DISA STIG compliance in MOSK

The following results are for the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) benchmark after applying the Mirantis-provided host OS configuration recipes:

Benchmark	Tenable DISA Canonical Ubuntu 24.04 LTS STIG v1r6
Pass rate	82.47% [0]
MOSK release	26.2
Operating system	Ubuntu 24.04
Scanner tool	Nessus version 11.2.2, build R20009

[0]

Pass rate measured on the release date. Later scans may report a different value.

Expected and falsely reported failures

The controls below did not pass the benchmark and are documented exceptions: not applicable to the MOSK architecture or pending further analysis. In field deployments, these items can be mitigated on a per-cluster basis, taking into account the specifics of the environment.

Caution

Compliance results can vary across different environments depending on configuration tests, such as server disk partitioning.

Note

The test IDs may differ depending on the scanning tool.

Expected failures

Test ID	Test Title	Comment
UBTU-24-100050	Ubuntu 24.04 LTS must not have the nfs-kernel-server package installed.	The nfs-kernel-server package is a prerequisite for backing up cluster data off-cloud to an NFS share. Removing it would disable that remote backup capability. For configuration details, see Enable OpenStack database remote backups.
UBTU-24-100100	Ubuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security functions.	Impacts the storage IO performance. Further investigation for an alternative is pending.
UBTU-24-100110	Ubuntu 24.04 LTS must configure AIDE to perform file integrity checking on the file system if installed.	Impacts the storage IO performance. Further investigation for an alternative is pending.
UBTU-24-100130	Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.	Impacts the storage IO performance. Further investigation for an alternative is pending.
UBTU-24-100300	Ubuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.	Not applicable. Uncomplicated Firewall (UFW) is not compatible with Docker and Kubernetes and therefore cannot be used in MOSK.
UBTU-24-100310	Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).	Not applicable. Uncomplicated Firewall (UFW) is not compatible with Docker and Kubernetes and therefore cannot be used in MOSK.
UBTU-24-100650	Ubuntu 24.04 LTS must have the “SSSD” package installed.	Not yet supported by the product. Further investigation is pending.
UBTU-24-100660	Ubuntu 24.04 LTS must use the “SSSD” package for multifactor authentication services.	Not yet supported by the product. Further investigation is pending.
UBTU-24-102000	Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.	Not applicable. Booting into single-user or maintenance mode is a recovery action. Requiring a password for that path introduces operational risk for the majority of MOSK deployments, and therefore is not done by default. If the environment requires it, apply the setting with extreme caution.
UBTU-24-200250	Ubuntu 24.04 LTS must automatically remove or disable emergency accounts after 72 hours.	Not applicable. MOSK does not provision emergency accounts on host operating systems. The check inspects all local accounts for an automatic 72-hour disablement policy that does not apply to this architecture.
UBTU-24-200260	Ubuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.	Exception. In MOSK, cloud operators only access hosts for deep troubleshooting. The mcc-user account is also used by life cycle management (LCM) to configure the host operating system in an unattended way. Disabling that account after inactivity would interrupt LCM, and the product does not provide a separate administrator account that can re-enable it.
UBTU-24-200680	Ubuntu 24.04 LTS must be configured to enforce the acknowledgement of the Standard Mandatory DOD Notice and Consent Banner for all SSH connections.	Exception. Enforcing interactive acknowledgement of the notice and consent banner during SSH authentication would interrupt MOSK life cycle management (LCM), which accesses hosts in an unattended way. Cloud operators are not expected to SSH to cluster nodes except for emergency troubleshooting.
UBTU-24-300020	Ubuntu 24.04 LTS must require users to provide a password for privilege escalation.	Exception. The mcc-user account is used by MOSK life cycle management (LCM) to apply host operating system configuration in an unattended way. Requiring a password for privilege escalation would block the normal operation of LCM.
UBTU-24-300030	Ubuntu 24.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.	Not applicable. The required default filesystem permissions are not compatible with reliable functioning of the Kubernetes underlay for MOSK.
UBTU-24-300041	Ubuntu 24.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.	Not applicable. Uncomplicated Firewall (UFW) is not compatible with Docker and Kubernetes and therefore cannot be used in MOSK.
UBTU-24-400020	Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.	Not yet supported by the product. Further investigation is pending.
UBTU-24-400060	Ubuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials.	Not yet supported by the product. Further investigation is pending.
UBTU-24-400340	Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.	Not yet supported by the product. Further investigation is pending.
UBTU-24-400360	Ubuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.	Not yet supported by the product. Further investigation is pending.
UBTU-24-400370	Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.	Not yet supported by the product. Further investigation is pending.
UBTU-24-400375	Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.	Not yet supported by the product. Further investigation is pending.
UBTU-24-400380	Ubuntu 24.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.	Not yet supported by the product. Further investigation is pending.
UBTU-24-600060	Ubuntu 24.04 LTS must use DOD PKI-established certificate authorities (CAs) for verification of the establishment of protected sessions.	Exception. Restricting trust to DOD PKI-established certificate authorities would cause the host operating system to reject TLS sessions whose certificates are not in that chain, including MOSK package repositories signed by commercial CAs. The requirement is not compatible with normal operation of MOSK.
UBTU-24-600090	Ubuntu 24.04 LTS handling data requiring “data at rest” protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.	Not yet supported by the product. Mirantis plans to introduce host operating system-level encryption of disk partitions to protect data at rest on each server in the cluster.
UBTU-24-600130	Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of the sudo group.	Exception. The mcc-user account is used by MOSK life cycle management (LCM) to apply required host operating system configuration in an unattended way. It is the only account that requires sudo access, including for maintenance.
UBTU-24-600150	Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred using shared system resources.	Not applicable. Container runtimes continuously create and recreate directories on host filesystems. Enforcing a sticky bit on all public directories is not compatible with normal operation of MOSK Kubernetes underlay.
UBTU-24-600200	Ubuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network interfaces.	Not applicable. Uncomplicated Firewall (UFW) is not compatible with Docker and Kubernetes and therefore cannot be used in MOSK.
UBTU-24-700120	Ubuntu 24.04 LTS must configure the /var/log directory to have mode “0755” or less permissive.	Exception. Restricting /var/log to mode 0755 or less permissive can break logging for services and containers that write to that directory. The required mode is not compatible with normal operation of MOSK.
UBTU-24-700320	Ubuntu 24.04 LTS must be configured so that Advance Package Tool (APT) removes all software components after updated versions have been installed.	Exception. MOSK preserves old kernel packages as a safety measure so that a host can be reverted to a previous state. Package cleanup is explicitly triggered by the cloud operator.
UBTU-24-700400	Ubuntu 24.04 LTS must be a vendor-supported release.	False positive. The product relies on Ubuntu 24.04 LTS as the host operating system, which is a vendor-supported release.
UBTU-24-900920	Ubuntu 24.04 LTS must allocate audit record storage capacity to store at least one week’s worth of audit records, when audit records are not immediately sent to a central audit record storage facility.	Not applicable. By default, MOSK forwards all logs, including audit records, to StackLight, where they are retained for the configured period. A dedicated local partition for audit logs is therefore not considered necessary, though it remains possible to configure during the initial deployment.
UBTU-24-900980	Ubuntu 24.04 LTS must alert the system administrator (SA) and information system security officer (ISSO) (at a minimum) in the event of an audit processing failure.	Not yet supported by the product. Further investigation is pending.
UBTU-24-909890	Ubuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.	Potential impact on the storage IO performance. Further investigation for an alternative is pending.

The following controls are already satisfied in MOSK. The scanner still reports them as failures because of how those checks are implemented. They count toward the published pass rate.

Falsely reported failures

Test ID	Test Title
UBTU-24-100450	Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited.
UBTU-24-100820	Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
UBTU-24-102010	Ubuntu 24.04 LTS must initiate session audits at system startup.
UBTU-24-600000	Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic after a period of inactivity.
UBTU-24-600010	Ubuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.
UBTU-24-600070	Ubuntu 24.04 LTS must disable kernel core dumps.
UBTU-24-700010	Ubuntu 24.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
UBTU-24-900950	Ubuntu 24.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.
UBTU-24-900960 [1]	Ubuntu 24.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

[1]

Audit logs are stored in a separate OpenSearch index in StackLight. The disk capacity allocated to logs is monitored.

For a detailed report of analyzed and fixed compliance checks, contact Mirantis support.