STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must employ a deny-all, allow-by-exception policy for allowing connections to other systems.

DISA Rule

SV-280957r1165226_rule

Vulnerability Number

V-280957

Group Title

SRG-OS-000297-GPOS-00115

Rule Version

RHEL-10-200532

Severity

CAT II

CCI(s)

• CCI-002314 - Employ automated mechanisms to control remote access methods.

Weight

10

Fix Recommendation

Configure RHEL 10 so that the "firewalld" daemon employs a deny-all, allow-by-exception policy with the following commands (using ens133 as an example interface):

Start by adding the exceptions that are required for mission functionality to the "drop" zone. If SSH access on port 22 is needed, for example, run the following:

$ sudo firewall-cmd --permanent --add-service=ssh --zone=drop

Reload the firewall rules to update the runtime configuration from the "--permanent" changes made above:

$ sudo firewall-cmd --reload

Set the default zone to the drop zone:

$ sudo firewall-cmd --set-default-zone=drop
Note: This is a runtime and permanent change.

Add any interfaces to the newly modified "drop" zone:

$ sudo firewall-cmd --permanent --zone=drop --change-interface=ens33

Reload the firewall rules for changes to take effect:

$ sudo firewall-cmd --reload

Check Contents

Verify RHEL 10 is configured so that "firewalld" employs a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands (using ens133 as an example interface):

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --get-active-zones
drop (default)
interfaces: ens33

$ sudo firewall-cmd --info-zone=drop | grep target
target: DROP

$ sudo firewall-cmd --permanent --info-zone=drop | grep target
target: DROP

If no zones are active on the RHEL 10 interfaces or if runtime and permanent targets are set to an option other than "DROP", this is a finding.

Verify the permanent configuration is valid and there are no misconfigured zones or rules with the following command:

$ sudo firewall-cmd --check-config
success

If this command does not return "success", this is a finding.

Vulnerability Number

V-280957

Documentable

False

Rule Version

RHEL-10-200532

Severity Override Guidance

Verify RHEL 10 is configured so that "firewalld" employs a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands (using ens133 as an example interface):

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --get-active-zones
drop (default)
interfaces: ens33

$ sudo firewall-cmd --info-zone=drop | grep target
target: DROP

$ sudo firewall-cmd --permanent --info-zone=drop | grep target
target: DROP

If no zones are active on the RHEL 10 interfaces or if runtime and permanent targets are set to an option other than "DROP", this is a finding.

Verify the permanent configuration is valid and there are no misconfigured zones or rules with the following command:

$ sudo firewall-cmd --check-config
success

If this command does not return "success", this is a finding.

Check Content Reference

M

Target Key

5733