Skip to content

RHEL 8 V2R8 Changes

This document is my change summary notes based on a diff analysis of the RHEL 8 STIG V2R7 and V2R8.

Added Rules

  • RHEL-08-040287: (CAT 2) net.ipv4.conf.default.rp_filter = 1 must be in sysctl.conf or an associated drop file.
  • RHEL-08-040221: (CAT 2) net.ipv4.conf.all.log_martians = 1 must be in sysctl.conf or an associated drop file.
  • RHEL-08-040222: (CAT 2) net.ipv4.conf.default.log_martians = 1 must be in sysctl.conf or an associated drop file.

Removed Rules

  • None

Rule ID Changes Only

  • RHEL-08-040286

Rule ID, Check, and Fix Changes

  • RHEL-08-040172: Updates check and fix so that the filename ends in .conf.
  • RHEL-08-010296: Corrects typo in MAC list for openssh crypto backend.
  • RHEL-08-010120: Updates check text to deliver usernames and password hashes to evaluate instead of just returning the hashes. Also, for those paying attention, the example user is nsauser instead of the disauser introduced in last quarter's changes. Also includes minor title change.
  • RHEL-08-010490: Updates title, check, and fix to change ssh private key permissions from 0640 to 0600.
  • RHEL-08-020060: Updates title, check text, and fix text values for 10 minutes instead of 15, and 600 seconds instead of 900 seconds regarding graphical logon sessions with GNOME.
  • RHEL-08-030610: Updates check and fix text to require 0600 permissions instead of 0640 for audit.rules and auditd.conf, as well as any drop-in files.
  • RHEL-08-010371: Updates check and fix text to configure dnf.conf to use localpkg_gpgcheck=1 instead of localpkg_gpgcheck=True.
  • RHEL-08-010430:: Adds check syntax to allow for values in sysctl.d, requires that the file end in .conf, and updates fix text to place the compliant values in /etc/sysctl.d/99-kernel_randomize_va_space.conf.
  • RHEL-08-040285: Makes editorial changes to check in fix text to call out reverse path filtering on all IPv4 interfaces. The substance of the check and fix do not actually change.
  • RHEL-08-040137: Inclusive language and other editorial (hyphenation) changes. This rule is still basically deny perm=any all : all as your final rule for fapolicyd.

Rule ID and Vuln Discussion

  • RHEL-08-040220: Updates title to specifically address IPv4 ICMP redirect messages. There is also a blank line added to the vun discussion and another removed from the check text.