End-to-End Demo: Compliance Posture
August 12, 2026 · View on GitHub
This repo comprises Compliance Posture for the end-to-end demo.
The end-to-end demo overview.
The end-to-end-demo compliance posture portion instructions.
Last updated: 2025-03-27 12:56:11
Controls for: NIST_800-53_rev5_selected
Component definition for: Ubuntu_Linux_24.04_LTS V1.0
type: #scap_org.open-scap_comp_ssg-ubuntu2404-xccdf
host: vagrant
Status by control
| control name | control status |
|---|---|
| ac-1 |
fail
|
| ac-2 |
fail
|
| ac-2.1 |
fail
|
| ac-2.5 |
fail
|
| ac-3 |
fail
|
| ac-5 |
fail
|
| ac-6 |
fail
|
| ac-6.2 |
error
|
| ac-6.5 |
error
|
| ac-11 |
fail
|
| ac-11.1 |
fail
|
| ac-12 |
fail
|
| ac-17.2 |
fail
|
| au-2 |
error
|
| au-3 |
error
|
| au-3.1 |
error
|
| au-7 |
error
|
| au-12 |
error
|
| cm-1 |
pass
|
| cm-2 |
pass
|
| cm-6 |
error
|
| cm-7 |
error
|
| cm-7.1 |
pass
|
| cm-9 |
pass
|
| ia-5 |
fail
|
| ia-5.1 |
fail
|
| mp-2 |
fail
|
| sa-3 |
pass
|
| sa-8 |
pass
|
| sa-10 |
pass
|
| sc-8 |
fail
|
| sc-8.1 |
fail
|
| sc-28 |
fail
|
| sc-28.1 |
fail
|
Status by control + rule
| control name | control status | rule name | rule status |
|---|---|---|---|
| ac-1 |
fail
| ||
| accounts_passwords_pam_faillock_deny |
fail
| ||
| accounts_passwords_pam_faillock_enabled |
fail
| ||
| accounts_passwords_pam_faillock_root_unlock_time |
fail
| ||
| accounts_passwords_pam_faillock_unlock_time |
fail
| ||
| ac-2 |
fail
| ||
| accounts_passwords_pam_faillock_deny |
fail
| ||
| accounts_passwords_pam_faillock_enabled |
fail
| ||
| accounts_passwords_pam_faillock_root_unlock_time |
fail
| ||
| accounts_passwords_pam_faillock_unlock_time |
fail
| ||
| ac-2.1 |
fail
| ||
| accounts_passwords_pam_faillock_deny |
fail
| ||
| accounts_passwords_pam_faillock_enabled |
fail
| ||
| accounts_passwords_pam_faillock_root_unlock_time |
fail
| ||
| accounts_passwords_pam_faillock_unlock_time |
fail
| ||
| ac-2.5 |
fail
| ||
| accounts_tmout |
fail
| ||
| ac-3 |
fail
| ||
| accounts_password_pam_unix_enabled |
pass
| ||
| accounts_root_gid_zero |
pass
| ||
| accounts_umask_etc_bashrc |
fail
| ||
| accounts_umask_etc_login_defs |
fail
| ||
| accounts_umask_etc_profile |
fail
| ||
| accounts_umask_root |
pass
| ||
| ensure_pam_wheel_group_empty |
fail
| ||
| ensure_root_access_controlled |
error
| ||
| file_groupowner_sshd_config |
pass
| ||
| file_owner_sshd_config |
pass
| ||
| file_permissions_sshd_config |
fail
| ||
| file_permissions_sshd_private_key |
pass
| ||
| file_permissions_sshd_pub_key |
pass
| ||
| groups_no_zero_gid_except_root |
pass
| ||
| no_invalid_shell_accounts_unlocked |
pass
| ||
| no_shelllogin_for_systemaccounts |
pass
| ||
| sshd_limit_user_access |
error
| ||
| use_pam_wheel_group_for_su |
fail
| ||
| ac-5 |
fail
| ||
| accounts_password_pam_unix_enabled |
pass
| ||
| accounts_root_gid_zero |
pass
| ||
| accounts_umask_etc_bashrc |
fail
| ||
| accounts_umask_etc_login_defs |
fail
| ||
| accounts_umask_etc_profile |
fail
| ||
| accounts_umask_root |
pass
| ||
| ensure_pam_wheel_group_empty |
fail
| ||
| ensure_root_access_controlled |
error
| ||
| file_groupowner_sshd_config |
pass
| ||
| file_owner_sshd_config |
pass
| ||
| file_permissions_sshd_config |
fail
| ||
| file_permissions_sshd_private_key |
pass
| ||
| file_permissions_sshd_pub_key |
pass
| ||
| groups_no_zero_gid_except_root |
pass
| ||
| no_invalid_shell_accounts_unlocked |
pass
| ||
| no_shelllogin_for_systemaccounts |
pass
| ||
| sshd_limit_user_access |
error
| ||
| use_pam_wheel_group_for_su |
fail
| ||
| ac-6 |
fail
| ||
| accounts_password_pam_unix_enabled |
pass
| ||
| accounts_root_gid_zero |
pass
| ||
| accounts_umask_etc_bashrc |
fail
| ||
| accounts_umask_etc_login_defs |
fail
| ||
| accounts_umask_etc_profile |
fail
| ||
| accounts_umask_root |
pass
| ||
| ensure_pam_wheel_group_empty |
fail
| ||
| ensure_root_access_controlled |
error
| ||
| file_groupowner_sshd_config |
pass
| ||
| file_owner_sshd_config |
pass
| ||
| file_permissions_sshd_config |
fail
| ||
| file_permissions_sshd_private_key |
pass
| ||
| file_permissions_sshd_pub_key |
pass
| ||
| groups_no_zero_gid_except_root |
pass
| ||
| no_invalid_shell_accounts_unlocked |
pass
| ||
| no_shelllogin_for_systemaccounts |
pass
| ||
| sshd_limit_user_access |
error
| ||
| use_pam_wheel_group_for_su |
fail
| ||
| ac-6.2 |
error
| ||
| package_sudo_installed |
pass
| ||
| sshd_disable_root_login |
error
| ||
| sudo_add_use_pty |
error
| ||
| sudo_remove_no_authenticate |
error
| ||
| sudo_require_authentication |
error
| ||
| sudo_require_reauthentication |
error
| ||
| ac-6.5 |
error
| ||
| package_sudo_installed |
pass
| ||
| sshd_disable_root_login |
error
| ||
| sudo_add_use_pty |
error
| ||
| sudo_remove_no_authenticate |
error
| ||
| sudo_require_authentication |
error
| ||
| sudo_require_reauthentication |
error
| ||
| ac-11 |
fail
| ||
| accounts_tmout |
fail
| ||
| ac-11.1 |
fail
| ||
| accounts_tmout |
fail
| ||
| ac-12 |
fail
| ||
| accounts_tmout |
fail
| ||
| ac-17.2 |
fail
| ||
| sshd_use_strong_ciphers |
fail
| ||
| sshd_use_strong_kex |
fail
| ||
| sshd_use_strong_macs |
fail
| ||
| au-2 |
error
| ||
| sshd_set_loglevel_info |
error
| ||
| au-3 |
error
| ||
| sshd_set_max_auth_tries |
error
| ||
| sudo_custom_logfile |
error
| ||
| au-3.1 |
error
| ||
| sshd_set_max_auth_tries |
error
| ||
| sudo_custom_logfile |
error
| ||
| au-7 |
error
| ||
| sshd_set_loglevel_info |
error
| ||
| sshd_set_max_auth_tries |
error
| ||
| sudo_custom_logfile |
error
| ||
| au-12 |
error
| ||
| sshd_set_loglevel_info |
error
| ||
| sshd_set_max_auth_tries |
error
| ||
| sudo_custom_logfile |
error
| ||
| cm-1 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| cm-2 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| cm-6 |
error
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| sshd_disable_forwarding |
error
| ||
| cm-7 |
error
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| sshd_disable_forwarding |
error
| ||
| cm-7.1 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| cm-9 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| ia-5 |
fail
| ||
| sshd_use_strong_ciphers |
fail
| ||
| sshd_use_strong_kex |
fail
| ||
| sshd_use_strong_macs |
fail
| ||
| ia-5.1 |
fail
| ||
| account_disable_post_pw_expiration |
fail
| ||
| accounts_maximum_age_login_defs |
fail
| ||
| accounts_minimum_age_login_defs |
fail
| ||
| accounts_password_last_change_is_in_past |
pass
| ||
| accounts_password_pam_dcredit |
fail
| ||
| accounts_password_pam_dictcheck |
fail
| ||
| accounts_password_pam_difok |
fail
| ||
| accounts_password_pam_enforce_root |
fail
| ||
| accounts_password_pam_enforcing |
fail
| ||
| accounts_password_pam_lcredit |
fail
| ||
| accounts_password_pam_maxrepeat |
fail
| ||
| accounts_password_pam_maxsequence |
fail
| ||
| accounts_password_pam_minclass |
fail
| ||
| accounts_password_pam_minlen |
fail
| ||
| accounts_password_pam_ocredit |
fail
| ||
| accounts_password_pam_pwhistory_enabled |
fail
| ||
| accounts_password_pam_pwhistory_enforce_root |
fail
| ||
| accounts_password_pam_pwhistory_remember |
fail
| ||
| accounts_password_pam_pwhistory_use_authtok |
fail
| ||
| accounts_password_pam_pwquality_enabled |
fail
| ||
| accounts_password_pam_ucredit |
fail
| ||
| accounts_password_pam_unix_authtok |
pass
| ||
| accounts_password_pam_unix_no_remember |
pass
| ||
| accounts_password_set_max_life_existing |
error
| ||
| accounts_password_set_min_life_existing |
error
| ||
| no_empty_passwords_unix |
fail
| ||
| set_password_hashing_algorithm_logindefs |
pass
| ||
| set_password_hashing_algorithm_systemauth |
pass
| ||
| sshd_disable_empty_passwords |
error
| ||
| sshd_disable_gssapi_auth |
error
| ||
| sshd_disable_rhosts |
error
| ||
| sshd_enable_pam |
error
| ||
| sshd_use_strong_ciphers |
fail
| ||
| sshd_use_strong_kex |
fail
| ||
| sshd_use_strong_macs |
fail
| ||
| mp-2 |
fail
| ||
| accounts_password_pam_unix_enabled |
pass
| ||
| accounts_root_gid_zero |
pass
| ||
| accounts_umask_etc_bashrc |
fail
| ||
| accounts_umask_etc_login_defs |
fail
| ||
| accounts_umask_etc_profile |
fail
| ||
| accounts_umask_root |
pass
| ||
| ensure_pam_wheel_group_empty |
fail
| ||
| ensure_root_access_controlled |
error
| ||
| file_groupowner_sshd_config |
pass
| ||
| file_owner_sshd_config |
pass
| ||
| file_permissions_sshd_config |
fail
| ||
| file_permissions_sshd_private_key |
pass
| ||
| file_permissions_sshd_pub_key |
pass
| ||
| groups_no_zero_gid_except_root |
pass
| ||
| no_invalid_shell_accounts_unlocked |
pass
| ||
| no_shelllogin_for_systemaccounts |
pass
| ||
| sshd_limit_user_access |
error
| ||
| use_pam_wheel_group_for_su |
fail
| ||
| sa-3 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| sa-8 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| sa-10 |
pass
| ||
| accounts_password_warn_age_login_defs |
pass
| ||
| sc-8 |
fail
| ||
| sshd_use_strong_ciphers |
fail
| ||
| sshd_use_strong_kex |
fail
| ||
| sshd_use_strong_macs |
fail
| ||
| sc-8.1 |
fail
| ||
| sshd_use_strong_ciphers |
fail
| ||
| sshd_use_strong_kex |
fail
| ||
| sshd_use_strong_macs |
fail
| ||
| sc-28 |
fail
| ||
| accounts_password_pam_pwhistory_use_authtok |
fail
| ||
| accounts_password_pam_unix_authtok |
pass
| ||
| set_password_hashing_algorithm_logindefs |
pass
| ||
| set_password_hashing_algorithm_systemauth |
pass
| ||
| sc-28.1 |
fail
| ||
| accounts_password_pam_pwhistory_use_authtok |
fail
| ||
| accounts_password_pam_unix_authtok |
pass
| ||
| set_password_hashing_algorithm_logindefs |
pass
| ||
| set_password_hashing_algorithm_systemauth |
pass
|
We are a Cloud Native Computing Foundation sandbox project.
The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see Trademark Usage.
OSCAL Compass is an independent open source project. It is not affiliated with, endorsed by, or sponsored by the National Institute of Standards and Technology (NIST) or any other government agency.
OSCAL Compass was originally contributed by IBM.