STIG compliance exceptions for version 1.0.30.0 and later

Review the list of DISA STIG compliance exceptions for IIAS.

Note: The settings that are listed below should not be changed. Changing them may adversely affect the operation of your IIAS environment.
  • The TFTP configuration in /etc/xinetd.d/tftp. TFTP is necessary during system provisioning. Do not remove or uninstall TFTP package.
  • The IP forwarding setting in /etc/sysctl.conf. IP forwarding is required for Db2® Warehouse containers to run. Do not turn it off by setting net.ipv4.ip_forward to 0.
  • The Time-out setting (TMOUT) in /etc/profile. Changing the TMOUT setting may impact the IIAS management activities.
  • The USELDAPAUTH setting in /etc/sysconfig/authconfig. IIAS uses SSSD for authentication and not LDAP. Do not set USELDAPAUTH to yes. Setting it to yes will enable LDAP authentication instead of SSSD authentication.
  • The NOPASSWD option in /etc/sudoersand /etc/sudoers.d/* files. This option is required for IIAS ibmapadmin group users to run appliance commands, which need root user privileges.
  • PermitRootLogin cannot be set to No, as the root user is required for appliance upgrades. Disabling it would restrict root login on the nodes and break passwordless SSH needed for GPFS and other internal cluster mechanisms.
  • RhostsRSAAuthentication no cannot be used in /etc/ssh/sshd_config since the parameter operations were deprecated by RedHat.
  • The pam_pwquality.so should not be included in /etc/pam.d/passwd file. The operation of pam_pwquality.so has been included in the system-auth substack. The substack covers the operation of pam_pwquality.so at /etc/pam.d/system-auth-ac file.
  • The Appliance has root a lock down mechanism to root user access, hence configuring the operating system to automatically lock the root account by using pam_faillock.so in /etc/pam.d/system-auth-ac and /etc/pam.d/password-authac is not applicable.
    Attention: The root user lock-down can be disabled by raising a PMR request. On disabling root lock-down, the root user has all the privileges to update the operations on the appliance. Improper handling of the appliance by the root user might lead to system instability, downtime, or other incidents. IBM Corporation is not liable for any such incidents.
  • Rate-limiting measures on interfaces cannot be implemented, as by rate limiting connections the system might run into the risk of bottle-necking an appliance with high usage.
  • IIAS does not support any SmartCard reader. Therefore, it cannot be configured by using Smart Card for multi factor authentication.
  • IIAS doesn't support installing McAfee ENSLTP security tool.
  • Files in /opt/ibm/appliance/storage/head/ and /var/lib/containers/storage/overlay/ are related to containers. The permissions to file are set according to their usage. Do not set sticky bit for the files under these directories.
  • Enabling the kernel.kexec_load_disabled parameter disables the loading of the new kernel, which can slow down the restart process during the appliance upgrade.
  • Kernel core memory-dumps are required for troubleshooting if there is a system crash; it is recommended not to disable kernel.core_pattern = |/bin/false.
  • The iprutils package is used to run the iprconfig on the system, and it is used during the diagnostic and troubleshooting of RAID (redundant array of independent disks). Do not remove or uninstall this package.
  • It is not recommended to enable the tmux terminal multiplexer. If you do, it might lead to failures during appliance upgrades.
  • The parameter user.max_user_namespaces is used by containers in the system. Do not modify its value to 0 or disable it. If you do, it can affect the functions of containers.
  • Do not uninstall the following packages from the system:
    • gssproxy
    • krb5-workstation
    • tuned package
  • fapolicy is configured to run in permissive mode, enforcing mode is not supported.
  • IP forwarding is needed for some functions in the system; do not disable it.
  • IIAS has a custom firewall zone setup; hence, creating a drop zone is not required.
  • NX/XD bit is only available for AMD/Intel platforms; do not enable it on IIAS.
  • Do not change the UMASK parameter to 077 in the files /etc/bashrc, /etc/csh.cshrc, and /etc/profile. Changing of this parameter creates restrictions on the copying or creation of the files or dirs and cause failures in multiple places during and after the appliance upgrade.
  • Partitioning of /var/log, /dev/shm, and /tmp with the nodev option and /var/tmp with the nodev, nosuid, and noexec options for the /etc/fstab affects the IIAS provision and appliance upgrade processes. Do not create these partitions.
  • Do not add the timeout session to /etc/systemd/logind.conf or /etc/tmux.conf. If you do, the apupgrade and any other task might fail.
  • Setting cache_credentials = false in /etc/sssd/sssd.conf disables offline logins, so LDAP must always be reachable.
  • By default, the gpgcheck option is set to 0 (disabled) in the local-rhel8.10-ppc64le-ppc64le.repo file.
  • Do not change group ownerships for the following files as it may result in service failure or security regression:
    • /usr/bin/staprun stapusr
    • /usr/bin/lockfile mail
    • /usr/bin/write tty
    • /usr/bin/procmail mail
    • /usr/bin/locate slocate
    • /usr/sbin/postqueue postdrop
    • /usr/sbin/postdrop postdrop
    • /usr/sbin/suexec apache
  • Do not change group ownership or permissions for files under /usr/lib/python3.9/site-packages/*, as these are managed by the Python package manager. Altering them may result in service failure, broken dependencies, or security regressions.
  • These libraries are installed and maintained by system or application processes (example: pip, yum, etc.) and typically have the correct permissions and ownership by default.
  • The appliance firewall rules are based on the iptables and while reload those rules during house network setup we need iptables as default firewall backend. So, if we try to edit /etc/firewalld/firewalld.conf and make FirewallBackend=nftables then it will create issue during house network setup for firewall reload.
  • RHEL-08-010287 is a false positive. The system uses the system-wide cryptographic policy set to FIPS, which applies automatically to the SSH service. You do not need to comment CRYPTO_POLICY=.

Exceed the requirement

  • maxpoll 4: The polling interval is more frequent than the requirement. Do not change this value.