AlmaLinux 9 STIG

25 items · Security · Hard difficulty · 1 day

Step-by-step AlmaLinux 9 STIG actions for sysadmins.

• Download the AlmaLinux OS 9 STIG XCCDF

  Get the standalone XCCDF (e.g., 1.1.4) or latest STIG from DISA.

• Review STIG requirements and scope

  Identify which controls apply to your environment and systems.

• Inventory target AlmaLinux 9 systems

  Record hostnames, IPs, OS versions, and roles.

• Backup system configs and critical data

  Create snapshots and config backups before making changes.

• Apply system updates and patches

  Install vendor patches for kernel, libraries, and apps.

• Update package index

  Run dnf makecache or equivalent before upgrades.

• Upgrade installed packages

  Run dnf upgrade to apply available package updates.

• Reboot systems if the kernel or critical packages updated

  Reboot when required to apply kernel/security fixes.

• Enable and configure the system firewall

  Use firewalld or nftables and apply default deny rules.

• Open only required ports and services

  Limit ports to necessary services and required zones.

• Harden SSH configuration

  Disable root login, disable password auth if using keys, restrict protocols.

• Enforce password and account policies

  Set complexity, expiration, lockout thresholds, and minimum lengths.

• Enable SELinux in enforcing mode

  Confirm SELinux is enforcing and remediate denials as needed.

• Configure auditing and log forwarding

  Enable auditd rules and forward logs to centralized collector.

• Apply sysctl kernel hardening settings

  Harden network and kernel parameters in /etc/sysctl.conf.

• Remove or disable unused services and packages

  Uninstall packages and stop services not required for the host role.

• Restrict sudoers and enforce least privilege

  Limit who can sudo and require logging of privileged actions.

• Configure automatic updates or patch management

  Set automated patching or integrate hosts with patch tooling.

• Verify time synchronization (chrony or ntp)

  Ensure accurate system time for logs and authentication.

• Run vulnerability scans and remediate findings

  Use scanners to find missing patches and config issues; remediate accordingly.

• Document changes and create a rollback plan

  Record configuration changes and rollback steps for each action.

• Test changes in a staging environment

  Validate stability and functionality before production rollout.

• Deploy validated changes to production

  Apply tested hardening and patches to production hosts.

• Schedule periodic compliance audits and reviews

  Plan recurring checks to ensure STIG controls remain enforced.

• Subscribe to STIG updates and track change history

  Monitor DISA and NIST updates and update checklist as needed.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.