STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.

DISA Rule

SV-274158r1184031_rule

Vulnerability Number

V-274158

Group Title

SRG-OS-000096-GPOS-00050

Rule Version

AZLX-23-002475

Severity

CAT II

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-002314 - Employ automated mechanisms to control remote access methods.
• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Configure Amazon Linux 2023 to prohibit/restrict Functions, Ports, Protocols, and Services. Use firewall-cmd to manage firewalld.

To open a port for a service, configure firewalld using the following command:

$ sudo firewall-cmd --permanent --add-port=port_number/tcp
or
$ sudo firewall-cmd --permanent --add-service=service_name

Check Contents

Verify Amazon Linux 2023 firewall is configured to block unregistered ports, protocols, and services.

Inspect the list of enabled firewall ports and verify they are configured correctly by running the following command:

$ sudo firewall-cmd --list-all

Ask the system administrator for the site or program PPSM Component Local Service Assessment (CLSA). Verify the services allowed by the firewall match the PPSM CLSA.

If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM CAL, or there are no firewall rules configured, this is a finding.

Vulnerability Number

V-274158

Documentable

False

Rule Version

AZLX-23-002475

Severity Override Guidance

Verify Amazon Linux 2023 firewall is configured to block unregistered ports, protocols, and services.

Inspect the list of enabled firewall ports and verify they are configured correctly by running the following command:

$ sudo firewall-cmd --list-all

Ask the system administrator for the site or program PPSM Component Local Service Assessment (CLSA). Verify the services allowed by the firewall match the PPSM CLSA.

If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM CAL, or there are no firewall rules configured, this is a finding.

Check Content Reference

M

Target Key

5700