################################################################################
DOCUMENT         : Amazon_Linux_2023_STIG
VERSION          : 001.002.001
CHECKSUM         : 7f75866ad43f7d0511b9aae9bdc8962319dc3ec4793940a2738b150630b7cb03
MANUAL QUESTIONS : 17

IMPORTANT: Make sure to save the completed version of this file to: 
<SCC Install>/Resources/Content/Manual_Questions/Completed_Files

This file contains all of the non-automated STIG requirements found in the STIG.
Results from this file will be combined with automated checks in SCC to provide
complete STIG compliance results.

This file will be programmaticaly imported, so do not modify anything in this file
except for placing an '[X]' to select a Single answer, and entering text comments.

The list of questions is printed in order of severity, listing CAT I (High), then CAT II, etc..

################################################################################

QUESTION         : 1 of 17
TITLE            : CAT I, V-273994, SV-273994r1119970, SRG-OS-000185-GPOS-00079
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:101
RULE             : Amazon Linux 2023 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
QUESTION_TEXT    : Verify Amazon Linux 2023 is configured so that all partitions are encrypted with the following command:

$ sudo blkid
/dev/xvda1: UUID="ed0acbe9-bd05-495e-a9ac-cb615b29327d" TYPE="crypto_LUKS"

Every persistent disk partition present must be of "Type" "crypto_LUKS". 

If any partitions other than the boot partition, bios partition or pseudo file systems (such as /proc or /sys) are not type "crypto_LUKS", this is a finding.

References:
CCI-001199
CCI-002475
CCI-002476
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 1 *******************************

QUESTION         : 2 of 17
TITLE            : CAT I, V-283441, SV-283441r1192638, SRG-OS-000033-GPOS-00014
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:36501
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:36501
RULE             : Amazon Linux 2023 must enable FIPS mode.
QUESTION_TEXT    : Verify Amazon Linux 2023 is in FIPS mode with the following command:

$ sudo fips-mode-setup --check
FIPS mode is enabled.

If FIPS mode is not enabled, this is a finding.

If any other lines are returned by the above command, run the following command to see the currently applied crypto-policy:

$ update-crypto-policies --show
FIPS

If the policy is not "FIPS" or a FIPS policy authorized by and documented with the ISSO, this is a finding.

References:
CCI-000068
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 2 *******************************

QUESTION         : 3 of 17
TITLE            : CAT I, V-283452, SV-283452r1188500, SRG-OS-000396-GPOS-00176
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:37101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:37101
RULE             : Amazon Linux 2023 must implement a FIPS 140-2/140-3 compliant systemwide cryptographic policy.
QUESTION_TEXT    : Verify Amazon Linux 2023 is set to use a FIPS 140-2/140-3 compliant systemwide cryptographic policy.

$ update-crypto-policies --show
FIPS
 
If the systemwide crypto policy is not set to "FIPS", this is a finding.

Inspect the contents of the REQUIRE.pmod file (if it exists) to verify only authorized modifications to the current policy are included with the following command:

$ cat /etc/crypto-policies/policies/modules/REQUIRE.pmod

Note: If subpolicies have been configured, they could be listed in a colon-separated list starting with FIPS as follows FIPS:<SUBPOLICY-NAME>:<SUBPOLICY-NAME>. This is not a finding.

If the AD-SUPPORT subpolicy module is included (e.g., "FIPS:AD-SUPPORT"), and Active Directory support is not documented as an operational requirement with the information system security officer (ISSO), this is a finding.

If the NO-ENFORCE-EMS subpolicy module is included (e.g., "FIPS:NO-ENFORCE-EMS"), and not enforcing EMS is not documented as an operational requirement with the ISSO, this is a finding.

Verify the current minimum crypto-policy configuration with the following commands:
 
$ grep -E 'rsa_size|hash' /etc/crypto-policies/state/CURRENT.pol
hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256
min_rsa_size = 2048
 
If the "hash" values do not include at least the following FIPS 140-2/140-3 compliant algorithms "SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 SHAKE-256", this is a finding.

If there are algorithms that include "SHA1" or a hash value less than "256" this is a finding.

If the "min_rsa_size" is not set to a value of at least 2048, this is a finding.
 
If these commands do not return any output, this is a finding.

References:
CCI-000803
CCI-002450
CCI-002890
CCI-003123
CCI-002421
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 3 *******************************

QUESTION         : 4 of 17
TITLE            : CAT II, V-273995, SV-273995r1119973, SRG-OS-000366-GPOS-00153
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:301
RULE             : Amazon Linux 2023 must ensure cryptographic verification of vendor software packages.
QUESTION_TEXT    : Verify Amazon Linux 2023 package-signing keys are installed on the system and verify their fingerprints match vendor values.

Note: For Amazon Linux 2023 software packages, AWS uses GPG keys defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2023" by default.

List Amazon Linux GPG keys installed on the system:

$ sudo rpm -q gpg-pubkey --qf "%{NAME}-%{VERSION}-%{RELEASE} %{SUMMARY}\n"
gpg-pubkey-d832c631-6515c85e Amazon Linux <amazon-linux@amazon.com> public key

If there is no Amazon Linux GPG key installed, this is a finding.

Extract the fingerprint from the key with this command:

$ sudo gpg -q --keyid-format short --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2023
pub  rsa4096/D832C631 2022-12-08 [SC]
     Key fingerprint = B21C 50FA 44A9 9720 EAA7 2F7F E951 904A D832 C631
uid           Amazon Linux <amazon-linux@amazon.com>

Compare the Key fingerprint with the key fingerprint from Amazon Documentation and instructions at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-keys.html

If key fingerprints do not match, or the key file is missing, this is a finding.

References:
CCI-003992
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 4 *******************************

QUESTION         : 5 of 17
TITLE            : CAT II, V-274025, SV-274025r1192649, SRG-OS-000363-GPOS-00150
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:6301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:6301
RULE             : Amazon Linux 2023 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.
QUESTION_TEXT    : Verify Amazon Linux 2023 routinely executes a file integrity scan for changes to the system baseline. The commands used in the example will use a daily occurrence.

If using cron, check that the cronie service is running:

$ systemctl status crond
o crond.service - Command Scheduler
Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; preset: enabled)
Active: active (running) since Wed 2025-11-12 20:37:42 UTC; 7s ago

Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if Advanced Intrusion Detection Environment (AIDE) is installed on the system, use the following commands:

$ ls -al /etc/cron.daily | grep aide
-rwxr-xr-x 1 root root 29 Nov 22 2015 aide

$ sudo grep aide /etc/crontab /var/spool/cron/root
/etc/crontab: 30 04 * * * root usr/sbin/aide
/var/spool/cron/root: 30 04 * * * root usr/sbin/aide

$ sudo more /etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

If using systemd timers, ensure the aide timer is enabled:

$ systemctl status aide.timer
o aide.timer - Aide check every day at 1AM
     Loaded: loaded (/etc/systemd/system/aide.timer; enabled; preset: disabled)
     Active: active (waiting) since Thu 2025-11-20 15:23:24 UTC; 37s ago
    Trigger: Fri 2025-11-21 01:00:00 UTC; 9h left
   Triggers: o aide.service

If the timer unit file has a different name, list all available timers with the following command:

$ systemctl list-timers

If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

References:
CCI-001744
CCI-002699
CCI-002702
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 5 *******************************

QUESTION         : 6 of 17
TITLE            : CAT II, V-274060, SV-274060r1120168, SRG-OS-000068-GPOS-00036
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:11901
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:11901
RULE             : Amazon Linux 2023 must map the authenticated identity to the user or group account for PKI-based authentication.
QUESTION_TEXT    : Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable.

Verify the certificate of the user or group is mapped to the corresponding user or group in the "sssd.conf" file with the following command:

$ sudo find /etc/sssd/sssd.conf /etc/sssd/conf.d/ -type f -exec cat {} \;
[sssd]
config_file_version = 2
services = pam, sudo, ssh
domains = testing.test

[pam]
pam_cert_auth = True
offline_credentials_expiration = 1

[domain/testing.test]
id_provider = ldap

[certmap/testing.test/rule_name]
matchrule =<SAN>.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test

If the certmap section does not exist, ask the SA to indicate how certificates are mapped to accounts. If there is no evidence of certificate mapping, this is a finding.

References:
CCI-000187
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 6 *******************************

QUESTION         : 7 of 17
TITLE            : CAT II, V-274064, SV-274064r1120180, SRG-OS-000067-GPOS-00035
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:12701
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:12701
RULE             : Amazon Linux 2023, for PKI-based authentication, must enforce authorized access to the corresponding private key.
QUESTION_TEXT    : Verify Amazon Linux 2023 SSH private key files have a passcode.

For each private key stored on the system, use the following command:

$ sudo ssh-keygen -y -f /path/to/file

If the contents of the key are displayed, this is a finding.

References:
CCI-000186
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 7 *******************************

QUESTION         : 8 of 17
TITLE            : CAT II, V-274065, SV-274065r1184021, SRG-OS-000023-GPOS-00006
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:12901
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:12901
RULE             : Amazon Linux 2023 must display the Standard Mandatory DOD Notice and Consent Banner before granting local or remote access to the system.
QUESTION_TEXT    : Verify Amazon Linux 2023 displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the system over any publicly accessible connection.

View the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DOD Notice and Consent Banner with the following command:

$ more /etc/issue

"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details."

If the system does not display a logon banner or the banner text does not match the Standard Mandatory DOD Notice and Consent Banner, this is a finding.

References:
CCI-000048
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 8 *******************************

QUESTION         : 9 of 17
TITLE            : CAT II, V-274146, SV-274146r1120426, SRG-OS-000002-GPOS-00002
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:28701
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:28701
RULE             : Amazon Linux 2023 must automatically remove or disable temporary user accounts after 72 hours.
QUESTION_TEXT    : Verify Amazon Linux 2023 temporary accounts have been provisioned with an expiration date of 72 hours.

For every existing temporary account, run the following command to obtain its account expiration information.

$ sudo chage -l system_account_name

Verify each of these accounts has an expiration date set within 72 hours.

If any temporary accounts have no expiration date set or do not expire within 72 hours, this is a finding.

References:
CCI-000016
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 9 *******************************

QUESTION         : 10 of 17
TITLE            : CAT II, V-274150, SV-274150r1120438, SRG-OS-000123-GPOS-00064
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:29501
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:29501
RULE             : Amazon Linux 2023 must automatically expire temporary accounts within 72 hours.
QUESTION_TEXT    : Verify Amazon Linux 2023 temporary accounts have been provisioned with an expiration date of 72 hours.

For every existing temporary account, run the following command to obtain its account expiration information:

$ sudo chage -l <temporary_account_name> | grep -i "account expires"

Verify each of these accounts has an expiration date set within 72 hours. 

If any temporary accounts have no expiration date set or do not expire within 72 hours, this is a finding.

References:
CCI-001682
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 10 *******************************

QUESTION         : 11 of 17
TITLE            : CAT II, V-274158, SV-274158r1184031, SRG-OS-000096-GPOS-00050
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:31101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:31101
RULE             : Amazon Linux 2023 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.
QUESTION_TEXT    : Verify Amazon Linux 2023 firewall is configured to block unregistered ports, protocols, and services. 

Inspect the list of enabled firewall ports and verify they are configured correctly by running the following command:

$ sudo firewall-cmd --list-all 

Ask the system administrator for the site or program PPSM Component Local Service Assessment (CLSA). Verify the services allowed by the firewall match the PPSM CLSA. 

If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM CAL, or there are no firewall rules configured, this is a finding.

References:
CCI-000382
CCI-002314
CCI-000381
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 11 *******************************

QUESTION         : 12 of 17
TITLE            : CAT II, V-274165, SV-274165r1137695, SRG-OS-000138-GPOS-00069
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:32501
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:32501
RULE             : Amazon Linux 2023 must ensure all world-writable directories be owned by root, sys, bin, or an application user.
QUESTION_TEXT    : Verify Amazon Linux 2023 world writable directories are owned by root, a system account, or an application account with the following command:

$ sudo find / -xdev -type d -perm -0002 ! -user root ! -uid +999 -exec ls -ld {} +

If there is output, this is a finding.

References:
CCI-001090
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 12 *******************************

QUESTION         : 13 of 17
TITLE            : CAT II, V-274175, SV-274175r1190705, SRG-OS-000356-GPOS-00144
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:33901
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:33901
RULE             : Amazon Linux 2023 must synchronize internal information system clocks to the authoritative time source at least every 24 hours.
QUESTION_TEXT    : Verify Amazon Linux 2023 chrony service specifies a maximum interval of 24 hours between requests sent to a United States Naval Observatory (USNO) server with the following command:

Note: <USNO/DOD Server> is used in place of a time source IP address.

$ sudo grep maxpoll /etc/chrony.conf
server <USNO/DOD Server> iburst maxpoll 16

If the "maxpoll" option is not configured, set to a number greater than 16, or the line is commented out, this is a finding.

Verify Amazon Linux 2023 chrony service is configured to use authoritative USNO or appropriate DOD time source with the following command:

$ sudo grep -i server /etc/chrony.conf
server <USNO/DOD Server>

If the parameter "server" is not set or is not set to an authoritative USNO/DOD time source, this is a finding.

References:
CCI-004926
CCI-004922
CCI-001890
CCI-004923
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 13 *******************************

QUESTION         : 14 of 17
TITLE            : CAT II, V-274183, SV-274183r1120714, SRG-OS-000420-GPOS-00186
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:35301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:35301
RULE             : Amazon Linux 2023 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures are configured on impacted network interfaces.
QUESTION_TEXT    : Verify Amazon Linux 2023 is implementing rate-limiting measures on network interfaces to protect against DoS attacks. 

Access the AWS Management Console:

Sign in to the AWS Management Console and navigate to the EC2 service.

To locate the Application Load Balancer (ALB) in the EC2 dashboard, go to the "Load Balancers" section and find the ALB. 

Check the ALB configuration: Click on the ALB to view its details. The listener configuration for the ALB is located in the "Listener" tab. 

Look for the rate limiting settings: Scroll down to the "Rules" section. If rate limiting is enabled, a rule with the "Rate Limit" action will be displayed.

References:
CCI-002385
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 14 *******************************

QUESTION         : 15 of 17
TITLE            : CAT II, V-274184, SV-274184r1120540, SRG-OS-000433-GPOS-00192
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:35501
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:35501
RULE             : Amazon Linux 2023 must implement nonexecutable data to protect its memory from unauthorized code execution.
QUESTION_TEXT    : Verify Amazon Linux 2023 NX support is enabled with the following command:

$ sudo dmesg | grep '[NX|DX]*protection'
[ 0.000000] NX (Execute Disable) protection: active

If "dmesg" does not show "NX (Execute Disable) protection" active, this is a finding.

References:
CCI-002824
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 15 *******************************

QUESTION         : 16 of 17
TITLE            : CAT II, V-284944, SV-284944r1208267, SRG-OS-000479-GPOS-00224
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:37301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:37301
RULE             : Amazon Linux 2023 must ensure that the rsyslog service is running and persistent.
QUESTION_TEXT    : Verify Amazon Linux 2023 is configured so that the rsyslog service is enabled and active with the following commands:

$ sudo systemctl is-enabled rsyslog
enabled

$ sudo systemctl is-active rsyslog
active

If the service is not "enabled" and "active" this is a finding.

References:
CCI-001851
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 16 *******************************

QUESTION         : 17 of 17
TITLE            : CAT III, V-274080, SV-274080r1120228, SRG-OS-000342-GPOS-00133
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:testaction:15901
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.amzlx23os:question:15901
RULE             : Amazon Linux 2023 must be configured to off-load audit records onto a different system from the system being audited via syslog.
QUESTION_TEXT    : Verify Amazon Linux 2023 off-loads audit records onto a different system with the following command:

$ more /etc/systemd/journal-upload.conf
[Upload]
URL=192.168.21.2
ServerKeyFile=/etc/ssl/private/journal-upload.pem
ServerCertificateFile=/etc/ssl/certs/journal-upload.pem
TrustedCertificateFile=/etc/ssl/ca/trusted.pem

If all of the entries do not have values, are commented out, or are missing, this is a finding.

References:
CCI-001851
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 17 *******************************

