<?xml version="1.0"?>
<overlays xmlns="http://checklists.nist.gov/xccdf/1.1">
	<overlay owner="disastig" ruleid="restricted_accounts" ownerid="GEN000000-LNX00320" disa="225" severity="high">
		<VMSinfo VKey="4268" SVKey="37181" VRelease="1" />
		<title>The system must not have special privilege accounts, such as shutdown and halt.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000000-LNX00360" disa="366" severity="medium">
		<VMSinfo VKey="1021" SVKey="37207" VRelease="1" />
		<title>The X server must have the correct options enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000000-LNX00380" disa="366" severity="medium">
		<VMSinfo VKey="1022" SVKey="37217" VRelease="2" />
		<title>An X server must have none of the following options enabled: -ac, -core (except for debugging purposes), or -nolock.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_security_access_conf" ownerid="GEN000000-LNX00400" disa="225" severity="medium">
		<VMSinfo VKey="1025" SVKey="37224" VRelease="1" />
		<title>The /etc/access.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_security_access_conf" ownerid="GEN000000-LNX00420" disa="225" severity="medium">
		<VMSinfo VKey="1054" SVKey="37227" VRelease="1" />
		<title>The /etc/access.conf file must have a privileged group owner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_security_access_conf" ownerid="GEN000000-LNX00440" disa="225" severity="medium">
		<VMSinfo VKey="1055" SVKey="37243" VRelease="2" />
		<title>The /etc/security/access.conf file must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_security_access_conf" ownerid="GEN000000-LNX00450" disa="225" severity="medium">
		<VMSinfo VKey="22595" SVKey="26998" VRelease="1" />
		<title>The access.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_sysctl_conf" ownerid="GEN000000-LNX00480" disa="225" severity="medium">
		<VMSinfo VKey="4334" SVKey="37253" VRelease="1" />
		<title>The /etc/sysctl.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_sysctl_conf" ownerid="GEN000000-LNX00500" disa="225" severity="medium">
		<VMSinfo VKey="4335" SVKey="37257" VRelease="1" />
		<title>The /etc/sysctl.conf file must be group-owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_sysctl_conf" ownerid="GEN000000-LNX00520" disa="225" severity="medium">
		<VMSinfo VKey="4336" SVKey="37258" VRelease="1" />
		<title>The /etc/sysctl.conf file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_sysctl_conf" ownerid="GEN000000-LNX00530" disa="225" severity="medium">
		<VMSinfo VKey="22596" SVKey="26999" VRelease="1" />
		<title>The /etc/sysctl.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="nfs_no_insecure_locks_exports" ownerid="GEN000000-LNX00560" disa="225" severity="high">
		<VMSinfo VKey="4339" SVKey="37316" VRelease="1" />
		<title>The Linux NFS Server must not have the insecure file locking option.</title>
	</overlay>
	<overlay owner="disastig" ruleid="disable_ctrlaltdel_reboot" ownerid="GEN000000-LNX00580" disa="366" severity="high">
		<VMSinfo VKey="4342" SVKey="37327" VRelease="1" />
		<title>The x86 CTRL-ALT-DELETE key sequence must be disabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000000-LNX00600" disa="225" severity="medium">
		<VMSinfo VKey="4346" SVKey="37339" VRelease="1" />
		<title>The Linux PAM system must not grant sole access to admin privileges to the first user who logs into the console.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_securetty" ownerid="GEN000000-LNX00620" disa="225" severity="medium">
		<VMSinfo VKey="12038" SVKey="37340" VRelease="1" />
		<title>The /etc/securetty file must be group-owned by root, sys, or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_securetty" ownerid="GEN000000-LNX00640" disa="225" severity="medium">
		<VMSinfo VKey="12039" SVKey="37341" VRelease="1" />
		<title>The /etc/securetty file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_securetty" ownerid="GEN000000-LNX00660" disa="225" severity="medium">
		<VMSinfo VKey="12040" SVKey="37342" VRelease="3" />
		<title>The /etc/securetty file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="bootloader_audit_argument" ownerid="GEN000000-LNX00720" disa="366" severity="low">
		<VMSinfo VKey="22598" SVKey="27001" VRelease="1" />
		<title>Auditing must be enabled at boot by setting a kernel parameter.</title>
	</overlay>
	<overlay owner="disastig" ruleid="selinux_enforcing" ownerid="GEN000000-LNX00800" disa="366" severity="low">
		<VMSinfo VKey="22584" SVKey="26978" VRelease="1" />
		<title>The system must use a Linux Security Module configured to limit the privileges of system services.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_gshadow" ownerid="GEN000000-LNX001431" disa="225" severity="medium">
		<VMSinfo VKey="22341" SVKey="37143" VRelease="1" />
		<title>The /etc/gshadow file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_gshadow" ownerid="GEN000000-LNX001432" disa="225" severity="medium">
		<VMSinfo VKey="22342" SVKey="37164" VRelease="1" />
		<title>The /etc/gshadow file must be group-owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_gshadow" ownerid="GEN000000-LNX001433" disa="225" severity="medium">
		<VMSinfo VKey="22343" SVKey="37170" VRelease="1" />
		<title>The /etc/gshadow file must have mode 0400.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_gshadow" ownerid="GEN000000-LNX001434" disa="225" severity="medium">
		<VMSinfo VKey="22344" SVKey="37176" VRelease="1" />
		<title>The /etc/gshadow file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000000-LNX001476" disa="366" severity="medium">
		<VMSinfo VKey="22349" SVKey="37386" VRelease="1" />
		<title>The /etc/gshadow file must not contain any group password hashes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="require_singleuser_auth" ownerid="GEN000020" disa="213" severity="medium">
		<VMSinfo VKey="756" SVKey="37350" VRelease="1" />
		<title>The system must require authentication upon booting into single-user and maintenance modes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000100" disa="1230" severity="high">
		<VMSinfo VKey="11940" SVKey="27049" VRelease="2" />
		<title>The operating system must be a supported release.</title>
	</overlay>
	<overlay owner="disastig" ruleid="security_patches_up_to_date" ownerid="GEN000120" disa="1227" severity="medium">
		<VMSinfo VKey="783" SVKey="27059" VRelease="2" />
		<title>System security patches and updates must be installed and up-to-date.</title>
	</overlay>
	<overlay owner="disastig" ruleid="aide_build_database" ownerid="GEN000140-2" disa="293" severity="medium">
		<VMSinfo VKey="27250" SVKey="34549" VRelease="2" />
		<title>A file integrity baseline including cryptographic hashes must be created.</title>
	</overlay>
	<overlay owner="disastig" ruleid="aide_build_database" ownerid="GEN000140-3" disa="293" severity="medium">
		<VMSinfo VKey="27251" SVKey="34550" VRelease="1" />
		<title>A file integrity baseline including cryptographic hashes must be maintained.</title>
	</overlay>
	<overlay owner="disastig" ruleid="aide_periodic_cron_checking" ownerid="GEN000220" disa="1069" severity="medium">
		<VMSinfo VKey="11945" SVKey="38178" VRelease="1" />
		<title>A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ntp_remote_server" ownerid="GEN000240" disa="1492" severity="medium">
		<VMSinfo VKey="4301" SVKey="37402" VRelease="1" />
		<title>The system clock must be synchronized to an authoritative DoD time source.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_ntpd_enabled" ownerid="GEN000241" disa="366" severity="medium">
		<VMSinfo VKey="22290" SVKey="26292" VRelease="1" />
		<title>The system clock must be synchronized continuously, or at least daily.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ntp_multiple_remote_servers" ownerid="GEN000242" disa="160" severity="medium">
		<VMSinfo VKey="22291" SVKey="37412" VRelease="1" />
		<title>The system must use at least two time sources for clock synchronization.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000244" disa="160" severity="low">
		<VMSinfo VKey="22292" SVKey="37413" VRelease="2" />
		<title>The system must use time sources local to the enclave.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_ntp_conf" ownerid="GEN000250" disa="225" severity="medium">
		<VMSinfo VKey="22294" SVKey="37415" VRelease="1" />
		<title>The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_ntp_conf" ownerid="GEN000251" disa="225" severity="medium">
		<VMSinfo VKey="22295" SVKey="37416" VRelease="1" />
		<title>The time synchronization configuration file (such as /etc/ntp.conf) must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_ntp_conf" ownerid="GEN000252" disa="225" severity="medium">
		<VMSinfo VKey="22296" SVKey="37417" VRelease="1" />
		<title>The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_ntp_conf" ownerid="GEN000253" disa="225" severity="medium">
		<VMSinfo VKey="22297" SVKey="37418" VRelease="1" />
		<title>The time synchronization configuration file (such as /etc/ntp.conf) must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000280" disa="770" severity="medium">
		<VMSinfo VKey="760" SVKey="37419" VRelease="2" />
		<title>Direct logins must not be permitted to shared, default, application, or utility accounts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000290" disa="12" severity="medium">
		<VMSinfo VKey="4269" SVKey="38176" VRelease="1" />
		<title>The system must not have unnecessary accounts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="restricted_accounts_games" ownerid="GEN000290-1" disa="12" severity="medium">
		<VMSinfo VKey="29376" SVKey="38177" VRelease="1" />
		<title>The system must not have the unnecessary "games" account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="restricted_accounts_news" ownerid="GEN000290-2" disa="12" severity="medium">
		<VMSinfo VKey="27275" SVKey="34574" VRelease="1" />
		<title>The system must not have the unnecessary "news" account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="restricted_accounts_gopher" ownerid="GEN000290-3" disa="12" severity="medium">
		<VMSinfo VKey="27276" SVKey="34575" VRelease="1" />
		<title>The system must not have the unnecessary "gopher" account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="restricted_accounts_ftp" ownerid="GEN000290-4" disa="12" severity="medium">
		<VMSinfo VKey="27279" SVKey="34578" VRelease="1" />
		<title>The system must not have the unnecessary "ftp" account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_unique_name" ownerid="GEN000300" disa="764" severity="medium">
		<VMSinfo VKey="761" SVKey="27063" VRelease="1" />
		<title>All accounts on the system must have unique user or account names.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_unique_uid" ownerid="GEN000320" disa="764" severity="medium">
		<VMSinfo VKey="762" SVKey="27068" VRelease="1" />
		<title>All accounts must be assigned unique User Identification Numbers (UIDs).</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000340" disa="366" severity="medium">
		<VMSinfo VKey="11946" SVKey="37155" VRelease="1" />
		<title>UIDs reserved for system accounts must not be assigned to non-system accounts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000360" disa="366" severity="medium">
		<VMSinfo VKey="780" SVKey="37157" VRelease="1" />
		<title>GIDs reserved for system accounts must not be assigned to non-system groups.</title>
	</overlay>
	<overlay owner="disastig" ruleid="gid_passwd_group_same" ownerid="GEN000380" disa="366" severity="low">
		<VMSinfo VKey="781" SVKey="27072" VRelease="1" />
		<title>All GIDs referenced in the /etc/passwd file must be defined in the /etc/group file.</title>
	</overlay>
	<overlay owner="disastig" ruleid="banner_etc_issue" ownerid="GEN000400" disa="48" severity="medium">
		<VMSinfo VKey="763" SVKey="37169" VRelease="1" />
		<title>The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="banner_gui_enabled" ownerid="GEN000402" disa="48" severity="medium">
		<VMSinfo VKey="24331" SVKey="37171" VRelease="1" />
		<title>The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ftp_enable_warning_banner" ownerid="GEN000410" disa="48" severity="medium">
		<VMSinfo VKey="23732" SVKey="28606" VRelease="1" />
		<title>The FTPS/FTP service on the system must be configured with the Department of Defense (DoD) login banner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000440" disa="126" severity="medium">
		<VMSinfo VKey="765" SVKey="37178" VRelease="1" />
		<title>Successful and unsuccessful logins and logouts must be logged.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_max_concurrent_login_sessions" ownerid="GEN000450" disa="54" severity="low">
		<VMSinfo VKey="22298" SVKey="37182" VRelease="1" />
		<title>The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_printlastlog" ownerid="GEN000452" disa="52" severity="low">
		<VMSinfo VKey="22299" SVKey="37187" VRelease="1" />
		<title>The system must display the date and time of the last successful account login upon login.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_tally_deny" ownerid="GEN000460" disa="44" severity="medium">
		<VMSinfo VKey="766" SVKey="37203" VRelease="1" />
		<title>The system must disable accounts after three consecutive unsuccessful login attempts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_fail_delay" ownerid="GEN000480" disa="43" severity="medium">
		<VMSinfo VKey="768" SVKey="37213" VRelease="1" />
		<title>The delay between login prompts following a failed login attempt must be at least 4 seconds.</title>
	</overlay>
	<overlay owner="disastig" ruleid="gconf_gnome_screensaver_idle_activation_enabled" ownerid="GEN000500" disa="57" severity="medium">
		<VMSinfo VKey="4083" SVKey="48455" VRelease="1" />
		<title>Graphical desktop environments provided by the system must automatically lock after 15 minutes of inactivity and the system must require users to re-authenticate to unlock the environment.</title>
	</overlay>
	<overlay owner="disastig" ruleid="gconf_gnome_screensaver_idle_delay" ownerid="GEN000500-2" disa="57" severity="medium">
		<VMSinfo VKey="27283" SVKey="48550" VRelease="1" />
		<title>The graphical desktop environment must set the idle timeout to no more than 15 minutes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="gconf_gnome_screensaver_lock_enabled" ownerid="GEN000500-3" disa="57" severity="medium">
		<VMSinfo VKey="27284" SVKey="48551" VRelease="1" />
		<title>Graphical desktop environments provided by the system must have automatic lock enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000510" disa="61" severity="low">
		<VMSinfo VKey="22301" SVKey="37222" VRelease="1" />
		<title>The system must display a publicly-viewable pattern during a graphical desktop environment session lock.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000520" disa="225" severity="medium">
		<VMSinfo VKey="769" SVKey="37232" VRelease="1" />
		<title>The root user must not own the logon session for an application requiring a continuous display.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_minimum_age_login_defs" ownerid="GEN000540" disa="198" severity="medium">
		<VMSinfo VKey="1032" SVKey="37239" VRelease="1" />
		<title>Users must not be able to change passwords more than once every 24 hours.</title>
	</overlay>
	<overlay owner="disastig" ruleid="no_empty_passwords" ownerid="GEN000560" disa="366" severity="high">
		<VMSinfo VKey="770" SVKey="37259" VRelease="1" />
		<title>The system must not have accounts configured with blank or null passwords.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_minlen" ownerid="GEN000580" disa="205" severity="medium">
		<VMSinfo VKey="11947" SVKey="37260" VRelease="1" />
		<title>The system must require passwords contain a minimum of 14 characters.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_minlen" ownerid="GEN000585" disa="205" severity="medium">
		<VMSinfo VKey="22302" SVKey="37261" VRelease="1" />
		<title>The system must enforce compliance of the entire password during authentification.</title>
	</overlay>
	<overlay owner="disastig" ruleid="set_password_hashing_algorithm_systemauth" ownerid="GEN000590" disa="803" severity="medium">
		<VMSinfo VKey="22303" SVKey="26313" VRelease="1" />
		<title>The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000595" disa="196" severity="medium">
		<VMSinfo VKey="22304" SVKey="26316" VRelease="2" />
		<title>The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_ucredit" ownerid="GEN000600" disa="192" severity="medium">
		<VMSinfo VKey="11948" SVKey="41826" VRelease="1" />
		<title>The system must require passwords contain at least one uppercase alphabetic character.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_global_setting" ownerid="GEN000600-2" disa="192" severity="medium">
		<VMSinfo VKey="27285" SVKey="34584" VRelease="1" />
		<title>Global settings defined in system-auth must be applied in the pam.d definition files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_lcredit" ownerid="GEN000610" disa="193" severity="medium">
		<VMSinfo VKey="22305" SVKey="26321" VRelease="1" />
		<title>The system must require passwords contain at least one lowercase alphabetic character.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_dcredit" ownerid="GEN000620" disa="194" severity="medium">
		<VMSinfo VKey="11972" SVKey="37281" VRelease="1" />
		<title>The system must require passwords contain at least one numeric character.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_ocredit" ownerid="GEN000640" disa="1619" severity="medium">
		<VMSinfo VKey="11973" SVKey="37287" VRelease="1" />
		<title>The system must require passwords contain at least one special character.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_maxrepeat" ownerid="GEN000680" disa="366" severity="medium">
		<VMSinfo VKey="11975" SVKey="37294" VRelease="1" />
		<title>The system must require passwords contain no more than three consecutive repeating characters.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_maximum_age_login_defs" ownerid="GEN000700" disa="180" severity="medium">
		<VMSinfo VKey="11976" SVKey="37298" VRelease="1" />
		<title>User passwords must be changed at least every 60 days.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000740" disa="199" severity="medium">
		<VMSinfo VKey="11977" SVKey="37302" VRelease="1" />
		<title>All non-interactive/automated processing account passwords must be changed at least once per year or be locked.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_difok" ownerid="GEN000750" disa="195" severity="medium">
		<VMSinfo VKey="22306" SVKey="37304" VRelease="1" />
		<title>The system must require at least four characters be changed between the old and new passwords during a password change.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN000760" disa="17" severity="medium">
		<VMSinfo VKey="918" SVKey="37314" VRelease="2" />
		<title>Accounts must be locked upon 35 days of inactivity.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_cracklib_present" ownerid="GEN000790" disa="189" severity="medium">
		<VMSinfo VKey="22307" SVKey="37318" VRelease="1" />
		<title>The system must prevent the use of dictionary words for passwords.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_pam_unix_remember" ownerid="GEN000800" disa="200" severity="medium">
		<VMSinfo VKey="4084" SVKey="37323" VRelease="2" />
		<title>The system must prohibit the reuse of passwords within five iterations.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sudo_wheel" ownerid="GEN000850" disa="9" severity="low">
		<VMSinfo VKey="22308" SVKey="37345" VRelease="1" />
		<title>The system must restrict the ability to switch to the root user to members of a defined group.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="GEN000880" disa="366" severity="medium">
		<VMSinfo VKey="773" SVKey="37347" VRelease="1" />
		<title>The root account must be the only account having a UID of 0.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXXX" ownerid="GEN000900" disa="366" severity="low">
		<VMSinfo VKey="774" SVKey="37349" VRelease="1" />
		<title>The root user's home directory must not be the root directory (/).</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_root_dir" ownerid="GEN000920" disa="225" severity="medium">
		<VMSinfo VKey="775" SVKey="37355" VRelease="1" />
		<title>The root account's home directory (other than /) must have mode 0700.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_root_dir" ownerid="GEN000930" disa="225" severity="medium">
		<VMSinfo VKey="22309" SVKey="37358" VRelease="1" />
		<title>The root account's home directory must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_executable_dangerous_path_for_root" ownerid="GEN000940" disa="366" severity="medium">
		<VMSinfo VKey="776" SVKey="37360" VRelease="1" />
		<title>The root account's executable search path must be the vendor default and must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_library_dangerous_path_for_root" ownerid="GEN000945" disa="366" severity="medium">
		<VMSinfo VKey="22310" SVKey="37363" VRelease="1" />
		<title>The root account's library search path must be the system default and must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXXX" ownerid="GEN000950" disa="366" severity="medium">
		<VMSinfo VKey="22311" SVKey="37364" VRelease="1" />
		<title>The root account's list of preloaded libraries must be empty.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_root_path_dirs_no_write" ownerid="GEN000960" disa="366" severity="medium">
		<VMSinfo VKey="777" SVKey="37372" VRelease="1" />
		<title>The root account must not have world-writable directories in its executable search path.</title>
	</overlay>
	<overlay owner="disastig" ruleid="securetty_root_login_console_only" ownerid="GEN000980" disa="770" severity="medium">
		<VMSinfo VKey="778" SVKey="37374" VRelease="1" />
		<title>The system must prevent the root account from directly logging in except from the system console.</title>
	</overlay>
	<overlay owner="disastig" ruleid="securetty_root_login_console_only" ownerid="GEN001000" disa="70" severity="medium">
		<VMSinfo VKey="4298" SVKey="37376" VRelease="1" />
		<title>Remote consoles must be disabled or protected from unauthorized access.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001020" disa="770" severity="medium">
		<VMSinfo VKey="11979" SVKey="37377" VRelease="2" />
		<title>The root account must not be used for direct log in.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001060" disa="126" severity="medium">
		<VMSinfo VKey="11980" SVKey="37378" VRelease="1" />
		<title>The system must log successful and unsuccessful access to the root account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001080" disa="366" severity="low">
		<VMSinfo VKey="1062" SVKey="37380" VRelease="1" />
		<title>The root shell must be located in the / file system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001100" disa="197" severity="high">
		<VMSinfo VKey="1046" SVKey="37150" VRelease="1" />
		<title>Root passwords must never be passed over a network in clear text form.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_disable_root_login" ownerid="GEN001120" disa="770" severity="medium">
		<VMSinfo VKey="1047" SVKey="37156" VRelease="1" />
		<title>The system must not permit root logins using remote access programs such as ssh.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001140" disa="225" severity="medium">
		<VMSinfo VKey="784" SVKey="37159" VRelease="1" />
		<title>System files and directories must not have uneven access permissions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="no_files_unowned_by_user" ownerid="GEN001160" disa="366" severity="medium">
		<VMSinfo VKey="785" SVKey="37161" VRelease="1" />
		<title>All files and directories must have a valid owner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ungroupowned" ownerid="GEN001170" disa="366" severity="medium">
		<VMSinfo VKey="22312" SVKey="37165" VRelease="1" />
		<title>All files and directories must have a valid group-owner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_usr_sbin_dir" ownerid="GEN001180" disa="225" severity="medium">
		<VMSinfo VKey="786" SVKey="37194" VRelease="1" />
		<title>All network services daemon files must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_usr_sbin_dir" ownerid="GEN001190" disa="225" severity="medium">
		<VMSinfo VKey="22313" SVKey="37199" VRelease="1" />
		<title>All network services daemon files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_binary_dirs" ownerid="GEN001200" disa="1499" severity="medium">
		<VMSinfo VKey="794" SVKey="37205" VRelease="2" />
		<title>All system command files must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_binary_dirs" ownerid="GEN001210" disa="1499" severity="medium">
		<VMSinfo VKey="22314" SVKey="37210" VRelease="1" />
		<title>All system command files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_binary_dirs" ownerid="GEN001220" disa="1499" severity="medium">
		<VMSinfo VKey="795" SVKey="37216" VRelease="1" />
		<title>All system files, programs, and directories must be owned by a system account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_binary_dirs" ownerid="GEN001240" disa="1499" severity="medium">
		<VMSinfo VKey="796" SVKey="37220" VRelease="1" />
		<title>System files, programs, and directories must be group-owned by a system group.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_var_log" ownerid="GEN001260" disa="1314" severity="medium">
		<VMSinfo VKey="787" SVKey="37228" VRelease="2" />
		<title>System log files must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_var_log" ownerid="GEN001270" disa="1314" severity="medium">
		<VMSinfo VKey="22315" SVKey="37233" VRelease="1" />
		<title>System log files must not have extended ACLs, except as needed to support authorized software.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_man_pages" ownerid="GEN001280" disa="225" severity="low">
		<VMSinfo VKey="792" SVKey="37234" VRelease="1" />
		<title>Manual page files must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_man_pages" ownerid="GEN001290" disa="225" severity="low">
		<VMSinfo VKey="22316" SVKey="37238" VRelease="1" />
		<title>All manual page files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_library_dirs" ownerid="GEN001300" disa="1499" severity="medium">
		<VMSinfo VKey="793" SVKey="37241" VRelease="1" />
		<title>Library files must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_library_dirs" ownerid="GEN001310" disa="1499" severity="medium">
		<VMSinfo VKey="22317" SVKey="37250" VRelease="1" />
		<title>All library files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_var_yp" ownerid="GEN001320" disa="225" severity="medium">
		<VMSinfo VKey="789" SVKey="37267" VRelease="1" />
		<title>NIS/NIS+/yp files must be owned by root, sys, or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_var_yp" ownerid="GEN001340" disa="225" severity="medium">
		<VMSinfo VKey="790" SVKey="41577" VRelease="2" />
		<title>NIS/NIS+/yp files must be group-owned by root, sys, or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_var_yp" ownerid="GEN001360" disa="225" severity="medium">
		<VMSinfo VKey="791" SVKey="37272" VRelease="1" />
		<title>The NIS/NIS+/yp command files must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_var_yp" ownerid="GEN001361" disa="225" severity="medium">
		<VMSinfo VKey="22318" SVKey="37277" VRelease="1" />
		<title>NIS/NIS+/yp command files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_resolv_conf" ownerid="GEN001362" disa="225" severity="medium">
		<VMSinfo VKey="22319" SVKey="37280" VRelease="1" />
		<title>The /etc/resolv.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_resolv_conf" ownerid="GEN001363" disa="225" severity="medium">
		<VMSinfo VKey="22320" SVKey="37286" VRelease="1" />
		<title>The /etc/resolv.conf file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_resolv_conf" ownerid="GEN001364" disa="225" severity="medium">
		<VMSinfo VKey="22321" SVKey="37291" VRelease="1" />
		<title>The /etc/resolv.conf file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_resolv_conf" ownerid="GEN001365" disa="225" severity="medium">
		<VMSinfo VKey="22322" SVKey="37307" VRelease="1" />
		<title>The /etc/resolv.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_hosts" ownerid="GEN001366" disa="225" severity="medium">
		<VMSinfo VKey="22323" SVKey="37309" VRelease="1" />
		<title>The /etc/hosts file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_hosts" ownerid="GEN001367" disa="225" severity="medium">
		<VMSinfo VKey="22324" SVKey="37315" VRelease="1" />
		<title>The /etc/hosts file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_hosts" ownerid="GEN001368" disa="225" severity="medium">
		<VMSinfo VKey="22325" SVKey="37321" VRelease="1" />
		<title>The /etc/hosts file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_hosts" ownerid="GEN001369" disa="225" severity="medium">
		<VMSinfo VKey="22326" SVKey="37324" VRelease="1" />
		<title>The /etc/hosts file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_nsswitch_conf" ownerid="GEN001371" disa="225" severity="medium">
		<VMSinfo VKey="22327" SVKey="37326" VRelease="1" />
		<title>The /etc/nsswitch.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_nsswitch_conf" ownerid="GEN001372" disa="225" severity="medium">
		<VMSinfo VKey="22328" SVKey="37330" VRelease="1" />
		<title>The /etc/nsswitch.conf file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_nsswitch_conf" ownerid="GEN001373" disa="225" severity="medium">
		<VMSinfo VKey="22329" SVKey="37332" VRelease="1" />
		<title>The /etc/nsswitch.conf file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_nsswitch_conf" ownerid="GEN001374" disa="225" severity="medium">
		<VMSinfo VKey="22330" SVKey="37334" VRelease="1" />
		<title>The /etc/nsswitch.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001375" disa="1182" severity="low">
		<VMSinfo VKey="22331" SVKey="37335" VRelease="2" />
		<title>For systems using DNS resolution, at least two name servers must be configured.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_passwd" ownerid="GEN001378" disa="225" severity="medium">
		<VMSinfo VKey="22332" SVKey="37336" VRelease="1" />
		<title>The /etc/passwd file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_passwd" ownerid="GEN001379" disa="225" severity="medium">
		<VMSinfo VKey="22333" SVKey="37337" VRelease="1" />
		<title>The /etc/passwd file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_passwd" ownerid="GEN001380" disa="225" severity="medium">
		<VMSinfo VKey="798" SVKey="37344" VRelease="1" />
		<title>The /etc/passwd file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_passwd" ownerid="GEN001390" disa="225" severity="medium">
		<VMSinfo VKey="22334" SVKey="37346" VRelease="1" />
		<title>The /etc/passwd file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_group" ownerid="GEN001391" disa="225" severity="medium">
		<VMSinfo VKey="22335" SVKey="37351" VRelease="1" />
		<title>The /etc/group file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_group" ownerid="GEN001392" disa="225" severity="medium">
		<VMSinfo VKey="22336" SVKey="37352" VRelease="1" />
		<title>The /etc/group file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_group" ownerid="GEN001393" disa="225" severity="medium">
		<VMSinfo VKey="22337" SVKey="37354" VRelease="1" />
		<title>The /etc/group file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_group" ownerid="GEN001394" disa="225" severity="medium">
		<VMSinfo VKey="22338" SVKey="37357" VRelease="1" />
		<title>The /etc/group file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_shadow" ownerid="GEN001400" disa="225" severity="medium">
		<VMSinfo VKey="797" SVKey="37361" VRelease="1" />
		<title>The /etc/shadow (or equivalent) file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_shadow" ownerid="GEN001410" disa="225" severity="medium">
		<VMSinfo VKey="22339" SVKey="37365" VRelease="1" />
		<title>The /etc/shadow file (or equivalent) must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_shadow" ownerid="GEN001420" disa="225" severity="medium">
		<VMSinfo VKey="800" SVKey="37368" VRelease="1" />
		<title>The /etc/shadow (or equivalent) file must have mode 0400.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_shadow" ownerid="GEN001430" disa="225" severity="medium">
		<VMSinfo VKey="22340" SVKey="37371" VRelease="1" />
		<title>The /etc/shadow file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001440" disa="225" severity="low">
		<VMSinfo VKey="899" SVKey="37375" VRelease="1" />
		<title>All interactive users must be assigned a home directory in the /etc/passwd file.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001460" disa="225" severity="low">
		<VMSinfo VKey="900" SVKey="37379" VRelease="1" />
		<title>All interactive user home directories defined in the /etc/passwd file must exist.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_password_all_shadowed" ownerid="GEN001470" disa="201" severity="medium">
		<VMSinfo VKey="22347" SVKey="37381" VRelease="2" />
		<title>The /etc/passwd file must not contain password hashes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001475" disa="225" severity="medium">
		<VMSinfo VKey="22348" SVKey="37383" VRelease="1" />
		<title>The /etc/group file must not contain any group password hashes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_home_dirs" ownerid="GEN001480" disa="225" severity="medium">
		<VMSinfo VKey="901" SVKey="37154" VRelease="1" />
		<title>All user home directories must have mode 0750 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_home_dirs" ownerid="GEN001490" disa="225" severity="low">
		<VMSinfo VKey="22350" SVKey="37162" VRelease="1" />
		<title>User home directories must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_home_dirs" ownerid="GEN001500" disa="225" severity="medium">
		<VMSinfo VKey="902" SVKey="37163" VRelease="1" />
		<title>All interactive user home directories must be owned by their respective users.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_home_dirs" ownerid="GEN001520" disa="225" severity="medium">
		<VMSinfo VKey="903" SVKey="37168" VRelease="1" />
		<title>All interactive user home directories must be group-owned by the home directory owner's primary group.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_home_files" ownerid="GEN001540" disa="225" severity="low">
		<VMSinfo VKey="914" SVKey="37175" VRelease="1" />
		<title>All files and directories contained in interactive user home directories must be owned by the home directory's owner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_home_files" ownerid="GEN001550" disa="225" severity="medium">
		<VMSinfo VKey="22351" SVKey="37180" VRelease="1" />
		<title>All files and directories contained in user home directories must be group-owned by a group of which the home directory's owner is a member.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_home_files" ownerid="GEN001560" disa="225" severity="low">
		<VMSinfo VKey="915" SVKey="37183" VRelease="1" />
		<title>All files and directories contained in user home directories must have mode 0750 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_home_files" ownerid="GEN001570" disa="225" severity="medium">
		<VMSinfo VKey="22352" SVKey="37188" VRelease="1" />
		<title>All files and directories contained in user home directories must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_run_control_scripts" ownerid="GEN001580" disa="225" severity="medium">
		<VMSinfo VKey="906" SVKey="37192" VRelease="1" />
		<title>All run control scripts must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_run_control_scripts" ownerid="GEN001590" disa="225" severity="medium">
		<VMSinfo VKey="22353" SVKey="37196" VRelease="1" />
		<title>All run control scripts must have no extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001600" disa="366" severity="medium">
		<VMSinfo VKey="907" SVKey="37202" VRelease="1" />
		<title>Run control scripts' executable search paths must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001605" disa="366" severity="medium">
		<VMSinfo VKey="22354" SVKey="37211" VRelease="1" />
		<title>Run control scripts' library search paths must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001610" disa="366" severity="medium">
		<VMSinfo VKey="22355" SVKey="37215" VRelease="1" />
		<title>Run control scripts' lists of preloaded libraries must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001640" disa="225" severity="high">
		<VMSinfo VKey="910" SVKey="38154" VRelease="2" />
		<title>Run control scripts must not execute world-writable programs or scripts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_run_control_scripts" ownerid="GEN001660" disa="225" severity="medium">
		<VMSinfo VKey="4089" SVKey="37264" VRelease="1" />
		<title>All system start-up files must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_run_control_scripts" ownerid="GEN001680" disa="225" severity="medium">
		<VMSinfo VKey="4090" SVKey="37269" VRelease="1" />
		<title>All system start-up files must be group-owned by root, sys, bin, other, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001700" disa="225" severity="medium">
		<VMSinfo VKey="4091" SVKey="37270" VRelease="1" />
		<title>System start-up files must only execute programs owned by a privileged UID or an application.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_global_initialization_files" ownerid="GEN001720" disa="225" severity="medium">
		<VMSinfo VKey="11981" SVKey="37275" VRelease="1" />
		<title>All global initialization files must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_global_initialization_files" ownerid="GEN001730" disa="225" severity="medium">
		<VMSinfo VKey="22356" SVKey="37279" VRelease="1" />
		<title>All global initialization files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_global_initialization_files" ownerid="GEN001740" disa="225" severity="medium">
		<VMSinfo VKey="11982" SVKey="37283" VRelease="1" />
		<title>All global initialization files must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_global_initialization_files" ownerid="GEN001760" disa="225" severity="medium">
		<VMSinfo VKey="11983" SVKey="37285" VRelease="1" />
		<title>All global initialization files must be group-owned by root, sys, bin, other, system, or the system default.</title>
	</overlay>
	<overlay owner="disastig" ruleid="global_initialization_files_mesg" ownerid="GEN001780" disa="366" severity="low">
		<VMSinfo VKey="825" SVKey="37289" VRelease="1" />
		<title>Global initialization files must contain the "mesg -n" or "mesg n" commands.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_skel" ownerid="GEN001800" disa="225" severity="medium">
		<VMSinfo VKey="788" SVKey="37292" VRelease="1" />
		<title>All skeleton files (typically those in /etc/skel) must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_skel" ownerid="GEN001810" disa="225" severity="medium">
		<VMSinfo VKey="22357" SVKey="37297" VRelease="1" />
		<title>Skeleton files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_skel" ownerid="GEN001820" disa="225" severity="medium">
		<VMSinfo VKey="11984" SVKey="37300" VRelease="1" />
		<title>All skeleton files and directories (typically in /etc/skel) must be owned by root or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_skel" ownerid="GEN001830" disa="225" severity="medium">
		<VMSinfo VKey="22358" SVKey="37237" VRelease="1" />
		<title>All skeleton files (typically in /etc/skel) must be group-owned by root, bin, sys, system, or other.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001840" disa="366" severity="medium">
		<VMSinfo VKey="11985" SVKey="37420" VRelease="1" />
		<title>All global initialization files' executable search paths must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001845" disa="366" severity="medium">
		<VMSinfo VKey="22359" SVKey="37246" VRelease="1" />
		<title>Global initialization files' library search paths must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001850" disa="366" severity="medium">
		<VMSinfo VKey="22360" SVKey="37248" VRelease="1" />
		<title>Global initialization files' lists of preloaded libraries must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_local_initialization_files" ownerid="GEN001860" disa="225" severity="medium">
		<VMSinfo VKey="904" SVKey="37430" VRelease="2" />
		<title>All local initialization files must be owned by the home directorys user or root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_local_initialization_files" ownerid="GEN001870" disa="225" severity="medium">
		<VMSinfo VKey="22361" SVKey="37252" VRelease="1" />
		<title>Local initialization files must be group-owned by the user's primary group or root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_local_initialization_files" ownerid="GEN001880" disa="225" severity="medium">
		<VMSinfo VKey="905" SVKey="37431" VRelease="1" />
		<title>All local initialization files must have mode 0740 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_local_initialization_files" ownerid="GEN001890" disa="225" severity="medium">
		<VMSinfo VKey="22362" SVKey="37271" VRelease="1" />
		<title>Local initialization files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001900" disa="366" severity="medium">
		<VMSinfo VKey="11986" SVKey="37432" VRelease="2" />
		<title>All local initialization files' executable search paths must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001901" disa="366" severity="medium">
		<VMSinfo VKey="22363" SVKey="37305" VRelease="2" />
		<title>Local initialization files' library search paths must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001902" disa="366" severity="medium">
		<VMSinfo VKey="22364" SVKey="37312" VRelease="2" />
		<title>Local initialization files' lists of preloaded libraries must contain only absolute paths.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001940" disa="225" severity="medium">
		<VMSinfo VKey="4087" SVKey="37433" VRelease="1" />
		<title>User start-up files must not execute world-writable programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN001980" disa="366" severity="medium">
		<VMSinfo VKey="11987" SVKey="37435" VRelease="1" />
		<title>The .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files must not contain a plus (+) without defining entries for NIS+ netgroups.</title>
	</overlay>
	<overlay owner="disastig" ruleid="no_netrc_files" ownerid="GEN002000" disa="196" severity="medium">
		<VMSinfo VKey="913" SVKey="37436" VRelease="1" />
		<title>There must be no .netrc files on the system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002020" disa="366" severity="medium">
		<VMSinfo VKey="4427" SVKey="37437" VRelease="1" />
		<title>All .rhosts, .shosts, or host.equiv files must only contain trusted host-user pairs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="no_rsh_trust_files" ownerid="GEN002040" disa="366" severity="high">
		<VMSinfo VKey="11988" SVKey="37370" VRelease="1" />
		<title>There must be no .rhosts, .shosts, hosts.equiv, or shosts.equiv files on the system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002060" disa="225" severity="medium">
		<VMSinfo VKey="4428" SVKey="37385" VRelease="1" />
		<title>All .rhosts, .shosts, .netrc, or hosts.equiv files must be accessible by only root or the owner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="rhosts_auth_pam_files" ownerid="GEN002100" disa="366" severity="medium">
		<VMSinfo VKey="11989" SVKey="37389" VRelease="1" />
		<title>The .rhosts file must not be supported in PAM.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002120" disa="366" severity="medium">
		<VMSinfo VKey="916" SVKey="37390" VRelease="1" />
		<title>The /etc/shells (or equivalent) file must exist.</title>
	</overlay>
	<overlay owner="disastig" ruleid="shells_file_references" ownerid="GEN002140" disa="366" severity="medium">
		<VMSinfo VKey="917" SVKey="37393" VRelease="1" />
		<title>All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_shell_files" ownerid="GEN002200" disa="225" severity="medium">
		<VMSinfo VKey="921" SVKey="37396" VRelease="1" />
		<title>All shell files must be owned by root or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_shell_files" ownerid="GEN002210" disa="225" severity="medium">
		<VMSinfo VKey="22365" SVKey="37399" VRelease="1" />
		<title>All shell files must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_shell_files" ownerid="GEN002220" disa="225" severity="high">
		<VMSinfo VKey="922" SVKey="37403" VRelease="1" />
		<title>All shell files must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_shell_files" ownerid="GEN002230" disa="225" severity="medium">
		<VMSinfo VKey="22366" SVKey="37405" VRelease="1" />
		<title>All shell files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="baseline_device_files" ownerid="GEN002260" disa="318" severity="low">
		<VMSinfo VKey="923" SVKey="37543" VRelease="1" />
		<title>The system must be checked for extraneous device files at least weekly.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002280" disa="225" severity="medium">
		<VMSinfo VKey="924" SVKey="37553" VRelease="1" />
		<title>Device files and directories must only be writable by users with a system account or as configured by the vendor.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002300" disa="225" severity="medium">
		<VMSinfo VKey="925" SVKey="37558" VRelease="1" />
		<title>Device files used for backup must only be readable and/or writable by root or the backup user.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_audio_devices" ownerid="GEN002320" disa="225" severity="medium">
		<VMSinfo VKey="1048" SVKey="37566" VRelease="1" />
		<title>Audio devices must have mode 0660 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_audio_devices" ownerid="GEN002330" disa="225" severity="medium">
		<VMSinfo VKey="22367" SVKey="37569" VRelease="1" />
		<title>Audio devices must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_audio_devices" ownerid="GEN002340" disa="225" severity="medium">
		<VMSinfo VKey="1049" SVKey="37575" VRelease="1" />
		<title>Audio devices must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_audio_devices" ownerid="GEN002360" disa="225" severity="medium">
		<VMSinfo VKey="1061" SVKey="37577" VRelease="1" />
		<title>Audio devices must be group-owned by root, sys, bin, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002380" disa="368" severity="medium">
		<VMSinfo VKey="801" SVKey="37579" VRelease="2" />
		<title>The owner, group-owner, mode, ACL, and location of files with the setuid bit set must be documented using site-defined procedures.</title>
	</overlay>
	<overlay owner="disastig" ruleid="baseline_suid_files" ownerid="GEN002400" disa="318" severity="medium">
		<VMSinfo VKey="803" SVKey="37592" VRelease="2" />
		<title>The system must be checked weekly for unauthorized setuid files as well as unauthorized modification to authorized setuid files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mount_option_nosuid_removable_filesystems" ownerid="GEN002420" disa="225" severity="medium">
		<VMSinfo VKey="805" SVKey="37607" VRelease="1" />
		<title>Removable media, remote file systems, and any file system not containing approved setuid files must be mounted with the "nosuid" option.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mount_option_nodev_removable_filesystems" ownerid="GEN002430" disa="366" severity="medium">
		<VMSinfo VKey="22368" SVKey="37623" VRelease="1" />
		<title>Removable media, remote file systems, and any file system not containing approved device files must be mounted with the "nodev" option.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002440" disa="368" severity="medium">
		<VMSinfo VKey="802" SVKey="37628" VRelease="2" />
		<title>The owner, group-owner, mode, ACL and location of files with the setgid bit set must be documented using site-defined procedures.</title>
	</overlay>
	<overlay owner="disastig" ruleid="baseline_sgid_files" ownerid="GEN002460" disa="318" severity="medium">
		<VMSinfo VKey="804" SVKey="37635" VRelease="2" />
		<title>The system must be checked weekly for unauthorized setgid files as well as unauthorized modification to authorized setgid files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_unauthorized_world_writable" ownerid="GEN002480" disa="366" severity="medium">
		<VMSinfo VKey="1010" SVKey="37645" VRelease="1" />
		<title>Public directories must be the only world-writable directories and world-writable files must be located only in public directories.</title>
	</overlay>
	<overlay owner="disastig" ruleid="dir_perms_world_writable_sticky_bits" ownerid="GEN002500" disa="366" severity="low">
		<VMSinfo VKey="806" SVKey="37647" VRelease="1" />
		<title>The sticky bit must be set on all public directories.</title>
	</overlay>
	<overlay owner="disastig" ruleid="dir_perms_world_writable_system_owned" ownerid="GEN002520" disa="225" severity="medium">
		<VMSinfo VKey="807" SVKey="37888" VRelease="1" />
		<title>All public directories must be owned by root or an application account.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002540" disa="225" severity="medium">
		<VMSinfo VKey="11990" SVKey="37893" VRelease="1" />
		<title>All public directories must be group-owned by root, sys, bin, or an application group.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_umask" ownerid="GEN002560" disa="366" severity="medium">
		<VMSinfo VKey="808" SVKey="37898" VRelease="2" />
		<title>The system and user default umask must be 077.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN002640" disa="178" severity="medium">
		<VMSinfo VKey="810" SVKey="37903" VRelease="1" />
		<title>Default system accounts must be disabled or removed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="GEN002660" disa="169" severity="medium">
		<VMSinfo VKey="811" SVKey="27270" VRelease="1" />
		<title>Auditing must be implemented.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_audit_log" ownerid="GEN002680" disa="162" severity="medium">
		<VMSinfo VKey="812" SVKey="37912" VRelease="1" />
		<title>System audit logs must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_audit_log" ownerid="GEN002690" disa="162" severity="medium">
		<VMSinfo VKey="22702" SVKey="37914" VRelease="1" />
		<title>System audit logs must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_audit_log" ownerid="GEN002700" disa="163" severity="medium">
		<VMSinfo VKey="813" SVKey="37916" VRelease="1" />
		<title>System audit logs must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_audit_log" ownerid="GEN002710" disa="163" severity="medium">
		<VMSinfo VKey="22369" SVKey="37917" VRelease="1" />
		<title>All system audit files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_audit_tools" ownerid="GEN002715" disa="1493" severity="low">
		<VMSinfo VKey="22370" SVKey="26504" VRelease="1" />
		<title>System audit tool executables must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_audit_tools" ownerid="GEN002716" disa="1493" severity="low">
		<VMSinfo VKey="22371" SVKey="26507" VRelease="1" />
		<title>System audit tool executables must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_audit_tools" ownerid="GEN002717" disa="1493" severity="low">
		<VMSinfo VKey="22372" SVKey="26510" VRelease="1" />
		<title>System audit tool executables must have mode 0750 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_audit_tools" ownerid="GEN002718" disa="1493" severity="low">
		<VMSinfo VKey="22373" SVKey="26513" VRelease="1" />
		<title>System audit tool executables must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="auditd_data_retention_audit_processing_failure" ownerid="GEN002719" disa="139" severity="low">
		<VMSinfo VKey="22374" SVKey="68095" VRelease="1" />
		<title>The audit system must alert the SA in the event of an audit processing failure.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_creat" ownerid="GEN002720" disa="126" severity="medium">
		<VMSinfo VKey="814" SVKey="38645" VRelease="1" />
		<title>The audit system must be configured to audit failed attempts to access files and programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_open" ownerid="GEN002720-2" disa="126" severity="medium">
		<VMSinfo VKey="29236" SVKey="37612" VRelease="2" />
		<title>The audit system must be configured to audit failed attempts to access files and programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_openat" ownerid="GEN002720-3" disa="126" severity="medium">
		<VMSinfo VKey="29237" SVKey="37614" VRelease="2" />
		<title>The audit system must be configured to audit failed attempts to access files and programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_truncate" ownerid="GEN002720-4" disa="126" severity="medium">
		<VMSinfo VKey="29238" SVKey="37654" VRelease="2" />
		<title>The audit system must be configured to audit failed attempts to access files and programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_ftruncate" ownerid="GEN002720-5" disa="126" severity="medium">
		<VMSinfo VKey="29239" SVKey="37655" VRelease="2" />
		<title>The audit system must be configured to audit failed attempts to access files and programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="auditd_data_retention_audit_storage_failure" ownerid="GEN002730" disa="143" severity="medium">
		<VMSinfo VKey="22375" SVKey="26518" VRelease="1" />
		<title>The audit system must alert the SA when the audit storage volume approaches its capacity.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_file_deletion_events" ownerid="GEN002740" disa="126" severity="medium">
		<VMSinfo VKey="815" SVKey="42185" VRelease="2" />
		<title>The audit system must be configured to audit files and programs deleted by the user.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_file_deletion_events_rmdir" ownerid="GEN002740-2" disa="126" severity="medium">
		<VMSinfo VKey="29240" SVKey="37656" VRelease="1" />
		<title>The audit system must be configured to audit file deletions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_usergroup_creation" ownerid="GEN002750" disa="18" severity="low">
		<VMSinfo VKey="22376" SVKey="26519" VRelease="1" />
		<title>The audit system must be configured to audit account creation.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_usergroup_modification" ownerid="GEN002751" disa="1403" severity="low">
		<VMSinfo VKey="22377" SVKey="26520" VRelease="1" />
		<title>The audit system must be configured to audit account modification.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_usergroup_disabling" ownerid="GEN002752" disa="1404" severity="low">
		<VMSinfo VKey="22378" SVKey="26521" VRelease="1" />
		<title>The audit system must be configured to audit account disabling.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_usergroup_termination" ownerid="GEN002753" disa="1405" severity="low">
		<VMSinfo VKey="22382" SVKey="26522" VRelease="1" />
		<title>The audit system must be configured to audit account termination.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_audit_rules" ownerid="GEN002760-2" disa="347" severity="medium">
		<VMSinfo VKey="29241" SVKey="48474" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="GEN002760-3" disa="347" severity="medium">
		<VMSinfo VKey="29242" SVKey="37658" VRelease="2" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_time_settimeofday" ownerid="GEN002760-4" disa="347" severity="medium">
		<VMSinfo VKey="29243" SVKey="37659" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_time_stime" ownerid="GEN002760-5" disa="347" severity="medium">
		<VMSinfo VKey="29244" SVKey="37660" VRelease="2" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_time_clock_settime" ownerid="GEN002760-6" disa="347" severity="medium">
		<VMSinfo VKey="29245" SVKey="37661" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_sethostname" ownerid="GEN002760-7" disa="347" severity="medium">
		<VMSinfo VKey="29246" SVKey="37662" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_setdomainname" ownerid="GEN002760-8" disa="347" severity="medium">
		<VMSinfo VKey="29247" SVKey="37663" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_sched_setparam" ownerid="GEN002760-9" disa="347" severity="medium">
		<VMSinfo VKey="29248" SVKey="37664" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_sched_setscheduler" ownerid="GEN002760-10" disa="347" severity="medium">
		<VMSinfo VKey="29249" SVKey="37665" VRelease="1" />
		<title>The audit system must be configured to audit all administrative, privileged, and security actions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_login_events" ownerid="GEN002800" disa="126" severity="medium">
		<VMSinfo VKey="818" SVKey="37944" VRelease="1" />
		<title>The audit system must be configured to audit login, logout, and session initiation.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_chmod" ownerid="GEN002820" disa="126" severity="medium">
		<VMSinfo VKey="819" SVKey="48488" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_fchmod" ownerid="GEN002820-2" disa="126" severity="medium">
		<VMSinfo VKey="29250" SVKey="37666" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_fchmodat" ownerid="GEN002820-3" disa="126" severity="medium">
		<VMSinfo VKey="29251" SVKey="37667" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_chown" ownerid="GEN002820-4" disa="126" severity="medium">
		<VMSinfo VKey="29252" SVKey="37668" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_fchown" ownerid="GEN002820-5" disa="126" severity="medium">
		<VMSinfo VKey="29253" SVKey="37669" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_fchownat" ownerid="GEN002820-6" disa="126" severity="medium">
		<VMSinfo VKey="29255" SVKey="37671" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_lchown" ownerid="GEN002820-7" disa="126" severity="medium">
		<VMSinfo VKey="29257" SVKey="37673" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_setxattr" ownerid="GEN002820-8" disa="126" severity="medium">
		<VMSinfo VKey="29259" SVKey="37677" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_lsetxattr" ownerid="GEN002820-9" disa="" severity="medium">
		<VMSinfo VKey="29261" SVKey="37681" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_fsetxattr" ownerid="GEN002820-10" disa="126" severity="medium">
		<VMSinfo VKey="29272" SVKey="37716" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_removexattr" ownerid="GEN002820-11" disa="126" severity="medium">
		<VMSinfo VKey="29274" SVKey="37718" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_lremovexattr" ownerid="GEN002820-12" disa="126" severity="medium">
		<VMSinfo VKey="29275" SVKey="37719" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_dac_modification_fremovexattr" ownerid="GEN002820-13" disa="126" severity="medium">
		<VMSinfo VKey="29279" SVKey="37726" VRelease="1" />
		<title>The audit system must be configured to audit all discretionary access control permission modifications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_kernel_module_loading" ownerid="GEN002825" disa="126" severity="medium">
		<VMSinfo VKey="22383" SVKey="38652" VRelease="1" />
		<title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_kernel_module_loading" ownerid="GEN002825-2" disa="126" severity="medium">
		<VMSinfo VKey="29281" SVKey="37728" VRelease="1" />
		<title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - delete_module.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_kernel_module_loading" ownerid="GEN002825-3" disa="126" severity="medium">
		<VMSinfo VKey="29284" SVKey="37734" VRelease="2" />
		<title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/insmod.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_kernel_module_loading" ownerid="GEN002825-4" disa="126" severity="medium">
		<VMSinfo VKey="29286" SVKey="37738" VRelease="2" />
		<title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules -/sbin/modprobe.</title>
	</overlay>
	<overlay owner="disastig" ruleid="audit_rules_kernel_module_loading" ownerid="GEN002825-5" disa="126" severity="medium">
		<VMSinfo VKey="29288" SVKey="37741" VRelease="2" />
		<title>The audit system must be configured to audit the loading and unloading of dynamic kernel modules - /sbin/rmmod</title>
	</overlay>
	<overlay owner="disastig" ruleid="logrotate_rotate_all_files" ownerid="GEN002860" disa="366" severity="medium">
		<VMSinfo VKey="4357" SVKey="37945" VRelease="1" />
		<title>Audit logs must be rotated daily.</title>
	</overlay>
	<overlay owner="disastig" ruleid="auditd_audispd_syslog_plugin_activated" ownerid="GEN002870" disa="136" severity="low">
		<VMSinfo VKey="24357" SVKey="37948" VRelease="2" />
		<title>The system must be configured to send audit records to a remote audit server.</title>
	</overlay>
	<overlay owner="disastig" ruleid="cron_access_controlled" ownerid="GEN002960" disa="225" severity="medium">
		<VMSinfo VKey="974" SVKey="27320" VRelease="2" />
		<title>Access to the cron utility must be controlled using the cron.allow and/or cron.deny file(s).</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_cron_allow" ownerid="GEN002980" disa="225" severity="medium">
		<VMSinfo VKey="975" SVKey="27326" VRelease="1" />
		<title>The cron.allow file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_cron_allow" ownerid="GEN002990" disa="225" severity="medium">
		<VMSinfo VKey="22384" SVKey="37382" VRelease="1" />
		<title>The cron.allow file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003000" disa="225" severity="medium">
		<VMSinfo VKey="976" SVKey="37384" VRelease="1" />
		<title>Cron must not execute group-writable or world-writable programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003020" disa="225" severity="medium">
		<VMSinfo VKey="977" SVKey="37388" VRelease="1" />
		<title>Cron must not execute programs in, or subordinate to, world-writable directories.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_crontab_files" ownerid="GEN003040" disa="225" severity="medium">
		<VMSinfo VKey="11994" SVKey="37392" VRelease="1" />
		<title>Crontabs must be owned by root or the crontab creator.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_crontab_files" ownerid="GEN003050" disa="225" severity="medium">
		<VMSinfo VKey="22385" SVKey="37400" VRelease="1" />
		<title>Crontab files must be group-owned by root, cron, or the crontab creator's primary group.</title>
	</overlay>
	<overlay owner="disastig" ruleid="cron_system_accounts" ownerid="GEN003060" disa="225" severity="medium">
		<VMSinfo VKey="11995" SVKey="27338" VRelease="1" />
		<title>Default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_crontab_files" ownerid="GEN003080" disa="225" severity="medium">
		<VMSinfo VKey="978" SVKey="37466" VRelease="1" />
		<title>Crontab files must have mode 0600 or less permissive, and files in cron script directories must have mode 0700 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_cron_files" ownerid="GEN003080-2" disa="225" severity="medium">
		<VMSinfo VKey="29289" SVKey="37745" VRelease="1" />
		<title>Files in cron script directories must have mode 0700 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_crontab_files" ownerid="GEN003090" disa="225" severity="medium">
		<VMSinfo VKey="22386" SVKey="37467" VRelease="1" />
		<title>Crontab files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_crontab_dirs" ownerid="GEN003100" disa="225" severity="medium">
		<VMSinfo VKey="979" SVKey="37470" VRelease="1" />
		<title>Cron and crontab directories must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_crontab_dirs" ownerid="GEN003110" disa="225" severity="medium">
		<VMSinfo VKey="22387" SVKey="37471" VRelease="1" />
		<title>Cron and crontab directories must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_crontab_dirs" ownerid="GEN003120" disa="225" severity="medium">
		<VMSinfo VKey="980" SVKey="37474" VRelease="1" />
		<title>Cron and crontab directories must be owned by root or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_crontab_dirs" ownerid="GEN003140" disa="225" severity="medium">
		<VMSinfo VKey="981" SVKey="37476" VRelease="1" />
		<title>Cron and crontab directories must be group-owned by root, sys, bin or cron.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003160" disa="126" severity="medium">
		<VMSinfo VKey="982" SVKey="27352" VRelease="1" />
		<title>Cron logging must be implemented.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_cron_log_files" ownerid="GEN003180" disa="225" severity="medium">
		<VMSinfo VKey="983" SVKey="27357" VRelease="1" />
		<title>The cronlog file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_cron_log_files" ownerid="GEN003190" disa="225" severity="medium">
		<VMSinfo VKey="22388" SVKey="37477" VRelease="1" />
		<title>The cron log files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_cron_deny" ownerid="GEN003200" disa="225" severity="medium">
		<VMSinfo VKey="4358" SVKey="27362" VRelease="1" />
		<title>The cron.deny file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_cron_deny" ownerid="GEN003210" disa="225" severity="medium">
		<VMSinfo VKey="22389" SVKey="37486" VRelease="1" />
		<title>The cron.deny file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003220" disa="225" severity="low">
		<VMSinfo VKey="4360" SVKey="37489" VRelease="1" />
		<title>Cron programs must not set the umask to a value less restrictive than 077.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_cron_allow" ownerid="GEN003240" disa="225" severity="medium">
		<VMSinfo VKey="4361" SVKey="27369" VRelease="1" />
		<title>The cron.allow file must be owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_at_allow" ownerid="GEN003245" disa="225" severity="medium">
		<VMSinfo VKey="22390" SVKey="37495" VRelease="1" />
		<title>The at.allow file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_cron_allow" ownerid="GEN003250" disa="225" severity="medium">
		<VMSinfo VKey="22391" SVKey="37499" VRelease="1" />
		<title>The cron.allow file must be group-owned by root, bin, sys, or cron.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_at_deny" ownerid="GEN003252" disa="225" severity="medium">
		<VMSinfo VKey="22392" SVKey="26555" VRelease="1" />
		<title>The at.deny file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_at_deny" ownerid="GEN003255" disa="225" severity="medium">
		<VMSinfo VKey="22393" SVKey="26558" VRelease="1" />
		<title>The at.deny file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_cron_deny" ownerid="GEN003260" disa="225" severity="medium">
		<VMSinfo VKey="4430" SVKey="27374" VRelease="1" />
		<title>The cron.deny file must be owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_cron_deny" ownerid="GEN003270" disa="225" severity="medium">
		<VMSinfo VKey="22394" SVKey="26562" VRelease="2" />
		<title>The cron.deny file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="at_access_controlled" ownerid="GEN003280" disa="225" severity="medium">
		<VMSinfo VKey="984" SVKey="37512" VRelease="2" />
		<title>Access to the "at" utility must be controlled via the at.allow and/or at.deny file(s).</title>
	</overlay>
	<overlay owner="disastig" ruleid="at_deny_nonempty" ownerid="GEN003300" disa="225" severity="medium">
		<VMSinfo VKey="985" SVKey="37516" VRelease="1" />
		<title>The at.deny file must not be empty if it exists.</title>
	</overlay>
	<overlay owner="disastig" ruleid="at_system_accounts" ownerid="GEN003320" disa="225" severity="medium">
		<VMSinfo VKey="986" SVKey="37517" VRelease="1" />
		<title>Default system accounts (with the exception of root) must not be listed in the at.allow file or must be included in the at.deny file if the at.allow file does not exist.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_at_allow" ownerid="GEN003340" disa="225" severity="medium">
		<VMSinfo VKey="987" SVKey="37518" VRelease="1" />
		<title>The at.allow file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003360" disa="225" severity="medium">
		<VMSinfo VKey="988" SVKey="37519" VRelease="1" />
		<title>The "at" daemon must not execute group-writable or world-writable programs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003380" disa="225" severity="medium">
		<VMSinfo VKey="989" SVKey="37520" VRelease="1" />
		<title>The "at" daemon must not execute programs in, or subordinate to, world-writable directories.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_var_spool_at" ownerid="GEN003400" disa="225" severity="medium">
		<VMSinfo VKey="4364" SVKey="37521" VRelease="1" />
		<title>The "at" directory must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_var_spool_at" ownerid="GEN003410" disa="225" severity="medium">
		<VMSinfo VKey="22395" SVKey="37523" VRelease="1" />
		<title>The "at" directory must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_var_spool_at" ownerid="GEN003420" disa="225" severity="medium">
		<VMSinfo VKey="4365" SVKey="37527" VRelease="2" />
		<title>The at directory must be owned by root, bin, sys, daemon, or cron.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_var_spool_at" ownerid="GEN003430" disa="225" severity="medium">
		<VMSinfo VKey="22396" SVKey="37529" VRelease="1" />
		<title>The "at" directory must be group-owned by root, bin, sys, or cron.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003440" disa="225" severity="medium">
		<VMSinfo VKey="4366" SVKey="37531" VRelease="1" />
		<title>"At" jobs must not set the umask to a value less restrictive than 077.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_at_allow" ownerid="GEN003460" disa="225" severity="medium">
		<VMSinfo VKey="4367" SVKey="37533" VRelease="1" />
		<title>The at.allow file must be owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_at_allow" ownerid="GEN003470" disa="225" severity="medium">
		<VMSinfo VKey="22397" SVKey="26569" VRelease="1" />
		<title>The at.allow file must be group-owned by root, bin, sys, or cron.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_at_deny" ownerid="GEN003480" disa="225" severity="medium">
		<VMSinfo VKey="4368" SVKey="37535" VRelease="1" />
		<title>The at.deny file must be owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_at_deny" ownerid="GEN003490" disa="225" severity="medium">
		<VMSinfo VKey="22398" SVKey="26572" VRelease="1" />
		<title>The at.deny file must be group-owned by root, bin, sys, or cron.</title>
	</overlay>
	<overlay owner="disastig" ruleid="disable_users_coredumps" ownerid="GEN003500" disa="366" severity="low">
		<VMSinfo VKey="11996" SVKey="37546" VRelease="1" />
		<title>Process core dumps must be disabled unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_kdump_disabled" ownerid="GEN003510" disa="366" severity="medium">
		<VMSinfo VKey="22404" SVKey="26604" VRelease="1" />
		<title>Kernel core dumps must be disabled unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_core_dump_dir" ownerid="GEN003520" disa="225" severity="low">
		<VMSinfo VKey="11997" SVKey="37570" VRelease="1" />
		<title>The kernel core dump data directory must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_core_dump_dir" ownerid="GEN003521" disa="225" severity="low">
		<VMSinfo VKey="22405" SVKey="26608" VRelease="1" />
		<title>The kernel core dump data directory must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_core_dump_dir" ownerid="GEN003522" disa="225" severity="low">
		<VMSinfo VKey="22406" SVKey="26612" VRelease="1" />
		<title>The kernel core dump data directory must have mode 0700 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_core_dump_dir" ownerid="GEN003523" disa="225" severity="low">
		<VMSinfo VKey="22407" SVKey="26616" VRelease="1" />
		<title>The kernel core dump data directory must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_kernel_nonexec_stack" ownerid="GEN003540" disa="366" severity="medium">
		<VMSinfo VKey="11999" SVKey="27414" VRelease="1" />
		<title>The system must implement non-executable program stacks.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003581" disa="225" severity="medium">
		<VMSinfo VKey="22408" SVKey="26620" VRelease="1" />
		<title>Network interfaces must not be configured to allow user control.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003600" disa="1551" severity="medium">
		<VMSinfo VKey="12002" SVKey="29795" VRelease="1" />
		<title>The system must not forward IPv4 source-routed packets.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_tcp_max_syn_backlog" ownerid="GEN003601" disa="" severity="medium">
		<VMSinfo VKey="23741" SVKey="37594" VRelease="1" />
		<title>TCP backlog queue sizes must be set appropriately.</title>
	</overlay>
	<overlay owner="disastig" ruleid="iptables_timestamp_reject_rule" ownerid="GEN003602" disa="1551" severity="low">
		<VMSinfo VKey="22409" SVKey="37601" VRelease="1" />
		<title>The system must not process Internet Control Message Protocol (ICMP)  timestamp requests.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" ownerid="GEN003603" disa="1551" severity="medium">
		<VMSinfo VKey="22410" SVKey="37608" VRelease="1" />
		<title>The system must not respond to Internet Control Message Protocol v4 (ICMPv4) echoes sent to a broadcast address.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003604" disa="1551" severity="medium">
		<VMSinfo VKey="22411" SVKey="29288" VRelease="1" />
		<title>The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_accept_source_route" ownerid="GEN003607" disa="1551" severity="medium">
		<VMSinfo VKey="22414" SVKey="37622" VRelease="1" />
		<title>The system must not accept source-routed IPv4 packets.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003608" disa="1551" severity="medium">
		<VMSinfo VKey="22415" SVKey="37624" VRelease="1" />
		<title>Proxy Address Resolution Protocol (Proxy ARP) must not be enabled on the system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_accept_redirects" ownerid="GEN003609" disa="1503" severity="medium">
		<VMSinfo VKey="22416" SVKey="37626" VRelease="1" />
		<title>The system must ignore IPv4 Internet Control Message Protocol (ICMP) redirect messages.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_send_redirects" ownerid="GEN003610" disa="1551" severity="medium">
		<VMSinfo VKey="22417" SVKey="37629" VRelease="1" />
		<title>The system must not send IPv4 Internet Control Message Protocol (ICMP) redirects.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_log_martians" ownerid="GEN003611" disa="126" severity="low">
		<VMSinfo VKey="22418" SVKey="37630" VRelease="1" />
		<title>The system must log martian packets.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_tcp_syncookies" ownerid="GEN003612" disa="1092" severity="medium">
		<VMSinfo VKey="22419" SVKey="37633" VRelease="1" />
		<title>The system must be configured to use TCP syncookies when experiencing a TCP SYN flood.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_bridge_disabled" ownerid="GEN003619" disa="1551" severity="medium">
		<VMSinfo VKey="22421" SVKey="37639" VRelease="1" />
		<title>The system must not be configured for network bridging.</title>
	</overlay>
	<overlay owner="disastig" ruleid="partition_for_home" ownerid="GEN003620" disa="1208" severity="low">
		<VMSinfo VKey="12003" SVKey="37640" VRelease="1" />
		<title>A separate file system must be used for user home directories (such as /home or an equivalent).</title>
	</overlay>
	<overlay owner="disastig" ruleid="partition_for_var" ownerid="GEN003621" disa="1208" severity="low">
		<VMSinfo VKey="23736" SVKey="37641" VRelease="1" />
		<title>The system must use a separate file system for /var.</title>
	</overlay>
	<overlay owner="disastig" ruleid="partition_for_var_log_audit" ownerid="GEN003623" disa="1208" severity="low">
		<VMSinfo VKey="23738" SVKey="37642" VRelease="1" />
		<title>The system must use a separate file system for the system audit data path.</title>
	</overlay>
	<overlay owner="disastig" ruleid="partition_for_tmp" ownerid="GEN003624" disa="1208" severity="low">
		<VMSinfo VKey="23739" SVKey="37395" VRelease="1" />
		<title>The system must use a separate file system for /tmp (or equivalent).</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003640" disa="553" severity="medium">
		<VMSinfo VKey="4304" SVKey="37398" VRelease="1" />
		<title>The root file system must employ journaling or another mechanism ensuring file system consistency.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003650" disa="553" severity="low">
		<VMSinfo VKey="22422" SVKey="37401" VRelease="1" />
		<title>All local file systems must employ journaling or another mechanism ensuring file system consistency.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003660" disa="126" severity="medium">
		<VMSinfo VKey="12004" SVKey="37404" VRelease="1" />
		<title>The system must log informational authentication data.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_xinetd_disabled" ownerid="GEN003700" disa="305" severity="medium">
		<VMSinfo VKey="12005" SVKey="27424" VRelease="1" />
		<title>Inetd and xinetd must be disabled or removed if no network services utilizing them are enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_xinetd_conf" ownerid="GEN003720" disa="225" severity="medium">
		<VMSinfo VKey="821" SVKey="37406" VRelease="1" />
		<title>The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be owned by root or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_xinetd_conf" ownerid="GEN003730" disa="225" severity="medium">
		<VMSinfo VKey="22423" SVKey="37407" VRelease="1" />
		<title>The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_xinetd_conf" ownerid="GEN003740" disa="225" severity="medium">
		<VMSinfo VKey="822" SVKey="37408" VRelease="2" />
		<title>The xinetd configuration files must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_xinetd_conf" ownerid="GEN003745" disa="225" severity="medium">
		<VMSinfo VKey="22424" SVKey="37409" VRelease="1" />
		<title>The inetd.conf and xinetd.conf files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_xinetd_dir" ownerid="GEN003750" disa="225" severity="medium">
		<VMSinfo VKey="22425" SVKey="37410" VRelease="1" />
		<title>The xinetd.d directory must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_xinetd_dir" ownerid="GEN003755" disa="225" severity="medium">
		<VMSinfo VKey="22426" SVKey="37411" VRelease="1" />
		<title>The xinetd.d directory must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_services" ownerid="GEN003760" disa="225" severity="medium">
		<VMSinfo VKey="823" SVKey="37424" VRelease="1" />
		<title>The services file must be owned by root or bin.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_services" ownerid="GEN003770" disa="225" severity="medium">
		<VMSinfo VKey="22427" SVKey="37425" VRelease="1" />
		<title>The services file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_services" ownerid="GEN003780" disa="225" severity="medium">
		<VMSinfo VKey="824" SVKey="37426" VRelease="1" />
		<title>The services file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_services" ownerid="GEN003790" disa="225" severity="medium">
		<VMSinfo VKey="22428" SVKey="37438" VRelease="1" />
		<title>The services file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003800" disa="134" severity="low">
		<VMSinfo VKey="1011" SVKey="37439" VRelease="1" />
		<title>Inetd or xinetd logging/tracing must be enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_rpc_disabled" ownerid="GEN003810" disa="1436" severity="medium">
		<VMSinfo VKey="22429" SVKey="26662" VRelease="1" />
		<title>The portmap or rpcbind service must not be running unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_rpc_removed" ownerid="GEN003815" disa="305" severity="medium">
		<VMSinfo VKey="22430" SVKey="26666" VRelease="1" />
		<title>The portmap or rpcbind service must not be installed unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_rsh_disabled" ownerid="GEN003820" disa="68" severity="high">
		<VMSinfo VKey="4687" SVKey="37441" VRelease="1" />
		<title>The rsh daemon must not be running.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_rsh-server_removed" ownerid="GEN003825" disa="305" severity="medium">
		<VMSinfo VKey="22431" SVKey="26667" VRelease="1" />
		<title>The rshd service must not be installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_rlogin_disabled" ownerid="GEN003830" disa="68" severity="medium">
		<VMSinfo VKey="22432" SVKey="26671" VRelease="1" />
		<title>The rlogind service must not be running.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_rsh-server_removed" ownerid="GEN003835" disa="305" severity="medium">
		<VMSinfo VKey="22433" SVKey="26669" VRelease="1" />
		<title>The rlogind service must not be installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_rexec_disabled" ownerid="GEN003840" disa="1435" severity="high">
		<VMSinfo VKey="4688" SVKey="37443" VRelease="1" />
		<title>The rexec daemon must not be running.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_rsh-server_removed" ownerid="GEN003845" disa="305" severity="medium">
		<VMSinfo VKey="22434" SVKey="26673" VRelease="1" />
		<title>The rexecd service must not be installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_telnetd_disabled" ownerid="GEN003850" disa="197" severity="high">
		<VMSinfo VKey="24386" SVKey="37444" VRelease="1" />
		<title>The telnet daemon must not be running.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003860" disa="1551" severity="low">
		<VMSinfo VKey="4701" SVKey="37445" VRelease="1" />
		<title>The system must not have the finger service active.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003865" disa="305" severity="medium">
		<VMSinfo VKey="12049" SVKey="37446" VRelease="1" />
		<title>Network analysis tools must not be installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN003900" disa="366" severity="medium">
		<VMSinfo VKey="827" SVKey="37447" VRelease="1" />
		<title>The hosts.lpd file (or equivalent) must not contain a ‘+’ character.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_cups_printers_conf" ownerid="GEN003920" disa="225" severity="medium">
		<VMSinfo VKey="828" SVKey="37448" VRelease="1" />
		<title>The hosts.lpd (or equivalent) file must be owned by root, bin, sys, or lp.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_cups_printers_conf" ownerid="GEN003930" disa="225" severity="medium">
		<VMSinfo VKey="22435" SVKey="37449" VRelease="1" />
		<title>The hosts.lpd (or equivalent) file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_cups_printers_conf" ownerid="GEN003940" disa="225" severity="medium">
		<VMSinfo VKey="829" SVKey="37461" VRelease="1" />
		<title>The hosts.lpd (or equivalent) must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_cups_printers_conf" ownerid="GEN003950" disa="225" severity="medium">
		<VMSinfo VKey="22436" SVKey="37462" VRelease="1" />
		<title>The hosts.lpd (or equivalent) file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_bin_traceroute" ownerid="GEN003960" disa="225" severity="medium">
		<VMSinfo VKey="4369" SVKey="37463" VRelease="1" />
		<title>The traceroute command owner must be root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_bin_traceroute" ownerid="GEN003980" disa="225" severity="medium">
		<VMSinfo VKey="4370" SVKey="37464" VRelease="1" />
		<title>The traceroute command must be group-owned by sys, bin, root, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_bin_traceroute" ownerid="GEN004000" disa="225" severity="medium">
		<VMSinfo VKey="4371" SVKey="37465" VRelease="1" />
		<title>The traceroute file must have mode 0700 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_bin_traceroute" ownerid="GEN004010" disa="225" severity="medium">
		<VMSinfo VKey="22437" SVKey="37468" VRelease="1" />
		<title>The traceroute file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="no_root_webbrowsing" ownerid="GEN004220" disa="225" severity="high">
		<VMSinfo VKey="4382" SVKey="37469" VRelease="1" />
		<title>Administrative accounts must not run a web browser, except as needed for local service administration.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_aliases_files" ownerid="GEN004360" disa="225" severity="medium">
		<VMSinfo VKey="831" SVKey="37472" VRelease="2" />
		<title>The alias file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_aliases_files" ownerid="GEN004370" disa="225" severity="medium">
		<VMSinfo VKey="22438" SVKey="37473" VRelease="2" />
		<title>The aliases file must be group-owned by root, sys, bin, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_aliases_files" ownerid="GEN004380" disa="225" severity="medium">
		<VMSinfo VKey="832" SVKey="37475" VRelease="2" />
		<title>The alias file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_aliases_files" ownerid="GEN004390" disa="225" severity="medium">
		<VMSinfo VKey="22439" SVKey="37488" VRelease="2" />
		<title>The alias file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_aliases" ownerid="GEN004400" disa="225" severity="high">
		<VMSinfo VKey="833" SVKey="37491" VRelease="1" />
		<title>Files executed through a mail aliases file must be owned by root and must reside within a directory owned and writable only by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_aliases" ownerid="GEN004410" disa="225" severity="medium">
		<VMSinfo VKey="22440" SVKey="37493" VRelease="1" />
		<title>Files executed through a mail aliases file must be group-owned by root, bin, sys, or system, and must reside within a directory group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_aliases" ownerid="GEN004420" disa="225" severity="medium">
		<VMSinfo VKey="834" SVKey="37494" VRelease="2" />
		<title>Files executed through a mail aliases file must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_aliases" ownerid="GEN004430" disa="225" severity="medium">
		<VMSinfo VKey="22441" SVKey="37496" VRelease="1" />
		<title>Files executed through a mail aliases file must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_log_level" ownerid="GEN004440" disa="366" severity="low">
		<VMSinfo VKey="835" SVKey="37497" VRelease="2" />
		<title>Sendmail logging must not be set to less than nine in the sendmail.cf file.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_log_enabled" ownerid="GEN004460" disa="126" severity="medium">
		<VMSinfo VKey="836" SVKey="37500" VRelease="2" />
		<title>The system syslog service must log informational and more severe SMTP service messages.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_smtp_logs" ownerid="GEN004480" disa="225" severity="medium">
		<VMSinfo VKey="837" SVKey="37501" VRelease="1" />
		<title>The SMTP service log file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_smtp_logs" ownerid="GEN004500" disa="225" severity="medium">
		<VMSinfo VKey="838" SVKey="37502" VRelease="1" />
		<title>The SMTP service log file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_smtp_logs" ownerid="GEN004510" disa="225" severity="medium">
		<VMSinfo VKey="22442" SVKey="37503" VRelease="1" />
		<title>The SMTP service log file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_help_command" ownerid="GEN004540" disa="366" severity="medium">
		<VMSinfo VKey="12006" SVKey="37504" VRelease="3" />
		<title>The SMTP service HELP command must not be enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_version_info" ownerid="GEN004560" disa="366" severity="low">
		<VMSinfo VKey="4384" SVKey="37505" VRelease="1" />
		<title>The SMTP service's SMTP greeting must not provide version information.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_forward_files" ownerid="GEN004580" disa="366" severity="medium">
		<VMSinfo VKey="4385" SVKey="37506" VRelease="2" />
		<title>The system must not use .forward files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_up_to_date" ownerid="GEN004600" disa="1230" severity="high">
		<VMSinfo VKey="4689" SVKey="37507" VRelease="2" />
		<title>The SMTP service must be an up-to-date version.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_debug_enabled" ownerid="GEN004620" disa="366" severity="high">
		<VMSinfo VKey="4690" SVKey="37508" VRelease="1" />
		<title>The sendmail server must have the debug feature disabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_decode_active" ownerid="GEN004640" disa="1230" severity="high">
		<VMSinfo VKey="4691" SVKey="37509" VRelease="1" />
		<title>The SMTP service must not have a uudecode alias active.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_expn_active" ownerid="GEN004660" disa="366" severity="low">
		<VMSinfo VKey="4692" SVKey="37510" VRelease="1" />
		<title>The SMTP service must not have the EXPN feature active.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_vrfy_active" ownerid="GEN004680" disa="366" severity="low">
		<VMSinfo VKey="4693" SVKey="37511" VRelease="1" />
		<title>The SMTP service must not have the Verify (VRFY) feature active.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_wiz_active" ownerid="GEN004700" disa="366" severity="low">
		<VMSinfo VKey="4694" SVKey="37513" VRelease="1" />
		<title>The sendmail service must not have the wizard backdoor active.</title>
	</overlay>
	<overlay owner="disastig" ruleid="mail_relaying_disabled" ownerid="GEN004710" disa="1305" severity="medium">
		<VMSinfo VKey="23952" SVKey="37514" VRelease="2" />
		<title>Mail relaying must be restricted.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_unencrypted_ftp_disabled" ownerid="GEN004800" disa="366" severity="medium">
		<VMSinfo VKey="12010" SVKey="37515" VRelease="1" />
		<title>Unencrypted FTP must not be used on the system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN004820" disa="1475" severity="medium">
		<VMSinfo VKey="846" SVKey="37526" VRelease="1" />
		<title>Anonymous FTP must not be active on the system unless authorized.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN004840" disa="787" severity="medium">
		<VMSinfo VKey="4702" SVKey="37528" VRelease="1" />
		<title>If the system is an anonymous FTP server, it must be isolated to the DMZ network.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ftp_ftpusers_file_exists" ownerid="GEN004880" disa="225" severity="medium">
		<VMSinfo VKey="840" SVKey="51983" VRelease="1" />
		<title>The ftpusers file must exist.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ftp_ftpusers_file_empty" ownerid="GEN004900" disa="225" severity="medium">
		<VMSinfo VKey="841" SVKey="52091" VRelease="1" />
		<title>The ftpusers file must contain account names not allowed to use FTP.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_ftpusers" ownerid="GEN004920" disa="225" severity="medium">
		<VMSinfo VKey="842" SVKey="37537" VRelease="1" />
		<title>The ftpusers file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_ftpusers" ownerid="GEN004930" disa="225" severity="medium">
		<VMSinfo VKey="22444" SVKey="37538" VRelease="1" />
		<title>The ftpusers file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ftpusers" ownerid="GEN004940" disa="225" severity="medium">
		<VMSinfo VKey="843" SVKey="37542" VRelease="1" />
		<title>The ftpusers file must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_ftpusers" ownerid="GEN004950" disa="225" severity="medium">
		<VMSinfo VKey="22445" SVKey="37544" VRelease="1" />
		<title>The ftpusers file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ftp_log_transactions" ownerid="GEN004980" disa="130" severity="low">
		<VMSinfo VKey="845" SVKey="37547" VRelease="1" />
		<title>The FTP daemon must be configured for logging or verbose mode.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ftp_anonymous_shell" ownerid="GEN005000" disa="225" severity="high">
		<VMSinfo VKey="4387" SVKey="37549" VRelease="1" />
		<title>Anonymous FTP accounts must not have a functional shell.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ftp_default_umask" ownerid="GEN005040" disa="225" severity="medium">
		<VMSinfo VKey="12011" SVKey="37555" VRelease="1" />
		<title>All FTP users must have a default umask of 077.</title>
	</overlay>
	<overlay owner="disastig" ruleid="tftpd_uses_secure_mode" ownerid="GEN005080" disa="366" severity="high">
		<VMSinfo VKey="847" SVKey="37560" VRelease="1" />
		<title>The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_tftp_binary" ownerid="GEN005100" disa="225" severity="high">
		<VMSinfo VKey="848" SVKey="37564" VRelease="1" />
		<title>The TFTP daemon must have mode 0755 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="tftpd_user_shell" ownerid="GEN005120" disa="225" severity="medium">
		<VMSinfo VKey="849" SVKey="37674" VRelease="1" />
		<title>The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_tftp_disabled" ownerid="GEN005140" disa="225" severity="high">
		<VMSinfo VKey="4695" SVKey="37676" VRelease="1" />
		<title>Any active TFTP daemon must be authorized and approved in the system accreditation package.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005160" disa="297" severity="medium">
		<VMSinfo VKey="850" SVKey="37678" VRelease="1" />
		<title>Any X Windows host must write .Xauthority files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_xauthority_files" ownerid="GEN005180" disa="225" severity="medium">
		<VMSinfo VKey="12014" SVKey="37679" VRelease="1" />
		<title>All .Xauthority files must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_xauthority_files" ownerid="GEN005190" disa="225" severity="medium">
		<VMSinfo VKey="22446" SVKey="37682" VRelease="1" />
		<title>The .Xauthority files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005200" disa="225" severity="high">
		<VMSinfo VKey="4697" SVKey="37683" VRelease="1" />
		<title>X displays must not be exported to the world.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005220" disa="297" severity="medium">
		<VMSinfo VKey="12016" SVKey="37684" VRelease="1" />
		<title>.Xauthority or X*.hosts (or equivalent) file(s) must be used to restrict access to the X server.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005240" disa="225" severity="medium">
		<VMSinfo VKey="12017" SVKey="37685" VRelease="1" />
		<title>The .Xauthority utility must only permit access to authorized hosts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="xwindows_runlevel_setting" ownerid="GEN005260" disa="1436" severity="medium">
		<VMSinfo VKey="12018" SVKey="37686" VRelease="1" />
		<title>X Window System connections not required must be disabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005280" disa="1436" severity="medium">
		<VMSinfo VKey="4696" SVKey="37688" VRelease="1" />
		<title>The system must not have the UUCP service active.</title>
	</overlay>
	<overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="GEN005300" disa="178" severity="high">
		<VMSinfo VKey="993" SVKey="37689" VRelease="1" />
		<title>SNMP communities, users, and passphrases must be changed from the default.</title>
	</overlay>
	<overlay owner="disastig" ruleid="snmpd_use_newer_protocol" ownerid="GEN005305" disa="1435" severity="medium">
		<VMSinfo VKey="22447" SVKey="37692" VRelease="1" />
		<title>The SNMP service must use only SNMPv3 or its successors.</title>
	</overlay>
	<overlay owner="disastig" ruleid="snmpd_use_approved_hash" ownerid="GEN005306" disa="1453" severity="medium">
		<VMSinfo VKey="22448" SVKey="37693" VRelease="1" />
		<title>The SNMP service must require the use of a FIPS 140-2 approved cryptographic hash algorithm as part of its authentication and integrity methods.</title>
	</overlay>
	<overlay owner="disastig" ruleid="snmpd_use_approved_encryption" ownerid="GEN005307" disa="68" severity="medium">
		<VMSinfo VKey="22449" SVKey="37695" VRelease="1" />
		<title>The SNMP service must require the use of a FIPS 140-2 approved encryption algorithm for protecting the privacy of SNMP messages.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_snmpd_conf" ownerid="GEN005320" disa="225" severity="medium">
		<VMSinfo VKey="994" SVKey="37696" VRelease="1" />
		<title>The snmpd.conf file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_mib_files" ownerid="GEN005340" disa="225" severity="medium">
		<VMSinfo VKey="995" SVKey="37698" VRelease="1" />
		<title>Management Information Base (MIB) files must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_mib_files" ownerid="GEN005350" disa="225" severity="medium">
		<VMSinfo VKey="22450" SVKey="37700" VRelease="1" />
		<title>Management Information Base (MIB) files must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_snmpd_conf" ownerid="GEN005360" disa="225" severity="medium">
		<VMSinfo VKey="12019" SVKey="37703" VRelease="1" />
		<title>The snmpd.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_snmpd_conf" ownerid="GEN005365" disa="225" severity="medium">
		<VMSinfo VKey="22451" SVKey="37704" VRelease="1" />
		<title>The snmpd.conf file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_snmpd_conf" ownerid="GEN005375" disa="225" severity="medium">
		<VMSinfo VKey="22452" SVKey="37706" VRelease="1" />
		<title>The snmpd.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005380" disa="1208" severity="medium">
		<VMSinfo VKey="4392" SVKey="37708" VRelease="1" />
		<title>If the system is a Network Management System (NMS) server, it must only run the NMS and any software required by the NMS.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_syslog_conf" ownerid="GEN005390" disa="225" severity="medium">
		<VMSinfo VKey="22453" SVKey="37709" VRelease="1" />
		<title>The /etc/syslog.conf file must have mode 0640 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_syslog_conf" ownerid="GEN005395" disa="225" severity="medium">
		<VMSinfo VKey="22454" SVKey="37710" VRelease="1" />
		<title>The /etc/syslog.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_syslog_conf" ownerid="GEN005400" disa="225" severity="medium">
		<VMSinfo VKey="4393" SVKey="37707" VRelease="1" />
		<title>The /etc/syslog.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_syslog_conf" ownerid="GEN005420" disa="225" severity="medium">
		<VMSinfo VKey="4394" SVKey="37711" VRelease="1" />
		<title>The /etc/syslog.conf file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005440" disa="366" severity="medium">
		<VMSinfo VKey="12020" SVKey="37810" VRelease="1" />
		<title>The system must not be used as a syslog server (loghost) for systems external to the enclave.</title>
	</overlay>
	<overlay owner="disastig" ruleid="syslog_remote_loghost" ownerid="GEN005450" disa="136" severity="medium">
		<VMSinfo VKey="22455" SVKey="37811" VRelease="1" />
		<title>The system must use a remote syslog server (loghost).</title>
	</overlay>
	<overlay owner="disastig" ruleid="syslog_remote_loghost" ownerid="GEN005460" disa="366" severity="medium">
		<VMSinfo VKey="4395" SVKey="37812" VRelease="1" />
		<title>The system must only use remote syslog servers (log hosts) that is justified and documented using site-defined procedures.</title>
	</overlay>
	<overlay owner="disastig" ruleid="syslog_nolisten" ownerid="GEN005480" disa="366" severity="medium">
		<VMSinfo VKey="12021" SVKey="37813" VRelease="1" />
		<title>The syslog daemon must not accept remote messages unless it is a syslog server documented using site-defined procedures.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_protocol_2" ownerid="GEN005500" disa="1436" severity="high">
		<VMSinfo VKey="4295" SVKey="37818" VRelease="2" />
		<title>The SSH daemon must be configured to only use the SSHv2 protocol.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ssh_protocol_2" ownerid="GEN005501" disa="1436" severity="medium">
		<VMSinfo VKey="22456" SVKey="37820" VRelease="1" />
		<title>The SSH client must be configured to only use the SSHv2 protocol.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_listen_addresses" ownerid="GEN005504" disa="69" severity="medium">
		<VMSinfo VKey="22457" SVKey="37823" VRelease="2" />
		<title>The SSH daemon must only listen on management network addresses unless authorized for uses other than management.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_use_approved_ciphers" ownerid="GEN005505" disa="68" severity="medium">
		<VMSinfo VKey="22458" SVKey="37824" VRelease="3" />
		<title>The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_no_cbc" ownerid="GEN005506" disa="366" severity="medium">
		<VMSinfo VKey="22459" SVKey="26752" VRelease="2" />
		<title>The SSH daemon must be configured to not use Cipher-Block Chaining (CBC) ciphers.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_use_approved_macs" ownerid="GEN005507" disa="1453" severity="medium">
		<VMSinfo VKey="22460" SVKey="37826" VRelease="2" />
		<title>The SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ssh_use_approved_ciphers" ownerid="GEN005510" disa="68" severity="medium">
		<VMSinfo VKey="22461" SVKey="37828" VRelease="1" />
		<title>The SSH client must be configured to only use FIPS 140-2 approved ciphers.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ssh_no_cbc" ownerid="GEN005511" disa="366" severity="medium">
		<VMSinfo VKey="22462" SVKey="37830" VRelease="1" />
		<title>The SSH client must be configured to not use Cipher-Block Chaining (CBC)-based ciphers.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ssh_use_approved_macs" ownerid="GEN005512" disa="1453" severity="medium">
		<VMSinfo VKey="22463" SVKey="37836" VRelease="1" />
		<title>The SSH client must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_users_groups" ownerid="GEN005521" disa="225" severity="medium">
		<VMSinfo VKey="22470" SVKey="37843" VRelease="2" />
		<title>The SSH daemon must restrict login ability to specific users and/or groups.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ssh_public_host_keys" ownerid="GEN005522" disa="225" severity="medium">
		<VMSinfo VKey="22471" SVKey="37844" VRelease="1" />
		<title>The SSH public host key files must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ssh_private_host_keys" ownerid="GEN005523" disa="225" severity="medium">
		<VMSinfo VKey="22472" SVKey="37863" VRelease="1" />
		<title>The SSH private host key files must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_gssapiauthentication" ownerid="GEN005524" disa="366" severity="low">
		<VMSinfo VKey="22473" SVKey="37866" VRelease="2" />
		<title>The SSH daemon must not permit GSSAPI authentication unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ssh_gssapiauthentication" ownerid="GEN005525" disa="366" severity="low">
		<VMSinfo VKey="22474" SVKey="37868" VRelease="1" />
		<title>The SSH client must not permit GSSAPI authentication unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_kerberosauthentication" ownerid="GEN005526" disa="366" severity="low">
		<VMSinfo VKey="22475" SVKey="37872" VRelease="2" />
		<title>The SSH daemon must not permit Kerberos authentication unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_strictmodes" ownerid="GEN005536" disa="225" severity="medium">
		<VMSinfo VKey="22485" SVKey="37900" VRelease="2" />
		<title>The SSH daemon must perform strict mode checking of home directory configuration files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_privilegeseparation" ownerid="GEN005537" disa="225" severity="medium">
		<VMSinfo VKey="22486" SVKey="37904" VRelease="2" />
		<title>The SSH daemon must use privilege separation.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_rhostsrsaauthentication" ownerid="GEN005538" disa="366" severity="medium">
		<VMSinfo VKey="22487" SVKey="37905" VRelease="2" />
		<title>The SSH daemon must not allow rhosts RSA authentication.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_compression" ownerid="GEN005539" disa="366" severity="medium">
		<VMSinfo VKey="22488" SVKey="37908" VRelease="2" />
		<title>The SSH daemon must not allow compression or must only allow compression after successful authentication.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_ipfiltering" ownerid="GEN005540" disa="366" severity="medium">
		<VMSinfo VKey="12022" SVKey="37913" VRelease="1" />
		<title>The SSH daemon must be configured for IP filtering.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sshd_enable_warning_banner" ownerid="GEN005550" disa="48" severity="medium">
		<VMSinfo VKey="22489" SVKey="37915" VRelease="3" />
		<title>The SSH daemon must be configured with the Department of Defense (DoD) logon banner.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005560" disa="366" severity="medium">
		<VMSinfo VKey="4397" SVKey="37918" VRelease="1" />
		<title>The system must be configured with a default gateway for IPv4 if the system uses IPv4, unless the system is a router.</title>
	</overlay>
	<overlay owner="disastig" ruleid="network_ipv6_default_gateway" ownerid="GEN005570" disa="366" severity="medium">
		<VMSinfo VKey="22490" SVKey="37921" VRelease="1" />
		<title>The system must be configured with a default gateway for IPv6 if the system uses IPv6, unless the system is a router.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005580" disa="1208" severity="medium">
		<VMSinfo VKey="4398" SVKey="37924" VRelease="1" />
		<title>A system used for routing must not run other network services or applications.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005590" disa="366" severity="medium">
		<VMSinfo VKey="22665" SVKey="37926" VRelease="1" />
		<title>The system must not be running any routing protocol daemons, unless the system is a router.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv4_ip_forward" ownerid="GEN005600" disa="366" severity="medium">
		<VMSinfo VKey="12023" SVKey="37929" VRelease="1" />
		<title>IP forwarding for IPv4 must not be enabled, unless the system is a router.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN005610" disa="366" severity="medium">
		<VMSinfo VKey="22491" SVKey="37930" VRelease="2" />
		<title>The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_exports" ownerid="GEN005740" disa="225" severity="medium">
		<VMSinfo VKey="928" SVKey="37936" VRelease="1" />
		<title>The Network File System (NFS) export configuration file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_exports" ownerid="GEN005750" disa="225" severity="medium">
		<VMSinfo VKey="22492" SVKey="37940" VRelease="1" />
		<title>The Network File System (NFS) export configuration file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_exports" ownerid="GEN005760" disa="225" severity="low">
		<VMSinfo VKey="929" SVKey="37943" VRelease="1" />
		<title>The Network File System (NFS) export configuration file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_exports" ownerid="GEN005770" disa="225" severity="low">
		<VMSinfo VKey="22493" SVKey="37947" VRelease="1" />
		<title>The Network File System (NFS) exports configuration file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_exports_dirs" ownerid="GEN005800" disa="225" severity="medium">
		<VMSinfo VKey="931" SVKey="37849" VRelease="1" />
		<title>All Network File System (NFS) exported system files and system directories must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_exports_dirs" ownerid="GEN005810" disa="225" severity="medium">
		<VMSinfo VKey="22496" SVKey="37851" VRelease="1" />
		<title>All Network File System (NFS) exported system files and system directories must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="nfs_no_anonymous" ownerid="GEN005820" disa="62" severity="medium">
		<VMSinfo VKey="932" SVKey="37854" VRelease="1" />
		<title>The Network File System (NFS) anonymous UID and GID must be configured to values without permissions.</title>
	</overlay>
	<overlay owner="disastig" ruleid="nfs_enforce_host_access" ownerid="GEN005840" disa="366" severity="medium">
		<VMSinfo VKey="933" SVKey="37857" VRelease="1" />
		<title>The Network File System (NFS) server must be configured to restrict file system access to local hosts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="nfs_use_root_squashing_all_exports" ownerid="GEN005880" disa="225" severity="medium">
		<VMSinfo VKey="935" SVKey="37859" VRelease="1" />
		<title>The Network File System (NFS) server must not allow remote root access.</title>
	</overlay>
	<overlay owner="disastig" ruleid="nfs_mount_option_nosuid_remote_filesystems" ownerid="GEN005900" disa="225" severity="medium">
		<VMSinfo VKey="936" SVKey="37860" VRelease="1" />
		<title>The "nosuid" option must be enabled on all Network File System (NFS) client mounts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006000" disa="366" severity="medium">
		<VMSinfo VKey="12024" SVKey="37862" VRelease="1" />
		<title>The system must not have a public Instant Messaging (IM) client installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006040" disa="1436" severity="medium">
		<VMSinfo VKey="12025" SVKey="37865" VRelease="1" />
		<title>The system must not have any peer-to-peer file-sharing application installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_samba_removed" ownerid="GEN006060" disa="1436" severity="medium">
		<VMSinfo VKey="4321" SVKey="37867" VRelease="1" />
		<title>The system must not run Samba unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="samba-swat_restricted" ownerid="GEN006080" disa="1436" severity="medium">
		<VMSinfo VKey="1026" SVKey="37870" VRelease="1" />
		<title>The Samba Web Administration Tool (SWAT) must be restricted to the local host or require SSL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_samba_smb_conf" ownerid="GEN006100" disa="225" severity="medium">
		<VMSinfo VKey="1027" SVKey="37871" VRelease="1" />
		<title>The /etc/smb.conf file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_samba_smb_conf" ownerid="GEN006120" disa="225" severity="medium">
		<VMSinfo VKey="1056" SVKey="37873" VRelease="1" />
		<title>The /etc/smb.conf file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_samba_smb_conf" ownerid="GEN006140" disa="225" severity="medium">
		<VMSinfo VKey="1028" SVKey="37875" VRelease="1" />
		<title>The /etc/smb.conf file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_samba_smb_conf" ownerid="GEN006150" disa="225" severity="medium">
		<VMSinfo VKey="22497" SVKey="37877" VRelease="1" />
		<title>The /etc/smb.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_samba_tdb" ownerid="GEN006160" disa="225" severity="medium">
		<VMSinfo VKey="1029" SVKey="37879" VRelease="1" />
		<title>The /etc/smbpasswd file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_samba_tdb" ownerid="GEN006180" disa="225" severity="medium">
		<VMSinfo VKey="1058" SVKey="41574" VRelease="1" />
		<title>The smbpasswd file must be group-owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_samba_tdb" ownerid="GEN006200" disa="225" severity="medium">
		<VMSinfo VKey="1059" SVKey="41575" VRelease="1" />
		<title>The smbpasswd file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_samba_tdb" ownerid="GEN006210" disa="225" severity="medium">
		<VMSinfo VKey="22498" SVKey="37884" VRelease="1" />
		<title>The /etc/smbpasswd file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="samba_hosts_option" ownerid="GEN006220" disa="225" severity="medium">
		<VMSinfo VKey="1030" SVKey="37887" VRelease="1" />
		<title>The smb.conf file must use the "hosts" option to restrict access to Samba.</title>
	</overlay>
	<overlay owner="disastig" ruleid="samba_security_option" ownerid="GEN006225" disa="366" severity="medium">
		<VMSinfo VKey="22499" SVKey="37891" VRelease="1" />
		<title>Samba must be configured to use an authentication mechanism other than "share."</title>
	</overlay>
	<overlay owner="disastig" ruleid="samba_encrypt_passwords_option" ownerid="GEN006230" disa="366" severity="medium">
		<VMSinfo VKey="22500" SVKey="37894" VRelease="2" />
		<title>Samba must be configured to use encrypted passwords.</title>
	</overlay>
	<overlay owner="disastig" ruleid="samba_guest_ok_option" ownerid="GEN006235" disa="366" severity="medium">
		<VMSinfo VKey="22501" SVKey="37896" VRelease="1" />
		<title>Samba must be configured to not allow guest access to shares.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006240" disa="381" severity="medium">
		<VMSinfo VKey="1023" SVKey="37899" VRelease="1" />
		<title>The system must not run an Internet Network News (INN) server.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_news_incoming_conf" ownerid="GEN006260" disa="225" severity="medium">
		<VMSinfo VKey="4273" SVKey="37901" VRelease="1" />
		<title>The /etc/news/incoming.conf (or equivalent) must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_news_incoming_conf" ownerid="GEN006270" disa="225" severity="medium">
		<VMSinfo VKey="22502" SVKey="37902" VRelease="2" />
		<title>The /etc/news/incoming.conf file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_news_infeed_conf" ownerid="GEN006280" disa="225" severity="medium">
		<VMSinfo VKey="4274" SVKey="37712" VRelease="1" />
		<title>The /etc/news/infeed.conf (or equivalent) must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_news_infeed_conf" ownerid="GEN006290" disa="225" severity="medium">
		<VMSinfo VKey="22503" SVKey="37713" VRelease="1" />
		<title>The /etc/news/hosts.nntp.nolimit file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006300" disa="225" severity="medium">
		<VMSinfo VKey="4275" SVKey="37714" VRelease="1" />
		<title>The /etc/news/readers.conf (or equivalent) must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_news_nnrp_access" ownerid="GEN006310" disa="225" severity="medium">
		<VMSinfo VKey="22504" SVKey="37730" VRelease="1" />
		<title>The /etc/news/nnrp.access file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_news_passwd_nntp" ownerid="GEN006320" disa="225" severity="medium">
		<VMSinfo VKey="4276" SVKey="37731" VRelease="1" />
		<title>The /etc/news/passwd.nntp file (or equivalent) must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_news_passwd_nntp" ownerid="GEN006330" disa="225" severity="medium">
		<VMSinfo VKey="22505" SVKey="37733" VRelease="1" />
		<title>The /etc/news/passwd.nntp file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006340" disa="225" severity="medium">
		<VMSinfo VKey="4277" SVKey="37735" VRelease="1" />
		<title>Files in /etc/news must be owned by root or news.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006360" disa="225" severity="medium">
		<VMSinfo VKey="4278" SVKey="37737" VRelease="1" />
		<title>The files in /etc/news must be group-owned by root or news.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006380" disa="1436" severity="high">
		<VMSinfo VKey="4399" SVKey="37739" VRelease="1" />
		<title>The system must not use UDP for NIS/NIS+.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_ypbind_disabled" ownerid="GEN006400" disa="1435" severity="medium">
		<VMSinfo VKey="867" SVKey="37742" VRelease="1" />
		<title>The Network Information System (NIS) protocol must not be used.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006420" disa="366" severity="medium">
		<VMSinfo VKey="12026" SVKey="37743" VRelease="1" />
		<title>NIS maps must be protected through hard-to-guess domain names.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_hids_installed" ownerid="GEN006480" disa="1259" severity="medium">
		<VMSinfo VKey="782" SVKey="37746" VRelease="2" />
		<title>The system must have a host-based intrusion detection tool installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006560" disa="366" severity="medium">
		<VMSinfo VKey="12028" SVKey="37747" VRelease="1" />
		<title>The system vulnerability assessment tool, host-based intrusion detection tool, and file integrity tool must notify the SA and the IAO of a security breach or a suspected security breach.</title>
	</overlay>
	<overlay owner="disastig" ruleid="rpm_verify_hashes" ownerid="GEN006565" disa="366" severity="medium">
		<VMSinfo VKey="22506" SVKey="37751" VRelease="2" />
		<title>The system package management tool must be used to verify system software periodically.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006570" disa="1297" severity="low">
		<VMSinfo VKey="22507" SVKey="37752" VRelease="1" />
		<title>The file integrity tool must be configured to verify ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006571" disa="1297" severity="low">
		<VMSinfo VKey="22508" SVKey="37753" VRelease="1" />
		<title>The file integrity tool must be configured to verify extended attributes.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006575" disa="1297" severity="low">
		<VMSinfo VKey="22509" SVKey="37754" VRelease="1" />
		<title>The file integrity tool must use FIPS 140-2 approved cryptographic hashes for validating file contents.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006580" disa="366" severity="medium">
		<VMSinfo VKey="940" SVKey="37756" VRelease="1" />
		<title>The system must use an access control program.</title>
	</overlay>
	<overlay owner="disastig" ruleid="XXXX" ownerid="GEN006600" disa="126" severity="medium">
		<VMSinfo VKey="941" SVKey="37757" VRelease="1" />
		<title>The system's access control program must log each system access attempt.</title>
	</overlay>
	<overlay owner="disastig" ruleid="system_access_control" ownerid="GEN006620" disa="366" severity="medium">
		<VMSinfo VKey="12030" SVKey="37758" VRelease="1" />
		<title>The system's access control program must be configured to grant or deny system access to specific hosts.</title>
	</overlay>
	<overlay owner="disastig" ruleid="package_av_installed" ownerid="GEN006640" disa="1668" severity="medium">
		<VMSinfo VKey="12765" SVKey="37760" VRelease="2" />
		<title>The system must use and update a DoD-approved virus scan program.</title>
	</overlay>
	<overlay owner="disastig" ruleid="accounts_disable_post_pw_expiration" ownerid="GEN006660" disa="17" severity="low">
		<VMSinfo VKey="38692" SVKey="50927" VRelease="1" />
		<title>Accounts must be locked upon 35 days of inactivity.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_sctp_disabled" ownerid="GEN007020" disa="382" severity="medium">
		<VMSinfo VKey="22511" SVKey="37761" VRelease="1" />
		<title>The Stream Control Transmission Protocol (SCTP) must be disabled unless required.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_dccp_disabled" ownerid="GEN007080" disa="382" severity="medium">
		<VMSinfo VKey="22514" SVKey="37763" VRelease="1" />
		<title>The Datagram Congestion Control Protocol (DCCP) must be disabled unless required.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_appletalk_disabled" ownerid="GEN007260" disa="382" severity="medium">
		<VMSinfo VKey="22524" SVKey="26887" VRelease="1" />
		<title>The AppleTalk protocol must be disabled or not installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_rds_disabled" ownerid="GEN007480" disa="382" severity="medium">
		<VMSinfo VKey="22530" SVKey="37603" VRelease="1" />
		<title>The Reliable Datagram Sockets (RDS) protocol must be disabled or not installed unless required.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_tipc_disabled" ownerid="GEN007540" disa="382" severity="medium">
		<VMSinfo VKey="22533" SVKey="37604" VRelease="1" />
		<title>The Transparent Inter-Process Communication (TIPC) protocol must be disabled or uninstalled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_bluetooth_disabled" ownerid="GEN007660" disa="1551" severity="medium">
		<VMSinfo VKey="22539" SVKey="37605" VRelease="1" />
		<title>The Bluetooth protocol handler must be disabled or not installed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="network_ipv6_disable_interfaces" ownerid="GEN007700" disa="1551" severity="medium">
		<VMSinfo VKey="22541" SVKey="37606" VRelease="1" />
		<title>The IPv6 protocol handler must not be bound to the network stack unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_ipv6_option_disabled" ownerid="GEN007720" disa="1551" severity="medium">
		<VMSinfo VKey="22542" SVKey="37609" VRelease="1" />
		<title>The IPv6 protocol handler must be prevented from dynamic loading unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ip_6to4_tunnels" ownerid="GEN007780" disa="1551" severity="medium">
		<VMSinfo VKey="22545" SVKey="37610" VRelease="1" />
		<title>The system must not have 6to4 enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ip_teredo" ownerid="GEN007800" disa="1551" severity="medium">
		<VMSinfo VKey="22546" SVKey="37611" VRelease="1" />
		<title>The system must not have Teredo enabled.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ip_tunnels" ownerid="GEN007820" disa="1551" severity="medium">
		<VMSinfo VKey="22547" SVKey="37613" VRelease="1" />
		<title>The system must not have IP tunnels configured.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysconfig_networking_bootproto_ifcfg" ownerid="GEN007840" disa="366" severity="medium">
		<VMSinfo VKey="22548" SVKey="37615" VRelease="1" />
		<title>The DHCP client must be disabled if not needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="dhcp_client_disable_ddns" ownerid="GEN007850" disa="366" severity="medium">
		<VMSinfo VKey="22549" SVKey="26933" VRelease="2" />
		<title>The DHCP client must not send dynamic DNS updates.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_all_accept_redirects" ownerid="GEN007860" disa="1551" severity="medium">
		<VMSinfo VKey="22550" SVKey="37616" VRelease="2" />
		<title>The system must ignore IPv6 ICMP redirect messages.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_forwarding" ownerid="GEN007920" disa="1551" severity="medium">
		<VMSinfo VKey="22553" SVKey="37618" VRelease="1" />
		<title>The system must not forward IPv6 source-routed packets.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ip6tables_input_icmpv6_broadcast" ownerid="GEN007950" disa="366" severity="medium">
		<VMSinfo VKey="23972" SVKey="29788" VRelease="1" />
		<title>The system must not respond to ICMPv6 echo requests sent to a broadcast address.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_usr_bin_ldd" ownerid="GEN007960" disa="305" severity="medium">
		<VMSinfo VKey="23953" SVKey="37621" VRelease="2" />
		<title>The 'ldd' command must be disabled unless it protects against the execution of untrusted files.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ldap_client_start_tls" ownerid="GEN007980" disa="1453" severity="medium">
		<VMSinfo VKey="22555" SVKey="37627" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ldap_client_tls_cert" ownerid="GEN008000" disa="185" severity="medium">
		<VMSinfo VKey="22556" SVKey="37631" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, certificates used to authenticate to the LDAP server must be provided from DoD PKI or a DoD-approved external PKI.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ldap_client_tls_checkpeer" ownerid="GEN008020" disa="185" severity="medium">
		<VMSinfo VKey="22557" SVKey="37632" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate with a valid trust path to a trusted CA.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ldap_client_tls_crlcheck" ownerid="GEN008040" disa="185" severity="medium">
		<VMSinfo VKey="22558" SVKey="37634" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the system must verify the LDAP server's certificate has not been revoked.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ldap_client_bindpw" ownerid="GEN008050" disa="196" severity="medium">
		<VMSinfo VKey="24384" SVKey="37643" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_etc_ldap_conf" ownerid="GEN008060" disa="225" severity="medium">
		<VMSinfo VKey="22559" SVKey="37951" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information the /etc/ldap.conf (or equivalent) file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_etc_ldap_conf" ownerid="GEN008080" disa="225" severity="medium">
		<VMSinfo VKey="22560" SVKey="37953" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the /etc/ldap.conf (or equivalent) file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_etc_ldap_conf" ownerid="GEN008100" disa="225" severity="medium">
		<VMSinfo VKey="22561" SVKey="37955" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the /etc/ldap.conf (or equivalent) file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_etc_ldap_conf" ownerid="GEN008120" disa="225" severity="medium">
		<VMSinfo VKey="22562" SVKey="37956" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the /etc/ldap.conf (or equivalent) file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_ldap_cacerts" ownerid="GEN008140" disa="225" severity="medium">
		<VMSinfo VKey="22563" SVKey="37959" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_ldap_cacerts" ownerid="GEN008160" disa="225" severity="medium">
		<VMSinfo VKey="22564" SVKey="37961" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ldap_cacerts" ownerid="GEN008180" disa="225" severity="medium">
		<VMSinfo VKey="22565" SVKey="37962" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must have mode 0644 (0755 for directories) or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_ldap_cacerts" ownerid="GEN008200" disa="225" severity="medium">
		<VMSinfo VKey="22566" SVKey="37964" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS certificate authority file and/or directory (as appropriate) must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_ldap_certs" ownerid="GEN008220" disa="225" severity="medium">
		<VMSinfo VKey="22567" SVKey="37965" VRelease="1" />
		<title>For systems using NSS LDAP, the TLS certificate file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_ldap_certs" ownerid="GEN008240" disa="225" severity="medium">
		<VMSinfo VKey="22568" SVKey="37967" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ldap_certs" ownerid="GEN008260" disa="225" severity="medium">
		<VMSinfo VKey="22569" SVKey="37966" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must have mode 0644 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_ldap_certs" ownerid="GEN008280" disa="225" severity="medium">
		<VMSinfo VKey="22570" SVKey="37968" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_ldap_keys" ownerid="GEN008300" disa="225" severity="medium">
		<VMSinfo VKey="22571" SVKey="37969" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_ldap_keys" ownerid="GEN008320" disa="225" severity="medium">
		<VMSinfo VKey="22572" SVKey="37971" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must be group-owned by root, bin, or sys.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_ldap_keys" ownerid="GEN008340" disa="225" severity="medium">
		<VMSinfo VKey="22573" SVKey="37973" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_ldap_keys" ownerid="GEN008360" disa="225" severity="medium">
		<VMSinfo VKey="22574" SVKey="37977" VRelease="1" />
		<title>If the system is using LDAP for authentication or account information, the LDAP TLS key file must not have an extended ACL.</title>
	</overlay>
	<overlay owner="disastig" ruleid="MANUAL_CHECK" ownerid="GEN008380" disa="1199" severity="medium">
		<VMSinfo VKey="22575" SVKey="37978" VRelease="1" />
		<title>A root kit check tool must be run on the system at least weekly.</title>
	</overlay>
	<overlay owner="disastig" ruleid="sysctl_kernel_execshield" ownerid="GEN008420" disa="366" severity="low">
		<VMSinfo VKey="22576" SVKey="37979" VRelease="1" />
		<title>The system must use available memory address randomization techniques.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_autofs_disabled" ownerid="GEN008440" disa="366" severity="low">
		<VMSinfo VKey="22577" SVKey="37980" VRelease="1" />
		<title>Automated file system mounting tools must not be enabled unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="bootloader_nousb_argument" ownerid="GEN008460" disa="366" severity="low">
		<VMSinfo VKey="22578" SVKey="37981" VRelease="1" />
		<title>The system must have USB disabled unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_usb-storage_disabled" ownerid="GEN008480" disa="366" severity="low">
		<VMSinfo VKey="22579" SVKey="37982" VRelease="1" />
		<title>The system must have USB Mass Storage disabled unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="kernel_module_ieee1394_disabled" ownerid="GEN008500" disa="366" severity="low">
		<VMSinfo VKey="22580" SVKey="37983" VRelease="1" />
		<title>The system must have IEEE 1394 (Firewire) disabled unless needed.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_iptables_enabled" ownerid="GEN008520" disa="1118" severity="medium">
		<VMSinfo VKey="22582" SVKey="37984" VRelease="1" />
		<title>The system must employ a local firewall.</title>
	</overlay>
	<overlay owner="disastig" ruleid="iptables_input_reject_rule" ownerid="GEN008540" disa="1109" severity="medium">
		<VMSinfo VKey="22583" SVKey="37985" VRelease="1" />
		<title>The system's local firewall must implement a deny-all, allow-by-exception policy.</title>
	</overlay>
	<overlay owner="disastig" ruleid="MANUAL_CHECK" ownerid="GEN008600" disa="366" severity="high">
		<VMSinfo VKey="1013" SVKey="37986" VRelease="1" />
		<title>The system must be configured to only boot from the system boot device.</title>
	</overlay>
	<overlay owner="disastig" ruleid="MANUAL_CHECK" ownerid="GEN008620" disa="213" severity="medium">
		<VMSinfo VKey="4246" SVKey="37925" VRelease="1" />
		<title>System BIOS or system controllers supporting password protection must have administrator accounts/passwords configured, and no others.</title>
	</overlay>
	<overlay owner="disastig" ruleid="MANUAL_CHECK" ownerid="GEN008640" disa="366" severity="high">
		<VMSinfo VKey="4247" SVKey="41534" VRelease="1" />
		<title>The system must not use removable media as the boot loader.</title>
	</overlay>
	<overlay owner="disastig" ruleid="bootloader_exists" ownerid="GEN008660" disa="366" severity="high">
		<VMSinfo VKey="4248" SVKey="42186" VRelease="1" />
		<title>For systems capable of using GRUB, the system must be configured with GRUB as the default boot loader unless another boot loader has been authorized, justified, and documented using site-defined procedures.</title>
	</overlay>
	<overlay owner="disastig" ruleid="MANUAL_CHECK" ownerid="GEN008680" disa="1208" severity="high">
		<VMSinfo VKey="4255" SVKey="4255" VRelease="2" />
		<title>If the system boots from removable media, it must be stored in a safe or similarly secured container.</title>
	</overlay>
	<overlay owner="disastig" ruleid="bootloader_password" ownerid="GEN008700" disa="213" severity="high">
		<VMSinfo VKey="4249" SVKey="37933" VRelease="1" />
		<title>The system boot loader must require authentication.</title>
	</overlay>
	<overlay owner="disastig" ruleid="bootloader_password_hash" ownerid="GEN008710" disa="213" severity="medium">
		<VMSinfo VKey="24624" SVKey="37938" VRelease="1" />
		<title>The system boot loader must protect passwords using an MD5 or stronger cryptographic hash.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_grub_conf" ownerid="GEN008720" disa="225" severity="medium">
		<VMSinfo VKey="4250" SVKey="37942" VRelease="1" />
		<title>The system's boot loader configuration file(s) must have mode 0600 or less permissive.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_permissions_extended_grub_conf" ownerid="GEN008740" disa="225" severity="medium">
		<VMSinfo VKey="22585" SVKey="26984" VRelease="1" />
		<title>The system's boot loader configuration file(s) must not have extended ACLs.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_owner_grub_conf" ownerid="GEN008760" disa="225" severity="medium">
		<VMSinfo VKey="22586" SVKey="26986" VRelease="1" />
		<title>The system's boot loader configuration files must be owned by root.</title>
	</overlay>
	<overlay owner="disastig" ruleid="file_groupowner_grub_conf" ownerid="GEN008780" disa="225" severity="medium">
		<VMSinfo VKey="22587" SVKey="26988" VRelease="1" />
		<title>The system's boot loader configuration file(s) must be group-owned by root, bin, sys, or system.</title>
	</overlay>
	<overlay owner="disastig" ruleid="ensure_gpgcheck_never_disabled" ownerid="GEN008800" disa="351" severity="low">
		<VMSinfo VKey="22588" SVKey="26990" VRelease="1" />
		<title>The system package management tool must cryptographically verify the authenticity of software packages during installation.</title>
	</overlay>
	<overlay owner="disastig" ruleid="service_yum-updatesd_disabled" ownerid="GEN008820" disa="1233" severity="low">
		<VMSinfo VKey="22589" SVKey="26992" VRelease="1" />
		<title>The system package management tool must not automatically obtain updates.</title>
	</overlay>
	<overlay owner="disastig" ruleid="smartcard_auth" ownerid="GEN009120" disa="768" severity="medium">
		<VMSinfo VKey="24347" SVKey="30004" VRelease="1" />
		<title>The system, if capable, must be configured to require the use of a CAC, PIV compliant hardware token, or Alternate Logon Token (ALT) for authentication.</title>
	</overlay>
</overlays>
