STIGQter STIGQter: STIG Summary:

Solaris 11 X86 Security Technical Implementation Guide

Version: 3

Release: 6 Benchmark Date: 01 Jul 2026

CheckedNameTitle
☐SV-216011r986460_ruleThe audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.
☐SV-216014r958430_ruleThe operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.
☐SV-216015r958442_ruleThe audit records must provide data for all auditable events defined at the organizational level for the organization-defined information system components.
☐SV-216016r958446_ruleThe operating system must generate audit records for the selected list of auditable events as defined in DoD list of events.
☐SV-216018r958412_ruleAudit records must include what type of events occurred.
☐SV-216019r958414_ruleAudit records must include when (date and time) the events occurred.
☐SV-216020r958416_ruleAudit records must include where the events occurred.
☐SV-216021r958418_ruleAudit records must include the sources of the events that occurred.
☐SV-216022r958420_ruleAudit records must include the outcome (success or failure) of the events that occurred.
☐SV-216023r959010_ruleThe audit system must be configured to audit file deletions.
☐SV-216024r958368_ruleThe audit system must be configured to audit account creation.
☐SV-216025r958590_ruleThe audit system must be configured to audit account modification.
☐SV-216026r958592_ruleThe operating system must automatically audit account disabling actions.
☐SV-216027r958594_ruleThe operating system must automatically audit account termination.
☐SV-216028r959010_ruleThe operating system must ensure unauthorized, security-relevant configuration changes detected are tracked.
☐SV-216029r959010_ruleThe audit system must be configured to audit all administrative, privileged, and security actions.
☐SV-216030r958406_ruleThe audit system must be configured to audit login, logout, and session initiation.
☐SV-216033r959010_ruleThe audit system must be configured to audit failed attempts to access files and programs.
☐SV-216034r958440_ruleThe operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server.
☐SV-216035r959010_ruleThe auditing system must not define a different auditing level for specific users.
☐SV-216038r958424_ruleThe operating system must alert designated organizational officials in the event of an audit processing failure.
☐SV-216041r1038966_ruleThe operating system must shut down by default upon audit failure (unless availability is an overriding concern).
☐SV-216042r958434_ruleThe operating system must protect audit information from unauthorized access.
☐SV-216045r959010_ruleThe System packages must be up to date with the most recent vendor updates and security fixes.
☐SV-216047r958610_ruleThe operating system must protect audit tools from unauthorized access.
☐SV-216048r958612_ruleThe operating system must protect audit tools from unauthorized modification.
☐SV-216049r958614_ruleThe operating system must protect audit tools from unauthorized deletion.
☐SV-216050r958634_ruleSystem packages must be configured with the vendor-provided files, permissions, and ownerships.
☐SV-216051r959010_ruleThe finger daemon package must not be installed.
☐SV-216052r959010_ruleThe legacy remote network access utilities daemons must not be installed.
☐SV-216053r959010_ruleThe NIS package must not be installed.
☐SV-216054r959010_ruleThe pidgin IM client package must not be installed.
☐SV-216055r959010_ruleThe FTP daemon must not be installed unless required.
☐SV-216056r959010_ruleThe TFTP service daemon must not be installed unless required.
☐SV-216057r959010_ruleThe telnet service daemon must not be installed unless required.
☐SV-216058r959010_ruleThe UUCP service daemon must not be installed unless required.
☐SV-216059r959010_ruleThe rpcbind service must be configured for local only services unless organizationally defined.
☐SV-216060r959010_ruleThe VNC server package must not be installed unless required.
☐SV-216062r958478_ruleThe operating system must be configured to provide essential capabilities.
☐SV-216064r959010_ruleAll run control scripts must have mode 0755 or less permissive.
☐SV-216065r959010_ruleAll run control scripts must have no extended ACLs.
☐SV-216066r959010_ruleRun control scripts executable search paths must contain only authorized paths.
☐SV-216067r959010_ruleRun control scripts library search paths must contain only authorized paths.
☐SV-216068r959010_ruleRun control scripts lists of preloaded libraries must contain only authorized paths.
☐SV-216069r959010_ruleRun control scripts must not execute world writable programs or scripts.
☐SV-216070r959010_ruleAll system start-up files must be owned by root.
☐SV-216071r959010_ruleAll system start-up files must be group-owned by root, sys, or bin.
☐SV-216072r959010_ruleSystem start-up files must only execute programs owned by a privileged UID or an application.
☐SV-216073r959010_ruleAny X Windows host must write .Xauthority files.
☐SV-216074r959010_ruleAll .Xauthority files must have mode 0600 or less permissive.
☐SV-216075r959010_ruleThe .Xauthority files must not have extended ACLs.
☐SV-216076r959010_ruleX displays must not be exported to the world.
☐SV-216077r959010_rule.Xauthority or X*.hosts (or equivalent) file(s) must be used to restrict access to the X server.
☐SV-216078r959010_ruleThe .Xauthority utility must only permit access to authorized hosts.
☐SV-216079r959010_ruleX Window System connections that are not required must be disabled.
☐SV-216080r959010_ruleThe graphical login service provides the capability of logging into the system using an X-Windows type interface from the console. If graphical login access for the console is required, the service must be in local-only mode.
☐SV-216081r959010_ruleGeneric Security Services (GSS) must be disabled.
☐SV-216082r959010_ruleSystems services that are not required must be disabled.
☐SV-216083r959010_ruleTCP Wrappers must be enabled and configured per site policy to only allow access by approved hosts and services.
☐SV-216086r1038967_ruleUser passwords must be changed at least every 60 days.
☐SV-216087r958364_ruleThe operating system must automatically terminate temporary accounts within 72 hours.
☐SV-216088r1016284_ruleThe operating system must enforce minimum password lifetime restrictions.
☐SV-216089r1016285_ruleUser passwords must be at least 15 characters in length.
☐SV-216091r1016286_ruleThe system must require at least eight characters be changed between the old and new passwords during a password change.
☐SV-216092r1016287_ruleThe system must require passwords to contain at least one uppercase alphabetic character.
☐SV-216093r1016288_ruleThe operating system must enforce password complexity requiring that at least one lowercase character is used.
☐SV-216094r1016289_ruleThe system must require passwords to contain at least one numeric character.
☐SV-216095r1016290_ruleThe system must require passwords to contain at least one special character.
☐SV-216096r959010_ruleThe system must require passwords to contain no more than three consecutive repeating characters.
☐SV-216097r959010_ruleThe system must not have accounts configured with blank or null passwords.
☐SV-216098r1016291_ruleSystems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors.
☐SV-216099r958388_ruleThe system must disable accounts after three consecutive unsuccessful login attempts.
☐SV-216100r959010_ruleThe delay between login prompts following a failed login attempt must be at least 4 seconds.
☐SV-216101r958400_ruleThe system must require users to re-authenticate to unlock a graphical desktop environment.
☐SV-216102r958402_ruleGraphical desktop environments provided by the system must automatically lock after 15 minutes of inactivity.
☐SV-216103r959010_ruleThe system must prevent the use of dictionary words for passwords.
☐SV-216105r1016292_ruleThe operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.
☐SV-216106r959010_ruleThe default umask for system and users must be 077.
☐SV-216107r959010_ruleThe default umask for FTP users must be 077.
☐SV-216108r959010_ruleThe value mesg n must be configured as the default setting for all users.
☐SV-216109r1016293_ruleUser accounts must be locked after 35 days of inactivity.
☐SV-216112r959010_ruleLogin services for serial ports must be disabled.
☐SV-216113r959010_ruleThe nobody access for RPC encryption key storage service must be disabled.
☐SV-216114r959010_ruleX11 forwarding for SSH must be disabled.
☐SV-216116r959010_ruleThe rhost-based authentication for SSH must be disabled.
☐SV-216117r959010_ruleDirect root account login must not be permitted for SSH access.
☐SV-216118r959010_ruleLogin must not be permitted with empty/null passwords for SSH.
☐SV-216119r970703_ruleThe operating system must terminate the network connection associated with a communications session at the end of the session or after 10 minutes of inactivity.
☐SV-216120r959010_ruleHost-based authentication for login-based services must be disabled.
☐SV-216121r959010_ruleThe use of FTP must be restricted.
☐SV-216122r959010_ruleThe system must not allow autologin capabilities from the GNOME desktop.
☐SV-216123r959010_ruleUnauthorized use of the at or cron capabilities must not be permitted.
☐SV-216124r959010_ruleLogins to the root account must be restricted to the system console only.
☐SV-216125r987814_ruleThe operating system, upon successful logon, must display to the user the date and time of the last logon (access).
☐SV-216126r1016294_ruleThe operating system must provide the capability for users to directly initiate session lock mechanisms.
☐SV-216127r958404_ruleThe operating system session lock mechanism, when activated on a device with a display screen, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen.
☐SV-216128r959010_ruleThe operating system must not allow logins for users with blank passwords.
☐SV-216129r959010_ruleThe operating system must prevent remote devices that have established a non-remote connection with the system from communicating outside of the communication path with resources in external networks.
☐SV-216130r958398_ruleThe operating system must limit the number of concurrent sessions for each account to an organization-defined number of sessions.
☐SV-216131r959010_ruleThe system must disable directed broadcast packet forwarding.
☐SV-216132r959010_ruleThe system must not respond to ICMP timestamp requests.
☐SV-216133r959010_ruleThe system must not respond to ICMP broadcast timestamp requests.
☐SV-216134r959010_ruleThe system must not respond to ICMP broadcast netmask requests.
☐SV-216135r959010_ruleThe system must not respond to broadcast ICMP echo requests.
☐SV-216136r959010_ruleThe system must not respond to multicast echo requests.
☐SV-216137r959010_ruleThe system must ignore ICMP redirect messages.
☐SV-216138r959010_ruleThe system must set strict multihoming.
☐SV-216139r959010_ruleThe system must disable ICMP redirect messages.
☐SV-216140r959010_ruleThe system must disable TCP reverse IP source routing.
☐SV-216141r959010_ruleThe system must set maximum number of half-open TCP connections to 4096.
☐SV-216142r959010_ruleThe system must set maximum number of incoming connections to 1024.
☐SV-216143r959010_ruleThe system must disable network routing unless required.
☐SV-216144r959010_ruleThe system must implement TCP Wrappers.
☐SV-216150r1045457_ruleThe boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
☐SV-216157r959010_ruleThe system must prevent local applications from generating source-routed packets.
☐SV-216158r1190827_ruleThe operating system must display the DOD-approved system use notification message or banner before granting access to the system for general system logons.
☐SV-216159r1190828_ruleThe operating system must display the DOD-approved system use notification message or banner for SSH connections.
☐SV-216160r1190830_ruleThe GNOME service must display the DOD-approved system use notification message or banner before granting access to the system.
☐SV-216161r1190832_ruleThe FTP service must display the DOD-approved system use notification message or banner before granting access to the system.
☐SV-216162r986457_ruleThe operating system must terminate all sessions and network connections when nonlocal maintenance is completed.
☐SV-216163r959010_ruleThe operating system must prevent internal users from sending out packets which attempt to manipulate or spoof invalid IP addresses.
☐SV-216164r958358_ruleWireless network adapters must be disabled.
☐SV-216165r958358_ruleThe operating system must use mechanisms for authentication to a cryptographic module meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for such authentication.
☐SV-216173r958408_ruleThe operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
☐SV-216174r959010_ruleThe operating system must use cryptographic mechanisms to protect and restrict access to information on portable digital media.
☐SV-216176r958552_ruleThe operating system must protect the confidentiality and integrity of information at rest.
☐SV-216178r958576_ruleThe operating system must use cryptographic mechanisms to protect the integrity of audit information.
☐SV-216180r959010_ruleThe sticky bit must be set on all world writable directories.
☐SV-216181r959010_rulePermissions on user home directories must be 750 or less permissive.
☐SV-216182r959010_rulePermissions on user . (hidden) files must be 750 or less permissive.
☐SV-216183r959010_rulePermissions on user .netrc files must be 750 or less permissive.
☐SV-216184r959010_ruleThere must be no user .rhosts files.
☐SV-216185r959010_ruleGroups assigned to users must exist in the /etc/group file.
☐SV-216186r959010_ruleUsers must have a valid home directory assignment.
☐SV-216187r959010_ruleAll user accounts must be configured to use a home directory that exists.
☐SV-216188r959010_ruleAll home directories must be owned by the respective user assigned to it in /etc/passwd.
☐SV-216189r958482_ruleDuplicate User IDs (UIDs) must not exist for users within the organization.
☐SV-216190r958504_ruleDuplicate UIDs must not exist for multiple non-organizational users.
☐SV-216191r959010_ruleDuplicate Group IDs (GIDs) must not exist for multiple groups.
☐SV-216192r959010_ruleReserved UIDs 0-99 must only be used by system accounts.
☐SV-216193r959010_ruleDuplicate user names must not exist.
☐SV-216194r959010_ruleDuplicate group names must not exist.
☐SV-216195r959010_ruleUser .netrc files must not exist.
☐SV-216196r959010_ruleThe system must not allow users to configure .forward files.
☐SV-216197r959010_ruleWorld-writable files must not exist.
☐SV-216198r959010_ruleAll valid SUID/SGID files must be documented.
☐SV-216199r959010_ruleThe operating system must have no unowned files.
☐SV-216200r959010_ruleThe operating system must have no files with extended attributes.
☐SV-216201r959010_ruleThe root account must be the only account with GID of 0.
☐SV-216202r958566_ruleThe operating system must reveal error messages only to authorized personnel.
☐SV-216204r959010_ruleThe operator must document all file system objects that have non-standard access control list settings.
☐SV-216205r1155804_ruleThe operating system must be a supported release.
☐SV-216206r959010_ruleThe system must implement non-executable program stacks.
☐SV-216207r959010_ruleAddress Space Layout Randomization (ASLR) must be enabled.
☐SV-216208r959010_ruleProcess core dumps must be disabled unless needed.
☐SV-216209r959010_ruleThe system must be configured to store any process core dumps in a specific, centralized directory.
☐SV-216210r959010_ruleThe centralized process core dump data directory must be owned by root.
☐SV-216211r959010_ruleThe centralized process core dump data directory must be group-owned by root, bin, or sys.
☐SV-216212r959010_ruleThe centralized process core dump data directory must have mode 0700 or less permissive.
☐SV-216213r959010_ruleKernel core dumps must be disabled unless needed.
☐SV-216214r959010_ruleThe kernel core dump data directory must be owned by root.
☐SV-216215r959010_ruleThe kernel core dump data directory must be group-owned by root.
☐SV-216216r959010_ruleThe kernel core dump data directory must have mode 0700 or less permissive.
☐SV-216217r959010_ruleSystem BIOS or system controllers supporting password protection must have administrator accounts/passwords configured, and no others. (Intel)
☐SV-216218r959010_ruleThe system must require authentication before allowing modification of the boot devices or menus. Secure the GRUB Menu (Intel).
☐SV-216219r959010_ruleThe operating system must implement transaction recovery for transaction-based systems.
☐SV-216220r1190834_ruleSNMP default community strings and passphrases must be changed from vendor defaults.
☐SV-216221r959010_ruleA file integrity baseline must be created, maintained, and reviewed at least weekly to determine if unauthorized changes have been made to important system files located in the root file system.
☐SV-216223r959010_ruleDirect logins must not be permitted to shared, default, application, or utility accounts.
☐SV-216224r959010_ruleThe system must not have any unnecessary accounts.
☐SV-216225r959010_ruleThe operating system must conduct backups of user-level information contained in the operating system per organization-defined frequency to conduct backups consistent with recovery time and recovery point objectives.
☐SV-216226r959010_ruleThe operating system must conduct backups of system-level information contained in the information system per organization-defined frequency to conduct backups that are consistent with recovery time and recovery point objectives.
☐SV-216227r959010_ruleThe operating system must conduct backups of operating system documentation including security-related documentation per organization-defined frequency to conduct backups that is consistent with recovery time and recovery point objectives.
☐SV-216228r958544_ruleThe operating system must prevent the execution of prohibited mobile code.
☐SV-216229r959010_ruleThe operating system must employ PKI solutions at workstations, servers, or mobile computing devices on the network to create, manage, distribute, use, store, and revoke digital certificates.
☐SV-216231r959010_ruleThe operating system must employ malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
☐SV-216233r958574_ruleThe operating system must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
☐SV-216234r1099908_ruleAll manual editing of system-relevant files shall be done using the pfedit command, which logs changes made to the files.
☐SV-216237r958528_ruleThe operating system must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.
☐SV-216238r959010_ruleThe /etc/zones directory, and its contents, must have the vendor default owner, group, and permissions.
☐SV-216239r959010_ruleThe limitpriv zone option must be set to the vendor default or less permissive.
☐SV-216240r959010_ruleThe systems physical devices must not be assigned to non-global zones.
☐SV-216241r959010_ruleThe audit system must identify in which zone an event occurred.
☐SV-216242r959010_ruleThe audit system must maintain a central audit trail for all zones.
☐SV-216243r959010_ruleThe operating system must monitor for unauthorized connections of mobile devices to organizational information systems.
☐SV-219988r958768_ruleThe audit system must support an audit reduction capability.
☐SV-219989r958774_ruleThe audit system records must be able to be used by a report generation capability.
☐SV-219990r958442_ruleThe operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.
☐SV-219991r958442_ruleThe audit system must be configured to audit all discretionary access control permission modifications.
☐SV-219992r958442_ruleThe audit system must be configured to audit the loading and unloading of dynamic kernel modules.
☐SV-219993r971542_ruleThe audit system must alert the SA when the audit storage volume approaches its capacity.
☐SV-219994r958758_ruleThe audit system must alert the System Administrator (SA) if there is any type of audit failure.
☐SV-219995r958752_ruleThe operating system must allocate audit record storage capacity.
☐SV-219996r1207686_ruleThe operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.
☐SV-219997r1016296_ruleThe system must verify that package updates are digitally signed.
☐SV-219998r958794_ruleThe operating system must employ automated mechanisms, per organization-defined frequency, to detect the addition of unauthorized components/devices into the operating system.
☐SV-219999r958804_ruleThe operating system must employ automated mechanisms to prevent program execution in accordance with the organization-defined specifications.
☐SV-220000r958548_ruleThe operating system must disable information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.
☐SV-220001r958726_ruleThe system must restrict the ability of users to assume excessive privileges to members of a defined group and prevent unauthorized users from accessing administrative tools.
☐SV-220003r987791_ruleThe operating system must employ FIPS-validate or NSA-approved cryptography to implement digital signatures.
☐SV-220004r958908_ruleThe operating system must protect the integrity of transmitted information.
☐SV-220005r1117271_ruleThe operating system must employ cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.
☐SV-220006r958912_ruleThe operating system must maintain the integrity of information during aggregation, packaging, and transformation in preparation for transmission.
☐SV-220007r958908_ruleThe operating system must protect the confidentiality of transmitted information.
☐SV-220008r1117271_ruleThe operating system must employ cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.
☐SV-220009r958912_ruleThe operating system must maintain the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission.
☐SV-220010r1207689_ruleThe operating system must employ cryptographic mechanisms to protect information in storage.
☐SV-220012r958908_ruleThe operating system must protect the integrity of transmitted information.
☐SV-220013r958732_ruleThe operating system must protect the audit records resulting from non-local accesses to privileged accounts and the execution of privileged functions.
☐SV-220014r1016297_ruleThe operating system must synchronize internal information system clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).
☐SV-220015r958944_ruleThe operating system must verify the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification).
☐SV-224672r958726_ruleThe operating system must prevent non-privileged users from circumventing malicious code protection capabilities.
☐SV-224673r958944_ruleThe operating system must identify potentially security-relevant error conditions.
☐SV-233301r959010_ruleThe sshd server must bind the X11 forwarding server to the loopback address.