Guide to the Secure Configuration of Red Hat Enterprise Linux 6
with profile Upstream STIG for RHEL 6 Server
scap-security-guide
package which is developed at
http://fedorahosted.org/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in any operational scenario. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for RHEL 6, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Profile Title | Upstream STIG for RHEL 6 Server |
---|---|
Profile ID | xccdf_org.ssgproject.content_profile_stig-rhel6-server-upstream |
Revision History
Current version: 0.9
- draft (as of 2015-07-30)
Platforms
- cpe:/o:redhat:enterprise_linux:6
- cpe:/o:redhat:enterprise_linux:6::client
Table of Contents
- System Settings
- Installing and Maintaining Software
- File Permissions and Masks
- SELinux
- Account and Access Control
- Network Configuration and Firewalls
- Configure Syslog
- System Accounting with auditd
- Services
Checklist
contains 224 rules |
System Settingsgroup |
contains 171 rules |
Installing and Maintaining SoftwaregroupThe following sections contain information on security-relevant choices during the initial operating system installation process and the setup of software updates. |
contains 16 rules |
Disk PartitioninggroupTo ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
|
contains 6 rules |
Ensure /tmp Located On Separate Partitionrule
The
The identifiers: CCE-26435-8, DISA FSO RHEL-06-000001 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1208, Test attestation on 20120928 by MM |
Ensure /var Located On Separate PartitionruleThe
Ensuring that identifiers: CCE-26639-5, DISA FSO RHEL-06-000002 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1208, Test attestation on 20120928 by MM |
Ensure /var/log Located On Separate Partitionrule
System logs are stored in the
Placing identifiers: CCE-26215-4, DISA FSO RHEL-06-000003 references: AU-9, 1208, Test attestation on 20120928 by MM |
Ensure /var/log/audit Located On Separate Partitionrule
Audit logs are stored in the
Placing identifiers: CCE-26436-6, DISA FSO RHEL-06-000004 references: AU-4, AU-9, 137, 138, 1208, Test attestation on 20120928 by MM |
Ensure /home Located On Separate Partitionrule
If user home directories will be stored locally, create a separate partition
for
Ensuring that identifiers: CCE-26557-9, DISA FSO RHEL-06-000007 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1208, Test attestation on 20120928 by MM |
Encrypt Partitionsrule
Red Hat Enterprise Linux 6 natively supports partition encryption through the
Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to
encrypt a partition is during installation time.
part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASEAny PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the
installer to pause and interactively ask for the passphrase during installation.
Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site: https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html Rationale: The risk of a system's physical compromise, particularly mobile systems such as laptops, places its data at risk of compromise. Encrypting this data mitigates the risk of its loss if the system is lost. identifiers: CCE-27596-6, DISA FSO RHEL-06-000275 |
Updating SoftwaregroupThe |
contains 4 rules |
Ensure Red Hat GPG Key InstalledruleTo ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run: $ sudo rhn_registerIf the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom , use the following command as the root user to import
it into the keyring:
$ sudo rpm --import /media/cdrom/RPM-GPG-KEYRationale: The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat. identifiers: CCE-26506-6, DISA FSO RHEL-06-000008 references: SI-7, MA-1(b), 351, Test attestation on 20120928 by MM Remediation script:
|
Ensure gpgcheck Enabled In Main Yum ConfigurationruleThe gpgcheck=1Rationale: Ensuring the validity of packages' cryptographic signatures prior to installation ensures the authenticity of the software and protects against malicious tampering. identifiers: CCE-26709-6, DISA FSO RHEL-06-000013 references: SI-7, MA-1(b), 352, 663, Test attestation on 20120928 by MM |
Ensure gpgcheck Enabled For All Yum Package RepositoriesruleTo ensure signature checking is not disabled for
any repos, remove any lines from files in gpgcheck=0Rationale: Ensuring all packages' cryptographic signatures are valid prior to installation ensures the authenticity of the software and protects against malicious tampering. identifiers: CCE-26647-8, DISA FSO RHEL-06-000015 references: SI-7, MA-1(b), 352, 663, Test attestation on 20120928 by MM |
Ensure Software Patches InstalledruleIf the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates: $ sudo yum updateIf the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the Red Hat Network and installed using rpm .
Rationale:Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. identifiers: CCE-27635-2, DISA FSO RHEL-06-000011 references: SI-2, MA-1(b), 1227, 1233, Test attestation on 20120928 by MM |
Software Integrity Checkinggroup
Both the AIDE (Advanced Intrusion Detection Environment)
software and the RPM package management system provide
mechanisms for verifying the integrity of installed software.
AIDE uses snapshots of file metadata (such as hashes) and compares these
to current system files in order to detect changes.
The RPM package management system can conduct integrity
checks by comparing information in its metadata database with
files installed on the system.
|
contains 6 rules |
Verify Integrity with AIDEgroupAIDE conducts integrity checks by comparing information about
files with previously-gathered information. Ideally, the AIDE database is
created immediately after initial system configuration, and then again after any
software update. AIDE is highly configurable, with further configuration
information located in |
contains 2 rules |
Install AIDEruleInstall the AIDE package with the command: $ sudo yum install aideRationale: The AIDE package must be installed if it is to be available for integrity checking. identifiers: CCE-27024-9, DISA FSO RHEL-06-000016 references: CM-3(d), CM-3(e), CM-6(d), SC-28, SI-7, 1069, Test attestation on 20121024 by DS Remediation script:
|
Configure Periodic Execution of AIDErule
To implement a daily execution of AIDE at 4:05am using cron, add the following line to 05 4 * * * root /usr/sbin/aide --checkAIDE can be executed periodically through other means; this is merely one example. Rationale: By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files. identifiers: CCE-27222-9, DISA FSO RHEL-06-000306 references: CM-3(d), CM-3(e), CM-6(d), SC-28, SI-7, 374, 416, 1069, 1263, 1297, 1589 Remediation script:
|
Verify Integrity with RPMgroupThe RPM package management system includes the ability to verify the integrity of installed packages by comparing the installed files with information about the files taken from the package metadata stored in the RPM database. Although an attacker could corrupt the RPM database (analogous to attacking the AIDE database as described above), this check can still reveal modification of important files. To list which files on the system differ from what is expected by the RPM database: $ rpm -qVaSee the man page for rpm to see a complete explanation of each column.
|
contains 2 rules |
Verify and Correct File Permissions with RPMruleThe RPM package management system can check file access permissions of installed software packages, including many that are important to system security. After locating a file with incorrect permissions, run the following command to determine which package owns it: $ rpm -qf FILENAMENext, run the following command to reset its permissions to the correct values: $ sudo rpm --setperms PACKAGENAMERationale: Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated. identifiers: CCE-26731-0, DISA FSO RHEL-06-000518 |
Verify File Hashes with RPMruleThe RPM package management system can check the hashes of installed software packages, including many that are important to system security. Run the following command to list which files on the system have hashes that differ from what is expected by the RPM database: $ rpm -Va | grep '^..5'A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file: $ rpm -qf FILENAMEThe package can be reinstalled from a yum repository using the command: $ sudo yum reinstall PACKAGENAMEAlternatively, the package can be reinstalled from trusted media using the command: $ sudo rpm -Uvh PACKAGENAMERationale: The hashes of important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system. identifiers: CCE-27223-7, DISA FSO RHEL-06-000519 |
Additional Security SoftwaregroupAdditional security software that is not provided or supported by Red Hat can be installed to provide complementary or duplicative security capabilities to those provided by the base platform. Add-on software may not be appropriate for some specialized systems. |
contains 2 rules |
Install Intrusion Detection Softwarerule
The base Red Hat platform already includes a sophisticated auditing system that
can detect intruder activity, as well as SELinux, which provides host-based
intrusion prevention capabilities by confining privileged programs and user
sessions which may become compromised. Host-based intrusion detection tools provide a system-level defense when an intruder gains access to a system or network. identifiers: CCE-27409-2, DISA FSO RHEL-06-000285 |
Install Virus Scanning SoftwareruleInstall virus scanning software, which uses signatures to search for the presence of viruses on the filesystem. The McAfee VirusScan Enterprise for Linux virus scanning tool is provided for DoD systems. Ensure virus definition files are no older than 7 days, or their last release. Configure the virus scanning software to perform scans dynamically on all accessed files. If this is not possible, configure the system to scan all altered files on the system on a daily basis. If the system processes inbound SMTP mail, configure the virus scanner to scan all received mail. Rationale:Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems. identifiers: CCE-27529-7, DISA FSO RHEL-06-000284 |
File Permissions and MasksgroupTraditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
$ mount -t ext4 | awk '{print $3}'For any systems that use a different local filesystem type, modify this command as appropriate. |
contains 28 rules |
Restrict Partition Mount OptionsgroupSystem partitions can be mounted with certain options
that limit what files on those partitions can do. These options
are set in the |
contains 1 rule |
Add noexec Option to Removable Media PartitionsruleThe Allowing users to execute binaries from removable media such as USB keys exposes the system to potential compromise. identifiers: CCE-27196-5, DISA FSO RHEL-06-000271 |
Restrict Dynamic Mounting and Unmounting of FilesystemsgroupLinux includes a number of facilities for the automated addition
and removal of filesystems on a running system. These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'If these filesystems are not required then they can be explicitly disabled in a configuratio file in /etc/modprobe.d .
|
contains 2 rules |
Disable Modprobe Loading of USB Storage Driverrule
To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.
To configure the system to prevent the install usb-storage /bin/trueThis will prevent the modprobe program from loading the usb-storage
module, but will not prevent an administrator (or another program) from using the
insmod program to load the module manually.Rationale:USB storage devices such as thumb drives can be used to introduce malicious software. identifiers: CCE-27016-5, DISA FSO RHEL-06-000503 references: AC-19(a), AC-19(d), AC-19(e), 1250, 85 Remediation script:
|
Disable the AutomounterruleThe $ sudo chkconfig autofs offRationale: Disabling the automounter permits the administrator to
statically control filesystem mounting through identifiers: CCE-26976-1, DISA FSO RHEL-06-000526 references: AC-19(a), AC-19(d), AC-19(e), 1250, 85 Remediation script:
|
Verify Permissions on Important Files and DirectoriesgroupPermissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses important permission restrictions which can be verified to ensure that no harmful discrepancies have arisen. |
contains 21 rules |
Verify Permissions on Files with Local Account Information and CredentialsgroupThe default restrictive permissions for files which act as
important security databases such as |
contains 12 rules |
Verify User Who Owns shadow Filerule
To properly set the owner of $ sudo chown root /etc/shadowRationale: The identifiers: CCE-26947-2, DISA FSO RHEL-06-000033 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Group Who Owns shadow Filerule
To properly set the group owner of $ sudo chgrp root /etc/shadowRationale: The identifiers: CCE-26967-0, DISA FSO RHEL-06-000034 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Permissions on shadow Filerule
To properly set the permissions of $ sudo chmod 0000 /etc/shadowRationale: The identifiers: CCE-26992-8, DISA FSO RHEL-06-000035 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify User Who Owns group Filerule
To properly set the owner of $ sudo chown root /etc/groupRationale: The identifiers: CCE-26822-7, DISA FSO RHEL-06-000042 references: AC-6, Test attestation on 20121026 by DS Remediation script:
|
Verify Group Who Owns group Filerule
To properly set the group owner of $ sudo chgrp root /etc/groupRationale: The identifiers: CCE-26930-8, DISA FSO RHEL-06-000043 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Permissions on group Filerule
To properly set the permissions of $ sudo chmod 644 /etc/groupRationale: The identifiers: CCE-26954-8, DISA FSO RHEL-06-000044 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify User Who Owns gshadow Filerule
To properly set the owner of $ sudo chown root /etc/gshadowRationale: The identifiers: CCE-27026-4, DISA FSO RHEL-06-000036 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Group Who Owns gshadow Filerule
To properly set the group owner of $ sudo chgrp root /etc/gshadowRationale: The identifiers: CCE-26975-3, DISA FSO RHEL-06-000037 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Permissions on gshadow Filerule
To properly set the permissions of $ sudo chmod 0000 /etc/gshadowRationale: The identifiers: CCE-26951-4, DISA FSO RHEL-06-000038 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify User Who Owns passwd Filerule
To properly set the owner of $ sudo chown root /etc/passwdRationale: The identifiers: CCE-26953-0, DISA FSO RHEL-06-000039 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Group Who Owns passwd Filerule
To properly set the group owner of $ sudo chgrp root /etc/passwdRationale: The identifiers: CCE-26856-5, DISA FSO RHEL-06-000040 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify Permissions on passwd Filerule
To properly set the permissions of $ sudo chmod 0644 /etc/passwdRationale: If the identifiers: CCE-26868-0, DISA FSO RHEL-06-000041 references: AC-6, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify File Permissions Within Some Important DirectoriesgroupSome directories contain files whose confidentiality or integrity is notably important and may also be susceptible to misconfiguration over time, particularly if unpackaged software is installed. As such, an argument exists to verify that files' permissions within these directories remain configured correctly and restrictively. |
contains 4 rules |
Verify that Shared Library Files Have Restrictive PermissionsruleSystem-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64Kernel modules, which can be added to the kernel during runtime, are stored in /lib/modules . All files in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
$ sudo chmod go-w FILERationale: Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system. identifiers: CCE-27381-3, DISA FSO RHEL-06-000045 references: AC-6, 1499, Test attestation on 20121026 by DS Remediation script:
|
Verify that Shared Library Files Have Root OwnershipruleSystem-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: /lib /lib64 /usr/lib /usr/lib64Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules . All files in these directories should be
owned by the root user. If the directory, or any file in these
directories, is found to be owned by a user other than root correct its
ownership with the following command:
$ sudo chown root FILERationale: Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Proper ownership is necessary to protect the integrity of the system. identifiers: CCE-27424-1, DISA FSO RHEL-06-000046 references: AC-6, 1499, Test attestation on 20130914 by swells Remediation script:
|
Verify that System Executables Have Restrictive PermissionsruleSystem executables are stored in the following directories by default: /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbinAll files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command: $ sudo chmod go-w FILERationale: System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted. identifiers: CCE-27289-8, DISA FSO RHEL-06-000047 Remediation script:
|
Verify that System Executables Have Root OwnershipruleSystem executables are stored in the following directories by default: /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbinAll files in these directories should be owned by the root user.
If any file FILE in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
$ sudo chown root FILERationale: System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted. identifiers: CCE-27623-8, DISA FSO RHEL-06-000048 Remediation script:
|
Verify that All World-Writable Directories Have Sticky Bits SetruleWhen the so-called 'sticky bit' is set on a directory,
only the owner of a given file may remove that file from the
directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky
bit prevents users from removing each other's files. In cases where
there is no reason for a directory to be world-writable, a better
solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application,
consult that application's documentation instead of blindly
changing modes.
$ sudo chmod +t DIRRationale:
Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.
identifiers: CCE-26840-9, DISA FSO RHEL-06-000336 references: AC-6, Test attestation on 20120929 by swells Remediation script:
|
Ensure No World-Writable Files ExistruleIt is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Rationale:Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files. identifiers: CCE-26910-0, DISA FSO RHEL-06-000282 references: AC-6 |
Ensure All Files Are Owned by a UserruleIf any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. Rationale:Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. identifiers: CCE-27032-2 |
Ensure All Files Are Owned by a GroupruleIf any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group. Rationale:Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. identifiers: CCE-26872-2 |
Ensure All World-Writable Directories Are Owned by a System AccountruleAll directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group. Rationale:Allowing a user account to own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users. identifiers: CCE-26642-9, DISA FSO RHEL-06-000337 references: AC-6, Test attestation on 20120929 by swells |
Restrict Programs from Dangerous Execution PatternsgroupThe recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution are activated. These protections are applied at the system initialization or kernel level, and defend against certain types of badly-configured or compromised programs. |
contains 4 rules |
Daemon UmaskgroupThe umask is a per-process setting which limits the default permissions for creation of new files and directories. The system includes initialization scripts which set the default umask for system daemons. |
contains 1 rule |
Set Daemon UmaskruleThe file umask 027Setting the umask to too restrictive a setting can cause serious errors at runtime. Many daemons on the system already individually restrict themselves to a umask of 077 in their own init scripts. Rationale: The umask influences the permissions assigned to files created by a process at run time. An unnecessarily permissive umask could result in files being created with insecure permissions. identifiers: CCE-27031-4, DISA FSO RHEL-06-000346 references: AC-6, Test attestation on 20140912 by JL Remediation script:
|
Disable Core DumpsgroupA core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
|
contains 1 rule |
Disable Core Dumps for All UsersruleTo disable core dumps for all users, add the following line to
* hard core 0Rationale: A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems. identifiers: CCE-27033-0, DISA FSO RHEL-06-000308 references: SC-5 Remediation script:
|
Enable ExecShieldgroupExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default and
controlled through |
contains 2 rules |
Enable ExecShieldrule
To set the runtime status of the $ sudo sysctl -w kernel.exec-shield=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
kernel.exec-shield = 1Rationale: ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range. identifiers: CCE-27007-4, DISA FSO RHEL-06-000079 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, Test attestation on 20121024 by DS Remediation script:
|
Enable Randomized Layout of Virtual Address Spacerule
To set the runtime status of the $ sudo sysctl -w kernel.randomize_va_space=2If this is not the system's default value, add the following line to /etc/sysctl.conf :
kernel.randomize_va_space = 2Rationale: Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques. identifiers: CCE-26999-3, DISA FSO RHEL-06-000078 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, Test attestation on 20121024 by DS Remediation script:
|
SELinuxgroupSELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
|
contains 4 rules |
Ensure SELinux Not Disabled in /etc/grub.confruleSELinux can be disabled at boot time by an argument in
Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation. identifiers: CCE-26956-3, DISA FSO RHEL-06-000017 references: AC-3, AC-3(3), AC-6, AU-9, 22, 32, Test attestation on 20121024 by DS Remediation script:
|
Ensure SELinux State is EnforcingruleThe SELinux state should be set to SELINUX=enforcingRationale: Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. identifiers: CCE-26969-6, DISA FSO RHEL-06-000020 references: AC-3, AC-3(3), AC-4, AC-6, AU-9, 22, 32, 26, Test attestation on 20121024 by DS Remediation script:
|
Configure SELinux PolicyruleThe SELinux SELINUXTYPE=targetedOther policies, such as mls , provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.
Rationale:
Setting the SELinux policy to identifiers: CCE-26875-5, DISA FSO RHEL-06-000023 references: AC-3, AC-3(3), AC-4, AC-6, AU-9, 22, 32, Test attestation on 20121024 by DS Remediation script:
|
Ensure No Device Files are Unlabeled by SELinuxruleDevice files, which are used for communication with important
system resources, should be labeled with proper SELinux types. If any device
files carry the SELinux type
If a device file carries the SELinux type identifiers: CCE-26774-0, DISA FSO RHEL-06-000025 references: AC-6, AU-9, CM-7, 22, 32, Test attestation on 20121024 by DS |
Account and Access ControlgroupIn traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. Therefore, making it more difficult for unauthorized people to gain shell access to accounts, particularly to privileged accounts, is a necessary part of securing a system. This section introduces mechanisms for restricting access to accounts under RHEL 6. |
contains 51 rules |
Protect Accounts by Restricting Password-Based LogingroupConventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the |
contains 15 rules |
Restrict Root Loginsgroup
Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system
via a unique unprivileged account, and then use |
contains 4 rules |
Restrict Virtual Console Root Loginsrule
To restrict root logins through the (deprecated) virtual console devices,
ensure lines of this form do not appear in vc/1 vc/2 vc/3 vc/4Rationale: Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account. identifiers: CCE-26855-7, DISA FSO RHEL-06-000027 references: AC-6(2), 770, Test attestation on 20121024 by DS Remediation script:
|
Restrict Serial Port Root LoginsruleTo restrict root logins on serial ports,
ensure lines of this form do not appear in ttyS0 ttyS1Rationale: Preventing direct root login to serial port interfaces helps ensure accountability for actions taken on the systems using the root account. identifiers: CCE-27047-0, DISA FSO RHEL-06-000028 references: AC-6(2), 770, Test attestation on 20121024 by DS |
Ensure that System Accounts Do Not Run a Shell Upon Loginrule
Some accounts are not associated with a human
user of the system, and exist to perform some administrative
function. Should an attacker be able to log into these accounts,
they should not be granted access to a shell.
$ sudo usermod -s /sbin/nologin SYSACCT warning
Do not perform the steps in this
section on the root account. Doing so might cause the system to
become inaccessible.
Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts. identifiers: CCE-26966-2 references: AC-2, 178, Test attestation on 20121024 by DS |
Verify Only Root Has UID 0ruleIf any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. Rationale:An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner. identifiers: CCE-26971-2, DISA FSO RHEL-06-000032 references: AC-6, IA-2(1), 366, Test attestation on 20121024 by DS Remediation script:
|
Verify Proper Storage and Existence of Password Hashesgroup
By default, password hashes for local accounts are stored
in the second field (colon-separated) in
|
contains 4 rules |
Prevent Log In to Accounts With Empty PasswordruleIf an account is configured for password authentication
but does not have an assigned password, it may be possible to log
onto the account without authentication. Remove any instances of the If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments. identifiers: CCE-27038-9, DISA FSO RHEL-06-000030 references: IA-5(b), IA-5(c), IA-5(1)(a), Test attestation on 20121024 by DS Remediation script:
|
Verify All Account Password Hashes are Shadowedrule
If any password hashes are stored in
The hashes for all user account passwords should be stored in
the file identifiers: CCE-26476-2, DISA FSO RHEL-06-000031 references: IA-5(h), 201, Test attestation on 20121024 by DS |
All GIDs referenced in /etc/passwd must be defined in /etc/groupruleAdd a group to the system for each GID referenced without a corresponding group. Rationale:
Inconsistency in GIDs between identifiers: CCE-27379-7, DISA FSO RHEL-06-000294 references: 366, Test attestation on 20121024 by DS |
Verify No netrc Files ExistruleThe
Unencrypted passwords for remote FTP servers may be stored in identifiers: CCE-27225-2, DISA FSO RHEL-06-000347 |
Set Password Expiration ParametersgroupThe file $ sudo chage -M 180 -m 7 -W 7 USER |
contains 4 rules |
Set Password Minimum Length in login.defsruleTo specify password length requirements for new accounts,
edit the file PASS_MIN_LEN 14 The DoD requirement is 14 .
The FISMA requirement is 12 .
If a program consults /etc/login.defs and also another PAM module
(such as pam_cracklib ) during a password change operation,
then the most restrictive must be satisfied. See PAM section
for more information about enforcing password quality requirements.
Rationale:Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result. identifiers: CCE-27002-5, DISA FSO RHEL-06-000050 references: IA-5(f), IA-5(1)(a), 205, Test attestation on 20121026 by DS Remediation script:
|
Set Password Minimum AgeruleTo specify password minimum age for new accounts,
edit the file PASS_MIN_DAYS 1A value of 1 day is considered for sufficient for many environments. The DoD requirement is 1. Rationale: Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement. identifiers: CCE-27013-2, DISA FSO RHEL-06-000051 references: IA-5(f), IA-5(1)(d), 198, Test attestation on 20121026 by DS Remediation script:
|
Set Password Maximum AgeruleTo specify password maximum age for new accounts,
edit the file PASS_MAX_DAYS 60A value of 180 days is sufficient for many environments. The DoD requirement is 60. Rationale: Setting the password maximum age ensures users are required to periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. identifiers: CCE-26985-2, DISA FSO RHEL-06-000053 references: IA-5(f), IA-5(g), IA-5(1)(d), 180, 199, 76, Test attestation on 20121026 by DS Remediation script:
|
Set Password Warning AgeruleTo specify how many days prior to password
expiration that a warning will be issued to users,
edit the file PASS_WARN_AGE 7The DoD requirement is 7. Rationale: Setting the password warning age enables users to make the change at a practical time. identifiers: CCE-26988-6, DISA FSO RHEL-06-000054 references: AC-2(2), IA-5(f), Test attestation on 20121026 by DS Remediation script:
|
Set Account Expiration ParametersgroupAccounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting $ sudo chage -I NUM_DAYS USERAccounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the -E option.
The file /etc/default/useradd controls
default settings for all newly-created accounts created with the system's
normal command line utilities.
|
contains 3 rules |
Set Account Expiration Following InactivityruleTo specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following lines in INACTIVE=NUM_DAYSA value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity
timeout must be done with careful consideration of the length of a "normal"
period of inactivity for users in the particular environment. Setting
the timeout too low incurs support costs and also has the potential to impact
availability of the system to legitimate users.
Rationale:Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials. identifiers: CCE-27283-1, DISA FSO RHEL-06-000334 references: AC-2(2), AC-2(3), 16, 17, 795 Remediation script:
|
Ensure All Accounts on the System Have Unique NamesruleChange usernames, or delete accounts, so each has a unique name. Rationale:Unique usernames allow for accountability on the system. identifiers: CCE-27609-7, DISA FSO RHEL-06-000296 |
Assign Expiration Date to Temporary Accountsrule
In the event temporary or emergency accounts are required, configure the system
to terminate them after a documented time period. For every temporary and
emergency account, run the following command to set an expiration date on it,
substituting $ sudo chage -E YYYY-MM-DD USER YYYY-MM-DD indicates the documented expiration date for the account.
Rationale:
When temporary and emergency accounts are created, there is a risk they may
remain in place and active after the need for them no longer exists. Account
expiration greatly reduces the risk of accounts being misused or hijacked.
identifiers: CCE-27474-6 |
Protect Accounts by Configuring PAMgroupPAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
warning
Be careful when making changes to PAM's
configuration files. The syntax for these files is complex, and
modifications can have unexpected consequences. The default
configurations shipped with applications should be sufficient for
most users. warning
Running authconfig or
system-config-authentication will re-write the PAM configuration
files, destroying any manually made changes and replacing them with
a series of system defaults. One reference to the configuration
file syntax can be found at
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html. |
contains 15 rules |
Set Password Quality RequirementsgroupThe default |
contains 7 rules |
Set Password Quality Requirements, if using pam_cracklibgroupThe password requisite pam_cracklib.so try_first_pass retry=3and then alter it to read: password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4If no such line exists, add one as the first line of the password section in /etc/pam.d/system-auth .
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.
warning
Note that the password quality
requirements are not enforced for the root account for some
reason. |
contains 7 rules |
Set Password Retry Prompts Permitted Per-SessionruleTo configure the number of retry prompts that are permitted per-session:
Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module. identifiers: CCE-27123-9 references: IA-5(c), 1092, Test attestation on 20121024 by DS |
Set Password to Maximum of Three Consecutive Repeating CharactersruleThe pam_cracklib module's password required pam_cracklib.so maxrepeat=3Rationale: Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. identifiers: CCE-27227-8, DISA FSO RHEL-06-000299 Remediation script:
|
Set Password Strength Minimum Digit CharactersruleThe pam_cracklib module's Requiring digits makes password guessing attacks more difficult by ensuring a larger search space. identifiers: CCE-26374-9, DISA FSO RHEL-06-000056 references: IA-5(b), IA-5(c), 194, 194, Test attestation on 20121024 by DS Remediation script:
|
Set Password Strength Minimum Uppercase CharactersruleThe pam_cracklib module's Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space. identifiers: CCE-26601-5, DISA FSO RHEL-06-000057 references: IA-5(b), IA-5(c), IA-5(1)(a), 192, Test attestation on 20121024 by DS Remediation script:
|
Set Password Strength Minimum Special CharactersruleThe pam_cracklib module's Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space. identifiers: CCE-26409-3, DISA FSO RHEL-06-000058 references: IA-5(b), IA-5(c), IA-5(1)(a), 1619, 266, Test attestation on 20121024 by DS Remediation script:
|
Set Password Strength Minimum Lowercase CharactersruleThe pam_cracklib module's Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space. identifiers: CCE-26631-2, DISA FSO RHEL-06-000059 references: IA-5(b), IA-5(c), IA-5(1)(a), 193, Test attestation on 20121024 by DS Remediation script:
|
Set Password Strength Minimum Different CharactersruleThe pam_cracklib module's Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however. identifiers: CCE-26615-5, DISA FSO RHEL-06-000060 references: IA-5(b), IA-5(c), IA-5(1)(b), 195, Test attestation on 20121024 by DS Remediation script:
|
Set Lockouts for Failed Password AttemptsgroupThe warning
Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks. |
contains 4 rules |
Set Deny For Failed Password Attemptsrule
To configure the system to lock out accounts after a number of incorrect login
attempts using
Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. identifiers: CCE-26844-1, DISA FSO RHEL-06-000061 Remediation script:
|
Set Lockout Time For Failed Password Attemptsrule
To configure the system to lock out accounts after a number of incorrect login
attempts and require an administrator to unlock the account using
Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations. identifiers: CCE-27110-6, DISA FSO RHEL-06-000356 Remediation script:
|
Set Interval For Counting Failed Password Attemptsrule
Utilizing
Locking out user accounts after a number of incorrect attempts within a specific period of time prevents direct password guessing attacks. identifiers: CCE-27215-3, DISA FSO RHEL-06-000357 Remediation script:
|
Limit Password ReuseruleDo not allow users to reuse recent passwords. This can
be accomplished by using the password sufficient pam_unix.so existing_options remember=5The DoD STIG requirement is 5 passwords.Rationale: Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. identifiers: CCE-26741-9, DISA FSO RHEL-06-000274 references: IA-5(f), IA-5(1)(e), 200, Test attestation on 20121024 by DS Remediation script:
|
Set Password Hashing AlgorithmgroupThe system's default algorithm for storing password hashes in
|
contains 3 rules |
Set Password Hashing Algorithm in /etc/pam.d/system-authrule
In password sufficient pam_unix.so sha512 other arguments...This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default. Rationale: Using a stronger hashing algorithm makes password cracking attacks more difficult. identifiers: CCE-26303-8, DISA FSO RHEL-06-000062 references: IA-5(b), IA-5(c), IA-5(1)(c), IA-7, 803, Test attestation on 20121024 by DS Remediation script:
|
Set Password Hashing Algorithm in /etc/login.defsrule
In ENCRYPT_METHOD SHA512Rationale: Using a stronger hashing algorithm makes password cracking attacks more difficult. identifiers: CCE-27228-6, DISA FSO RHEL-06-000063 references: IA-5(b), IA-5(c), IA-5(1)(c), IA-7, 803, Test attestation on 20121024 by DS Remediation script:
|
Set Password Hashing Algorithm in /etc/libuser.confrule
In crypt_style = sha512Rationale: Using a stronger hashing algorithm makes password cracking attacks more difficult. identifiers: CCE-27229-4, DISA FSO RHEL-06-000064 references: IA-5(b), IA-5(c), IA-5(1)(c), IA-7, 803, Test attestation on 20121026 by DS |
Set Last Login/Access NotificationruleTo configure the system to notify users of last login/access
using session required pam_lastlog.so showfailedRationale: Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators. identifiers: CCE-27291-4, DISA FSO RHEL-06-000372 references: 366 Remediation script:
|
Secure Session Configuration Files for Login AccountsgroupWhen a user logs into a Unix account, the system configures the user's session by reading a number of files. Many of these files are located in the user's home directory, and may have weak permissions as a result of user error or misconfiguration. If an attacker can modify or even read certain types of account configuration information, they can often gain full access to the affected user's account. Therefore, it is important to test and correct configuration file permissions for interactive accounts, particularly those of privileged users such as root or system administrators. |
contains 5 rules |
Ensure that Users Have Sensible Umask Valuesgroup
The umask setting controls the default permissions
for the creation of new files.
With a default |
contains 4 rules |
Ensure the Default Bash Umask is Set Correctlyrule
To ensure the default umask for users of the Bash shell is set properly,
add or correct the umask 077Rationale: The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. identifiers: CCE-26917-5, DISA FSO RHEL-06-000342 references: SA-8, 366, Test attestation on 20140912 by JL Remediation script:
|
Ensure the Default C Shell Umask is Set Correctlyrule
To ensure the default umask for users of the C shell is set properly,
add or correct the umask 077Rationale: The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. identifiers: CCE-27034-8, DISA FSO RHEL-06-000343 references: SA-8, 366, Test attestation on 20140912 by JL Remediation script:
|
Ensure the Default Umask is Set Correctly in /etc/profilerule
To ensure the default umask controlled by umask 077Rationale: The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users. identifiers: CCE-26669-2, DISA FSO RHEL-06-000344 references: SA-8, 366, Test attestation on 20120929 by swells Remediation script:
|
Ensure the Default Umask is Set Correctly in login.defsrule
To ensure the default umask controlled by UMASK 077Rationale: The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and written to by unauthorized users. identifiers: CCE-26371-5, DISA FSO RHEL-06-000345 references: SA-8, 366, Test attestation on 20140912 by JL Remediation script:
|
Limit the Number of Concurrent Login Sessions Allowed Per Userrule
Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
concurrent sessions by a single user via multiple accounts. The DoD requirement is 10. To set the number of concurrent
sessions per user add the following line in * hard maxlogins 10Rationale: Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions. identifiers: CCE-27457-1, DISA FSO RHEL-06-000319 Remediation script:
|
Protect Physical Console AccessgroupIt is impossible to fully protect a system from an attacker with physical access, so securing the space in which the system is located should be considered a necessary step. However, there are some steps which, if taken, make it more difficult for an attacker to quickly or undetectably modify a system from its console. |
contains 13 rules |
Set Boot Loader PasswordgroupDuring the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows for the selection of different kernels - possibly on different partitions or media. The default RHEL boot loader for x86 systems is called GRUB. Options it can pass to the kernel include single-user mode, which provides root access without any authentication, and the ability to disable SELinux. To prevent local users from modifying the boot parameters and endangering security, protect the boot loader configuration with a password and ensure its configuration file's permissions are set properly. |
contains 4 rules |
Verify /etc/grub.conf User OwnershipruleThe file $ sudo chown root /etc/grub.confRationale: Only root should be able to modify important boot parameters. identifiers: CCE-26995-1, DISA FSO RHEL-06-000065 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify /etc/grub.conf Group OwnershipruleThe file $ sudo chgrp root /etc/grub.confRationale:
The identifiers: CCE-27022-3, DISA FSO RHEL-06-000066 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 225, Test attestation on 20121026 by DS Remediation script:
|
Verify /boot/grub/grub.conf PermissionsruleFile permissions for $ sudo chmod 600 /boot/grub/grub.confRationale: Proper permissions ensure that only the root user can modify important boot parameters. identifiers: CCE-26949-8, DISA FSO RHEL-06-000067 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 225, Test attestation on 20121026 by DS Remediation script:
|
Set Boot Loader PasswordruleThe grub boot loader should have password protection enabled to protect boot-time settings. To do so, select a password and then generate a hash from it by running the following command: $ grub-crypt --sha-512When prompted to enter a password, insert the following line into /etc/grub.conf
immediately after the header comments. (Use the output from grub-crypt as the
value of password-hash):
password --encrypted password-hashNOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password. Rationale: Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode. identifiers: CCE-26911-8, DISA FSO RHEL-06-000068 references: IA-2(1), IA-5(e) AC-3, 213, Test attestation on 20121026 by DS |
Configure Screen LockinggroupWhen a user must temporarily leave an account
logged-in, screen locking should be employed to prevent passersby
from abusing the account. User education and training is
particularly important for screen locking to be effective, and policies
can be implemented to reinforce this.
|
contains 6 rules |
Configure GUI Screen LockinggroupIn the default GNOME desktop, the screen can be locked
by choosing Lock Screen from the System menu.
|
contains 4 rules |
Set GNOME Login Inactivity TimeoutruleRun the following command to set the idle time-out value for inactivity in the GNOME desktop to 15 minutes: $ sudo gconftool-2 \ --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type int \ --set /desktop/gnome/session/idle_delay 15Rationale: Setting the idle delay controls when the screensaver will start, and can be combined with screen locking to prevent access from passersby. identifiers: CCE-26828-4, DISA FSO RHEL-06-000257 Remediation script:
|
GNOME Desktop Screensaver Mandatory UseruleRun the following command to activate the screensaver in the GNOME desktop after a period of inactivity: $ sudo gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/gnome-screensaver/idle_activation_enabled trueRationale: Enabling idle activation of the screensaver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area. identifiers: CCE-26600-7, DISA FSO RHEL-06-000258 Remediation script:
|
Enable Screen Lock Activation After Idle PeriodruleRun the following command to activate locking of the screensaver in the GNOME desktop when it is activated: $ sudo gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/gnome-screensaver/lock_enabled trueRationale: Enabling the activation of the screen lock after an idle period ensures password entry will be required in order to access the system, preventing access by passersby. identifiers: CCE-26235-2, DISA FSO RHEL-06-000259 Remediation script:
|
Implement Blank ScreensaverruleRun the following command to set the screensaver mode in the GNOME desktop to a blank screen: $ sudo gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type string \ --set /apps/gnome-screensaver/mode blank-onlyRationale: Setting the screensaver mode to blank-only conceals the contents of the display from passersby. identifiers: CCE-26638-7, DISA FSO RHEL-06-000260 Remediation script:
|
Configure Console Screen Lockinggroup
A console screen locking mechanism is provided in the
|
contains 1 rule |
Install the screen Packagerule
To enable console screen locking, install the $ sudo yum install screenInstruct users to begin new terminal sessions with the following command: $ screenThe console can now be locked with the following key combination: ctrl+a xRationale:
Installing identifiers: CCE-26940-7, DISA FSO RHEL-06-000071 references: 58, Test attestation on 20121026 by DS Remediation script:
|
Hardware Tokens for AuthenticationgroupThe use of hardware tokens such as smart cards for system login provides stronger, two-factor authentication than using a username and password. In Red Hat Enterprise Linux servers and workstations, hardware token login is not enabled by default and must be enabled in the system settings. |
contains 1 rule |
Enable Smart Card LoginruleTo enable smart card authentication, consult the documentation at:
Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials. identifiers: CCE-27440-7, DISA FSO RHEL-06-000349 |
Require Authentication for Single User ModeruleSingle-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup. By default, no authentication
is performed if single-user mode is selected.
SINGLE=/sbin/suloginRationale: This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password. identifiers: CCE-27040-5, DISA FSO RHEL-06-000069 references: IA-2(1), AC-3, 213, Test attestation on 20121024 by DS Remediation script:
|
Disable Ctrl-Alt-Del Reboot Activationrule
By default, the system includes the following line in
exec /sbin/shutdown -r now "Control-Alt-Delete pressed" To configure the system to log a message instead of rebooting the system, alter that line to read as follows: exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"Rationale:
A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.
In the GNOME graphical environment, risk of unintentional reboot from the
Ctrl-Alt-Del sequence is reduced because the user will be
prompted before any action is taken.
NOTE: When updating the identifiers: CCE-27567-7, DISA FSO RHEL-06-000286 Remediation script:
|
Disable Interactive Bootrule
To disable the ability for users to perform interactive startups,
edit the file PROMPT=noThe PROMPT option allows the console user to perform an
interactive system startup, in which it is possible to select the
set of services which are started on boot.
Rationale:Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security. identifiers: CCE-27043-9, DISA FSO RHEL-06-000070 references: SC-2, AC-3, 213, Test attestation on 20121024 by DS Remediation script:
|
Warning Banners for System AccessesgroupEach system should expose as little information about
itself as possible.
|
contains 3 rules |
Implement a GUI Warning BannergroupIn the default graphical environment, users logging directly into the system are greeted with a login screen provided by the GNOME Display Manager (GDM). The warning banner should be displayed in this graphical environment for these users. The following sections describe how to configure the GDM login banner. |
contains 2 rules |
Enable GUI Warning BannerruleTo enable displaying a login warning banner in the GNOME Display Manager's login screen, run the following command: $ sudo gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/gdm/simple-greeter/banner_message_enable trueTo display a banner, this setting must be enabled and then banner text must also be set. Rationale: An appropriate warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. identifiers: CCE-27195-7, DISA FSO RHEL-06-000324 references: AC-8(a), AC-8(b), AC-8(c), 48, 50 Remediation script:
|
Set GUI Warning Banner TextruleTo set the text shown by the GNOME Display Manager in the login screen, run the following command: $ sudo gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type string \ --set /apps/gdm/simple-greeter/banner_message_text \ "Text of the warning banner here"When entering a warning banner that spans several lines, remember to begin and end the string with " . This command writes
directly either to the /etc/gconf/gconf.xml.mandatory/%gconf-tree.xml
if it exists or to the file /etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml .
Either of these files can later be edited directly if necessary.
Rationale:An appropriate warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. identifiers: CCE-27017-3, DISA FSO RHEL-06-000326 references: AC-8(a), AC-8(b), AC-8(c), 48, 1384, 1385, 1386, 1387, 1388 Remediation script:
|
Modify the System Login Bannerrule
To configure the system login banner:
An appropriate warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. identifiers: CCE-26974-6, DISA FSO RHEL-06-000073 references: AC-8(a), AC-8(b), AC-8(c), 48, 1384, 1385, 1386, 1387, 1388, Test attestation on 20121026 by DS Remediation script:
|
Network Configuration and FirewallsgroupMost machines must be connected to a network of some
sort, and this brings with it the substantial risk of network
attack. This section discusses the security impact of decisions
about networking which must be made when configuring a system.
|
contains 29 rules |
Kernel Parameters Which Affect NetworkinggroupThe |
contains 15 rules |
Network Parameters for Hosts OnlygroupIf the system is not going to be used as a router, then setting certain kernel parameters ensure that the host will not perform routing of network traffic. |
contains 3 rules |
Disable Kernel Parameter for Sending ICMP Redirects by Defaultrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.default.send_redirects = 0Rationale: Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for systems acting as routers. identifiers: CCE-27001-7, DISA FSO RHEL-06-000080 references: AC-4, CM-7, SC-5, SC-7, 1551, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for Sending ICMP Redirects for All Interfacesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.send_redirects = 0Rationale: Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for systems acting as routers. identifiers: CCE-27004-1, DISA FSO RHEL-06-000081 references: CM-7, SC-5(1), 1551, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for IP Forwardingrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.ip_forward=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.ip_forward = 0Rationale: IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers. identifiers: CCE-26866-4, DISA FSO RHEL-06-000082 references: CM-7, SC-5, 366, Test attestation on 20121024 by DS |
Network Related Kernel Runtime Parameters for Hosts and RoutersgroupCertain kernel parameters should be set for systems which are acting as either hosts or routers to improve the system's ability defend against certain types of IPv4 protocol attacks. |
contains 12 rules |
Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfacesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.accept_source_route = 0Rationale: Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. identifiers: CCE-27037-1, DISA FSO RHEL-06-000083 references: CM-7, SC-5, 1551, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for Accepting ICMP Redirects for All Interfacesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.accept_redirects = 0Rationale: Accepting ICMP redirects has few legitimate uses. It should be disabled unless it is absolutely required. identifiers: CCE-27027-2, DISA FSO RHEL-06-000084 references: CM-7, SC-5, 1503, 1551, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for Accepting Secure Redirects for All Interfacesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.secure_redirects = 0Rationale: Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. identifiers: CCE-26854-0, DISA FSO RHEL-06-000086 references: AC-4, CM-7, SC-5, 1503, 1551, Test attestation on 20121024 by DS Remediation script:
|
Enable Kernel Parameter to Log Martian Packetsrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.all.log_martians=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.log_martians = 1Rationale: The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected. identifiers: CCE-27066-0, DISA FSO RHEL-06-000088 references: AC-3(10), CM-7, SC-5(3), 126, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for Accepting Source-Routed Packets By Defaultrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.default.accept_source_route = 0Rationale: Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. identifiers: CCE-26983-7, DISA FSO RHEL-06-000089 references: AC-4, CM-7, SC-5, SC-7, 1551, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for Accepting ICMP Redirects By Defaultrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.default.accept_redirects = 0Rationale: This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. identifiers: CCE-27015-7, DISA FSO RHEL-06-000091 references: AC-4, CM-7, SC-5, SC-7, 1551, Test attestation on 20121024 by DS Remediation script:
|
Disable Kernel Parameter for Accepting Secure Redirects By Defaultrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.default.secure_redirects = 0Rationale: Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. identifiers: CCE-26831-8, DISA FSO RHEL-06-000090 references: AC-4, CM-7, SC-5, SC-7, 1551, Test attestation on 20121024 by DS Remediation script:
|
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requestsrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.icmp_echo_ignore_broadcasts = 1Rationale: Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network. identifiers: CCE-26883-9, DISA FSO RHEL-06-000092 references: CM-7, SC-5, 1551, Test attestation on 20121024 by DS Remediation script:
|
Enable Kernel Parameter to Ignore Bogus ICMP Error Responsesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.icmp_ignore_bogus_error_responses = 1Rationale: Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged. identifiers: CCE-26993-6, DISA FSO RHEL-06-000093 references: CM-7, SC-5, Test attestation on 20121024 by DS Remediation script:
|
Enable Kernel Parameter to Use TCP Syncookiesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.tcp_syncookies=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.tcp_syncookies = 1Rationale: A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests. identifiers: CCE-27053-8, DISA FSO RHEL-06-000095 references: AC-4, SC-5(2), SC-5(3), 1092, 1095, Test attestation on 20121024 by DS Remediation script:
|
Enable Kernel Parameter to Use Reverse Path Filtering for All Interfacesrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.rp_filter = 1Rationale: Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. identifiers: CCE-26979-5, DISA FSO RHEL-06-000096 references: AC-4, SC-5, SC-7, 1551, Test attestation on 20121024 by DS Remediation script:
|
Enable Kernel Parameter to Use Reverse Path Filtering by Defaultrule
To set the runtime status of the $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv4.conf.default.rp_filter = 1Rationale: Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. identifiers: CCE-26915-9, DISA FSO RHEL-06-000097 references: AC-4, SC-5, SC-7, Test attestation on 20121024 by DS Remediation script:
|
Wireless NetworkinggroupWireless networking, such as 802.11
(WiFi) and Bluetooth, can present a security risk to sensitive or
classified systems and networks. Wireless networking hardware is
much more likely to be included in laptop or portable systems than
in desktops or servers.
|
contains 2 rules |
Disable Wireless Through Software ConfigurationgroupIf it is impossible to remove the wireless hardware from the device in question, disable as much of it as possible through software. The following methods can disable software support for wireless networking, but note that these methods do not prevent malicious software or careless users from re-activating the devices. |
contains 2 rules |
Disable Bluetooth Servicerule
The $ sudo chkconfig bluetooth off $ sudo service bluetooth stopRationale: Disabling the identifiers: CCE-27081-9, DISA FSO RHEL-06-000331 references: AC-18(a), AC-18(d), AC-18(3), CM-7, 85, 1551, Test attestation on 20121025 by DS Remediation script:
|
Disable Bluetooth Kernel ModulesruleThe kernel's module loading system can be configured to prevent
loading of the Bluetooth module. Add the following to
the appropriate install bluetooth /bin/trueRationale: If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation. identifiers: CCE-26763-3, DISA FSO RHEL-06-000315 references: AC-18(a), AC-18(d), AC-18(3), CM-7, 85, 1551, Test attestation on 20141031 by JL Remediation script:
|
IPv6groupThe system includes support for Internet Protocol version 6. A major and often-mentioned improvement over IPv4 is its enormous increase in the number of available addresses. Another important feature is its support for automatic configuration of many network settings. |
contains 2 rules |
Disable Support for IPv6 Unless NeededgroupDespite configuration that suggests support for IPv6 has been disabled, link-local IPv6 address auto-configuration occurs even when only an IPv4 address is assigned. The only way to effectively prevent execution of the IPv6 networking stack is to instruct the system not to activate the IPv6 kernel module. |
contains 1 rule |
Disable IPv6 Networking Support Automatic LoadingruleTo prevent the IPv6 kernel module ( options ipv6 disable=1This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol. Rationale: Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation. identifiers: CCE-27153-6, DISA FSO RHEL-06-000098 references: CM-7, 1551, Test attestation on 20121024 by DS Remediation script:
|
Configure IPv6 Settings if NecessarygroupA major feature of IPv6 is the extent to which systems implementing it can automatically configure their networking devices using information from the network. From a security perspective, manually configuring important configuration information is preferable to accepting it from the network in an unauthenticated fashion. |
contains 1 rule |
Disable Automatic ConfigurationgroupDisable the system's acceptance of router
advertisements and redirects by adding or correcting the following
line in IPV6_AUTOCONF=no |
contains 1 rule |
Disable Accepting IPv6 Redirectsrule
To set the runtime status of the $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0If this is not the system's default value, add the following line to /etc/sysctl.conf :
net.ipv6.conf.default.accept_redirects = 0Rationale: An illicit ICMP redirect message could result in a man-in-the-middle attack. identifiers: CCE-27166-8, DISA FSO RHEL-06-000099 Remediation script:
|
iptables and ip6tablesgroupA host-based firewall called |
contains 5 rules |
Inspect and Activate Default RulesgroupView the currently-enforced $ sudo iptables -nL --line-numbersThe command is analogous for ip6tables .
If the firewall does not appear to be active (i.e., no rules appear), activate it and ensure that it starts at boot by issuing the following commands (and analogously for ip6tables ):
$ sudo service iptables restartThe default iptables rules are: Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) num target prot opt source destinationThe ip6tables default rules are essentially the same. |
contains 3 rules |
Verify ip6tables Enabled if Using IPv6rule
The $ sudo chkconfig --level 2345 ip6tables onRationale: The identifiers: CCE-27006-6, DISA FSO RHEL-06-000103 references: AC-4, CA-3(c), CM-7, 32, 66, 1115, 1118, 1092, 1117, 1098, 1100, 1097, 1414, Test attestation on 20121024 by DS Remediation script:
|
Set Default ip6tables Policy for Incoming PacketsruleTo set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
:INPUT DROP [0:0]If changes were required, reload the ip6tables rules: $ sudo service ip6tables reloadRationale: In identifiers: CCE-27317-7, DISA FSO RHEL-06-000523 references: CM-7, 66, 1109, 1154, 1414 Remediation script:
|
Verify iptables Enabledrule
The $ sudo chkconfig --level 2345 iptables onRationale:
The identifiers: CCE-27018-1, DISA FSO RHEL-06-000117 references: AC-4, CA-3(c), CM-7, 32, 66, 1115, 1118, 1092, 1117, 1098, 1100, 1097, 1414, Test attestation on 20121024 by DS Remediation script:
|
Strengthen the Default RulesetgroupThe default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files warning
The program system-config-securitylevel
allows additional services to penetrate the default firewall rules
and automatically adjusts /etc/sysconfig/iptables . This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file. |
contains 2 rules |
Set Default iptables Policy for Incoming PacketsruleTo set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
:INPUT DROP [0:0]Rationale: In identifiers: CCE-26444-0, DISA FSO RHEL-06-000120 references: CM-7, 66, 1109, 1154, 1414 Remediation script:
|
Set Default iptables Policy for Forwarded PacketsruleTo set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
:FORWARD DROP [0:0]Rationale: In identifiers: CCE-27186-6, DISA FSO RHEL-06-000320 Remediation script:
|
Uncommon Network ProtocolsgroupThe system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code are not frequently discovered, the consequences can be dramatic. Ensuring uncommon network protocols are disabled reduces the system's risk to attacks targeted at its implementation of those protocols. warning
Although these protocols are not commonly used, avoid disruption
in your network environment by ensuring they are not needed
prior to disabling them.
|
contains 4 rules |
Disable DCCP Supportrule
The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.
To configure the system to prevent the install dccp /bin/trueRationale: Disabling DCCP protects the system against exploitation of any flaws in its implementation. identifiers: CCE-26448-1, DISA FSO RHEL-06-000124 references: CM-7, 382, Test attestation on 20121024 by DS Remediation script:
|
Disable SCTP Supportrule
The Stream Control Transmission Protocol (SCTP) is a
transport layer protocol, designed to support the idea of
message-oriented communication, with several streams of messages
within one connection.
To configure the system to prevent the install sctp /bin/trueRationale: Disabling SCTP protects the system against exploitation of any flaws in its implementation. identifiers: CCE-26410-1, DISA FSO RHEL-06-000125 references: CM-7, 382, Test attestation on 20121024 by DS Remediation script:
|
Disable RDS Supportrule
The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high- bandwidth,
low-latency communications between nodes in a cluster.
To configure the system to prevent the install rds /bin/trueRationale: Disabling RDS protects the system against exploitation of any flaws in its implementation. identifiers: CCE-26239-4, DISA FSO RHEL-06-000126 references: CM-7, 382, Test attestation on 20121024 by DS Remediation script:
|
Disable TIPC Supportrule
The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.
To configure the system to prevent the install tipc /bin/trueRationale: Disabling TIPC protects the system against exploitation of any flaws in its implementation. identifiers: CCE-26696-5, DISA FSO RHEL-06-000127 references: CM-7, 382, Test attestation on 20121024 by DS Remediation script:
|
IPSec SupportgroupSupport for Internet Protocol Security (IPsec) is provided in RHEL 6 with Openswan. |
contains 1 rule |
Install openswan PackageruleThe Openswan package provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks.
The $ sudo yum install openswanRationale: Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network. identifiers: CCE-27626-1, DISA FSO RHEL-06-000321 references: AC-17, MA-4, SC-8, 1130, 1131 Remediation script:
|
Configure SysloggroupThe syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
|
contains 7 rules |
Ensure Proper Configuration of Log Filesgroup
The file *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg * uucp,news.crit /var/log/spooler local7.* /var/log/boot.logSee the man page rsyslog.conf(5) for more information.
Note that the rsyslog daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file /etc/rsyslog.conf and add or edit the following line:
$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat |
contains 3 rules |
Ensure Log Files Are Owned By Appropriate UserruleThe owner of all log files written by
$ ls -l LOGFILEIf the owner is not root , run the following command to
correct this:
$ sudo chown root LOGFILERationale: The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access. identifiers: CCE-26812-8, DISA FSO RHEL-06-000133 references: AC-6, 1314, Test attestation on 20121024 by DS |
Ensure Log Files Are Owned By Appropriate GroupruleThe group-owner of all log files written by
$ ls -l LOGFILEIf the owner is not root , run the following command to
correct this:
$ sudo chgrp root LOGFILERationale: The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access. identifiers: CCE-26821-9, DISA FSO RHEL-06-000134 references: AC-6, 1314, Test attestation on 20121024 by DS |
Ensure System Log Files Have Correct PermissionsruleThe file permissions for all log files written by
$ ls -l LOGFILEIf the permissions are not 600 or more restrictive, run the following command to correct this: $ sudo chmod 0600 LOGFILERationale: Log files can contain valuable information regarding system configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value. identifiers: CCE-27190-8, DISA FSO RHEL-06-000135 references: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1314, Test attestation on 20121024 by DS |
contains 1 rule |
Ensure All Logs are Rotated by logrotategroupEdit the file /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \ /var/log/boot.log /var/log/cron {Edit this line so that it contains a one-space-separated listing of each log file referenced in /etc/rsyslog.conf .
All logs in use on a system must be rotated regularly, or the log files will consume disk space over time, eventually interfering with system operation. The file /etc/logrotate.d/syslog is the
configuration file used by the logrotate program to maintain all
log files written by syslog . By default, it rotates logs weekly and
stores four archival copies of each log. These settings can be
modified by editing /etc/logrotate.conf , but the defaults are
sufficient for purposes of this guide.
Note that logrotate is run nightly by the cron job
/etc/cron.daily/logrotate . If particularly active logs need to be
rotated more often than once a day, some other mechanism must be
used. |
contains 1 rule |
Ensure Logrotate Runs PeriodicallyruleThe # rotate log files frequency dailyRationale: Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full. identifiers: CCE-27014-0, DISA FSO RHEL-06-000138 |
Ensure rsyslog is Installedrule
Rsyslog is installed by default.
The $ sudo yum install rsyslogRationale: The rsyslog package provides the rsyslog daemon, which provides system logging services. identifiers: CCE-26809-4 references: AU-9(2), 1311, 1312, Test attestation on 20121024 by DS Remediation script:
|
Enable rsyslog ServiceruleThe $ sudo chkconfig --level 2345 rsyslog onRationale: The identifiers: CCE-26807-8 references: AU-12, 1557, 1312, 1311, Test attestation on 20121024 by DS Remediation script:
|
System Accounting with auditdgroupThe audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, type=AVC msg=audit(1226874073.147:96): avc: denied { getattr } for pid=2465 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13 a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
|
contains 36 rules |
Configure auditd Data Retentiongroup
The audit system writes data to |
contains 6 rules |
Configure auditd Number of Logs RetainedruleDetermine how many log files
num_logs = NUMLOGSSet the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation.Rationale: The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained. identifiers: CCE-27522-2, DISA FSO RHEL-06-000159 references: AU-1(b), AU-11, IR-5, Test attestation on 20121024 by DS |
Configure auditd Max Log File SizeruleDetermine the amount of audit data (in megabytes)
which should be retained in each log file. Edit the file
max_log_file = STOREMBSet the value to 6 (MB) or higher for general-purpose systems.
Larger values, of course,
support retention of even more audit data.Rationale:The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained. identifiers: CCE-27550-3, DISA FSO RHEL-06-000160 references: AU-1(b), AU-11, IR-5, Test attestation on 20121024 by DS |
Configure auditd max_log_file_action Upon Reaching Maximum Log Sizerule The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by max_log_file_action = ACTIONPossible values for ACTION are described in the auditd.conf man
page. These include:
ACTION to rotate to ensure log rotation
occurs. This is the default. The setting is case-insensitive.
Rationale:Automatically rotating logs (by setting this to identifiers: CCE-27237-7, DISA FSO RHEL-06-000161 references: AU-1(b), AU-4, AU-11, IR-5, Test attestation on 20121024 by DS |
Configure auditd space_left Action on Low Disk SpaceruleThe space_left_action = ACTIONPossible values for ACTION are described in the auditd.conf man page.
These include:
email (instead of the default,
which is suspend ) as it is more likely to get prompt attention. Acceptable values
also include suspend , single , and halt .
Rationale:Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption. identifiers: CCE-27238-5, DISA FSO RHEL-06-000005 references: AU-1(b), AU-4, AU-5(b), IR-5, 140, 143, Test attestation on 20121024 by DS Remediation script:
|
Configure auditd admin_space_left Action on Low Disk SpaceruleThe admin_space_left_action = ACTIONSet this value to single to cause the system to switch to single-user
mode for corrective action. Acceptable values also include suspend and
halt . For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for ACTION are described in the
auditd.conf man page.
Rationale:Administrators should be made aware of an inability to record audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur. identifiers: CCE-27239-3 references: AU-1(b), AU-4, AU-5(b), IR-5, 140, 1343, Test attestation on 20121024 by DS Remediation script:
|
Configure auditd mail_acct Action on Low Disk SpaceruleThe action_mail_acct = rootRationale: Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action. identifiers: CCE-27241-9, DISA FSO RHEL-06-000313 |
Configure auditd Rules for Comprehensive AuditinggroupThe
Auditing rules at startup are controlled by the file /etc/audit/audit.rules .
Add rules to it to meet the auditing requirements for your organization.
Each line in /etc/audit/audit.rules represents a series of arguments
that can be passed to auditctl and can be individually tested
during runtime. See documentation in /usr/share/doc/audit-VERSION and
in the related man pages for more details.
If copying any example audit rulesets from /usr/share/doc/audit-VERSION ,
be sure to comment out the
lines containing arch= which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
After reviewing all the rules, reading the following sections, and editing as needed, the new rules can be activated as follows: $ sudo service auditd restart |
contains 28 rules |
Records Events that Modify Date and Time InformationgroupArbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time. All changes to the system time should be audited. |
contains 5 rules |
Record attempts to alter time through adjtimexruleOn a 32-bit system, add the following to # audit_time_rules -a always,exit -F arch=b32 -S adjtimex -k audit_time_rulesOn a 64-bit system, add the following to /etc/audit/audit.rules :
# audit_time_rules -a always,exit -F arch=b64 -S adjtimex -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rulesRationale: Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. identifiers: CCE-26242-8, DISA FSO RHEL-06-000165 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 1487, 169 Remediation script:
|
Record attempts to alter time through settimeofdayruleOn a 32-bit system, add the following to # audit_time_rules -a always,exit -F arch=b32 -S settimeofday -k audit_time_rulesOn a 64-bit system, add the following to /etc/audit/audit.rules :
# audit_time_rules -a always,exit -F arch=b64 -S settimeofday -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rulesRationale: Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. identifiers: CCE-27203-9, DISA FSO RHEL-06-000167 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 1487, 169 Remediation script:
|
Record Attempts to Alter Time Through stimeruleOn a 32-bit system, add the following to # audit_time_rules -a always,exit -F arch=b32 -S stime -k audit_time_rulesOn a 64-bit system, the "-S stime" is not necessary. The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rulesRationale: Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. identifiers: CCE-27169-2, DISA FSO RHEL-06-000169 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 1487, 169 Remediation script:
|
Record Attempts to Alter Time Through clock_settimeruleOn a 32-bit system, add the following to # audit_time_rules -a always,exit -F arch=b32 -S clock_settime -k audit_time_rulesOn a 64-bit system, add the following to /etc/audit/audit.rules :
# audit_time_rules -a always,exit -F arch=b64 -S clock_settime -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rulesRationale: Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. identifiers: CCE-27170-0, DISA FSO RHEL-06-000171 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 1487, 169 Remediation script:
|
Record Attempts to Alter the localtime FileruleAdd the following to -w /etc/localtime -p wa -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used. Rationale: Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. identifiers: CCE-27172-6, DISA FSO RHEL-06-000173 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 1487, 169 Remediation script:
|
Record Events that Modify the System's Discretionary Access ControlsgroupAt a minimum, the audit system should collect file permission
changes for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_modIf your system is 64 bit then these lines should be duplicated and the arch=b32 replaced with arch=b64 as follows: -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod |
contains 13 rules |
Record Events that Modify the System's Discretionary Access Controls - chmodruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-26280-8, DISA FSO RHEL-06-000184 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - chownruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27173-4, DISA FSO RHEL-06-000185 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - fchmodruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27174-2, DISA FSO RHEL-06-000186 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - fchmodatruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27175-9, DISA FSO RHEL-06-000187 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - fchownruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27177-5, DISA FSO RHEL-06-000188 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - fchownatruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27178-3, DISA FSO RHEL-06-000189 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - fremovexattrruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27179-1, DISA FSO RHEL-06-000190 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - fsetxattrruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27180-9, DISA FSO RHEL-06-000191 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - lchownruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27181-7, DISA FSO RHEL-06-000192 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - lremovexattrruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27182-5, DISA FSO RHEL-06-000193 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - lsetxattrruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27183-3, DISA FSO RHEL-06-000194 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - removexattrruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27184-1, DISA FSO RHEL-06-000195 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify the System's Discretionary Access Controls - setxattrruleAt a minimum the audit system should collect file
permission changes for all users and root. Add the following to
-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_modIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users. identifiers: CCE-27185-8, DISA FSO RHEL-06-000196 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Record Events that Modify User/Group InformationruleAdd the following to # audit_rules_usergroup_modification -w /etc/group -p wa -k audit_rules_usergroup_modification -w /etc/passwd -p wa -k audit_rules_usergroup_modification -w /etc/gshadow -p wa -k audit_rules_usergroup_modification -w /etc/shadow -p wa -k audit_rules_usergroup_modification -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modificationRationale: In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. identifiers: CCE-26664-3, DISA FSO RHEL-06-000174 references: AC-2(4), AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 18, 1403, 1404, 1405, 1684, 1683, 1685, 1686 Remediation script:
|
Record Events that Modify the System's Network EnvironmentruleAdd the following to # audit_rules_networkconfig_modification -a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification -w /etc/issue -p wa -k audit_rules_networkconfig_modification -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification -w /etc/hosts -p wa -k audit_rules_networkconfig_modification -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modificationRationale: The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited. identifiers: CCE-26648-6, DISA FSO RHEL-06-000182 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5 Remediation script:
|
System Audit Logs Must Have Mode 0640 or Less PermissiveruleChange the mode of the audit log files with the following command: $ sudo chmod 0640 audit_fileRationale: If users can write to audit logs, audit trails can be modified or destroyed. identifiers: CCE-27243-5, DISA FSO RHEL-06-000383 references: AC-6, AU-1(b), AU-9, IR-5, 166, Test attestation on 20121024 by DS Remediation script:
|
Record Events that Modify the System's Mandatory Access ControlsruleAdd the following to -w /etc/selinux/ -p wa -k MAC-policyRationale: The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. identifiers: CCE-26657-7, DISA FSO RHEL-06-000183 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5 Remediation script:
|
Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)ruleAt a minimum the audit system should collect
unauthorized file accesses for all users and root. Add the following
to -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k accessIf the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k accessRationale: Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise. identifiers: CCE-26712-0, DISA FSO RHEL-06-000197 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Ensure auditd Collects Information on the Use of Privileged CommandsruleAt a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition PART: $ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/nullThen, for each setuid / setgid program on the system, add a line of the following form to /etc/audit/audit.rules , where
SETUID_PROG_PATH is the full path to each setuid / setgid program
in the list:
-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=500 -F auid!=4294967295 -k privilegedRationale: Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity. identifiers: CCE-26457-2, DISA FSO RHEL-06-000198 references: AC-3(10)), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AC-6(9), AU-12(a), AU-12(c), IR-5, 40, Test attestation on 20140703 by JL Remediation script:
|
Ensure auditd Collects Information on Exporting to Media (successful)ruleAt a minimum the audit system should collect media
exportation events for all users and root. Add the following to
-a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k exportRationale: The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss. identifiers: CCE-26573-6, DISA FSO RHEL-06-000199 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126, Test attestation on 20121024 by DS Remediation script:
|
Ensure auditd Collects File Deletion Events by UserruleAt a minimum the audit system should collect file
deletion events for all users and root. Add the following to
-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k deleteRationale: Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence. identifiers: CCE-26651-0, DISA FSO RHEL-06-000200 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Ensure auditd Collects System Administrator ActionsruleAt a minimum the audit system should collect
administrator actions for all users and root. Add the following to
-w /etc/sudoers -p wa -k actionsRationale: The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes. identifiers: CCE-26662-7, DISA FSO RHEL-06-000201 references: AC-2(7)(b), AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126, Test attestation on 20121024 by DS Remediation script:
|
Ensure auditd Collects Information on Kernel Module Loading and UnloadingruleAdd the following to -w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -F arch=ARCH -S init_module -S delete_module -k modulesRationale: The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel. identifiers: CCE-26611-4, DISA FSO RHEL-06-000202 references: AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, 126 Remediation script:
|
Enable auditd ServiceruleThe $ sudo chkconfig --level 2345 auditd onRationale: Ensuring the identifiers: CCE-27058-7, DISA FSO RHEL-06-000145 references: AC-17(1), AU-1(b), AU-10, AU-12(a), AU-12(c), IR-5, 347, 157, 172, 880, 1353, 1462, 1487, 1115, 1454, 067, 158, 831, 1190, 1312, 1263, 130, 120, 1589, Test attestation on 20121024 by DS Remediation script:
|
Enable Auditing for Processes Which Start Prior to the Audit DaemonruleTo ensure all processes can be audited, even
those which start prior to the audit daemon, add the argument
kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1Rationale:
Each process on the system carries an "auditable" flag which
indicates whether its activities can be audited. Although identifiers: CCE-26785-6, DISA FSO RHEL-06-000525 references: AC-17(1), AU-14(1), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-10, IR-5, 1464, 130 Remediation script:
|
Servicesgroup
The best protection against vulnerable software is running less software. This section describes how to review
the software which Red Hat Enterprise Linux 6 installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default RHEL 6 system and provides guidance about which
ones can be safely disabled.
|
contains 53 rules |
Obsolete ServicesgroupThis section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of RHEL 6
by default.
|
contains 14 rules |
XinetdgroupThe |
contains 2 rules |
Disable xinetd Servicerule
The $ sudo chkconfig xinetd offRationale: The xinetd service provides a dedicated listener service for some programs, which is no longer necessary for commonly-used network services. Disabling it ensures that these uncommon services are not running, and also prevents attacks against xinetd itself. identifiers: CCE-27046-2, DISA FSO RHEL-06-000203 references: CM-7, 305, Test attestation on 20121026 by DS |
Uninstall xinetd PackageruleThe $ sudo yum erase xinetdRationale:
Removing the identifiers: CCE-27005-8, DISA FSO RHEL-06-000204 references: CM-7, 305, Test attestation on 20121026 by DS Remediation script:
|
TelnetgroupThe telnet protocol does not provide confidentiality or integrity for information transmitted on the network. This includes authentication information such as passwords. Organizations which use telnet should be actively working to migrate to a more secure protocol. |
contains 2 rules |
Disable telnet Servicerule
The $ sudo chkconfig telnet offRationale: The telnet protocol uses unencrypted network communication, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks. identifiers: CCE-26836-7, DISA FSO RHEL-06-000211 references: CM-7, IA-5(1)(c), 68, 1436, 197, 877, 888, Test attestation on 20121026 by DS |
Uninstall telnet-server PackageruleThe $ sudo yum erase telnet-serverRationale:
Removing the identifiers: CCE-27073-6, DISA FSO RHEL-06-000206 references: CM-7, 305, 381, Test attestation on 20121026 by DS Remediation script:
|
Rlogin, Rsh, and RexecgroupThe Berkeley r-commands are legacy services which allow cleartext remote access and have an insecure trust model. |
contains 5 rules |
Uninstall rsh-server PackageruleThe $ sudo yum erase rsh-serverRationale: The identifiers: CCE-27062-9, DISA FSO RHEL-06-000213 references: CM-7, 305, 381, Test attestation on 20121026 by DS Remediation script:
|
Disable rexec ServiceruleThe $ sudo chkconfig rexec offRationale: The rexec service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. identifiers: CCE-27208-8, DISA FSO RHEL-06-000216 references: CM-7, 68, 1436, Test attestation on 20121026 by DS |
Disable rsh ServiceruleThe $ sudo chkconfig rsh offRationale: The rsh service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. identifiers: CCE-26994-4, DISA FSO RHEL-06-000214 references: CM-7, IA-5(1)(c), 68, 1436, Test attestation on 20121026 by DS |
Disable rlogin ServiceruleThe $ sudo chkconfig rlogin offRationale: The rlogin service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. identifiers: CCE-26865-6, DISA FSO RHEL-06-000218 references: CM-7, IA-5(1)(c), 1436, Test attestation on 20121026 by DS |
Remove Rsh Trust FilesruleThe files $ sudo rm /etc/hosts.equiv $ rm ~/.rhostsRationale: Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system. identifiers: CCE-27270-8, DISA FSO RHEL-06-000019 references: CM-7, 1436, Test attestation on 20121026 by DS Remediation script:
|
NISgroupThe Network Information Service (NIS), also known as 'Yellow Pages' (YP), and its successor NIS+ have been made obsolete by Kerberos, LDAP, and other modern centralized authentication services. NIS should not be used because it suffers from security problems inherent in its design, such as inadequate protection of important authentication information. |
contains 2 rules |
Uninstall ypserv PackageruleThe $ sudo yum erase ypservRationale: Removing the identifiers: CCE-27079-3, DISA FSO RHEL-06-000220 references: CM-7, 305, 381, Test attestation on 20121026 by DS Remediation script:
|
Disable ypbind ServiceruleThe $ sudo chkconfig ypbind offRationale:
Disabling the identifiers: CCE-26894-6, DISA FSO RHEL-06-000221 references: CM-7, 305, Test attestation on 20121026 by DS |
TFTP ServergroupTFTP is a lightweight version of the FTP protocol which has traditionally been used to configure networking equipment. However, TFTP provides little security, and modern versions of networking operating systems frequently support configuration via SSH or other more secure protocols. A TFTP server should be run only if no more secure method of supporting existing equipment can be found. |
contains 3 rules |
Disable tftp ServiceruleThe $ sudo chkconfig tftp offRationale:
Disabling the identifiers: CCE-27055-3, DISA FSO RHEL-06-000223 references: CM-7, 1436, Test attestation on 20121026 by DS Remediation script:
|
Uninstall tftp-server Packagerule
The $ sudo yum erase tftp-serverRationale:
Removing the identifiers: CCE-26946-4, DISA FSO RHEL-06-000222 references: CM-7, 305, Test attestation on 20121026 by DS |
Ensure tftp Daemon Uses Secure ModeruleIf running the server_args = -s /var/lib/tftpbootRationale: Using the identifiers: CCE-27272-4, DISA FSO RHEL-06-000338 |
Base ServicesgroupThis section addresses the base services that are installed on a RHEL 6 default installation which are not covered in other sections. Some of these services listen on the network and should be treated with particular discretion. Other services are local system utilities that may or may not be extraneous. In general, system services should be disabled if not required. |
contains 7 rules |
Disable Automatic Bug Reporting Tool (abrtd)ruleThe Automatic Bug Reporting Tool ( $ sudo chkconfig abrtd offRationale: Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the local machine, as well as sensitive information from within a process's address space or registers. identifiers: CCE-27247-6, DISA FSO RHEL-06-000261 Remediation script:
|
Disable Network Console (netconsole)ruleThe $ sudo chkconfig netconsole offRationale: The identifiers: CCE-27254-2, DISA FSO RHEL-06-000289 Remediation script:
|
Disable ntpdate Service (ntpdate)ruleThe $ sudo chkconfig ntpdate offRationale: The identifiers: CCE-27256-7, DISA FSO RHEL-06-000265 references: CM-7, 382, Test attestation on 20121024 by DS |
Disable Odd Job Daemon (oddjobd)ruleThe $ sudo chkconfig oddjobd offRationale: The identifiers: CCE-27257-5, DISA FSO RHEL-06-000266 references: CM-7, 381, Test attestation on 20121024 by DS Remediation script:
|
Disable Apache Qpid (qpidd)ruleThe $ sudo chkconfig qpidd offRationale: The qpidd service is automatically installed when the "base"
package selection is selected during installation. The qpidd service listens
for network connections, which increases the attack surface of the system. If
the system is not intended to receive AMQP traffic, then the identifiers: CCE-26928-2, DISA FSO RHEL-06-000267 Remediation script:
|
Disable Network Router Discovery Daemon (rdisc)ruleThe $ sudo chkconfig rdisc offRationale: General-purpose systems typically have their network and routing information configured statically by a system administrator. Workstations or some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information. identifiers: CCE-27261-7, DISA FSO RHEL-06-000268 references: AC-4, CM-7, 382, Test attestation on 20121024 by DS Remediation script:
|
Disable Red Hat Network Service (rhnsd)ruleThe Red Hat Network service automatically queries Red Hat Network
servers to determine whether there are any actions that should be executed,
such as package updates. This only occurs if the system was registered to an
RHN server or satellite and managed as such.
The $ sudo chkconfig rhnsd offRationale: Although systems management and patching is extremely important to
system security, management by a system outside the enterprise enclave is not
desirable for some environments. However, if the system is being managed by RHN or
RHN Satellite Server the identifiers: CCE-26846-6, DISA FSO RHEL-06-000009 references: CM-7, 382, Test attestation on 20121024 by DS Remediation script:
|
Cron and At DaemonsgroupThe cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform necessary maintenance tasks, while at may or may not be required on a given system. Both daemons should be configured defensively. |
contains 1 rule |
Enable cron ServiceruleThe $ sudo chkconfig --level 2345 crond onRationale: Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential. identifiers: CCE-27070-2, DISA FSO RHEL-06-000224 references: CM-7, Test attestation on 20121024 by DS Remediation script:
|
SSH ServergroupThe SSH protocol is recommended for remote login and
remote file transfer. SSH provides confidentiality and integrity
for data exchanged between two systems, as well as server
authentication, through the use of public key cryptography. The
implementation included with the system is called OpenSSH, and more
detailed documentation is available from its website,
http://www.openssh.org. Its server program is called |
contains 10 rules |
Configure OpenSSH Server if NecessarygroupIf the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file |
contains 10 rules |
Allow Only SSH Protocol 2ruleOnly SSH protocol version 2 connections should be
permitted. The default setting in
Protocol 2Rationale: SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used. identifiers: CCE-27072-8, DISA FSO RHEL-06-000227 references: AC-3(10), IA-5(1)(c), 776, 774, 1436, Test attestation on 20121024 by DS Remediation script:
|
Set SSH Idle Timeout IntervalruleSSH allows administrators to set an idle timeout
interval.
After this interval has passed, the idle user will be
automatically logged out.
ClientAliveInterval 15The timeout interval is given in seconds. To have a timeout of 15 minutes, set interval to 900. If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made here. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle. Rationale: Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another. identifiers: CCE-26919-1, DISA FSO RHEL-06-000230 references: AC-2(5), SA-8, 879, 1133, Test attestation on 20121024 by DS Remediation script:
|
Set SSH Client Alive CountruleTo ensure the SSH idle timeout occurs precisely when the ClientAliveCountMax 0Rationale:
This ensures a user login will be terminated as soon as the identifiers: CCE-26282-4, DISA FSO RHEL-06-000231 references: AC-2(5), SA-8, 879, 1133, Test attestation on 20121024 by DS Remediation script:
|
Disable SSH Support for .rhosts FilesruleSSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via IgnoreRhosts yesRationale: SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. identifiers: CCE-27124-7, DISA FSO RHEL-06-000234 Remediation script:
|
Disable Host-Based AuthenticationruleSSH's cryptographic host-based authentication is
more secure than HostbasedAuthentication noRationale: SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. identifiers: CCE-27091-8, DISA FSO RHEL-06-000236 references: AC-3, 765, 766, Test attestation on 20121024 by DS Remediation script:
|
Disable SSH Root LoginruleThe root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line
in PermitRootLogin noRationale: Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password. identifiers: CCE-27100-7, DISA FSO RHEL-06-000237 references: AC-3, AC-6(2), IA-2(1), 770, Test attestation on 20121024 by DS Remediation script:
|
Disable SSH Access via Empty PasswordsruleTo explicitly disallow remote login from accounts with
empty passwords, add or correct the following line in
PermitEmptyPasswords noAny accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords. Rationale: Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere. identifiers: CCE-26887-0, DISA FSO RHEL-06-000239 references: AC-3, 765, 766, Test attestation on 20121024 by DS Remediation script:
|
Enable SSH Warning Bannerrule
To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in Banner /etc/issueAnother section contains information on how to create an appropriate system-wide warning banner. Rationale: The warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution. identifiers: CCE-27112-2, DISA FSO RHEL-06-000240 references: AC-8(a), 48, Test attestation on 20121024 by DS Remediation script:
|
Do Not Allow SSH Environment OptionsruleTo ensure users are not able to present
environment options to the SSH daemon, add or correct the following line
in PermitUserEnvironment noRationale: SSH environment options potentially allow users to bypass access restriction in some configurations. identifiers: CCE-27201-3, DISA FSO RHEL-06-000241 references: 1414, Test attestation on 20121024 by DS Remediation script:
|
Use Only Approved CiphersruleLimit the ciphers to those algorithms which are FIPS-approved.
Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
The following line in Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbcThe man page sshd_config(5) contains a list of supported ciphers.
Rationale:Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance. identifiers: CCE-26555-3, DISA FSO RHEL-06-000243 references: AC-3, AC-17(2), SI-7, IA-5(1)(c), IA-7, 803, 1144, 1145, 1146, Test attestation on 20121024 by DS Remediation script:
|
X Window SystemgroupThe X Window System implementation included with the system is called X.org. |
contains 2 rules |
Disable X WindowsgroupUnless there is a mission-critical reason for the system to run a graphical user interface, ensure X is not set to start automatically at boot and remove the X Windows software packages. There is usually no reason to run X Windows on a dedicated server machine, as it increases the system's attack surface and consumes system resources. Administrators of server systems should instead login via SSH or on the text console. |
contains 2 rules |
Disable X Windows Startup By Setting RunlevelruleSetting the system's runlevel to 3 will prevent automatic startup
of the X server. To do so, ensure the following line in id:3:initdefault:Rationale: Unnecessary services should be disabled to decrease the attack surface of the system. identifiers: CCE-27119-7, DISA FSO RHEL-06-000290 references: AC-3, 366, Test attestation on 20121025 by DS |
Remove the X Windows Package GroupruleRemoving all packages which constitute the X Window System ensures users or malicious software cannot start X. To do so, run the following command: $ sudo yum groupremove "X Window System"Rationale: Unnecessary packages should not be installed to decrease the attack surface of the system. identifiers: CCE-27198-1, DISA FSO RHEL-06-000291 references: 366, Test attestation on 20121025 by DS |
Avahi ServergroupThe Avahi daemon implements the DNS Service Discovery and Multicast DNS protocols, which provide service and host discovery on a network. It allows a system to automatically identify resources on the network, such as printers or web servers. This capability is also known as mDNSresponder and is a major part of Zeroconf networking. |
contains 1 rule |
Disable Avahi Server if PossiblegroupBecause the Avahi daemon service keeps an open network port, it is subject to network attacks. Disabling it can reduce the system's vulnerability to such attacks. |
contains 1 rule |
Disable Avahi Server Softwarerule
The $ sudo chkconfig avahi-daemon offRationale: Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted. identifiers: CCE-27087-6, DISA FSO RHEL-06-000246 |
DHCPgroupThe Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
|
contains 1 rule |
Disable DHCP ClientgroupDHCP is the default network configuration method provided by the system installer, and common on many networks. Nevertheless, manual management of IP addresses for systems implies a greater degree of management and accountability for network activity. |
contains 1 rule |
Disable DHCP Clientrule
For each interface on the system (e.g. eth0), edit
DHCP relies on trusting the local network. If the local network is not trusted, then it should not be used. However, the automatic configuration provided by DHCP is commonly used and the alternative, manual configuration, presents an unacceptable burden in many circumstances. identifiers: CCE-27021-5, DISA FSO RHEL-06-000292 references: CM-7, 366, Test attestation on 20121024 by DS |
Network Time ProtocolgroupThe Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of machines, and that their time is consistent with the
outside world.
|
contains 2 rules |
Enable the NTP Daemonrule
The $ sudo chkconfig --level 2345 ntpd onRationale: Enabling the identifiers: CCE-27093-4, DISA FSO RHEL-06-000247 references: AU-8(1), 160, Test attestation on 20121024 by DS Remediation script:
|
Specify a Remote NTP ServerruleTo specify a remote NTP server for time synchronization, edit
the file server ntpserverThis instructs the NTP software to contact that remote server to obtain time data. Rationale: Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with real time events. identifiers: CCE-27098-3, DISA FSO RHEL-06-000248 references: AU-8(1), 160, Test attestation on 20121024 by DS |
Mail Server Softwaregroup
Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that machines are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
|
contains 3 rules |
Configure SMTP For Mail ClientsgroupThis section discusses settings for Postfix in a submission-only e-mail configuration. |
contains 1 rule |
Disable Postfix Network Listeningrule
Edit the file inet_interfaces = localhostRationale:
This ensures identifiers: CCE-26780-7, DISA FSO RHEL-06-000249 references: CM-7, 382, Test attestation on 20121024 by DS |
Enable Postfix ServiceruleThe Postfix mail transfer agent is used for local mail delivery
within the system. The default configuration only listens for connections to
the default SMTP port (port 25) on the loopback interface (127.0.0.1). It is
recommended to leave this service enabled for local mail delivery.
The $ sudo chkconfig --level 2345 postfix onRationale: Local mail delivery is essential to some system maintenance and notification tasks. identifiers: CCE-26325-1, DISA FSO RHEL-06-000287 references: Test attestation on 20121024 by DS Remediation script:
|
Uninstall Sendmail PackageruleSendmail is not the default mail transfer agent and is
not installed by default.
The $ sudo yum erase sendmailRationale: The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead. identifiers: CCE-27515-6, DISA FSO RHEL-06-000288 references: CM-7, Test attestation on 20121024 by DS |
LDAPgroupLDAP is a popular directory service, that is, a standardized way of looking up information from a central database. RHEL 6 includes software that enables a system to act as both an LDAP client and server. |
contains 3 rules |
Configure OpenLDAP ClientsgroupThis section provides information on which security settings are
important to configure in OpenLDAP clients by manually editing the appropriate
configuration files. RHEL 6 provides an automated configuration tool called
authconfig and a graphical wrapper for authconfig called
warning
Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network. |
contains 2 rules |
Configure LDAP Client to Use TLS For All TransactionsruleConfigure LDAP to enforce TLS use. First, edit the file
ssl start_tlsThen review the LDAP server and ensure TLS has been configured. Rationale: The ssl directive specifies whether to use ssl or not. If not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL. identifiers: CCE-26690-8, DISA FSO RHEL-06-000252 references: CM-7, 776, 778, 1453, Test attestation on 20121024 by DS |
Configure Certificate Directives for LDAP Use of TLSruleEnsure a copy of a trusted CA certificate has been placed in
the file tls_cacertdir /etc/pki/tls/CAor tls_cacertfile /etc/pki/tls/CA/cacert.pemThen review the LDAP server and ensure TLS has been configured. Rationale: The tls_cacertdir or tls_cacertfile directives are required when tls_checkpeer is configured (which is the default for openldap versions 2.1 and up). These directives define the path to the trust certificates signed by the site CA. identifiers: CCE-27189-0, DISA FSO RHEL-06-000253 references: CM-7, 776, 778, 1453, Test attestation on 20121024 by DS |
Configure OpenLDAP ServergroupThis section details some security-relevant settings for an OpenLDAP server. Installation and configuration of OpenLDAP on RHEL 6 is available at: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-Directory_Servers.html. |
contains 1 rule |
Uninstall openldap-servers PackageruleThe $ sudo yum erase openldap-serversThe openldap-servers RPM is not installed by default on RHEL 6 machines. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed. Rationale: Unnecessary packages should not be installed to decrease the attack surface of the system. While this software is clearly essential on an LDAP server, it is not necessary on typical desktop or workstation systems. identifiers: CCE-26858-1, DISA FSO RHEL-06-000256 references: CM-7, 366, Test attestation on 20121024 by DS |
NFS and RPCgroupThe Network File System is a popular distributed filesystem for the Unix environment, and is very widely deployed. This section discusses the circumstances under which it is possible to disable NFS and its dependencies, and then details steps which should be taken to secure NFS's configuration. This section is relevant to machines operating as NFS clients, as well as to those operating as NFS servers. |
contains 3 rules |
Configure NFS ClientsgroupThe steps in this section are appropriate for machines which operate as NFS clients. |
contains 2 rules |
Mount Remote Filesystems with Restrictive OptionsgroupEdit the file |
contains 2 rules |
Mount Remote Filesystems with nodevrule
Add the Legitimate device files should only exist in the /dev directory. NFS mounts should not present device files to users. identifiers: CCE-27090-0, DISA FSO RHEL-06-000269 references: CM-7, MP-2, Test attestation on 20121025 by DS |
Mount Remote Filesystems with nosuidrule
Add the NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables should be installed to their default location on the local filesystem. identifiers: CCE-26972-0, DISA FSO RHEL-06-000270 references: Test attestation on 20121025 by DS |
Configure NFS ServersgroupThe steps in this section are appropriate for machines which operate as NFS servers. |
contains 1 rule |
Ensure Insecure File Locking is Not AllowedruleBy default the NFS server requires secure file-lock requests,
which require credentials from the client in order to lock a file. Most NFS
clients send credentials with file lock requests, however, there are a few
clients that do not send credentials when requesting a file-lock, allowing the
client to only be able to lock world-readable files. To get around this, the
Allowing insecure file locking could allow for sensitive data to be viewed or edited by an unauthorized user. identifiers: CCE-27167-6, DISA FSO RHEL-06-000309 references: 764 |
FTP ServergroupFTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
|
contains 2 rules |
Use vsftpd to Provide FTP Service if NecessarygroupThe primary vsftpd configuration file is
|
contains 2 rules |
Enable Logging of All FTP TransactionsruleAdd or correct the following configuration options within the xferlog_enable=YES xferlog_std_format=NO log_ftp_protocol=YES warning
If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to
the FTP server are logged using the verbose vsftpd log
format. The default vsftpd log file is identifiers: CCE-27142-9, DISA FSO RHEL-06-000339 |
Create Warning Banners for All FTP UsersruleEdit the vsftpd configuration file, which resides at banner_file=/etc/issueRationale: This setting will cause the system greeting banner to be used for FTP connections as well. identifiers: CCE-27145-2, DISA FSO RHEL-06-000348 references: 48 |
Samba(SMB) Microsoft Windows File Sharing ServergroupWhen properly configured, the Samba service allows
Linux machines to provide file and print sharing to Microsoft
Windows machines. There are two software packages that provide
Samba support. The first, |
contains 2 rules |
Configure Samba if NecessarygroupAll settings for the Samba daemon can be found in
|
contains 2 rules |
Require Client SMB Packet Signing, if using smbclientrule
To require samba clients running client signing = mandatoryRequiring samba clients such as smbclient to use packet
signing ensures they can
only communicate with servers that support packet signing.
Rationale:Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit. identifiers: CCE-26328-5, DISA FSO RHEL-06-000272 Remediation script:
|
Require Client SMB Packet Signing, if using mount.cifsruleRequire packet signing of clients who mount Samba
shares using the Packet signing can prevent man-in-the-middle attacks which modify SMB packets in transit. identifiers: CCE-26792-2, DISA FSO RHEL-06-000273 |
SNMP ServergroupThe Simple Network Management Protocol allows administrators to monitor the state of network devices, including computers. Older versions of SNMP were well-known for weak security, such as plaintext transmission of the community string (used for authentication) and usage of easily-guessable choices for the community string. |
contains 2 rules |
Configure SNMP Server if NecessarygroupIf it is necessary to run the snmpd agent on the system, some best practices should be followed to minimize the security risk from the installation. The multiple security models implemented by SNMP cannot be fully covered here so only the following general configuration advice can be offered:
|
contains 2 rules |
Configure SNMP Service to Use Only SNMPv3 or Newer rule
Edit $ sudo service snmpd restartRationale: Earlier versions of SNMP are considered insecure, as they potentially allow unauthorized access to detailed system management information. identifiers: CCE-27365-6, DISA FSO RHEL-06-000340 |
Ensure Default Password Is Not Usedrule
Edit $ sudo service snmpd restartRationale: Presence of the default SNMP password enables querying of different system aspects and could result in unauthorized knowledge of the system. identifiers: CCE-27593-3, DISA FSO RHEL-06-000341 references: Test attestation on 20121214 by MAN |