Skip to content

RHEL 9 V2R9 Changes

This document is my change summary notes based on a diff analysis of the RHEL 9 STIG V2R8 and V2R9.

Added Rules

  • None

Removed Rules

  • RHEL-09-255130: sshd compression = no

Stuff that might bite you

  • RHEL-09-653110: Updates check and fix text to require 0600 permissions instead of 0640 for audit.rules and auditd.conf, as well as any drop-in files.

Rule ID Changes Only

  • RHEL-09-213010
  • RHEL-09-213015
  • RHEL-09-213025
  • RHEL-09-213075
  • RHEL-09-213080

Rule ID and Title Changes

  • RHEL-09-611180: Updates title to reference pcscd socket instead of service.

Rule ID and Check Changes

  • RHEL-09-232040: Removes sample check output.
  • RHEL-09-411070: Updates check text command to give the assessor prettier output to evaluate. There is no material change regarding compliance posture.
  • RHEL-09-671015: Updates check text to deliver usernames and password hashes to evaluate instead of just returning the hashes. Also, for those paying attention, the example user is nsauser instead of the disauser introduced in last quarter's changes. Also includes minor title change.

Rule ID, Check, and Fix Changes

  • RHEL-09-211045: Updates check and fix so that the filename ends in .conf.
  • RHEL-09-213070: Adds check syntax to allow for values in sysctl.d, requires that the file end in .conf, and updates fix text to place the compliant values in /etc/sysctl.d/99-kernel_randomize_va_space.conf.
  • RHEL-09-215015: Updates check and fix text to reference the vsftpd package.
  • RHEL-09-654225: Updates the audit.rules syntax, which is consistent with what we see in the RHEL 10 STIG. Be mindful that the rule converts from one line to two because it covers both b32 and b64. In RHEL 10, rules in the old format break auditd.
  • RHEL-09-654230: Updates the audit.rules syntax, see above.
  • RHEL-09-654235: Updates the audit.rules syntax, see above.
  • RHEL-09-654240: Updates the audit.rules syntax, see above.
  • RHEL-09-654245: Updates the audit.rules syntax, see above.
  • RHEL-09-654250: Updates the audit.rules syntax, see above.
  • RHEL-09-654255: Updates the audit.rules syntax, see above.
  • RHEL-09-654220: Updates the audit.rules syntax, see above.
  • RHEL-09-654215: Updates the audit.rules syntax, see above.
  • RHEL-09-654097: Updates the audit.rules syntax, see above.
  • RHEL-09-255120: Updates title, check, and fix to change ssh private key permissions from 0640 to 0600.

Rule ID and Vuln Discussion

  • RHEL-09-611010: Removes references to /etc/pam.d/password-auth and /etc/pam.d/system-auth from vul discussion since the setting is actually handled over in /etc/security/pwquality.conf or one of its drop files.