STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.

DISA Rule

SV-257879r1045454_rule

Vulnerability Number

V-257879

Group Title

SRG-OS-000405-GPOS-00184

Rule Version

RHEL-09-231190

Severity

CAT I

CCI(s)

CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
CCI-002475 - Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.
CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

Fix Recommendation

Configure RHEL 9 to prevent unauthorized modification of all information at rest by using disk encryption.

Encrypting a partition in an already installed system is more difficult, because existing partitions will need to be resized and changed.

To encrypt an entire partition, dedicate a partition for encryption in the partition layout.

Check Contents

Note: If there is a documented and approved reason for not having data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is Not Applicable.

Verify RHEL 9 prevents unauthorized disclosure or modification of all information requiring at-rest protection by using disk encryption.

Note: If there is a documented and approved reason for not having data-at-rest encryption, this requirement is Not Applicable.

List all block devices in tree-like format:

$ sudo lsblk --tree

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
zram0 252:0 0 8G 0 disk [SWAP]
nvme0n1 259:0 0 476.9G 0 disk
|-nvme0n1p1 259:1 0 1G 0 part /boot/efi
|-nvme0n1p2 259:2 0 1G 0 part /boot
|-nvme0n1p3 259:3 0 474.9G 0 part
|-luks-<encrypted_id> 253:0 0 474.9G 0 crypt
|-rhel-root 253:1 0 16G 0 lvm /
|-rhel-varcache 253:2 0 8G 0 lvm /var/cache
|-rhel-vartmp 253:3 0 4G 0 lvm /var/tmp
|-rhel-varlog 253:4 0 4G 0 lvm /var/log
|-rhel-home 253:5 0 64G 0 lvm /home
|-rhel-varlogaudit 253:6 0 4G 0 lvm /var/log/audit

Verify that the block device tree for each persistent filesystem, excluding the /boot and /boot/efi filesystems, has at least one parent block device of type "crypt", and that the encryption type is LUKS:

$ sudo cryptsetup status luks-b74f6910-2547-4399-86b2-8b0252d926d7
/dev/mapper/luks-b74f6910-2547-4399-86b2-8b0252d926d7 is active and is in use.
type: LUKS2
cipher: aes-xts-plain64
keysize: 512 bits
key location: keyring
device: /dev/nvme0n1p3
sector size: 512
offset: 32768 sectors
size: 995986063 sectors
mode: read/write

If there are persistent filesystems (other than /boot or /boot/efi) whose block device trees do not have a crypt block device of type LUKS, ask the administrator to indicate how persistent filesystems are encrypted.

If there is no evidence that persistent filesystems are encrypted, this is a finding.

Vulnerability Number

V-257879

Documentable

False

Rule Version

RHEL-09-231190

Severity Override Guidance

Check Content Reference

Target Key

5551