STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

RHEL 8 must block unauthorized peripherals before establishing a connection.

DISA Rule

SV-230524r627750_rule

Vulnerability Number

V-230524

Group Title

SRG-OS-000378-GPOS-00163

Rule Version

RHEL-08-040140

Severity

CAT II

CCI(s)

• CCI-001958 - The information system authenticates an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.

Weight

10

Fix Recommendation

Configure the operating system to enable the blocking of unauthorized peripherals with the following commands:

$ sudo yum install usbguard.x86_64

$ sudo usbguard generate-policy > /etc/usbguard/rules.conf

$ sudo systemctl enable usbguard.service

$ sudo systemctl start usbguard.service

Note: Enabling and starting usbguard without properly configuring it for an individual system will immediately prevent any access over a usb device such as a keyboard or mouse

Check Contents

Verify the operating system has enabled the use of USBGuard with the following command:

$ sudo systemctl status usbguard.service

usbguard.service - USBGuard daemon
Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; vendor preset: disabled)
Active: active (running)

If the usbguard.service is not installed and active, ask the SA to indicate how unauthorized peripherals are being blocked.

If there is no evidence that unauthorized peripherals can be blocked before establishing a connection, this is a finding.

Vulnerability Number

V-230524

Documentable

False

Rule Version

RHEL-08-040140

Severity Override Guidance

Verify the operating system has enabled the use of USBGuard with the following command:

$ sudo systemctl status usbguard.service

usbguard.service - USBGuard daemon
Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; vendor preset: disabled)
Active: active (running)

If the usbguard.service is not installed and active, ask the SA to indicate how unauthorized peripherals are being blocked.

If there is no evidence that unauthorized peripherals can be blocked before establishing a connection, this is a finding.

Check Content Reference

M

Target Key

2921

Comments