Compliance
Control coverage
The framework controls Signal9's hardening labs exercise, and which lab grades each one. Every lab here starts from a deliberately insecure box and passes only when the box's real configuration meets the control.
30
labs
4
frameworks
96
controls mapped
Coverage by framework
Rule ids from the Canonical Ubuntu 22.04 LTS STIG (V2R8), the OS these labs run on. A lab is listed only when it grades the rule's setting at a value the STIG accepts.
| Control | Graded in |
|---|---|
| UBTU-22-213020Ubuntu 22.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution. | STIG Capstone: Certify the Full Baseline, STIG: Harden Kernel Network Parameters (sysctl) |
| UBTU-22-253010Ubuntu 22.04 LTS must be configured to use TCP syncookies. | STIG Capstone: Certify the Full Baseline, STIG: Harden Kernel Network Parameters (sysctl) |
| UBTU-22-255020Ubuntu 22.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting any local or remote connection to the system. | STIG: Display the DoD Notice and Consent Banner |
| UBTU-22-255035Ubuntu 22.04 LTS must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. | STIG: Harden the SSH Daemon |
| UBTU-22-255040Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. | STIG Capstone: Certify the Full Baseline, STIG: Harden the SSH Daemon |
| UBTU-22-255050Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | STIG: Enforce Strong SSH Crypto |
| UBTU-22-255055Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. | STIG: Enforce Strong SSH Crypto |
| UBTU-22-255060Ubuntu 22.04 LTS SSH server must be configured to use only FIPS-validated key exchange algorithms. | STIG: Enforce Strong SSH Crypto |
| UBTU-22-411015Ubuntu 22.04 LTS must uniquely identify interactive users. | STIG: Clean Up Dangerous Accounts |
| UBTU-22-411025Ubuntu 22.04 LTS must enforce 24 hours/one day as the minimum password lifetime. Passwords for new users must have a 24 hours/one day minimum password lifetime restriction. | STIG: Enforce Account & Password Policy |
| UBTU-22-411030Ubuntu 22.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction. | STIG Baseline Hardening, STIG Capstone: Certify the Full Baseline, STIG: Enforce Account & Password Policy |
| UBTU-22-411045Ubuntu 22.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made. | STIG: Account Lockout with pam_faillock |
| UBTU-22-412035Ubuntu 22.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files. | STIG Capstone: Certify the Full Baseline, STIG: Set a Restrictive Default umask (077) |
| UBTU-22-432011Ubuntu 22.04 LTS must require users to provide a password for privilege escalation. | STIG: Fix a Dangerous sudo Policy |
| UBTU-22-611020Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one numeric character be used. | STIG: Enforce Account & Password Policy |
| UBTU-22-611035Ubuntu 22.04 LTS must enforce a minimum 15-character password length. | STIG Capstone: Certify the Full Baseline, STIG: Enforce Account & Password Policy |
| UBTU-22-611065Ubuntu 22.04 LTS must not have accounts configured with blank or null passwords. | STIG: Clean Up Dangerous Accounts |
| UBTU-22-654145Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | STIG: Configure auditd Rules & Retention |
| UBTU-22-654150Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. | STIG: Configure auditd Rules & Retention |
| UBTU-22-654220Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur. | STIG: Configure auditd Rules & Retention |
What this does and doesn't show
- Labs are checked by Signal9's own grader, not by OpenSCAP or an assessor. A lab maps to its controls as a whole; it doesn't grade every requirement in each control.
- The mapping is Signal9's, kept in each lab's source. No third-party assessor has reviewed it.
- Completing these labs shows hands-on practice. It isn't an audit, a certification or an attestation that any system you run is compliant.
Your evidence record
The mapped labs you've completed, when the grader passed them, and the controls they cover. Hints and viewed solutions are listed, so a reader can weigh each one.
Sign in to see which of these controls your completed labs cover.