
1156 ## (LNX00480: CAT II) (Previously – L204) The SA will ensure the owner of the
1157 ## /etc/sysctl.conf file is root.
1158 chown root /etc/sysctl.conf
1159
1160 ## (LNX00500: CAT II) (Previously – L206) The SA will ensure the group owner
1161 ## of the /etc/sysctl.conf file is root.
1162 chgrp root /etc/sysctl.conf
1163
1164 ## (LNX00520: CAT II) (Previously – L208) The SA will ensure the
1165 ## /etc/sysctl.conf file has permissions of 600, or more restrictive.
1166 chmod 600 /etc/sysctl.conf
1167
1168 ## (LNX00580: CAT I) (Previously – L222) The SA will disable the
1169 ## Ctrl-Alt-Delete sequence unless the system is located in a controlled
1170 ## access area accessible only by SAs.
1171 sed -i "s/ca\:\:ctrlaltdel/\#ca\:\:ctrlaltdel/" /etc/inittab
1172
1173 ## (LNX00620: CAT II) The SA will ensure the group owner of the /etc/securetty
1174 ## file is root, sys, or bin.
1175 chgrp root /etc/securetty
1176
1177 ## (LNX00640: CAT II) The SA will ensure the owner of the /etc/securetty file
1178 ## is root.
1179 chown root /etc/securetty
1180
1181 ## (LNX00660: CAT II) The SA will ensure the /etc/securetty file has
1182 ## permissions of 640, or more restrictive.
1183 chmod 640 /etc/securetty
1184
1185
1186
1187
1188 ##########################################################################
1189 # DCID 6/3 PL4
1190 ##########################################################################
1191
1192 ## 4.B.4 Protection Level 4
1193
1194 # 4.B.4.a(1)
1195 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1196
1197         # 4.B.4.a(1)(a)
1198         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1199
1200         # 4.B.4.a(1)(b)
1201         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1202
1203
1204 # 4.B.4.a(2)
1205 # KickStart Actions: All ext3 file systmes have been mounted with the ACL
1206 #                    setting to allow for a finer granualrity of DAC.
1207 #                    (See:  getfacl and setfacl man pages).
1208 #                    Create ACL and other security features during
1209 #                    the mounting of each file system (/etc/fstab).
1210
1211         # Implemented in GEN002420
1212
1213
1214 # 4.B.4.a(3) 
1215 # KickStart Actions: None - CLIP policy specific
1216
1217
1218 # 4.B.4.a(4) 
1219 # KickStart Actions:
1220
1221         # 4.B.4.a(4)(a)
1222         # KickStart Actions:
1223        
1224         # 4.B.4.a(4)(b)
1225         # KickStart Actions:
1226        
1227         # 4.B.4.a(4)(c)
1228         # KickStart Actions:
1229        
1230         # 4.B.4.a(4)(d)
1231         # KickStart Actions:
1232        
1233         # 4.B.4.a(4)(e)
1234         # KickStart Actions:
1235        
1236                 # 4.B.4.a(4)(e)1.
1237                 # KickStart Actions:
1238                
1239                 # 4.B.4.a(4)(e)2.
1240                 # KickStart Actions:
1241        
1242                
1243 # 4.B.4.a(5)
1244 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1245
1246         # 4.B.4.a(5)(a)
1247         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1248
1249         # 4.B.4.a(5)(b)
1250         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1251
1252         # 4.B.4.a(5)(c)
1253         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1254
1255         # 4.B.4.a(5)(d)
1256         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1257
1258         #(FOUO)
1259         #4.B.4.a(5)(e)
1260         #KickStart Actions: None - PROCEDURAL REQUIREMENT
1261
1262
1263
1264 # 4.B.4.a(6)
1265 # KickStart Actions: None
1266
1267         # 4.B.4.a(6)(a)
1268         # KickStart Actions: None
1269
1270         # 4.B.4.a(6)(b)
1271         # KickStart Actions: Reset the permissions of /etc/syslog.conf to 640 and set
1272         #                   /var/{run,log}/{wtmp,utmp} files to 664.
1273
1274                 # Implemented in GEN001260
1275                 # Implemented in GEN005400
1276                 # Implemented in GEN005420
1277                 # Implemented in GEN004500
1278                 # Implemented in GEN004480
1279                 # Implemented in GEN003180
1280
1281
1282         # 4.B.4.a(6)(c)
1283         # KickStart Actions: Log rotation to 90 days (12 weeks) and turn compression on.
1284         #                    This will have to up'd if system does not retain backups
1285         #                    for 5 years  (e.g., tape backup).
1286
1287                 # Implemented in GEN002860
1288
1289         # 4.B.4.a(6)(d)
1290         # KickStart Actions: Turn on the Audit Daemon and set permissions
1291
1292                 # Implemented in GEN002660
1293                 # Implemented in GEN002680
1294                 # Implemented in GEN002700
1295
1296                 # 4.B.4.a(6)(d)(1)
1297                 # KickStart Actions: None, This is met with the /var/log/wtmp and
1298                 #                    /var/log/utmp files. Permissions have been set
1299                 #                    correctly above.
1300                 #                    See Section 4.B.4.a(6)(d)(2)
1301
1302                 # 4.B.4.a(6)(d)(2)
1303                 # KickStart Actions: This will require refinement. 
1304                 #                    Commented rules do not insert w/o an error.
1305
1306                         # Implemented in GEN002720
1307                         # Implemented in GEN002740
1308                         # Implemented in GEN002760
1309                         # Implemented in GEN002780
1310                         # Implemented in GEN002800
1311                         # Implemented in GEN002820
1312                         # Implemented in GEN002840
1313
1314                 # 4.B.4.a(6)(d)(3)
1315                 # KickStart Actions: All authentication attemps will be monitored
1316                 #                    in /var/log/messages.
1317
1318                         # Implemented in GEN003660
1319                         # Implemented in GEN000440
1320                         # Implemented in GEN004440
1321
1322 # 4.B.4.a(7)
1323 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1324
1325 # 4.B.4.a(8)
1326 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1327
1328         # 4.B.4.a(8)(a)
1329         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1330
1331         # 4.B.4.a(8)(b)
1332         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1333
1334 # 4.B.4.a(9)
1335 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1336
1337         # 4.B.4.a(9)(a)
1338         # KickStart Actions: 
1339
1340         # 4.B.4.a(9)(b)
1341         # KickStart Actions:  POLICY
1342
1343         # 4.B.4.a(9)(c)
1344         # KickStart Actions: 
1345
1346         # 4.B.4.a(9)(d)
1347         # KickStart Actions: 
1348
1349 # 4.B.4.a(10) 
1350 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1351
1352         # 4.B.4.a(10)(a)
1353         # KickStart Actions: 
1354
1355         # 4.B.4.a(10)(b)
1356         # KickStart Actions: 
1357
1358 # 4.B.4.a(11)
1359 # KickStart Actions:  None
1360
1361         # 4.B.4.a(11)(a)
1362         # KickStart Actions:  None
1363
1364         # 4.B.4.a(11)(b)
1365         # KickStart Actions:  None
1366
1367         # 4.B.4.a(11)(c)
1368         # KickStart Actions: The following item have been set to meet this policy.
1369         # Note:
1370         # Investigating using PAM for preventing 10 recent passwords- doesn't appear
1371         # to be easily done using pam_passwdqc
1372
1373                 # Implemented in GEN000580
1374                 # Implemented in GEN000600
1375
1376         # 4.B.4.a(11)(d)
1377         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1378
1379         # 4.B.4.a(11)(e)
1380         # KickStart Actions: Change the password expiration time from undefined to 60 days.
1381         #                    Users cannot change passwords more than once a day.
1382
1383                 # Implemented in GEN000700
1384                 # Implemented in GEN000540
1385
1386         # 4.B.4.a(11)(f)
1387         # KickStart Actions: opasswd file creation in /etc/security/opasswd
1388         #                    for non-replication.
1389
1390                 # Implemented in GEN000800
1391
1392         # 4.B.4.a(11)(g)
1393         # KickStart Actions: Additional I&A Security.
1394         #                    Protection of authenticators to perserve confidentiality and
1395         #                    integrity.  Red Hat encrypts authenticators using the MD5
1396         #                    Message Digest.
1397
1398                 # Implemented in GEN001380
1399                 # Implemented in GEN001400
1400                 # Implemented in GEN001420
1401                 # Implemented in GEN000560
1402
1403 # 4.B.4.a(12)
1404 # KickStart Actions:  See 4.B.4.a(9)(c); specifically passwdqc
1405
1406
1407 # 4.B.4.a(13)
1408 # KickStart Actions: By default ssh uses Triple DES.  This script will edit
1409 #                    the /etc/ssh/ssh_config file to use stronger encryption.
1410 #                    AES with 256-bit key Cycpher Block Chaining 
1411
1412         # Implemented in GEN005500
1413
1414
1415 # 4.B.4.a(14)
1416 # KickStart Actions: None
1417
1418         # 4.B.4.a(14)(a)
1419         # KickStart Actions: 
1420
1421         # 4.B.4.a(14)(b)
1422         # KickStart Actions: 
1423
1424
1425 # 4.B.4.a(15)
1426 # KickStart Actions: 
1427
1428         # 4.B.4.a(15)(a)
1429         # KickStart Actions: 
1430
1431         # 4.B.4.a(15)(b)
1432         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1433
1434         # 4.B.4.a(15)(c)
1435         # KickStart Actions: 
1436
1437         # 4.B.4.a(15)(d) 
1438         # KickStart Actions: 
1439
1440         # 4.B.4.a(15)(e)
1441         # KickStart Actions: 
1442
1443
1444 # 4.B.4.a(16) 
1445 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1446
1447
1448 # 4.B.4.a(17)
1449 # KickStart Actions: Restrict Root Logins and Least Privilege Enhancements.
1450
1451         # Implemented in GEN000020
1452
1453
1454 # 4.B.4.a(18)
1455 # KickStart Actions: None
1456
1457
1458 # 4.B.4.a(19)
1459 # KickStart Actions: Centralized Time
1460
1461
1462 # 4.B.4.a(20)
1463 # KickStart Actions: None
1464
1465
1466 # 4.B.4.a(21)
1467 # KickStart Actions: None
1468
1469         # 4.B.4.a(21)(a)
1470         # KickStart Actions: Interactive Shell setting here.
1471         # Gnome screen-saver line command tool -->  needs to be tested.
1472         # gconftool-2 --direct \
1473         #   --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
1474         #   --type int \
1475         #   --set /apps/gnome-screensaver/idle_delay 15
1476
1477         # 4.B.4.a(21)(b)
1478         # KickStart Actions: None
1479
1480         # 4.B.4.a(21)(c)
1481         # KickStart Actions: None
1482
1483
1484 # 4.B.4.a(22)
1485 # KickStart Actions: None
1486
1487
1488 # 4.B.4.a(23)
1489 # KickStart Actions: None
1490
1491         # 4.B.4.a(23)(a)
1492         # KickStart Actions: See Section 4.B.4.a(23)(b)
1493
1494         # 4.B.4.a(23)(b)
1495         # KickStart Actions: Banner Settings
1496
1497                 # Implemented in GEN000400
1498
1499 # 4.B.4.a(24)
1500 # KickStart Actions: None
1501
1502         # 4.B.4.a(24)(a)
1503         # KickStart Actions: None
1504
1505         # 4.B.4.a(24)(b)
1506         # KickStart Actions: Set an inactive shell timeout - likely going away in March STIG
1507
1508                 # Implemented in GEN000500
1509
1510         # 4.B.4.a(24)(c)
1511         # KickStart Actions: None
1512
1513                 # Implemented in GEN000460
1514                 # Implemented in GEN000480
1515
1516         # 4.B.4.a(24)(d)
1517         # KickStart Actions: None
1518
1519 # 4.B.4.a(25)
1520 # KickStart Actions: None
1521          
1522         # 4.B.4.a(25)(a)
1523         # KickStart Actions: None
1524
1525         # 4.B.4.a(25)(b)
1526         # KickStart Actions: None
1527
1528         # 4.B.4.a(25)(c)
1529         # KickStart Actions: None
1530
1531         # 4.B.4.a(25)(d)
1532         # KickStart Actions: None - Will need to down load an encryption package like "secret agent"
1533
1534
1535 # 4.B.4.a(26)
1536 # KickStart Actions: None
1537
1538         # 4.B.4.a(26)(a)
1539         # KickStart Actions: None
1540          
1541                 # 4.B.4.a(26)(a)(1)
1542                 # KickStart Actions: None
1543
1544                 # 4.B.4.a(26)(a)(2)
1545                 # KickStart Actions: None
1546
1547                 # 4.B.4.a(26)(a)(3)
1548                 # KickStart Actions:
1549        
1550                         # Implemented in GEN005500
1551
1552                 # 4.B.4.a(26)(a)(4)
1553                 # KickStart Actions: None
1554
1555         # 4.B.4.a(26)(b)
1556         # KickStart Actions: None
1557
1558
1559 # 4.B.4.a(27) 
1560 # KickStart Actions:
1561
1562
1563
1564
1565 ### DCID 6/3 PL4
1566 # 4.B.4 Protection Level 4
1567
1568 # 4.B.4.b --  Requirements for system assurance at PL4
1569 # KickStart Actions: None
1570
1571 # 4.B.4.b(1)
1572 # KickStart Actions:
1573
1574 # 4.B.4.b(2)
1575 # KickStart Actions: None
1576
1577         # 4.B.4.b(2)(a)
1578         # KickStart Actions: None
1579
1580         # 4.B.4.b(2)(b)
1581         # KickStart Actions: None
1582
1583 # 4.B.4.b(3)
1584 # KickStart Actions: None
1585
1586 # 4.B.4.b(4)
1587 # KickStart Actions: None
1588
1589         # 4.B.4.b(4)(a)
1590         # KickStart Actions: None
1591
1592         # 4.B.4.b(4)(b)
1593         # KickStart Actions: None
1594
1595         # 4.B.4.b(4)(c)
1596         # KickStart Actions: None
1597
1598         # 4.B.4.b(4)(d)
1599         # KickStart Actions: None
1600
1601 # 4.B.4.b(5)
1602 # KickStart Actions: None
1603
1604         # 4.B.4.b(5)(a)
1605         # KickStart Actions: Expected Operations
1606
1607                 # Implemented in GEN003600
1608                 # Implemented in GEN003700
1609                 # Implemented in GEN003740
1610                 # Implemented in GEN003860
1611                 # Implemented in GEN003960
1612                 # Implemented in GEN003980
1613                 # Implemented in GEN004000
1614                 # Implemented in GEN005600
1615
1616         # 4.B.4.b(5)(b)
1617         # KickStart Actions: Actions Listed Below
1618
1619                 # Implemented in GEN000920
1620                 # Implemented in GEN000980
1621                 # Implemented in GEN001020
1622                 # Implemented in GEN001080
1623                 # Implemented in GEN001120
1624                 # Implemented in GEN001280
1625                 # Implemented in GEN001460
1626                 # Implemented in GEN001560
1627                 # Implemented in GEN001580
1628                 # Implemented in GEN001620
1629                 # Implemented in GEN001660
1630                 # Implemented in GEN001680
1631                 # Implemented in GEN001720
1632                 # Implemented in GEN001740
1633                 # Implemented in GEN001760
1634                 # Implemented in GEN001780
1635                 # Implemented in GEN001800
1636                 # Implemented in GEN001820
1637                 # Implemented in GEN002040
1638                 # Implemented in GEN002120
1639                 # Implemented in GEN002160
1640                 # Implemented in GEN002180
1641                 # Implemented in GEN002200
1642                 # Implemented in GEN002220
1643                 # Implemented in GEN002320
1644                 # Implemented in GEN002340
1645                 # Implemented in GEN002360
1646                 # Implemented in GEN002560
1647                 # Implemented in GEN002640
1648                 # Implemented in GEN002980
1649                 # Implemented in GEN003040
1650                 # Implemented in GEN003060
1651                 # Implemented in GEN003080
1652                 # Implemented in GEN003100
1653                 # Implemented in GEN003120
1654                 # Implemented in GEN003140
1655                 # Implemented in GEN003200
1656                 # Implemented in GEN003240
1657                 # Implemented in GEN003260
1658                 # Implemented in GEN003300
1659                 # Implemented in GEN003320
1660                 # Implemented in GEN003340
1661                 # Implemented in GEN003400
1662                 # Implemented in GEN003420
1663                 # Implemented in GEN003460
1664                 # Implemented in GEN003480
1665                 # Implemented in GEN003500
1666                 # Implemented in GEN003520
1667                 # Implemented in GEN003760
1668                 # Implemented in GEN003780
1669                 # Implemented in GEN004360
1670                 # Implemented in GEN004380
1671                 # Implemented in GEN004540
1672                 # Implemented in GEN004560
1673                 # Implemented in GEN004580
1674                 # Implemented in GEN004640
1675                 # Implemented in GEN004880
1676                 # Implemented in GEN004900
1677                 # Implemented in GEN004920
1678                 # Implemented in GEN004940
1679                 # Implemented in GEN005000
1680                 # Implemented in GEN005360
1681                 # Implemented in GEN005740
1682                 # Implemented in GEN005760
1683                 # Implemented in GEN006100
1684                 # Implemented in GEN006120
1685                 # Implemented in GEN006140
1686                 # Implemented in GEN006160
1687                 # Implemented in GEN006180
1688                 # Implemented in GEN006200
1689                 # Implemented in GEN006260
1690                 # Implemented in GEN006280
1691                 # Implemented in GEN006300
1692                 # Implemented in GEN006320
1693                 # Implemented in GEN006340
1694                 # Implemented in GEN006360
1695                 # Implemented in GEN006520
1696                 # Implemented in GEN006620
1697                 # Implemented in LNX00160
1698                 # Implemented in LNX00220
1699                 # Implemented in LNX00320
1700                 # Implemented in LNX00340
1701                 # Implemented in LNX00360
1702                 # Implemented in LNX00400
1703                 # Implemented in LNX00420
1704                 # Implemented in LNX00440
1705                 # Implemented in LNX00480
1706                 # Implemented in LNX00500
1707                 # Implemented in LNX00520
1708                 # Implemented in LNX00580
1709                 # Implemented in LNX00620
1710                 # Implemented in LNX00640
1711                 # Implemented in LNX00660
1712
1713 # 4.B.4.b(6)
1714 # KickStart Actions: None
1715
1716         # 4.B.4.b(6)(a)
1717         # KickStart Actions: None
1718
1719         # 4.B.4.b(6)(b)
1720         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1721
1722
1723 # 4.B.4.b(7)
1724 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1725
1726         # 4.B.4.b(7)(a)
1727         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1728
1729         # 4.B.4.b(7)(b)
1730         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1731
1732         # 4.B.4.b(8)
1733         # KickStart Actions:
1734
1735
1736 # 4.B.4.b(9)
1737 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1738
1739
1740 # 4.B.4.b(10)
1741 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1742
1743         # 4.B.4.b(10)(a)
1744         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1745
1746         # 4.B.4.b(10)(b)
1747         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1748
1749                 # 4.B.4.b(10)(b)(1)
1750                 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1751
1752                 # 4.B.4.b(10)(b)(2)
1753                 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1754
1755                 # 4.B.4.b(10)(b)(3)
1756                 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1757
1758 # 4.B.4.b(11)
1759 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1760
1761         # 4.B.4.b(11)(a)
1762         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1763
1764         # 4.B.4.b(11)(b)
1765         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1766
1767
1768 ##########################################################################
1769 # Integrity System Security Features and Assurances (HIGH Integrity)
1770
1771 # 5.B.3.a(1)
1772 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1773
1774         # 5.B.3.a(1)(a)
1775         # KickStart Actions:  None
1776
1777         # 5.B.3.a(1)(b)
1778         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1779
1780         # 5.B.3.a(1)(c)
1781         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1782
1783         # 5.B.3.a(1)(d)
1784         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1785
1786 # 5.B.3.a(2)
1787 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1788
1789         # 5.B.3.a(2)(a)
1790         # KickStart Actions:  None
1791
1792         # 5.B.3.a(2)(b)
1793         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1794
1795                 # 5.B.3.a(2)(b)(1)
1796                 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1797
1798                 # 5.B.3.a(2)(b)(2)
1799                 # KickStart Actions: 
1800
1801 # 5.B.3.a(3)
1802 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1803
1804         # 5.B.3.a(3)(a)
1805         # KickStart Actions:  None
1806
1807         # 5.B.3.a(3)(b)
1808         # KickStart Actions:  None
1809
1810 # 5.B.3.a(4)
1811 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1812
1813         # 5.B.3.a(4)(a)
1814         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1815
1816         # 5.B.3.a(4)(b)
1817         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1818
1819 # 5.B.3.a(5)
1820 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1821
1822         # 5.B.3.a(5)(a)
1823         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1824
1825                 # 5.B.3.a(5)(a)(1)
1826                 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1827
1828                 # 5.B.3.a(5)(a)(2)
1829                 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1830
1831                 # 5.B.3.a(5)(a)(3)
1832                 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1833
1834         # 5.B.3.a(5)(b)
1835         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1836
1837 # 5.B.3.a(6)
1838 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1839
1840         # 5.B.3.a(6)(a)
1841         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1842
1843         # 5.B.3.a(6)(b)
1844         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1845
1846         # 5.B.3.a(6)(c)
1847         # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1848
1849 # 5.B.3.a(7)
1850 # KickStart Actions:  None
1851
1852 # 5.B.3.a(8)
1853 # KickStart Actions:  None
1854
1855 # 5.B.3.a(9)
1856 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1857
1858 # 5.B.3.a(10)
1859 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1860
1861 # 5.B.3.a(11)
1862 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1863
1864         # 5.B.3.a(11)(a)
1865         # KickStart Actions:  None
1866
1867         # 5.B.3.a(11)(b)
1868         # KickStart Actions:  None
1869
1870 # 5.B.3.b
1871 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1872
1873 # 5.B.3.b(1)
1874 # KickStart Actions:  None
1875
1876 # 5.B.3.b(2)
1877 # KickStart Actions:  None
1878
1879 # 5.B.3.b(3)
1880 # KickStart Actions:  None - PROCEDURAL REQUIREMENT
1881
1882 # 5.B.3.b(4)
1883 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1884
1885
1886 ###############################################################################
1887 # Availability System Security Features and Assurances (HIGH Availability)
1888
1889 # 6.B.3.a(1)
1890 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1891
1892 # 6.B.3.a(2)
1893 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1894
1895         # 6.B.3.a(2)(a)
1896         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1897
1898         # 6.B.3.a(2)(b)
1899         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1900
1901         # 6.B.3.a(2)(c)
1902         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1903
1904         # 6.B.3.a(2)(d)
1905         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1906
1907 # 6.B.3.a(3)
1908 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1909
1910         # 6.B.3.a(3)(a)
1911         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1912
1913         # 6.B.3.a(3)(b)
1914         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1915
1916         # 6.B.3.a(3)(c)
1917         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1918
1919         # 6.B.3.a(3)(d)
1920         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1921
1922 # 6.B.3.a(4)
1923 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1924
1925         # 6.B.3.a(4)(a)
1926         # KickStart Actions: None
1927
1928         # 6.B.3.a(4)(b)
1929         # KickStart Actions: None
1930
1931 # 6.B.3.a(5)
1932 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1933
1934 # 6.B.3.a(6)
1935 # KickStart Actions: None
1936
1937 # 6.B.3.a(7)
1938 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1939
1940         # 6.B.3.a(7)(a)
1941         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1942
1943         # 6.B.3.a(7)(b)
1944         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1945
1946         # 6.B.3.a(7)(c)
1947         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1948
1949 # 6.B.3.a(8)
1950 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1951
1952 # 6.B.3.a(9)
1953 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1954
1955 # 6.B.3.a(10)
1956 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1957
1958 # 6.B.3.a(11)
1959 # KickStart Actions: None
1960
1961 # 6.B.3.a(12)
1962 # KickStart Actions: None
1963
1964 # 6.B.3.b
1965 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1966
1967 # 6.B.3.b(1)
1968 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1969
1970 # 6.B.3.b(2)
1971 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1972
1973         # 6.B.3.b(2)(a)
1974         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1975
1976         # 6.B.3.b(2)(b)
1977         # KickStart Actions: None - PROCEDURAL REQUIREMENT
1978
1979 # 6.B.3.b(3)
1980 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1981
1982
1983
1984 ##########################################################################
1985 # Requirements for Interconnected Information Systems and Advanced Technologies
1986 #
1987
1988 # 7.A.1.a
1989 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1990
1991 # 7.A.1.b
1992 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1993
1994 # 7.A.2
1995 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1996
1997 # 7.A.3
1998 # KickStart Actions: None - PROCEDURAL REQUIREMENT
1999
2000 # 7.A.4
2001 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2002
2003 # 7.B.1.a(1)
2004 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2005
2006 # 7.B.1.a(2)
2007 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2008
2009 # 7.B.1.a(3)
2010 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2011
2012 # 7.B.2.a(1)
2013 # KickStart Actions: None
2014
2015 # 7.B.2.a(2)
2016 # KickStart Actions: None
2017
2018 # 7.B.2.a(3)
2019 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2020
2021 # 7.B.2.b
2022 # KickStart Actions: None
2023
2024 # 7.B.2.c
2025 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2026
2027 # 7.B.2.d
2028 # KickStart Actions: None
2029
2030 # 7.B.2.e
2031 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2032
2033 # 7.B.2.f
2034 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2035
2036 # 7.B.2.g
2037 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2038
2039 # 7.B.2.h
2040 # KickStart Actions: None
2041        
2042         # Implemented in GEN000980
2043         # Implemented in GEN002720
2044         # Implemented in GEN002740
2045         # Implemented in GEN002780
2046         # Implemented in GEN003660
2047
2048 # 7.B.2.i(1)
2049 # KickStart Actions: None
2050
2051         # Implemented in GEN006620
2052
2053 # 7.B.2.i(2)
2054 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2055
2056 # 7.B.2.i(3)(a)
2057 # KickStart Actions: None - DEVELOPMENT Requirement
2058
2059 # 7.B.2.i(3)(b)
2060 # KickStart Actions: None - DEVELOPMENT AND PROCEDURAL REQUIREMENTS
2061
2062 # 7.B.2.i(4)
2063 # KickStart Actions: None
2064
2065         # Implemented in GEN000980
2066
2067 # 7.B.2.i(5)
2068 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2069
2070 # 7.B.2.i(6)
2071 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2072
2073 # 7.B.3.a(1)
2074 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2075
2076 # 7.B.3.a(2)
2077 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2078
2079 # 7.B.3.b(1)
2080 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2081
2082 # 7.B.3.b(2)
2083 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2084
2085 # 7.B.3.c
2086 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2087
2088 # 7.B.3.d(1)
2089 # KickStart Actions:
2090
2091 # 7.B.3.d(2)
2092 # KickStart Actions:
2093
2094 # 7.B.3.d(3)
2095 # KickStart Actions:
2096
2097 # 7.B.3.d(4)
2098 # KickStart Actions:
2099
2100 # 7.B.3.d(5)
2101 # KickStart Actions:
2102
2103 # 7.B.3.d(6)
2104 # KickStart Actions:
2105
2106 # 7.B.3.e
2107 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2108
2109 # 7.B.3.f(1)
2110 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2111
2112 # 7.B.3.f(2)
2113 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2114
2115 # 7.B.3.g
2116 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2117
2118 # 7.B.4.a
2119 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2120
2121 # 7.B.4.b(1)
2122 # KickStart Actions:
2123
2124 # 7.B.4.b(2)
2125 # KickStart Actions:
2126
2127 # 7.B.4.b(3)
2128 # KickStart Actions:
2129
2130 # 7.B.4.b(4)
2131 # KickStart Actions:
2132
2133 # 7.B.4.b(5)
2134 # KickStart Actions:
2135
2136 # 7.B.4.b(6)
2137 # KickStart Actions:
2138  
2139 # 7.B.4.b(7)
2140 # KickStart Actions:
2141  
2142 # 7.B.4.c
2143 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2144
2145 # 7.C.1.a
2146 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2147
2148 # 7.C.1.b
2149 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2150
2151 # 7.C.1.c
2152 # KickStart Actions:
2153
2154 # 7.C.2.a
2155 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2156  
2157 # 7.C.2.a(1)
2158 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2159
2160 # 7.C.2.a(2)
2161 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2162
2163 # 7.C.2.a(3)
2164 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2165
2166 # 7.C.2.b
2167 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2168  
2169 # 7.D.2.a
2170 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2171  
2172 # 7.D.2.b
2173 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2174  
2175 # 7.D.2.c
2176 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2177  
2178 # 7.D.2.d
2179 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2180
2181 # 7.D.2.e
2182 # KickStart Actions:
2183  
2184 # 7.D.3.a
2185 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2186  
2187 # 7.D.3.b(1)
2188 # KickStart Actions: None - PROCEDURAL REQUIREMENT
2189  
2190 # 7.D.3.b(2)
2191 # KickStart Actions:
2192
2193 # 7.D.3.b(3)
2194 # KickStart Actions:
2195
2196
2197
2198
2199
2200 ##########################################################################
2201 # CNSS-SCC
2202 ##########################################################################
2203
2204
2205 ###################################
2206 # Access Control
2207
2208 # AC-1: Access Control Policy and Procedures
2209 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2210
2211 # AC-2: Account Management
2212 # Kickstart Actions:
2213
2214         # AC-2(1)
2215         # Kickstart Actions:
2216
2217         # AC-2(2)
2218         # Kickstart Actions:
2219
2220         # AC-2(3)
2221         # Kickstart Actions:
2222
2223         # AC-2(4)
2224         # Kickstart Actions:
2225
2226 # AC-3: Access Enforcement
2227 # Kickstart Actions:
2228
2229         # AC-3(1)
2230         # Kickstart Actions:
2231
2232                 # Implemented in GEN002420
2233
2234         # AC-3(2)
2235         # Kickstart Actions:
2236
2237         # AC-3(3)
2238         # Kickstart Actions:
2239
2240         # AC-3(4)
2241         # Kickstart Actions:
2242
2243                 # Implemented in GEN001260
2244                 # Implemented in GEN002980
2245                 # Implemented in GEN003200
2246                 # Implemented in GEN003240
2247                 # Implemented in GEN003260
2248                 # Implemented in GEN003960
2249                 # Implemented in GEN003980
2250                 # Implemented in GEN004000
2251                 # Implemented in GEN006520
2252
2253 # AC-4: Information Flow Enforcement
2254 # Kickstart Actions:
2255
2256         # AC-4(1)
2257         # Kickstart Actions:
2258
2259         # AC-4(2)
2260         # Kickstart Actions:
2261
2262         # AC-4(3)
2263         # Kickstart Actions:
2264
2265 # AC-5: Separation of Duties
2266 # Kickstart Actions:
2267
2268 # AC-6: Least Privilege
2269 # Kickstart Actions:
2270
2271         # AC-6(1)
2272         # Kickstart Actions:
2273
2274 # AC-7: Unsuccessful Login Attempts
2275 # Kickstart Actions:
2276
2277         # AC-7(1)
2278         # Kickstart Actions:
2279
2280                 # Implemented in GEN000460
2281                 # Implemented in GEN000480
2282
2283         # AC-7(2)
2284         # Kickstart Actions:
2285
2286 # AC-8: System Use Notification
2287 # Kickstart Actions:
2288
2289         # Implemented in GEN000400
2290
2291 # AC-9: Previous Logon Notification
2292 # Kickstart Actions:
2293
2294         # AC-9(1)
2295         # Kickstart Actions:
2296
2297 # AC-10: Concurrent Session Control
2298 # Kickstart Actions:
2299
2300 # AC-11: Session Lock
2301 # Kickstart Actions:
2302
2303         # AC-11(1)
2304         # Kickstart Actions:
2305
2306                 # Implemented in GEN000500
2307
2308 # AC-12: Session Termination
2309 # Kickstart Actions:
2310
2311         # AC-12(1)
2312         # Kickstart Actions:
2313                
2314                 # Implemented in GEN000500
2315
2316         # AC-12(2)
2317         # Kickstart Actions:
2318
2319 # AC-13: Supervision and Review—Access Control
2320 # Kickstart Actions:
2321
2322         # AC-13(1)
2323         # Kickstart Actions:
2324
2325 # AC-14: Permitted Actions without Identification or Authentication
2326 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2327
2328         # AC-14(1)
2329         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2330
2331 # AC-15: Automated Marking
2332 # Kickstart Actions:
2333
2334         # AC-15(1)
2335         # Kickstart Actions:
2336
2337 # AC-16: Automated Labeling
2338 # Kickstart Actions: None
2339
2340         # AC-16(1)
2341         # Kickstart Actions:
2342
2343         # AC-16(2)
2344         # Kickstart Actions:
2345
2346 # AC-17: Remote Access
2347 # Kickstart Actions:
2348
2349         # AC-17(1)
2350         # Kickstart Actions:
2351
2352         # AC-17(2)
2353         # Kickstart Actions:
2354                
2355                 # Implemented in GEN005500
2356
2357         # AC-17(3)
2358         # Kickstart Actions:
2359
2360         # AC-17(4)
2361         # Kickstart Actions:
2362
2363         # AC-17(5)
2364         # Kickstart Actions:
2365                
2366                 # Implemented in GEN005500
2367                 # Implemented in GEN006620
2368
2369         # AC-17(6)
2370         # Kickstart Actions:
2371
2372         # AC-17(7)
2373         # Kickstart Actions:
2374        
2375                 # Implemented in GEN001020
2376                 # Implemented in GEN001120
2377
2378 # AC-18: Wireless Access Restrictions
2379 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2380
2381         # AC-18(1)
2382         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2383
2384         # AC-18(2)
2385         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2386
2387         # AC-18(3)
2388         # Kickstart Actions:
2389
2390         # AC-18(4)
2391         # Kickstart Actions:
2392
2393 # AC-19: Access Control for Portable and Mobile Devices
2394 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2395
2396         # AC-19(1)
2397         # Kickstart Actions:
2398
2399 # AC-20: Use of External Information Systems
2400 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2401
2402         # AC-20(1)
2403         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2404
2405 # AC-21: Confidentiality of Data at Rest
2406 # Kickstart Actions:
2407
2408         # AC-21(1)
2409         # Kickstart Actions:
2410
2411         # AC-21(2)
2412         # Kickstart Actions:
2413
2414         # AC-21(3)
2415         # Kickstart Actions:
2416
2417 # AC-22: Distinct Level of Access
2418 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2419
2420 ###################################
2421 # Awareness and Training
2422
2423 # AT-1: Security Awareness and Training Policy and Procedures
2424 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2425
2426 # AT-2: Security Awareness
2427 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2428
2429 # AT-3: Security Training
2430 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2431
2432 # AT-4: Security Training Records
2433 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2434
2435 # AT-5: Contacts with Security Groups and Associations
2436 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2437
2438
2439 ###################################
2440 # Audit and Accountability
2441
2442 # AU-1: Audit and Accountability Policy and Procedures
2443 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2444
2445         # AU-1(1)
2446         # Kickstart Actions:
2447
2448 # AU-2: Auditable Events
2449 # Kickstart Actions:
2450
2451
2452         # AU-2(1)
2453         # Kickstart Actions:
2454                
2455                 # Implemented in GEN002660
2456                 # Implemented in GEN002680
2457                 # Implemented in GEN002700
2458
2459         # AU-2(2)
2460         # Kickstart Actions:
2461
2462         # AU-2(3)
2463         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2464
2465         # AU-2(4)
2466         # Kickstart Actions:
2467                
2468                 # Implemented in GEN002720
2469                 # Implemented in GEN002740
2470                 # Implemented in GEN002760
2471                 # Implemented in GEN002780
2472                 # Implemented in GEN002800
2473                 # Implemented in GEN002820
2474                 # Implemented in GEN002840
2475                
2476         # AU-2(5)
2477         # Kickstart Actions:
2478
2479         # AU-2(6)
2480         # Kickstart Actions:
2481
2482         # AU-2(7)
2483         # Kickstart Actions:
2484
2485         # AU-2(8)
2486         # Kickstart Actions:
2487
2488         # AU-2(9)
2489         # Kickstart Actions:
2490
2491 # AU-3: Content of Audit Records
2492 # Kickstart Actions:
2493
2494         # AU-3(1)
2495         # Kickstart Actions:
2496
2497         # AU-3(2)
2498         # Kickstart Actions:
2499
2500         # AU-3(3)
2501         # Kickstart Actions:
2502
2503         # AU-3(4)
2504         # Kickstart Actions:
2505
2506         # AU-3(5)
2507         # Kickstart Actions:
2508
2509 # AU-4: Audit Storage Capacity
2510 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2511
2512 # AU-5: Response to Audit Processing Failures
2513 # Kickstart Actions:
2514
2515         # AU-5(1)
2516         # Kickstart Actions:
2517
2518         # AU-5(2)
2519         # Kickstart Actions:
2520
2521         # AU-5(3)
2522         # Kickstart Actions:
2523
2524 # AU-6: Audit Monitoring, Analysis, and Reporting
2525 # Kickstart Actions:
2526
2527         # AU-6(1)
2528         # Kickstart Actions:
2529
2530         # AU-6(2)
2531         # Kickstart Actions:
2532
2533         # AU-6(3)
2534         # Kickstart Actions:
2535
2536         # AU-6(4)
2537         # Kickstart Actions:
2538
2539         # AU-6(5)
2540         # Kickstart Actions:
2541
2542 # AU-7: Audit Reduction and Report Generation
2543 # Kickstart Actions:
2544
2545         # AU-7(1)
2546         # Kickstart Actions:
2547
2548         # AU-7(2)
2549         # Kickstart Actions:
2550
2551 # AU-8: Time Stamps
2552 # Kickstart Actions:
2553
2554         # AU-8(1)
2555         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2556
2557         # AU-8(2)
2558         # Kickstart Actions:
2559
2560 # AU-9: Protection of Audit Information
2561 # Kickstart Actions:
2562        
2563         # Implemented in GEN002680
2564         # Implemented in GEN002700
2565
2566         # AU-9(1)
2567         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2568
2569         # AU-9(2)
2570         # Kickstart Actions:
2571
2572 # AU-10: Non-repudiation
2573 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2574
2575         # AU-10(1)
2576         # Kickstart Actions:
2577
2578         # AU-10(2)
2579         # Kickstart Actions:
2580
2581         # AU-10(3)
2582         # Kickstart Actions:
2583
2584         # AU-10(4)
2585         # Kickstart Actions:
2586
2587 # AU-11: Audit Record Retention
2588 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2589
2590         # AU-11(1)
2591         # Kickstart Actions:
2592
2593         # AU-11(2)
2594         # Kickstart Actions:
2595
2596         # AU-11(3)
2597         # Kickstart Actions:
2598
2599         # AU-11(4)
2600         # Kickstart Actions:
2601
2602 # AU-12: Session Audit
2603 # Kickstart Actions:
2604
2605         # AU-12(1)
2606         # Kickstart Actions:
2607
2608         # AU-12(2)
2609         # Kickstart Actions:
2610
2611
2612 ###################################
2613 # Certification, Accreditation, and Security Assessments
2614
2615 # CA-1: Certification, Accreditation, and Security Assessment Policies and Procedures
2616 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2617
2618 # CA-2: Security Assessments
2619 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2620
2621 # CA-3: Information System Connections
2622 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2623
2624 # CA-4: Security Certification
2625 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2626
2627         # CA-4(1)
2628         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2629
2630 # CA-5: Plan of Action and Milestones
2631 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2632
2633 # CA-6: Security Accreditation
2634 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2635
2636 # CA-7: Continuous Monitoring
2637 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2638
2639         # CA-7(1)
2640         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2641
2642         # CA-7(2)
2643         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2644
2645
2646 ###################################
2647 # Configuration Management
2648
2649 # CM-1: Configuration Management Policy and Procedures
2650 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2651
2652 # CM-2: Baseline Configuration
2653 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2654
2655         # CM-2(1)
2656         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2657
2658         # CM-2(2)
2659         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2660
2661 # CM-3: Configuration Change Control
2662 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2663
2664         # CM-3(1)
2665         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2666
2667         # CM-3(2)
2668         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2669
2670         # CM-3(3)
2671         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2672
2673 # CM-4: Monitoring Configuration Changes
2674 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2675
2676 # CM-5: Access Restrictions for Change
2677 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2678
2679         # CM-5(1)
2680         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2681
2682         # CM-5(2)
2683         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2684
2685         # CM-5(3)
2686         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2687
2688         # CM-5(4)
2689         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2690
2691 # CM-6: Configuration Settings
2692 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2693
2694         # CM-6(1)
2695         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2696
2697         # CM-6(2)
2698         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2699
2700 # CM-7: Least Functionality
2701 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2702
2703         # CM-7(1)
2704         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2705
2706         # CM-7(2)
2707         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2708
2709 # CM-8: Information System Component Inventory
2710 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2711
2712         # CM-8(1)
2713         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2714
2715         # CM-8(2)
2716         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2717
2718
2719 ###################################
2720 # Contingency Planning
2721
2722 # CP-1: Contingency Planning Policy and Procedures
2723 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2724
2725         # CP-1(1)
2726         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2727
2728 # CP-2: Contingency Plan
2729 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2730
2731         # CP-2(1)
2732         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2733
2734         # CP-2(2)
2735         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2736
2737         # CP-2(3)
2738         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2739
2740         # CP-2(4)
2741         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2742
2743         # CP-2(5)
2744         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2745
2746         # CP-2(6)
2747         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2748
2749         # CP-2(7)
2750         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2751
2752 # CP-3: Contingency Training
2753 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2754
2755         # CP-3(1)
2756         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2757
2758         # CP-3(2)
2759         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2760
2761 # CP-4: Contingency Plan Testing and Exercises
2762 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2763
2764         # CP-4(1)
2765         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2766
2767         # CP-4(2)
2768         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2769
2770         # CP-4(3)
2771         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2772
2773         # CP-4(4)
2774         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2775
2776 # CP-5: Contingency Plan Update
2777 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2778
2779 # CP-6: Alternate Storage Site
2780 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2781
2782         # CP-6(1)
2783         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2784
2785         # CP-6(2)
2786         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2787
2788         # CP-6(3)
2789         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2790
2791         # CP-6(4)
2792         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2793
2794         # CP-6(5)
2795         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2796
2797         # CP-6(6)
2798         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2799
2800 # CP-7: Alternate Processing Site
2801 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2802
2803         # CP-7(1)
2804         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2805
2806         # CP-7(2)
2807         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2808
2809         # CP-7(3)
2810         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2811
2812         # CP-7(4)
2813         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2814
2815         # CP-7(5)
2816         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2817
2818         # CP-7(6)
2819         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2820
2821 # CP-8: Telecommunications Services
2822 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2823
2824         # CP-8(1)
2825         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2826
2827         # CP-8(2)
2828         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2829
2830         # CP-8(3)
2831         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2832
2833         # CP-8(4)
2834         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2835
2836 # CP-9: Information System Backup
2837 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2838
2839         # CP-9(1)
2840         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2841
2842         # CP-9(2)
2843         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2844
2845         # CP-9(3)
2846         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2847
2848         # CP-9(4)
2849         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2850
2851 # CP-10: Information System Recovery and Reconstitution Identification and Authentication
2852 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2853
2854         # CP-10(1)
2855         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2856
2857         # CP-10(2)
2858         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2859
2860         # CP-10(3)
2861         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2862
2863
2864 ###################################
2865 # Identification and Authentication
2866
2867 # IA-1: Identification and Authentication Policy and Procedures
2868 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2869
2870 # IA-2: User Identification and Authentication
2871 # Kickstart Actions:
2872
2873         # Implemented in GEN000540
2874         # Implemented in GEN000560
2875         # Implemented in GEN000580
2876         # Implemented in GEN000600
2877         # Implemented in GEN000700
2878         # Implemented in GEN000800
2879         # Implemented in GEN001380
2880         # Implemented in GEN001400
2881         # Implemented in GEN001420
2882
2883         # IA-2(1)
2884         # Kickstart Actions:
2885
2886         # IA-2(2)
2887         # Kickstart Actions:
2888
2889         # IA-2(3)
2890         # Kickstart Actions:
2891
2892         # IA-2(4)
2893         # Kickstart Actions:
2894
2895         # IA-2(5)
2896         # Kickstart Actions:
2897
2898         # IA-2(6)
2899         # Kickstart Actions:
2900
2901         # IA-2(7)
2902         # Kickstart Actions:
2903
2904         # IA-2(8)
2905         # Kickstart Actions:
2906
2907 # IA-3: Device Identification and Authentication
2908 # Kickstart Actions:
2909
2910         # IA-3(1)
2911         # Kickstart Actions:
2912
2913         # IA-3(2)
2914         # Kickstart Actions:
2915
2916 # IA-4: Identifier Management
2917 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2918
2919         # IA-4(1)
2920         # Kickstart Actions:
2921
2922         # IA-4(2)
2923         # Kickstart Actions:
2924
2925         # IA-4(3)
2926         # Kickstart Actions:
2927
2928         # IA-4(4)
2929         # Kickstart Actions:
2930
2931 # IA-5: Authenticator Management
2932 # Kickstart Actions:
2933
2934         # IA-5(1)
2935         # Kickstart Actions:
2936
2937         # IA-5(2)
2938         # Kickstart Actions:
2939
2940         # IA-5(3)
2941         # Kickstart Actions:
2942
2943         # IA-5(4)
2944         # Kickstart Actions:
2945
2946         # IA-5(5)
2947         # Kickstart Actions:
2948
2949 # IA-6: Authenticator Feedback
2950 # Kickstart Actions:
2951
2952 # IA-7: Cryptographic Module Authentication Incident Response
2953 # Kickstart Actions:
2954
2955
2956 ###################################
2957 # Incident Response
2958
2959 # IR-1: Incident Response Policy and Procedures
2960 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2961
2962         # IR-1(1)
2963         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2964
2965 # IR-2: Incident Response Training
2966 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2967
2968         # IR-2(1)
2969         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2970
2971         # IR-2(2)
2972         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2973
2974 # IR-3: Incident Response Testing and Exercises
2975 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2976
2977         # IR-3(1)
2978         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2979
2980         # IR-3(2)
2981         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2982
2983 # IR-4: Incident Handling
2984 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2985
2986         # IR-4(1)
2987         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2988
2989 # IR-5: Incident Monitoring
2990 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2991
2992         # IR-5(1)
2993         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2994
2995 # IR-6: Incident Reporting
2996 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
2997
2998         # IR-6(1)
2999         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3000
3001 # IR-7: Incident Response Assistance
3002 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3003
3004         # IR-7(1)
3005         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3006
3007
3008 ###################################
3009 # Maintenance
3010
3011 # MA-1: System Maintenance Policy and Procedures
3012 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3013
3014 # MA-2: Controlled Maintenance
3015 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3016
3017         # MA-2(1)
3018         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3019
3020         # MA-2(2)
3021         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3022
3023 # MA-3: Maintenance Tools
3024 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3025
3026         # MA-3(1)
3027         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3028
3029         # MA-3(2)
3030         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3031
3032         # MA-3(3)
3033         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3034
3035         # MA-3(4)
3036         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3037
3038 # MA-4: Remote Maintenance
3039 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3040
3041         # MA-4(1)
3042         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3043
3044         # MA-4(2)
3045         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3046
3047         # MA-4(3)
3048         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3049
3050 # MA-5: Maintenance Personnel
3051 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3052
3053 # MA-6: Timely Maintenance
3054 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3055
3056
3057 ###################################
3058 # Media Protection
3059
3060 # MP-1: Media Protection Policy and Procedures
3061 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3062
3063 # MP-2: Media Access
3064 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3065
3066         # MP-2(1)
3067         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3068
3069 # MP-3: Media Labeling
3070 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3071
3072 # MP-4: Media Storage
3073 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3074
3075 # MP-5: Media Transport
3076 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3077
3078         # MP-5(1)
3079         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3080
3081         # MP-5(2)
3082         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3083
3084         # MP-5(3)
3085         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3086
3087 # MP-6: Media Sanitization and Disposal
3088 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3089
3090         # MP-6(1)
3091         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3092
3093         # MP-6(2)
3094         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3095
3096
3097 ###################################
3098 # Physical and Environmental Protection
3099
3100 # PE-1: Physical and Environmental Protection Policy and Procedures
3101 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3102
3103 # PE-2: Physical Access Authorizations
3104 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3105
3106 # PE-3: Physical Access Control
3107 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3108
3109         # PE-3(1)
3110         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3111
3112 # PE-4: Access Control for Transmission Medium
3113 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3114
3115 # PE-5: Access Control for Display Medium
3116 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3117
3118 # PE-6: Monitoring Physical Access
3119 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3120
3121         # PE-6(1)
3122         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3123
3124         # PE-6(2)
3125         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3126
3127 # PE-7: Visitor Control
3128 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3129
3130         # PE-7(1)
3131         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3132
3133 # PE-8: Access Records
3134 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3135
3136         # PE-8(1)
3137         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3138
3139         # PE-8(2)
3140         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3141
3142 # PE-9: Power Equipment and Power Cabling
3143 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3144
3145         # PE-9(1)
3146         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3147
3148 # PE-10: Emergency Shutoff
3149 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3150
3151         # PE-10(1)
3152         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3153
3154 # PE-11: Emergency Power
3155 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3156
3157         # PE-11(1)
3158         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3159
3160         # PE-11(2)
3161         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3162
3163 # PE-12: Emergency Lighting
3164 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3165
3166 # PE-13: Fire Protection
3167 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3168
3169         # PE-13(1)
3170         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3171
3172         # PE-13(2)
3173         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3174
3175         # PE-13(3)
3176         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3177
3178 # PE-14: Temperature and Humidity Controls
3179 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3180
3181 # PE-15: Water Damage Protection
3182 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3183
3184         # PE-15(1)
3185         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3186
3187 # PE-16: Delivery and Removal
3188 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3189
3190 # PE-17: Alternate Work Site
3191 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3192
3193 # PE-18: Location of Information System Components
3194 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3195
3196         # PE-18(1)
3197         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3198
3199 # PE-19: Information Leakage Planning
3200 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3201
3202
3203 ###################################
3204 # Planning
3205
3206 # PL-1: Security Planning Policy and Procedures
3207 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3208
3209 # PL-2: System Security Plan
3210 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3211
3212 # PL-3: System Security Plan Update
3213 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3214
3215 # PL-4: Rules of Behavior
3216 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3217
3218 # PL-5: Privacy Impact Assessment
3219 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3220
3221 # PL-6: Security-Related Activity Planning Personnel Security
3222 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3223
3224
3225 ###################################
3226 # Personnel Security
3227
3228 # PS-1: Personnel Security Policy and Procedures
3229 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3230
3231 # PS-2: Position Categorization
3232 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3233
3234 # PS-3: Personnel Screening
3235 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3236
3237 # PS-4: Personnel Termination
3238 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3239
3240 # PS-5: Personnel Transfer
3241 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3242
3243 # PS-6: Access Agreements
3244 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3245
3246 # PS-7: Third-Party Personnel Security
3247 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3248
3249 # PS-8: Personnel Sanctions Risk Assessment
3250 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3251
3252
3253 ###################################
3254 # Risk Assessment
3255
3256 # RA-1: Risk Assessment Policy and Procedures
3257 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3258
3259 # RA-2: Security Categorization
3260 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3261
3262 # RA-3: Risk Assessment
3263 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3264
3265 # RA-4: Risk Assessment Update
3266 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3267
3268 # RA-5: Vulnerability Scanning
3269 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3270
3271         # RA-5(1)
3272         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3273
3274         # RA-5(2)
3275         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3276
3277         # RA-5(3)
3278         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3279
3280
3281 ###################################
3282 # System and Services Acquisition
3283
3284 # SA-1: System and Services Acquisition Policy and Procedures
3285 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3286
3287 # SA-2: Allocation of Resources
3288 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3289
3290 # SA-3: Life Cycle Support
3291 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3292
3293 # SA-4: Acquisitions
3294 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3295
3296         # SA-4(1)
3297         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3298
3299         # SA-4(2)
3300         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3301
3302 # SA-5: Information System Documentation
3303 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3304
3305         # SA-5(1)
3306         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3307
3308         # SA-5(2)
3309         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3310
3311 # SA-6: Software Usage Restrictions
3312 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3313
3314 # SA-7: User Installed Software
3315 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3316
3317 # SA-8: Security Engineering Principles
3318 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3319
3320 # SA-9: External Information System Services
3321 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3322
3323 # SA-10: Developer Configuration Management
3324 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3325
3326 # SA-11: Developer Security Testing
3327 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3328
3329
3330 ###################################
3331 # System and Communications Protection
3332
3333 # SC-1: System and Communications Protection Policy and Procedures
3334 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3335
3336         # SC-1(1)
3337         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3338
3339 # SC-2: Application Partitioning
3340 # Kickstart Actions:
3341
3342 # SC-3: Security Function Isolation
3343 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3344
3345         # SC-3(1)
3346         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3347
3348         # SC-3(2)
3349         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3350
3351         # SC-3(3)
3352         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3353
3354         # SC-3(4)
3355         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3356
3357         # SC-3(5)
3358         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3359
3360 # SC-4: Information Remnance
3361 # Kickstart Actions:
3362
3363 # SC-5: Denial of Service Protection
3364 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3365
3366         # SC-5(1)
3367         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3368
3369         # SC-5(2)
3370         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3371
3372                 # Implemented in GEN003600
3373                 # Implemented in GEN005600
3374
3375         # SC-5(3)
3376         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3377
3378 # SC-6: Resource Priority
3379 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3380
3381 # SC-7: Boundary Protection
3382 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3383
3384         # SC-7(1)
3385         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3386
3387         # SC-7(2)
3388         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3389
3390         # SC-7(3)
3391         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3392
3393         # SC-7(4)
3394         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3395
3396         # SC-7(5)
3397         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3398
3399                 # Implemented in GEN006620
3400
3401         # SC-7(6)
3402         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3403
3404         # SC-7(7)
3405         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3406
3407         # SC-7(8)
3408         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3409
3410 # SC-8: Transmission Integrity
3411 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3412
3413         # SC-8(1)
3414         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3415
3416         # SC-8(2)
3417         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3418
3419 # SC-9: Transmission Confidentiality
3420 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3421
3422         # Implemented in GEN005500
3423
3424         # SC-9(1)
3425         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3426
3427         # SC-9(2)
3428         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3429
3430         # SC-9(3)
3431         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3432
3433         # SC-9(4)
3434         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3435
3436         # SC-9(5)
3437         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3438
3439 # SC-10: Network Disconnect
3440 # Kickstart Actions:
3441
3442 # SC-11: Trusted Path
3443 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3444
3445 # SC-12: Cryptographic Key Establishment and Management
3446 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3447
3448         # SC-12(1)
3449         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3450
3451         # SC-12(2)
3452         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3453
3454         # SC-12(3)
3455         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3456
3457         # SC-12(4)
3458         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3459
3460 # SC-13: Use of Cryptography
3461 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3462
3463 # SC-14: Public Access Protections
3464 # Kickstart Actions:
3465
3466 # SC-15: Collaborative Computing
3467 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3468
3469         # SC-15(1)
3470         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3471
3472         # SC-15(2)
3473         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3474
3475         # SC-15(3)
3476         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3477
3478 # SC-16: Transmission of Security Parameters
3479 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3480
3481         # SC-16(1)
3482         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3483
3484         # SC-16(2)
3485         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3486
3487 # SC-17: Public Key Infrastructure Certificates
3488 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3489
3490 # SC-18: Mobile Code
3491 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3492
3493         # SC-18(1)
3494         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3495
3496         # SC-18(2)
3497         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3498
3499 # SC-19: Voice Over Internet Protocol
3500 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3501
3502 # SC-20: Secure Name /Address Resolution Service (Authoritative Source)
3503 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3504
3505         # SC-20(1)
3506         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3507
3508 # SC-21: Secure Name /Address Resolution Service (Recursive or Caching Resolver)
3509 # Kickstart Actions:
3510
3511         # SC-21(1)
3512         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3513
3514 # SC-22: Architecture and Provisioning for Name/Address Resolution Service
3515 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3516
3517 # SC-23: Session Authenticity
3518 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3519
3520
3521 ###################################
3522 # System and Information Integrity
3523
3524 # SI-1: System and Information Integrity Policy and Procedures
3525 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3526
3527 # SI-2: Flaw Remediation
3528 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3529
3530         # SI-2(1)
3531         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3532
3533         # SI-2(2)
3534         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3535
3536         # SI-2(3)
3537         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3538
3539 # SI-3: Malicious Code Protection
3540 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3541
3542         # SI-3(1)
3543         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3544
3545         # SI-3(2)
3546         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3547
3548         # SI-3(3)
3549         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3550
3551         # SI-3(4)
3552         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3553
3554         # SI-3(5)
3555         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3556
3557         # SI-3(6)
3558         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3559
3560 # SI-4: Information System Monitoring Tools and Techniques
3561 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3562
3563         # SI-4(1)
3564         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3565
3566         # SI-4(2)
3567         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3568
3569         # SI-4(3)
3570         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3571
3572         # SI-4(4)
3573         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3574
3575         # SI-4(5)
3576         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3577
3578         # SI-4(6)
3579         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3580
3581 # SI-5: Security Alerts and Advisories
3582 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3583
3584         # SI-5(1)
3585         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3586
3587 # SI-6: Security Functionality Verification
3588 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3589
3590         # SI-6(1)
3591         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3592
3593         # SI-6(2)
3594         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3595
3596 # SI-7: Software and Information Integrity
3597 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3598
3599         # SI-7(1)
3600         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3601
3602         # SI-7(2)
3603         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3604
3605         # SI-7(3)
3606         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3607
3608 # SI-8: Spam Protection
3609 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3610
3611         # SI-8(1)
3612         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3613
3614         # SI-8(2)
3615         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3616
3617         # SI-8(3)
3618         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3619
3620         # SI-8(4)
3621         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3622
3623         # SI-8(5)
3624         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3625
3626         # SI-8(6)
3627         # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3628
3629 # SI-9: Information Input Restrictions
3630 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3631
3632 # SI-10: Information Accuracy, Completeness, Validity, and Authenticity
3633 # Kickstart Actions:
3634
3635 # SI-11: Error Handling
3636 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3637
3638 # SI-12: Information Output Handling and Retention
3639 # Kickstart Actions: None - PROCEDURAL REQUIREMENT
3640
3641
3642
3643
3644
3645 eject
3646
3647
3648 #END OF KICKSTART FILE POST SETTINGS
Note: See TracBrowser for help on using the browser.