OVALFileLinker from SCAP Security Guide ssg: [0, 1, 81], python: 3.14.3 5.11.2 2026-04-01T21:16:40 Configure audispd Plugin To Send Logs To Remote Server Claroty CTD 5.x remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname Configure auditd Disk Full Action when Disk Space Is Full Claroty CTD 5.x disk_full_action setting in /etc/audit/auditd.conf is set to a certain action Configure auditd mail_acct Action on Low Disk Space Claroty CTD 5.x action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account Configure auditd space_left Action on Low Disk Space Claroty CTD 5.x space_left_action setting in /etc/audit/auditd.conf is set to a certain action Configure auditd space_left on Low Disk Space Claroty CTD 5.x space_left setting in /etc/audit/auditd.conf is set to at least a certain value Offload audit Logs to External Media Claroty CTD 5.x Check if a script for audit offload exists in /etc/cron.weekly/ Disable unauthenticated repositories in APT configuration Claroty CTD 5.x Accessing a repository should be allowed only when the repository is authenticated. Configure Time Service Maxpoll Interval Claroty CTD 5.x Configure the maxpoll setting in /etc/ntp.conf or chrony.conf to continuously poll the time source servers. Certificate trust path in SSSD Claroty CTD 5.x SSSD should be configured with trust path to an accepted trust anchor. Configure PAM in SSSD Services Claroty CTD 5.x SSSD should be configured to run SSSD PAM services. Enable Smartcards in SSSD Claroty CTD 5.x SSSD should be configured to authenticate access to the system using smart cards. Enable Certificates Mapping in SSSD Claroty CTD 5.x SSSD should be configured to map the certificate to correct user or group Configure SSSD to Expire Offline Credentials Claroty CTD 5.x SSSD should be configured to expire offline credentials after 1 day. Enable authselect Claroty CTD 5.x Check that authselect is enabled Modify the System Login Banner for Remote Connections Claroty CTD 5.x The system login banner text should be set correctly. Account Lockouts Must Be Logged Claroty CTD 5.x Account Lockouts Must Be Logged Do Not Show System Messages When Unsuccessful Logon Attempts Occur Claroty CTD 5.x Prevent System Messages When Three Unsuccessful Logon Attempts Occur Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session Claroty CTD 5.x The password retry should meet minimum requirements Set Password Hashing Algorithm for PAM Claroty CTD 5.x The password hashing algorithm should be set correctly in {{{ pam_file }}}. Set Password Hashing Algorithm in /etc/login.defs Claroty CTD 5.x The password hashing algorithm should be set correctly in /usr/etc/login.defs. Disable Ctrl-Alt-Del Reboot Activation Claroty CTD 5.x By default, the system will reboot when the Ctrl-Alt-Del key sequence is pressed. Set Account Expiration Following Inactivity Claroty CTD 5.x The accounts should be configured to expire automatically following password expiration. Set Password Maximum Age Claroty CTD 5.x The maximum password age policy should meet minimum requirements. Set Password Minimum Age Claroty CTD 5.x The minimum password age policy should be set appropriately. Set number of Password Hashing Rounds - password-auth Claroty CTD 5.x The number of rounds for password hashing should be set correctly. Prevent Login to Accounts With Empty Password Claroty CTD 5.x The file /etc/pam.d/system-auth should not contain the nullok option Ensure There Are No Accounts With Blank or Null Passwords Claroty CTD 5.x The file /etc/shadow shows that there aren't empty passwords Direct root Logins Are Not Allowed Claroty CTD 5.x Direct root Logins Are Not Allowed Limit the Number of Concurrent Login Sessions Allowed Per User Claroty CTD 5.x The maximum number of concurrent login sessions per user should meet minimum requirements. Set Interactive Session Timeout Claroty CTD 5.x Checks interactive shell timeout Set Boot Loader Password in grub2 Claroty CTD 5.x The grub2 boot loader should have password protection enabled. Set the UEFI Boot Loader Password Claroty CTD 5.x The UEFI grub2 boot loader should have password protection enabled. Ensure real-time clock is set to UTC Claroty CTD 5.x Ensure RTC is using UTC as its time base Ensure remote access methods are monitored in Rsyslog Claroty CTD 5.x Rsyslog should be configured to monitor remote access methods. Deactivate Wireless Network Interfaces Claroty CTD 5.x All wireless interfaces should be disabled. Verify that All World-Writable Directories Have Sticky Bits Set Claroty CTD 5.x The sticky bit should be set for all world-writable directories. Verify that system commands files are group owned by root or a system account Claroty CTD 5.x Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin are owned by root group or a system account. Verify that System Executables Have Root Ownership Claroty CTD 5.x Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin, /usr/libexec, and objects therein, are owned by root. Verify that System Executables Have Restrictive Permissions Claroty CTD 5.x Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable. Enable NX or XD Support in the BIOS Claroty CTD 5.x The NX (no-execution) bit flag should be set on the system. Verify '/proc/sys/crypto/fips_enabled' exists Claroty CTD 5.x Inspect the contents of /proc/sys/crypto/fips_enabled Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate Claroty CTD 5.x Checks sudo usage without authentication Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD Claroty CTD 5.x Checks sudo usage without password The operating system must restrict privilege elevation to authorized personnel Claroty CTD 5.x Check that sudoers doesn't allow all users to run commands via sudo Ensure apt_get Removes Previous Package Versions Claroty CTD 5.x The clean_requirements_on_remove option should be used to ensure that old versions of software components are removed after updating. Ensure PAM Enforces Password Requirements - Enforcing Claroty CTD 5.x Check presence of enforcing = 1 in /etc/security/pwquality.conf Enforce Delay After Failed Logon Attempts Claroty CTD 5.x Configure PAM module Lock Accounts After Failed Password Attempts Claroty CTD 5.x Lockout account after failed login attempts. Set Interval For Counting Failed Password Attempts Claroty CTD 5.x The number of allowed failed logins should be set correctly. Set Lockout Time for Failed Password Attempts Claroty CTD 5.x The unlock time after number of failed logins should be set correctly. Configure AIDE To Notify Personnel if Baseline Configurations Are Altered Claroty CTD 5.x Ensure 'SILENTREPORTS' is configured with value 'no' in /etc/default/aide Ensure AppArmor is Active and Configured Claroty CTD 5.x The apparmor service should be enabled if possible. Synchronize internal information system clocks Claroty CTD 5.x Ensure 'makestep' is configured with value '1 -1' in /etc/chrony/chrony.conf Verify that Shared Library Directories Have Root Group Ownership Claroty CTD 5.x This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is group owned by 0. Verify group-owner of system journal directories Claroty CTD 5.x This test makes sure that /run/log/journal/, /var/log/journal/ is group owned by systemd-journal. Verify that system commands directories are group owned by root Claroty CTD 5.x This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ is group owned by 0. Verify owner of system journal directories Claroty CTD 5.x This test makes sure that /run/log/journal/, /var/log/journal/ is owned by 0. Verify that System Executable Have Root Ownership Claroty CTD 5.x This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ is owned by 0. Verify that Shared Library Directories Have Root Ownership Claroty CTD 5.x This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is owned by 0. Verify that System Executable Directories Have Restrictive Permissions Claroty CTD 5.x This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ has mode 0755. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on the system journal directories Claroty CTD 5.x This test makes sure that /run/log/journal/, /var/log/journal/ has mode 2750. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Groupowner on the journalctl command Claroty CTD 5.x This test makes sure that /usr/bin/journalctl is group owned by 0. Verify Group Who Owns the system journal Claroty CTD 5.x This test makes sure that ^/var/log/journal/.*/system.journal$ is group owned by systemd-journal. Verify Group Who Owns /var/log Directory Claroty CTD 5.x This test makes sure that /var/log/ is group owned by 0. Verify Group Who Owns /var/log/syslog File Claroty CTD 5.x This test makes sure that /var/log/syslog is group owned by 4. Audit Configuration Files Must Be Owned By Group root Claroty CTD 5.x This test makes sure that /etc/audit/, /etc/audit/rules.d/ is group owned by 0. Verify Owner on the journalctl Command Claroty CTD 5.x This test makes sure that /usr/bin/journalctl is owned by 0. Verify Owner on the system journal Claroty CTD 5.x This test makes sure that ^/var/log/journal/.*/system.journal$ is owned by 0. Verify User Who Owns /var/log Directory Claroty CTD 5.x This test makes sure that /var/log/ is owned by 0. Verify User Who Owns /var/log/syslog File Claroty CTD 5.x This test makes sure that /var/log/syslog is owned by syslog. Verify that audit tools are owned by root Claroty CTD 5.x This test makes sure that /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/audispd, /sbin/augenrules is owned by 0. Audit Configuration Files Must Be Owned By Root Claroty CTD 5.x This test makes sure that /etc/audit/, /etc/audit/rules.d/ is owned by 0. Verify that Shared Library Files Have Root Ownership Claroty CTD 5.x This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is owned by 0. Verify that audit tools Have Mode 0755 or less Claroty CTD 5.x This test makes sure that /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/audispd, /sbin/augenrules has mode 0755. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on /etc/audit/auditd.conf Claroty CTD 5.x This test makes sure that /etc/audit/auditd.conf has mode 0640. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on /etc/audit/audit.rules Claroty CTD 5.x This test makes sure that /etc/audit/audit.rules has mode 0640. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on /etc/audit/rules.d/*.rules Claroty CTD 5.x This test makes sure that /etc/audit/rules.d/ has mode 0600. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on the journal command Claroty CTD 5.x This test makes sure that /usr/bin/journalctl has mode 0740. If the target file or directory has an extended ACL, then it will fail the mode check. Verify that Shared Library Files Have Restrictive Permissions Claroty CTD 5.x This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ has mode 7755. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on the system journal Claroty CTD 5.x This test makes sure that ^/var/log/journal/.*/system.journal$ has mode 0640. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on /var/log Directory Claroty CTD 5.x This test makes sure that /var/log/ has mode 0755. If the target file or directory has an extended ACL, then it will fail the mode check. Verify Permissions on /var/log/syslog File Claroty CTD 5.x This test makes sure that /var/log/syslog has mode 0640. If the target file or directory has an extended ACL, then it will fail the mode check. Disable Modprobe Loading of USB Storage Driver Claroty CTD 5.x The kernel module usb-storage should be disabled. Verify permissions of log files Claroty CTD 5.x This test makes sure that /var/log/ has mode 0640. If the target file or directory has an extended ACL, then it will fail the mode check. Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root. Claroty CTD 5.x This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is group owned by 0. Enable auditd Service Claroty CTD 5.x The auditd service should be enabled if possible. Enable rsyslog Service Claroty CTD 5.x The rsyslog service should be enabled if possible. Enable the OpenSSH Service Claroty CTD 5.x The sshd service should be enabled if possible. Enable the SSSD Service Claroty CTD 5.x The sssd service should be enabled if possible. Verify ufw Enabled Claroty CTD 5.x The ufw service should be enabled if possible. Restrict Access to Kernel Message Buffer Claroty CTD 5.x The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in system configuration and system runtime. Restrict Access to Kernel Message Buffer Claroty CTD 5.x The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system runtime. Restrict Access to Kernel Message Buffer Claroty CTD 5.x The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system configuration. Enable Randomized Layout of Virtual Address Space Claroty CTD 5.x The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in system configuration and system runtime. Enable Randomized Layout of Virtual Address Space Claroty CTD 5.x The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system runtime. Enable Randomized Layout of Virtual Address Space Claroty CTD 5.x The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system configuration. Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces Claroty CTD 5.x The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in system configuration and system runtime. Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces Claroty CTD 5.x The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system runtime. Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces Claroty CTD 5.x The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system configuration. Verify that 'use_mappers' is set to 'pwent' in PAM Claroty CTD 5.x Check presence of use_mappers = pwent in /etc/pam_pkcs11/pam_pkcs11.conf /etc/audit/audisp-remote.conf ^[ ]*(?i)remote_server(?-i)[ ]+=[ ]+(\S+)[ ]*$ 1 /etc/audit/auditd.conf ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ 1 /etc/audit/auditd.conf ^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$ 1 /etc/audit/auditd.conf ^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$ 1 /etc/audit/auditd.conf ^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$ 1 /etc/cron.weekly/audit-offload ^.*$ 1 /etc/apt/apt.conf(\.d/.*)?$ ^[^#]*(?i)AllowUnauthenticated(?-i)(.*)$ 1 /etc/ntp.conf ^server[\s]+[\S]+.*maxpoll[\s]+(\d+) 1 ^(/etc/chrony/chrony\.conf|/etc/chrony/conf\.d/.+\.conf)$ ^(?:server|pool|peer)[\s]+[\S]+.*maxpoll[\s]+(\d+) 1 /etc/ntp.conf ^server[\s]+[\S]+[\s]+(.*) 1 ^(/etc/chrony/chrony\.conf|/etc/chrony/conf\.d/.+\.conf)$ ^(?:server|pool|peer)[\s]+[\S]+[\s]+(.*) 1 ^/etc/sssd/sssd.conf$ ^[\s]*\[domain\/.*](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*([\w,]+)$ 1 ^/etc/sssd/(sssd|conf\.d/.*)\.conf$ ^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*services[ \t]*=[ \t]*(.*)$ 1 /etc/sssd/(sssd\.conf|conf.d/[^/]+\.conf) ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(\w+)\s*$ 1 /etc/sssd/sssd.conf ^[\s]*\[[^\n\[\]]+\](?:[^\n\[]*\n+)+?[\s]*ldap_user_certificate\s*=\s*([\w;]+)$ 1 ^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$ ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*(\d+)\s*(?:#.*)?$ 1 /etc/pam.d/fingerprint-auth /etc/pam.d/password-auth /etc/pam.d/postlogin /etc/pam.d/smartcard-auth /etc/pam.d/system-auth ^/etc/issue\.net$ ^(.*)$ 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/security/faillock.conf ^\s*audit 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/security/faillock.conf ^\s*silent 1 /etc/pam.d/system-auth ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$ 1 /etc/security/pwquality.conf ^[\s]*retry[\s]*=[\s]*(\d+)(?:[\s]|$) 1 /etc/pam.d/common-password ^[\s]*password[\s]+(?:\[success=\d+\s+default=ignore\])[\s]+pam_unix\.so[\s]+(?!.*\b(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)\b[^#]*\b(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)\b)[^#]*\b(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)\b.*$ 1 /etc/login.defs .*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n 1 oval:ssg-variable_last_encrypt_method_instance_value:var:1 /etc/systemd/system/ctrl-alt-del.target /etc/default/useradd ^\s*INACTIVE\s*=\s*(\d+)\s*$ 1 /etc/login.defs ^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n 1 oval:ssg-variable_last_pass_max_days_instance_value:var:1 /etc/login.defs .*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n 1 oval:ssg-variable_last_pass_min_days_instance_value:var:1 ^/etc/pam.d/password-auth$ ^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so[^#]*rounds=([0-9]*).*$ 1 ^/etc/pam.d/(system|password)-auth$ ^[^#]*\bnullok\b.*$ 1 /etc/shadow ^[^:]+::.*$ 1 /etc/shadow ^root:([^:]*):(?:[^:]*:){6}(?:[^:]*)$ 1 /etc/security/limits.conf ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$ 1 /etc/security/limits.d ^.*\.conf$ ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$ 1 /etc/security/limits.d ^.*\.conf$ ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins 1 /etc/profile ^[\s]*(?:typeset|declare)[\s]+-xr[\s]+TMOUT=([\w$]+).*$ 1 /etc/profile.d ^.*\.sh$ ^[\s]*(?:typeset|declare)[\s]+-xr[\s]+TMOUT=([\w$]+).*$ 1 oval:ssg-object_etc_profile_tmout:obj:1 oval:ssg-object_etc_profiled_tmout:obj:1 oval:ssg-variable_count_of_tmout_instances:var:1 /boot/grub/grub.cfg ^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$ 1 /boot/grub/user.cfg ^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$ 1 /boot/grub/grub.cfg ^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$ 1 /boot/efi/EFI/ubuntu/user.cfg ^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$ 1 /etc/localtime ^/etc/rsyslog\.(conf|d/.+\.conf)$ ^[ \t]*(?:(?:\w+,)*auth(?:,\w+)*\.\*|\S+;auth\.\*|auth\.\*;\S+|\S+;auth\.\*;\S+)[ \t]+(?:(?!action\()\S+|action\([^)]*file\s*=\s*["'][^"']+["'][^)]*\))\s*$ 1 ^/etc/rsyslog\.(conf|d/.+\.conf)$ ^[ \t]*(?:(?:\w+,)*authpriv(?:,\w+)*\.\*|\S+;authpriv\.\*|authpriv\.\*;\S+|\S+;authpriv\.\*;\S+)[ \t]+(?:(?!action\()\S+|action\([^)]*file\s*=\s*["'][^"']+["'][^)]*\))\s*$ 1 ^/etc/rsyslog\.(conf|d/.+\.conf)$ ^[ \t]*(?:(?:\w+,)*daemon(?:,\w+)*\.\*|\S+;daemon\.\*|daemon\.\*;\S+|\S+;daemon\.\*;\S+)[ \t]+(?:(?!action\()\S+|action\([^)]*file\s*=\s*["'][^"']+["'][^)]*\))\s*$ 1 ^wl.*$ .* oval:ssg-state_dir_perms_world_writable_sticky_bits_dev_partitons:ste:1 oval:ssg-state_dir_perms_world_writable_sticky_bits:ste:1 ^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin ^.*$ oval:ssg-state_groupowner_system_commands_dirs_not_root_or_system_account:ste:1 oval:ssg-state_groupowner_system_commands_dirs_symlink:ste:1 ^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec oval:ssg-state_owner_binaries_not_root:ste:1 ^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec ^.*$ oval:ssg-state_owner_binaries_not_root:ste:1 ^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec ^.*$ oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1 oval:ssg-state_perms_binary_files_symlink:ste:1 /proc/cpuinfo ^flags[\s]+:.*[\s]+nx[\s]+.*$ 1 /proc/cmdline .+noexec[0-9]*=off.+ 1 /proc/sys/crypto/fips_enabled ^.*$ 1 /etc/sudoers ^(?!#).*[\s]+\!authenticate.*$ 1 /etc/sudoers.d ^.*$ ^(?!#).*[\s]+\!authenticate.*$ 1 /etc/sudoers ^(?!#).*[\s]+NOPASSWD[\s]*\:.*$ 1 /etc/sudoers.d ^.*$ ^(?!#).*[\s]+NOPASSWD[\s]*\:.*$ 1 ^/etc/sudoers(\.d/.*)?$ ^\s*ALL\s+ALL\=\(ALL\)\s+ALL\s*$ 1 ^/etc/sudoers(\.d/.*)?$ ^\s*ALL\s+ALL\=\(ALL\:ALL\)\s+ALL\s* 1 /etc/apt/apt.conf ^\s*clean_requirements_on_remove\s*=\s*(1|True|yes)\s*$ 1 /etc/security/pwquality.conf ^[\s]*enforcing = 1[\s]*$ 1 /etc/pam.d/common-auth ^\s*auth\s+required\s+pam_faildelay.so.*\sdelay=(-?[a-zA-Z0-9]+)(?:\s+.*)? 1 /etc/pam.d/system-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/security/faillock.conf 1 /etc/pam.d/system-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/security/faillock.conf 1 /etc/pam.d/system-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/pam.d/system-auth 1 /etc/pam.d/password-auth 1 /etc/security/faillock.conf 1 /etc/default/aide ^\s*SILENTREPORTS=(.+?)[ \t]*(?:$|#) 1 ^/etc/default/aide multi-user.target multi-user.target ^apparmor\.(socket|service)$ ActiveState apparmor-parser /etc/chrony/chrony.conf ^\s*makestep (.+?)[ \t]*(?:$|#) 1 ^/etc/chrony/chrony.conf /lib oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1 /lib64 oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1 /usr/lib oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1 /usr/lib64 oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_0_0:ste:1 /etc/group ^systemd-journal:\w+:(\w+):.* 1 /usr/lib/group ^systemd-journal:\w+:(\w+):.* 1 oval:ssg-object_file_groupownerdir_groupowner_system_journal_systemd-journal_gid_etc:obj:1 oval:ssg-object_file_groupownerdir_groupowner_system_journal_systemd-journal_gid_usr:obj:1 /run/log/journal oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupowner_system_journal_0_systemd-journal:ste:1 /var/log/journal oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupowner_system_journal_0_systemd-journal:ste:1 /bin oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupownership_binary_dirs_0_0:ste:1 /sbin oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupownership_binary_dirs_0_0:ste:1 /usr/bin oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupownership_binary_dirs_0_0:ste:1 /usr/sbin oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupownership_binary_dirs_0_0:ste:1 /usr/local/bin oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupownership_binary_dirs_0_0:ste:1 /usr/local/sbin oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerdir_groupownership_binary_dirs_0_0:ste:1 /run/log/journal oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_owner_system_journal_0_0:ste:1 /var/log/journal oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_owner_system_journal_0_0:ste:1 /bin oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_binary_dirs_0_0:ste:1 /sbin oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_binary_dirs_0_0:ste:1 /usr/bin oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_binary_dirs_0_0:ste:1 /usr/sbin oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_binary_dirs_0_0:ste:1 /usr/local/bin oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_binary_dirs_0_0:ste:1 /usr/local/sbin oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_binary_dirs_0_0:ste:1 /lib oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1 /lib64 oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1 /usr/lib oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1 /usr/lib64 oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownerdir_ownership_library_dirs_0_0:ste:1 /bin oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1 /sbin oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1 /usr/bin oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1 /usr/sbin oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1 /usr/local/bin oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1 /usr/local/sbin oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1 oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1 /run/log/journal oval:ssg-exclude_symlinks_dir_permissions_system_journal:ste:1 oval:ssg-state_file_permissionsdir_permissions_system_journal_0_mode_2750or_stricter_:ste:1 /var/log/journal oval:ssg-exclude_symlinks_dir_permissions_system_journal:ste:1 oval:ssg-state_file_permissionsdir_permissions_system_journal_1_mode_2750or_stricter_:ste:1 /usr/bin/journalctl oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupowner_journalctl_0_0:ste:1 /etc/group ^systemd-journal:\w+:(\w+):.* 1 /usr/lib/group ^systemd-journal:\w+:(\w+):.* 1 oval:ssg-object_file_groupowner_system_journal_systemd-journal_gid_etc:obj:1 oval:ssg-object_file_groupowner_system_journal_systemd-journal_gid_usr:obj:1 ^/var/log/journal/.*/system.journal$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupowner_system_journal_0_systemd-journal:ste:1 /var/log oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupowner_var_log_0_0:ste:1 /var/log/syslog oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupowner_var_log_syslog_0_4:ste:1 /etc/audit ^.*audit(\.rules|d\.conf)$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownership_audit_configuration_0_0:ste:1 /etc/audit/rules.d ^.*\.rules$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownership_audit_configuration_0_0:ste:1 /usr/bin/journalctl oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_owner_journalctl_0_0:ste:1 ^/var/log/journal/.*/system.journal$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_owner_system_journal_0_0:ste:1 /var/log oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_owner_var_log_0_0:ste:1 syslog /var/log/syslog oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_owner_var_log_syslog_0_syslog:ste:1 /sbin/auditctl oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /sbin/aureport oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /sbin/ausearch oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /sbin/autrace oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /sbin/auditd oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /sbin/audispd oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /sbin/augenrules oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_binaries_0_0:ste:1 /etc/audit ^.*audit(\.rules|d\.conf)$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_configuration_0_0:ste:1 /etc/audit/rules.d ^.*\.rules$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_audit_configuration_0_0:ste:1 /lib ^.*$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_library_dirs_0_0:ste:1 /lib64 ^.*$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_library_dirs_0_0:ste:1 /usr/lib ^.*$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_library_dirs_0_0:ste:1 /usr/lib64 ^.*$ oval:ssg-symlink_file_owner:ste:1 oval:ssg-state_file_ownership_library_dirs_0_0:ste:1 /sbin/auditctl oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_0_mode_0755or_stricter_:ste:1 /sbin/aureport oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_1_mode_0755or_stricter_:ste:1 /sbin/ausearch oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_2_mode_0755or_stricter_:ste:1 /sbin/autrace oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_3_mode_0755or_stricter_:ste:1 /sbin/auditd oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_4_mode_0755or_stricter_:ste:1 /sbin/audispd oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_5_mode_0755or_stricter_:ste:1 /sbin/augenrules oval:ssg-exclude_symlinks__audit_binaries:ste:1 oval:ssg-state_file_permissions_audit_binaries_6_mode_0755or_stricter_:ste:1 /etc/audit/auditd.conf oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1 oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1 /etc/audit/audit.rules oval:ssg-exclude_symlinks__etc_audit_rules:ste:1 oval:ssg-state_file_permissions_etc_audit_rules_0_mode_0640or_stricter_:ste:1 /etc/audit/rules.d ^.*rules$ oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1 oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0600or_stricter_:ste:1 /usr/bin/journalctl oval:ssg-exclude_symlinks__journalctl:ste:1 oval:ssg-state_file_permissions_journalctl_0_mode_0740or_stricter_:ste:1 /lib ^.*$ oval:ssg-exclude_symlinks__library_dirs:ste:1 oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1 /lib64 ^.*$ oval:ssg-exclude_symlinks__library_dirs:ste:1 oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1 /usr/lib ^.*$ oval:ssg-exclude_symlinks__library_dirs:ste:1 oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1 /usr/lib64 ^.*$ oval:ssg-exclude_symlinks__library_dirs:ste:1 oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1 ^/var/log/journal/.*/system.journal$ oval:ssg-exclude_symlinks__system_journal:ste:1 oval:ssg-state_file_permissions_system_journal_0_mode_0640or_stricter_:ste:1 /var/log oval:ssg-exclude_symlinks__var_log:ste:1 oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1 /var/log/syslog oval:ssg-exclude_symlinks__var_log_syslog:ste:1 oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1 ^.*\.conf$ ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ 1 /etc/modprobe.conf ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ 1 /var/log .* oval:ssg-exclude_symlinks_permissions_local_var_log:ste:1 oval:ssg-state_file_permissionspermissions_local_var_log_0_mode_0640or_stricter_:ste:1 /lib ^.*$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1 /lib64 ^.*$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1 /usr/lib ^.*$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1 /usr/lib64 ^.*$ oval:ssg-symlink_file_groupowner:ste:1 oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_0_0:ste:1 multi-user.target multi-user.target ^auditd\.(socket|service)$ ActiveState audit multi-user.target multi-user.target ^rsyslog\.(socket|service)$ ActiveState rsyslog multi-user.target multi-user.target ^sshd\.(socket|service)$ ActiveState openssh-server multi-user.target multi-user.target ^sssd\.(socket|service)$ ActiveState sssd-common multi-user.target multi-user.target ^ufw\.(socket|service)$ ActiveState ufw kernel.dmesg_restrict oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_etc_sysctls_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_sysctl_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_etc_sysctld_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1 oval:ssg-object_static_run_sysctld_sysctl_kernel_dmesg_restrict:obj:1 /etc/sysctl.conf ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ 1 /etc/sysctl.d ^.*\.conf$ ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ 1 /run/sysctl.d ^.*\.conf$ ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ 1 /usr/local/lib/sysctl.d ^.*\.conf$ ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ 1 /usr/lib/sysctl.d ^.*\.conf$ ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ 1 /lib/sysctl.d ^.*\.conf$ ^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$ 1 kernel.randomize_va_space oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_etc_sysctls_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_sysctl_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_etc_sysctld_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_run_sysctld_sysctl_kernel_randomize_va_space:obj:1 /etc/sysctl.conf ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ 1 /etc/sysctl.d ^.*\.conf$ ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ 1 /run/sysctl.d ^.*\.conf$ ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ 1 /usr/local/lib/sysctl.d ^.*\.conf$ ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ 1 /usr/lib/sysctl.d ^.*\.conf$ ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ 1 /lib/sysctl.d ^.*\.conf$ ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$ 1 net.ipv4.tcp_syncookies oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1 /etc/sysctl.conf ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ 1 /etc/sysctl.d ^.*\.conf$ ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ 1 /run/sysctl.d ^.*\.conf$ ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ 1 /usr/local/lib/sysctl.d ^.*\.conf$ ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ 1 /usr/lib/sysctl.d ^.*\.conf$ ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ 1 /lib/sysctl.d ^.*\.conf$ ^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$ 1 /etc/pam_pkcs11/pam_pkcs11.conf ^[\s]*use_mappers = pwent[\s]*$ 1 ^[\s]+"false"[\s]*;[\s]*$ maxpoll \d+ ca_cert,ocsp ^.*pam.*$ (?i)true userCertificate;binary 1 /etc/pam.d/fingerprint-auth /etc/authselect/fingerprint-auth /etc/pam.d/password-auth /etc/authselect/password-auth /etc/pam.d/postlogin /etc/authselect/postlogin /etc/pam.d/smartcard-auth /etc/authselect/smartcard-auth /etc/pam.d/system-auth /etc/authselect/system-auth 0 sha512 /etc/systemd/system/ctrl-alt-del.target /dev/null -1 ^(\!|\*).*$ 1 1 /etc/localtime ^(/usr)?/share/zoneinfo(/Etc)?/(GMT|UTC)$ UP false true ^/dev/.*$ 1000 symbolic link 0 true true symbolic link 1 1 ^no$ apparmor.service apparmor.socket active ^1 -1$ symbolic link symbolic link false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false symbolic link false false false false false false false false false false false false symbolic link false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false false symbolic link false false false false false false false false false symbolic link false false false false false false false false false symbolic link false false false false false false false false false false symbolic link false false false false false false false false symbolic link false false false false false false false false symbolic link false false false false false false false false false symbolic link false false false false false symbolic link false false false false false false false false false symbolic link false false false false false false false false false symbolic link auditd.service auditd.socket active rsyslog.service rsyslog.socket active sshd.service sshd.socket active sssd.service sssd.socket active ufw.service ufw.socket active 1 1 2 2 (?i) (?i) ^[\s]*auth[\s]+(?:required|requisite)[\s]+pam_faillock.so[^\n#]preauth[^\n#]*audit ^[\s]*auth[\s]+(?:required|requisite)[\s]+pam_faillock.so[^\n#]+preauth[^\n#]+silent ^ $ ^\s*auth\N+pam_unix\.so ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+) ^[\s]*deny[\s]*=[\s]*([0-9]+) ^\s*auth\N+pam_unix\.so ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+) ^[\s]*fail_interval[\s]*=[\s]*([0-9]+) ^\s*auth\N+pam_unix\.so ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) ^[\s]*unlock_time[\s]*=[\s]*([0-9]+) 0 0 0 0 0 0 0 4 0 0 0 0 0 0 0 /etc/modprobe.d /etc/modules-load.d /run/modprobe.d /run/modules-load.d /usr/lib/modprobe.d /usr/lib/modules-load.d 0