Oracle Cloud Infrastructure Documentation
Try Free Tier

Oracle Linux STIG Image

The Oracle Linux STIG Image is an implementation of Oracle Linux that follows the Security Technical Implementation Guide (STIG).

With the STIG image, you can configure an Oracle Linux instance in Oracle Cloud Infrastructure that follows certain security standards and requirements set by the Defense Information Systems Agency (DISA).

Note

Oracle updates the Oracle Linux STIG Image regularly with the latest security errata. This document is updated whenever the STIG benchmark changes, or when changes in the security guidance require manual configuration of the image. See Revision History for Oracle Linux STIG Image for specific changes made in each release.
Important

Any changes that you make to an Oracle Linux STIG Image instance (such as installing other applications or modifying the configuration settings) might impact the compliance score. After making any changes, rescan the instance to check for compliance. See Rescanning an Instance for Compliance.

What's a STIG?

A Security Technical Implementation Guide (STIG) is a document written by the Defense Information Systems Agency (DISA). It provides guidance on configuring a system to meet cybersecurity requirements for deployment within the Department of Defense (DoD) IT network systems. STIG requirements help secure the network against cybersecurity threats by focusing on infrastructure and network security to mitigate vulnerabilities. Compliance with STIGs is a requirement for DoD agencies, or any organization that's a part of the DoD information networks (DoDIN).

The Oracle Linux STIG image helps automate compliance by providing a hardened version of the standard Oracle Linux image. The image is hardened to follow STIG guidelines. However, the image can't meet all STIG requirements and might require additional manual remediation. See Applying Remediations.

Downloading the Latest STIG

DISA provides quarterly updates to the STIGs. This documentation was created using the latest STIG available at the time of publication. However, you should always use the latest STIG when assessing your system.

Download the latest at STIG https://public.cyber.mil/stigs/downloads/. Search for Oracle Linux and then download the appropriate zip file.

Optionally, use the DISA STIG Viewer from https://public.cyber.mil/stigs/srg-stig-tools/. Then, import in the STIG's xccdf.xml file to view the STIG rules.

How's STIG Compliance Assessed?

Compliance assessment often begins with a scan using a Security Content Automation Protocol (SCAP) compliance checker tool. The tool uses a STIG (uploaded in SCAP format) to analyze the security of a system. However, the tool doesn't always test for all rules within a STIG and some STIGs might not have SCAP versions. In these cases, an auditor needs to check the system manually for compliance by going through the STIG rules not covered by the tool.

The following tools are available for automating compliance assessment:

  • SCAP Compliance Checker (SCC) - A tool developed by DISA that can run an evaluation using either the DISA STIG Benchmark or an OpenSCAP upstream profile. Commonly, the DISA STIG Benchmark is used for compliance scanning when using the SCC tool.

    Important

    To scan Arm architecture (aarch64), you must use SCC version 5.5 or later.

  • OpenSCAP - An open source utility available through yum that can run an evaluation using either the DISA STIG Benchmark or an OpenSCAP upstream profile. Oracle Linux distributes an SCAP Security Guide (SSG) package that contains system release specific profiles. For example, the SCAP datastream ssg-ol7-ds.xml file provided by the SSG package includes the DISA STIG for Oracle Linux 7 profile. One advantage to using the OpenSCAP tool is that SSG provides Bash or Ansible scripts to automate remediation and bring the system to a compliant state.

    Caution

    Automatic remediation using scripts might lead to undesired system configuration or make a system nonfunctional. Test the remediation scripts in a nonproduction environment.

See Rescanning an Instance for Compliance for information on running the compliance tools and generating a scan report.

Compliance Targets

The Oracle Linux STIG image contains additional remediations for rules not addressed by the DISA STIG Benchmark. Use the SSG "stig" profile aligned with DISA STIG for Oracle Linux to extend automation on the previously unaddressed rules and determine compliance against the complete DISA STIG.

Two DISA STIG Viewer checklist files are provided with the image, which are based on scan results from SCC and OpenSCAP. The checklist for the DISA STIG Benchmark uses the SCC scan results, while the checklist for the SSG "stig" profile uses the OpenSCAP scan results. These checklists contain comments by Oracle for areas of the image that don't meet guidance. See Using the Checklist to View Additional Configurations.
Note

The higher compliance scores for the DISA STIG Benchmark reflect a more limited scope of rules compared to the complete DISA STIG. However, the SSG "stig" profile accounts for the full DISA STIG, providing a more comprehensive evaluation of the image's compliance.
Oracle Linux 8

Oracle Linux 8 STIG images follow the DISA security standards and are hardened according to the Oracle Linux 8 DISA STIG. For the latest Oracle Linux 8 STIG Image release, the compliance target is the DISA STIG for Oracle Linux 8 Ver 1, Rel 10. The scap-security-guide package (minimum version 0.1.73-1.0.1) available through yum contains the SSG "stig" profile aligned with DISA STIG for Oracle Linux 8 Ver 1, Rel 10.

Compliance Information for Oracle Linux 8.10 September 2024 STIG images:

Target: SSG "stig" profile aligned with DISA STIG for Oracle Linux 8 Ver 1, Rel 10

  • Checklist Compliance Score for x86_64: 74.63%
  • Checklist Compliance Score for aarch64: 74.55%

Target: DISA STIG for Oracle Linux 8 Ver 1, Rel 8 Benchmark profile

  • Checklist Compliance Score for x86_64: 80.57%
  • Checklist Compliance Score for aarch64: 80.57%
Oracle Linux 7 (extended support)

Oracle Linux 7 STIG images follow the DISA security standards and are hardened according to the Oracle Linux 7 DISA STIG. For the latest Oracle Linux 7 STIG Image release, the compliance target has transitioned to the DISA STIG Ver 3, Rel 1. The scap-security-guide package (minimum version 0.1.73-1.0.3) available through yum contains the SSG "stig" profile aligned with DISA STIG for Oracle Linux 7 Version 3, Release 1.

Compliance Information for Oracle Linux 7.9 February 2025 STIG images:

Target: SSG "stig" profile aligned with DISA STIG for Oracle Linux 7 Ver 3, Rel 1

  • Checklist Compliance Score x86_64: 81.65%
  • Checklist Compliance Score aarch64: 81.65%

Target: DISA STIG for Oracle Linux 7 Ver 3, Rel 1 Benchmark profile

  • Checklist Compliance Score x86_64: 91.71%
  • Checklist Compliance Score aarch64: 91.71%
Note

The STIG standard from DISA had no significant changes, other than wording, between Oracle Linux 7 Ver 3, Rel 1 and Oracle Linux 7 Ver 2, Rel 14. Because of this, any system compliant with Oracle Linux 7 Ver 2, Rel 14 is also compliant with Oracle Linux 7 Ver 3, Rel 1.

Applying Remediations

The hardened Oracle Linux STIG Image can't be configured for all the recommended guidance. You must manually finalize any configurations not included in the Oracle Linux STIG Image instance.

For each security rule established by DISA, instructions to apply the appropriate security configuration are provided in the corresponding Oracle Linux Security Technical Implementation Guide.

Important

Some changes to the image might affect the instance's default Oracle Cloud Infrastructure account. If you decide to enforce a rule, study the information about each rule and the reasons for exclusion to fully understand the potential impact on the instance.

Using the Checklist to View Additional Configurations

Use the checklists provided with the Oracle Linux STIG image to view additional "Release Notes" on areas of guidance not included in the image, which might require additional configuration. The release notes identify additional configurations that might affect the instances default Oracle Cloud Infrastructure account.

Accessing the Checklist

The Oracle Linux STIG image includes DISA STIG Viewer checklists for both the DISA STIG Benchmark and SCAP Security Guide (SSG) "stig" profile aligned with DISA STIG for Oracle Linux. These checklists are located in the /usr/share/xml/stig directory. See Revision History for the specific filename associated with each release.

  • OL<release>_SSG_STIG_<stig-version>_CHECKLIST_RELEASE.ckl - checklist for DISA STIG for Oracle Linux using the SSG "stig" profile scan results.
  • OL<release>_DISA_BENCHMARK_<stig-version>_CHECKLIST_RELEASE.ckl - checklist for DISA STIG Benchmark for Oracle Linux using the SCC Oracle_Linux_<release>_STIG profile scan results.

Viewing the Checklist Release Notes

  1. Download the DISA STIG Viewer tool from: https://public.cyber.mil/stigs/srg-stig-tools/
  2. Open the STIG Viewer tool.
  3. Under Checklist, select Open Checklist from File... and navigate to the checklist file.
  4. Expand the Filter Panel and add the following filter:
    • Must Match: ALL
    • Filter by: Keyword
    • Filter type: Inclusive (+) Filter
    • Keyword: Oracle Release Notes
  5. The release notes offer additional information for the rules:
    • Open - Rules which have been excluded or deemed out of scope.
      • Excluded - Rules which might affect the instance's default Oracle Cloud Infrastructure account and have been excluded from remediation for the Oracle Linux STIG Image.
      • Out of Scope - Rules which are out of scope for remediation on the current release but might be considered for remediation in a future release.
    • Not Applicable - Rules which have been deemed not applicable to the Oracle Linux STIG Image.
    • Not reviewed - Rules which are out of scope for remediation on the current release but might be considered for remediation in a future release.
  6. For each rule, ensure you fully understand the implications to the instance before applying remediation.

Rescanning an Instance for Compliance

Use the SCC or OpenSCAP tool to scan the instance to verify it remains compliant.

Changes to an Oracle Linux STIG Image instance (such as installing other applications or adding new configuration settings) can affect compliance. We recommend scanning to check that the instance is compliant after any changes. In addition, you might need to perform subsequent scans to check for regular, quarterly DISA STIG updates.

Using the OpenSCAP Tool

The OpenSCAP tool is available in Oracle Linux and certified by the National Institute of Standards and Technologies (NIST).

  1. Sign in to your Oracle Linux STIG Image instance.
  2. Install the openscap-scanner package. 
    sudo yum install openscap-scanner
  3. Identify the XCCDF or datastream file to use for the scan.

    To use the SSG "stig" profile:

    1. Install the scap-security-guide package. 
      sudo yum install scap-security-guide
    2. Locate the file to use for the scan found in /usr/share/xml/scap/ssg/content.
    To use the Oracle Linux DISA STIG Benchmark:
    1. Go to https://public.cyber.mil/stigs/downloads/".
    2. Search for Oracle Linux and download the appropriate DISA STIG Benchmark file.
    3. Unzip the file after downloading it.
  4. To perform a scan, run the following command: 
    sudo oscap xccdf eval --profile profile-name \
--results=path-to-results.xml --oval-results \
--report=path-to-report.html \
--check-engine-results \
--stig-viewer=path-to-stig-viewer-report.xml \
path-to-xccdf-document

    For other options that you can use with the oscap command, see Using OpenSCAP to Scan for Vulnerabilities in the Oracle® Linux 7: Security Guide and Oracle Linux 8: Using OpenSCAP for Security Compliance.

  5. Check the path-to-report.html file for the evaluation results.

Using the SCC Tool

The SCC tool is the official tool for checking government compliance and can be used to scan an Oracle Linux STIG Image instance.

Important

To scan Arm architecture (aarch64), you must use SCC version 5.5 or later.

For instructions on using the SCC tool, see the SCAP Tools table at https://public.cyber.mil/stigs/scap/.

  1. Obtain the SCC tool from the table at https://public.cyber.mil/stigs/scap/.
  2. Install the tool. 
    unzip scc-5.4.2_rhel7_sles12-15_oracle-linux7_x86_64_bundle.zip
cd scc-5.4.2_rhel7_x86_64/
rpm -i scc-5.4.2.rhel7.x86_64.rpm
  3. Zip the SCAP content .xml file before importing in to the SCC tool.

    For the SSG "stig" profile:

    zip ssg_content.zip /usr/share/xml/scap/ssg/content/xml-document
/opt/scc/cscc -is ssg_content.zip

    For the Oracle Linux DISA STIG Benchmark:

    zip scap_content.zip path-to-disa-benchmark-xml-document
/opt/scc/cscc -is scap_content.zip
  4. Configure SCC to scan against the imported content 
    /opt/scc/cscc --config
  5. Perform the scan using the command line menu:
    1. Enter 1 to configure SCAP content.
    2. Enter clear and then enter the number that matches the imported SCAP content.

      In the following example, you would enter 2 for the imported SCAP content for Oracle Linux 7. 

      SCC 5.4.2 Available SCAP Content                        [Version]  [Date]    
1.  [ ]  Mozilla_Firefox_RHEL                           005.003    2021-06-09
2.  [X]  OL-7                                           0.1.54     2021-09-23
3.  [ ]  Oracle_Linux_7_STIG                            002.004    2021-06-14
4.  [ ]  RHEL_6_STIG                                    002.002    2020-12-04
5.  [ ]  RHEL_7_STIG                                    003.004    2021-06-14
6.  [ ]  RHEL_8_STIG                                    001.002    2021-06-14
7.  [ ]  SLES_12_STIG                                   002.004    2021-06-14
    3. Enter 0 to return to the main menu.
    4. Enter 2 to configure the SCAP profile.
    5. Enter 1 to select the profile. Verify "stig" is selected. 
      Available Profiles for OL-7

1.  [ ] no_profile_selected
2.  [X] stig
    6. Return to the main menu. Enter 9 to save changes and perform a scan on the system.
      The scan might take 25 to 30 minutes.

Revision History for Oracle Linux STIG Image

Oracle updates the Oracle Linux STIG Image regularly to address security issues.

If you are deploying an older Oracle Linux STIG Image, you might want to perform a subsequent scan to check for regular, quarterly DISA STIG updates. See Rescanning an Instance for Compliance for more information.

Oracle Linux 8

Oracle Linux 7 (extended support)

Older Images

Was this article helpful?