Skip to content

RHEL 10 V1R2 Changes

This document is my change summary notes based on a diff analysis of the RHEL 10 STIG V1R1 and V1R2.

Added Rules

  • None

Removed Rules

  • None

Stuff that might bite you

  • RHEL-10-700920: Updates fix text for 10 minutes of inactivity instead of 15 regarding interactive login shells. Removes CCI 000057. If you were confused at all about inactivity timeouts, 10 appears to be the new 15 for most cases.
  • RHEL-10-700750: Updates title, check text, and fix text values for 10 minutes instead of 15, and 600 seconds instead of 900 seconds regarding graphical logon sessions with GNOME.

Rule ID and Check Changes

  • RHEL-10-200691: Changes postfix alias maps to use lmdb instead of hash, changes alias name from isso to ISSO.
  • RHEL-10-500040: Updates check text to reference space_left instead of admin_space_left.
  • RHEL-10-500410: Updates check text to reference init_module and finit_module system calls instead of incorrectly referencing delete_module.
  • RHEL-10-600730: Updates check text to deliver usernames and password hashes to evaluate instead of just returning the hashes. Also, for those paying attention, the example user is nsauser instead of the disauser introduced in last quarter's changes.
  • RHEL-10-600750: Updates check text value to sha512 instead of yescrypt. I hope none of you guys fell for that one. :)
  • RHEL-10-200530: Adds the actual check command dnf list --installed firewalld, which was omitted in the original text. This one also removes a couple of CCIs so that it just references CCI 00382 now.

Rule ID, Check, and Fix Changes

  • RHEL-10-701130: Adds check syntax to allow for values in sysctl.d, requires that the file end in .conf, and updates fix text to place the compliant values in /etc/sysctl.d/99-kernel_randomize_va_space.conf. I don't know about you guys, but I find it easier to stick them in something like 99-RHEL-10-701130.conf so I know at a glance what control a file is meant to address.

Rule ID, Title, and Vuln Discussion

  • RHEL-10-200611: Updates title to reference pcscd socket instead of pcscd service and makes some changes to the word salad in the Vuln Discussion.