| V-239138 | High | The Photon operating system must configure sshd to use preferred ciphers. | Privileged access contains control and configuration information and is particularly sensitive, so additional protections are necessary. This is maintained by using cryptographic mechanisms such... |
| V-239081 | High | The Photon operating system must configure sshd to use approved encryption algorithms. | Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.
OpenSSH on the Photon operating system is compiled... |
| V-239100 | Medium | The Photon operating system must be configured so that passwords for new users are restricted to a 90-day maximum lifetime. | Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force... |
| V-239101 | Medium | The Photon operating system must prohibit password reuse for a minimum of five generations. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the... |
| V-239102 | Medium | The Photon operating system must ensure old passwords are being stored. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the... |
| V-239103 | Medium | The Photon operating system must enforce a minimum eight-character password length. | The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the... |
| V-239104 | Medium | The Photon operating system must only allow installation of packages signed by VMware. | Installation of any non-trusted software, patches, service packs, device drivers, or operating system components can significantly affect the overall security of the operating system. This... |
| V-239105 | Medium | The Photon operating system must disable the loading of unnecessary kernel modules. | To support the requirements and principles of least functionality, the operating system must provide only essential capabilities and limit the use of modules, protocols, and/or services to only... |
| V-239106 | Medium | The Photon operating system must not have Duplicate User IDs (UIDs). | To ensure accountability and prevent unauthenticated access, organizational users must be uniquely identified and authenticated to prevent potential misuse and provide for non-repudiation. |
| V-239107 | Medium | The Photon operating system must configure sshd to disallow root logins. | Logging on with a user-specific account provides individual accountability for actions performed on the system. Users must log in with their individual accounts and elevate to root as necessary.... |
| V-239108 | Medium | The Photon operating system must disable new accounts immediately upon password expiration. | Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive... |
| V-239109 | Medium | The Photon operating system must use TCP syncookies. | A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a... |
| V-239188 | Medium | The Photon operating system must enforce password complexity on the root account. | Password complexity rules must apply to all accounts on the system, including root. Without specifying the enforce_for_root flag, pam_cracklib does not apply complexity rules to the root user.... |
| V-239189 | Medium | The Photon operating system must protect all boot configuration files from unauthorized access. | Boot configuration files control how the system boots, including single-user mode, auditing, log levels, etc. Improper or malicious configurations can negatively affect system security and availability. |
| V-239180 | Medium | The Photon operating system must log IPv4 packets with impossible addresses. | The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these... |
| V-239181 | Medium | The Photon operating system must use a reverse-path filter for IPv4 network traffic. | Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are... |
| V-239182 | Medium | The Photon operating system must not perform multicast packet forwarding. | Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be... |
| V-239183 | Medium | The Photon operating system must not perform IPv4 packet forwarding. | Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be... |
| V-239184 | Medium | The Photon operating system must send TCP timestamps. | TCP timestamps are used to provide protection against wrapped sequence numbers. It is possible to calculate system uptime (and boot time) by analyzing TCP timestamps. These calculated uptimes can... |
| V-239185 | Medium | The Photon OS must not have the xinetd service enabled. | The xinetd service is not required for normal appliance operation and must be disabled. |
| V-239186 | Medium | The Photon operating system must be configured to protect the SSH public host key from unauthorized modification. | If a public host key file is modified by an unauthorized user, the SSH service may be compromised. |
| V-239187 | Medium | The Photon operating system must be configured to protect the SSH private host key from unauthorized access. | If an unauthorized user obtains the private SSH host key file, the host could be impersonated. |
| V-239175 | Medium | The Photon operating system must not forward IPv4 or IPv6 source-routed packets. | Source routing is an Internet Protocol (IP) mechanism that allows an IP packet to carry information, a list of addresses, which tells a router the path the packet must take. There is also an... |
| V-239174 | Medium | The Photon operating system must be configured so that all cron paths are protected from unauthorized modification. | If cron files and folders are accessible to unauthorized users, malicious jobs may be created. |
| V-239177 | Medium | The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) redirect messages from being accepted. | ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An... |
| V-239176 | Medium | The Photon operating system must not respond to IPv4 Internet Control Message Protocol (ICMP) echoes sent to a broadcast address. | Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. |
| V-239078 | Medium | The Photon operating system must have the sshd SyslogFacility set to "authpriv". | Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities. |
| V-239079 | Medium | The Photon operating system must have sshd authentication logging enabled. | Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities.
Shipping... |
| V-239173 | Medium | The Photon operating system must be configured so that all cron jobs are protected from unauthorized modification. | If cron files and folders are accessible to unauthorized users, malicious jobs may be created. |
| V-239172 | Medium | The Photon operating system must be configured so that the /etc/cron.allow file is protected from unauthorized modification. | If cron files and folders are accessible to unauthorized users, malicious jobs may be created. |
| V-239074 | Medium | The Photon operating system must automatically lock an account when three unsuccessful logon attempts occur. | By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by... |
| V-239075 | Medium | The Photon operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting SSH access. | Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal... |
| V-239076 | Medium | The Photon operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types. | Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is... |
| V-239077 | Medium | The Photon operating system must set a session inactivity timeout of 15 minutes or less. | A session timeout is an action taken when a session goes idle for any reason. Rather than relying on the user to manually disconnect their session prior to going idle, the Photon operating system... |
| V-239179 | Medium | The Photon operating system must not send IPv4 Internet Control Message Protocol (ICMP) redirects. | ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly... |
| V-239178 | Medium | The Photon operating system must prevent IPv4 Internet Control Message Protocol (ICMP) secure redirect messages from being accepted. | ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An... |
| V-239072 | Medium | The Photon operating system must be configured to offload audit logs to a syslog server. | Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Offloading is a common process in information systems with limited audit storage... |
| V-239073 | Medium | The Photon operating system must audit all account creations. | Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create an... |
| V-239113 | Medium | The Photon operating system /var/log directory must be owned by root. | Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state and can provide sensitive information to... |
| V-239112 | Medium | The Photon operating system must configure rsyslog to offload system logs to a central server. | Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Proper configuration of rsyslog ensures that information critical to forensic analysis of... |
| V-239111 | Medium | The Photon operating system must configure sshd to disconnect idle SSH sessions. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port... |
| V-239110 | Medium | The Photon operating system must configure sshd to disconnect idle SSH sessions. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port... |
| V-239117 | Medium | The Photon operating system must audit all account disabling actions. | When operating system accounts are disabled, user accessibility is affected. Accounts are used for identifying individual users or the operating system processes themselves. To detect and respond... |
| V-239116 | Medium | The Photon operating system must audit all account modifications. | Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to modify an... |
| V-239115 | Medium | The Photon operating system messages file must have mode 0640 or less permissive. | Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state and can provide sensitive information to... |
| V-239114 | Medium | The Photon operating system messages file must be owned by root. | Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state and can provide sensitive information to... |
| V-239119 | Medium | The Photon operating system must initiate auditing as part of the boot process. | Each process on the system carries an "auditable" flag, which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes that launch after it... |
| V-239118 | Medium | The Photon operating system must audit all account removal actions. | When operating system accounts are removed, user accessibility is affected. Accounts are used for identifying individual users or the operating system processes themselves. To detect and respond... |
| V-239193 | Medium | The Photon operating system must set the UMASK parameter correctly. | The umask value influences the permissions assigned to files when they are created. The umask setting in login.defs controls the permissions for a new user's home directory. By setting the proper... |
| V-239192 | Medium | The Photon operating system must ship vCenter SSO logs via rsyslog. | Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Proper configuration of rsyslog ensures that information critical to forensic analysis of... |
| V-239191 | Medium | The Photon operating system must protect all sysctl configuration files from unauthorized access. | The sysctl configuration file specifies values for kernel parameters to be set on boot. Incorrect or malicious configuration of these parameters can have a negative effect on system security. |
| V-239190 | Medium | The Photon operating system must protect sshd configuration from unauthorized access. | The sshd_config file contains all the configuration items for sshd. Incorrect or malicious configuration of sshd can allow unauthorized access to the system, insecure communication, limited... |
| V-239195 | Medium | The Photon operating system must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. | If the system does not require authentication before it boots into single-user mode, anyone with vCenter console rights to the VCSA can trivially access all files on the system. GRUB2 is the boot... |
| V-239194 | Medium | The Photon operating system must configure sshd to disallow HostbasedAuthentication. | SSH trust relationships enable trivial lateral spread after a host compromise and therefore must be explicitly disabled. |
| V-239171 | Medium | The Photon operating system must be configured so that all files have a valid owner and group owner. | If files do not have valid user and group owners, unintended access to files could occur. |
| V-239126 | Medium | The Photon operating system must configure sshd with a specific ListenAddress. | Without specifying a ListenAddress, sshd will listen on all interfaces. In situations with multiple interfaces, this may not be intended behavior and could lead to offering remote access on an... |
| V-239127 | Medium | The Photon operating system must audit the execution of privileged functions. | Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious... |
| V-239124 | Medium | The Photon operating system package files must not be modified. | Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit... |
| V-239125 | Medium | The Photon operating system must set an inactivity timeout value for non-interactive sessions. | A session timeout is an action taken when a session goes idle for any reason. Rather than relying on the user to manually disconnect their session prior to going idle, the Photon operating system... |
| V-239122 | Medium | The Photon operating system must protect audit tools from unauthorized modification. | Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized... |
| V-239123 | Medium | The Photon operating system must enforce password complexity by requiring that at least one special character be used. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in... |
| V-239120 | Medium | The Photon operating system audit files and directories must have correct permissions. | Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized... |
| V-239121 | Medium | The Photon operating system audit files and directories must have correct permissions. | Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized... |
| V-239128 | Medium | The Photon operating system must configure auditd to keep five rotated log files. | Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep... |
| V-239129 | Medium | The Photon operating system must configure auditd to keep five rotated log files. | Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep... |
| V-239147 | Medium | The Photon operating system must set the FAIL_DELAY parameter. | Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain access to an account. |
| V-239139 | Medium | The Photon operating system must use OpenSSH for remote maintenance sessions. | If the remote connection is not closed and verified as closed, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Remote connections must be... |
| V-239131 | Medium | The Photon operating system must configure auditd to log space limit problems to syslog. | If security personnel are not notified immediately when storage volume reaches 75% utilization, they are unable to plan for audit record storage capacity expansion. |
| V-239130 | Medium | The Photon operating system must configure a cron job to rotate auditd logs daily. | Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep... |
| V-239133 | Medium | The Photon operating system RPM package management tool must cryptographically verify the authenticity of all software packages during installation. | Installation of any non-trusted software, patches, service packs, device drivers, or operating system components can significantly affect the overall security of the operating system. Ensuring all... |
| V-239132 | Medium | The Photon operating system must be configured to synchronize with an approved DoD time source. | Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when... |
| V-239135 | Medium | The Photon operating system RPM package management tool must cryptographically verify the authenticity of all software packages during installation. | Installation of any non-trusted software, patches, service packs, device drivers, or operating system components can significantly affect the overall security of the operating system. This... |
| V-239134 | Medium | The Photon operating system RPM package management tool must cryptographically verify the authenticity of all software packages during installation. | Installation of any non-trusted software, patches, service packs, device drivers, or operating system components can significantly affect the overall security of the operating system. This... |
| V-239137 | Medium | The Photon operating system must prohibit the use of cached authenticators after one day. | If cached authentication information is out of date, the validity of the authentication information may be questionable. |
| V-239170 | Medium | The Photon operating system must be configured so that all system startup scripts are protected from unauthorized modification. | If system startup scripts are accessible to unauthorized modification, this could compromise the system on startup. |
| V-239098 | Medium | The Photon operating system must store only encrypted representations of passwords. | Passwords must be protected at all times via strong, one-way encryption. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. If they are encrypted... |
| V-239099 | Medium | The Photon operating system must be configured so that passwords for new users are restricted to a 24-hour minimum lifetime. | Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and... |
| V-239096 | Medium | The Photon operating system must require that new passwords are at least four characters different from the old password. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in... |
| V-239097 | Medium | The Photon operating system must store only encrypted representations of passwords. | Passwords must be protected at all times via strong, one-way encryption. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. If they are encrypted... |
| V-239094 | Medium | The Photon operating system must enforce password complexity by requiring that at least one lowercase character be used. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in... |
| V-239095 | Medium | The Photon operating system must enforce password complexity by requiring that at least one numeric character be used. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in... |
| V-239092 | Medium | The Photon operating system must generate audit records when successful/unsuccessful attempts to access privileges occur. | The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the... |
| V-239093 | Medium | The Photon operating system must enforce password complexity by requiring that at least one uppercase character be used. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in... |
| V-239090 | Medium | The Photon operating system must have the auditd service running. | Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. To that... |
| V-239091 | Medium | The Photon operating system must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. | Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured... |
| V-239148 | Medium | The Photon operating system must enforce a delay of at least four seconds between logon prompts following a failed logon attempt. | Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain access to an account. |
| V-239149 | Medium | The Photon operating system must ensure audit events are flushed to disk at proper intervals. | Without setting a balance between performance and ensuring all audit events are written to disk, performance of the system may suffer or the risk of missing audit entries may be too high. |
| V-239144 | Medium | The Photon operating system must audit the insmod module. | Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an... |
| V-239145 | Medium | The Photon operating system auditd service must generate audit records for all account creations, modifications, disabling, and termination events. | Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an... |
| V-239146 | Medium | The Photon operating system must use the pam_cracklib module. | If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses and... |
| V-239136 | Medium | The Photon operating system must require users to reauthenticate for privilege escalation. | Without reauthentication, users may access resources or perform tasks for which they do not have authorization.
When operating systems provide the capability to escalate a functional capability,... |
| V-239140 | Medium | The Photon operating system must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. | ASLR makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR... |
| V-239141 | Medium | The Photon operating system must remove all software components after updated versions have been installed. | Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products... |
| V-239142 | Medium | The Photon operating system must generate audit records when the sudo command is used. | Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an... |
| V-239143 | Medium | The Photon operating system must generate audit records when successful/unsuccessful logon attempts occur. | Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an... |
| V-239080 | Medium | The Photon operating system must have the sshd LogLevel set to "INFO". | Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities.
The INFO... |
| V-239083 | Medium | The Photon operating system must configure auditd to use the correct log format. | To compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know exact, unfiltered details of the event in question. |
| V-239082 | Medium | The Photon operating system must configure auditd to log to disk. | Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
Audit record content must be... |
| V-239085 | Medium | The Photon operating system audit log must log space limit problems to syslog. | It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an... |
| V-239084 | Medium | The Photon operating system must be configured to audit the execution of privileged functions. | Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious... |
| V-239087 | Medium | The Photon operating system audit log must have correct permissions. | Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity.
Unauthorized disclosure of audit records... |
| V-239086 | Medium | The Photon operating system audit log must attempt to log audit failures to syslog. | It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an... |
| V-239089 | Medium | The Photon operating system audit log must be group-owned by root. | Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity.
Unauthorized disclosure of audit records... |
| V-239088 | Medium | The Photon operating system audit log must be owned by root. | Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity.
Unauthorized disclosure of audit records... |
| V-239159 | Medium | The Photon operating system must configure sshd to use privilege separation. | Privilege separation in sshd causes the process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section. |
| V-239158 | Medium | The Photon operating system must configure sshd to disallow Kerberos authentication. | If Kerberos is enabled through SSH, sshd provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to... |
| V-239157 | Medium | The Photon operating system must configure sshd to perform strict mode checking of home directory configuration files. | If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user. |
| V-239156 | Medium | The Photon operating system must configure sshd to disable X11 forwarding. | X11 is an older, insecure graphics forwarding protocol. It is not used by Photon and should be disabled as a general best practice to limit attack surface area and communication channels. |
| V-239155 | Medium | The Photon operating system must configure sshd to disable environment processing. | Enabling environment processing may enable users to bypass access restrictions in some configurations and must therefore be disabled. |
| V-239154 | Medium | The Photon operating system must configure sshd to disallow Generic Security Service Application Program Interface (GSSAPI) authentication. | GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing... |
| V-239153 | Medium | The Photon operating system must configure a secure umask for all shells. | A user's umask influences the permissions assigned to files that a user creates. Setting an appropriate umask is important to make sure that information is not exposed to unprivileged users. |
| V-239152 | Medium | The Photon operating system must disable the debug-shell service. | The debug-shell service is intended to diagnose system-related boot issues with various systemctl commands. Once enabled and following a system reboot, the root shell will be available on tty9.... |
| V-239151 | Medium | The Photon operating system must create a home directory for all new local interactive user accounts. | If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own. |
| V-239150 | Medium | The Photon operating system must ensure root $PATH entries are appropriate. | The $PATH variable contains a semicolon-delimited set of directories that allows root to not specify the full path for a limited set of binaries. Having unexpected directories in $PATH can lead to... |
| V-239162 | Medium | The Photon operating system must configure sshd to display the last login immediately after authentication. | Providing users with feedback on the last time they logged on via SSH facilitates user recognition and reporting of unauthorized account use. |
| V-239163 | Medium | The Photon operating system must configure sshd to ignore user-specific trusted hosts lists. | SSH trust relationships enable trivial lateral spread after a host compromise and therefore must be explicitly disabled. Individual users can have a local list of trusted remote machines, which... |
| V-239160 | Medium | The Photon operating system must configure sshd to disallow authentication with an empty password. | Blank passwords are one of the first things an attacker checks for when probing a system. Even is the user somehow has a blank password on the OS, sshd must not allow that user to log in. |
| V-239161 | Medium | The Photon operating system must configure sshd to disallow compression of the encrypted session stream. | If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection. |
| V-239166 | Medium | The Photon operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line. | When the Ctrl-Alt-Del target is enabled, a locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a... |
| V-239167 | Medium | The Photon operating system must be configured so that the /etc/skel default scripts are protected from unauthorized modification. | If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files. |
| V-239164 | Medium | The Photon operating system must configure sshd to ignore user-specific known_host files. | SSH trust relationships enable trivial lateral spread after a host compromise and therefore must be explicitly disabled. Individual users can have a local list of trusted remote machines which... |
| V-239165 | Medium | The Photon operating system must configure sshd to limit the number of allowed login attempts per connection. | By setting the login attempt limit to a low value, an attacker will be forced to reconnect frequently, which severely limits the speed and effectiveness of brute-force attacks. |
| V-239168 | Medium | The Photon operating system must be configured so that the /root path is protected from unauthorized access. | If the /root path is accessible from users other than root, unauthorized users could change the root partitions files. |
| V-239169 | Medium | The Photon operating system must be configured so that all global initialization scripts are protected from unauthorized modification. | Local initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon login. |
