Feature: stig

Description

A feature that applies Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) controls.

What it does

Installs aide, aide-common, and auditd. Configures comprehensive STIG controls: audit rules, kernel auditing at boot, PAM hardening, password quality requirements, SSH hardening, resource limits, account lockout, sysctl settings, and rsyslog configuration.

Files

Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.

File	Purpose
exec.config (ref)	Enables auditd and configures STIG-required services.
file.include.markers.yaml (ref)	Maps files to test-coverage marker IDs.
info.yaml (ref)	Declares type: element and included/excluded features.
pkg.include (ref)	Installs: aide, aide-common, auditd.
file.include/etc/apt/apt.conf.d/01-vendor-Ubuntu (file.include)	APT vendor configuration per STIG requirement.
file.include/etc/audit/auditd.conf (file.include)	auditd configuration per STIG requirements.
file.include/etc/audit/rules.d/stig.rules (file.include)	DISA STIG audit rules.
file.include/etc/kernel/cmdline.d/90-audit.cfg (file.include)	Enables kernel auditing (audit=1) at boot per STIG.
file.include/etc/modprobe.d/disabled_usb.conf (file.include)	Denylists USB storage per STIG requirement.
file.include/etc/pam.d/common-auth (file.include)	PAM authentication configuration per STIG.
file.include/etc/pam.d/common-password (file.include)	PAM password configuration per STIG.
file.include/etc/rsyslog.d/50-default.conf (file.include)	rsyslog configuration per STIG.
file.include/etc/security/faillock.conf (file.include)	Account lockout configuration per STIG.
file.include/etc/security/limits.conf (file.include)	Resource limits per STIG.
file.include/etc/security/pwquality.conf (file.include)	Password quality requirements per STIG.
file.include/etc/ssh/sshd_config (file.include)	SSH daemon configuration hardened per STIG.
file.include/etc/sysctl.d/99-stig.conf (file.include)	sysctl settings per STIG.
file.include/usr/share/pam-configs/garden-stig (file.include)	PAM profile for STIG authentication requirements.

Related features

This feature has no include or exclude relationships.

Related topics

• Building a custom FeatureCreate a custom Feature and build an image with the Builder
• FeaturesDetailed specification of Features
• FeaturesFeature types, dependency graph resolution, and composition rules in Garden Linux