STIGQter: STIG Summary: Oracle Linux 9 Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

The OL 9 operating system must implement cryptographic mechanisms to prevent unauthorized modification of all information at rest.

DISA Rule

SV-271431r1092616_rule

Vulnerability Number

V-271431

Group Title

SRG-OS-000780-GPOS-00240

Rule Version

OL09-00-000001

Severity

CAT II

CCI(s)

• CCI-004910 - Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

Weight

10

Fix Recommendation

Configure the OL 9 operating system to implement cryptographic mechanisms to prevent unauthorized modification of all information at rest.

To encrypt an entire partition, dedicate a partition for encryption in the partition layout.

Note: Encrypting a partition in an already-installed system is more difficult because it will need to be resized and existing partitions changed.

Check Contents

Note: If there is a documented and approved reason for not having data at rest encryption, this requirement is Not Applicable.

Verify that OL 9 prevents unauthorized disclosure or modification of all information requiring at rest protection by using disk encryption.

Determine the partition layout for the system with the following command:

$ sudo fdisk -l
(..)
Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB

Device Start End Sectors Size Type
/dev/vda1 2048 4095 2048 1M BIOS boot
/dev/vda2 4096 2101247 2097152 1G Linux filesystem
/dev/vda3 2101248 31455231 29353984 14G Linux filesystem
(...)

Verify that the system partitions are all encrypted with the following command:

$ sudo more /etc/crypttab

Every persistent disk partition present must have an entry in the file.

If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) are not listed, this is a finding.

Vulnerability Number

V-271431

Documentable

False

Rule Version

OL09-00-000001

Severity Override Guidance

Note: If there is a documented and approved reason for not having data at rest encryption, this requirement is Not Applicable.

Verify that OL 9 prevents unauthorized disclosure or modification of all information requiring at rest protection by using disk encryption.

Determine the partition layout for the system with the following command:

$ sudo fdisk -l
(..)
Disk /dev/vda: 15 GiB, 16106127360 bytes, 31457280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 83298450-B4E3-4B19-A9E4-7DF147A5FEFB

Device Start End Sectors Size Type
/dev/vda1 2048 4095 2048 1M BIOS boot
/dev/vda2 4096 2101247 2097152 1G Linux filesystem
/dev/vda3 2101248 31455231 29353984 14G Linux filesystem
(...)

Verify that the system partitions are all encrypted with the following command:

$ sudo more /etc/crypttab

Every persistent disk partition present must have an entry in the file.

If any partitions other than the boot partition or pseudo file systems (such as /proc or /sys) are not listed, this is a finding.

Check Content Reference

M

Target Key

5680