RHEL 9 STIG Checklist

21 items · Security · Medium difficulty · 2 hours

Practical RHEL 9 STIG steps to harden and audit your systems.

• Download RHEL 9 STIG SCAP and XCCDF content

  Obtain official SCAP 1.3, XCCDF, and automated SCC files from DISA.

• Download SCAP 1.3 benchmark for RHEL 9

  Get the specific SCAP 1.3 benchmark (Ver/Rel) for your RHEL 9 build.

• Download XCCDF standalone and remediation scripts

  Include Ansible/Chef remediations and standalone XCCDF files.

• Download automated SCC content for RHEL 9 architectures

  Grab x86_64 and AArch64 SCC content when applicable.

• Verify file integrity and checksums of downloaded resources

  Compare provided SHA hashes to ensure downloads are intact.

• Review STIG requirements and applicability

  Map STIG controls to your enclave, role, and services.

• Test STIG settings in a staging environment

  Validate functionality and rollback procedures before production.

• Apply OS updates and security patches

  Install latest RHEL 9 errata and kernel/security updates.

• Enable and enforce SELinux in enforcing mode

  Set SELinux to enforcing and resolve policy denials.

• Configure and enable firewalld with appropriate zones

  Apply least-privilege rules and open only required ports.

• Harden SSH: disable root login and require key auth

  Set PermitRootLogin no and use PubkeyAuthentication.

• Enforce strong password policies and account lockouts

  Configure pam_pwquality, password aging, and lockouts.

• Configure sudo and remove unnecessary admin accounts

  Grant least privilege and audit sudoers changes.

• Disable unnecessary services and remove unused packages

  Stop and mask services not required by the system role.

• Harden kernel parameters via sysctl.conf

  Apply RHEL STIG-recommended sysctl values and persist them.

• Enable and configure auditd for system auditing

  Ensure audit rules capture privileged events and log retention.

• Run SCAP/XCCDF compliance scan using downloaded content

  Execute automated scan to produce a compliance report.

• Review scan report and prioritize remediations

  Triage findings by risk and impact for remediation planning.

• Remediate findings and apply configuration changes

  Implement fixes, using automation where possible, and retest.

• Document deviations and obtain AO approval for exceptions

  Record accepted risks and authorized exceptions with justification.

• Schedule regular automated compliance scans and reporting

  Automate periodic scans and export reports for audit trails.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.