Download
| Alert*
|
CCE-91280-8
Collect Login and Logout Events (Scored) Monitor login and logout events. The parameters below track changes to files associated with login/logout events. The file /var/log/faillog tracks failed events from login. The file /var/log/lastlog maintain records of the last time a user successfully logge ... CCE-91288-1 Collect Kernel Module Loading and Unloading (Scored) "Monitor the loading and unloading of kernel modules. The programs insmod (install a kernel module), rmmod (remove a kernel module), and modprobe (a more sophisticated program to load and unload modules, as well as some other features) control lo ... CCE-91242-8 Limit Access via SSH (Scored) There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: AllowUsers The AllowUsers variable gives the system administrator the option of allowing specifi ... CCE-91121-4 Disable Mounting of jffs2 Filesystems (Not Scored) The jffs2 (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices. CCE-91167-7 Disable Send Packet Redirects (Scored) ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects. CCE-91144-6 Ensure chargen is not enabled (Scored) chargen is a network service that responds with 0 to 512 ASCII characters for each connection it receives. This service is intended for debugging and testing purposes. It is recommended that this service be disabled. CCE-91129-7 Set Boot Loader Password (Scored) Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters CCE-91230-3 Set SSH Protocol to 2 (Scored) SSH supports two different and incompatible protocols: SSH1 and SSH2. SSH1 was the original protocol and was subject to security issues. SSH2 is more advanced and secure. CCE-91170-1 Disable Secure ICMP Redirect Acceptance (Scored) Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure. CCE-91276-6 Record Events That Modify Date and Time Information (Scored) "Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the adjtimex (tune kernel clock), settimeofday (Set time, using timeval and timezone structures) stime (using seco ... CCE-91155-2 Ensure NFS and RPC are not enabled (Not Scored) The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network. CCE-91227-9 Set Password Creation Requirement Parameters Using pam_cracklib (Scored) The pam_cracklib module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and mor ... CCE-91178-4 Disable IPv6 (Not Scored) Although IPv6 has many advantages over IPv4, few organizations have implemented IPv6. CCE-91119-8 Disable Mounting of cramfs Filesystems (Not Scored) The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image. CCE-91281-6 Collect Session Initiation Information (Scored) "Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp file tracks all currently logged in users. The /var/log/wtmp file tracks logins, logouts, shutdown and ... CCE-91220-4 Set User/Group Owner and Permission on /etc/crontab (Scored) The /etc/crontab file is used by cron to control its own jobs. The commands in this item make sure that root is the user and group owner of the file and that only the owner can access the file. CCE-91243-6 Set SSH Banner (Scored) The Banner parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed. CCE-91289-9 Set system audit so that audit rules cannot be modified with auditctl. Setting the flag -e 2 forces audit to be put in immutable mode. Audit changes can only be made on system reboot. Rationale: In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide mal ... CCE-91122-2 Disable Mounting of hfs Filesystems (Not Scored) The hfs filesystem type is a hierarchical filesystem that allows you to mount Mac OS filesystems. CCE-91183-4 Verify Permissions on /etc/hosts.deny (Scored) The /etc/hosts.deny file contains network information that is used by many system applications and therefore must be readable for these applications to operate. CCE-91160-2 Ensure Samba is not enabled (Not Scored) The Samba daemon allows system administrators to configure their Linux systems to share file systems and directories with Windows desktops. Samba will advertise the file systems and directories via the Small Message Block (SMB) protocol. Windows desktop user ... CCE-91145-3 Ensure daytime is not enabled (Scored) daytime is a network service that responds with the server's current date and time. This service is intended for debugging and testing purposes. It is recommended that this service be disabled. CCE-91168-5 Disable Source Routed Packet Acceptance (Scored) In networking, source routing allows a sender to partially or fully specify the route packets take through a network. In contrast, non-source routed packets travel a path determined by routers in the network. In some cases, systems may not be routabl ... CCE-91231-1 Set LogLevel to INFO (Scored) The INFO parameter specifices that record login and logout activity will be logged. CCE-91277-4 Record Events That Modify User/Group Information (Scored) "Record events affecting the group, passwd (user IDs), shadow and gshadow (passwords) or /etc/security/opasswd (old passwords, based on remember parameter in the PAM configuration) files. The parameters in this section will watch the files t ... CCE-91239-4 Do Not Allow Users to Set Environment Options (Scored) The PermitUserEnvironment option allows users to present environment options to the ssh daemon. CCE-91216-2 In some installations, AIDE is not installed automatically. Rationale: Ensure AIDE is installed to make use of the file integrity features to monitor critical files for changes that could affect the security of the system. CCE-91171-9 Log Suspicious Packets (Scored) When enabled, this feature logs packets with un-routable source addresses to the kernel log. CCE-91228-7 Set Lockout for Failed Password Attempts (Not Scored) Lock out users after n unsuccessful consecutive login attempts. The first sets of changes are made to the PAM configuration file /etc/pam.d/login. The second set of changes are applied to the program specific PAM configuration file. The second s ... CCE-91133-9 Enable Randomized Virtual Memory Region Placement (Scored) Set the system flag to force randomized virtual memory region placement. CCE-91179-2 Install TCP Wrappers (Scored) TCP Wrappers provides a simple access list and standardized logging method for services capable of supporting it. In the past, services that were called from inetd and xinetd supported the use of tcp wrappers. As inetd and xinetd have been falling in disuse, any servic ... CCE-91221-2 Set User/Group Owner and Permission on /etc/cron.hourly (Scored) This directory contains system cron jobs that need to run on an hourly basis. The files in this directory cannot be manipulated by the crontab command, but are instead edited by system administrators using a text editor. The commands ... CCE-91282-4 Collect Discretionary Access Control Permission Modification Events (Scored) "Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The chmod, fchmod and fchmodat system calls ... CCE-91161-0 Ensure HTTP Proxy Server is not enabled (Not Scored) Squid is a standard proxy server used in many distributions and environments. CCE-91123-0 Disable Mounting of hfsplus Filesystems (Not Scored) The hfsplus filesystem type is a hierarchical filesystem designed to replace hfs that allows you to mount Mac OS filesystems. CCE-91146-1 Ensure echo is not enabled (Scored) echo is a network service that responds to clients with the data sent to it by the client. This service is intended for debugging and testing purposes. It is recommended that this service be disabled. CCE-91184-2 Disable DCCP (Not Scored) The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in- sequence delivery ... CCE-91169-3 Disable ICMP Redirect Acceptance (Scored) ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. By setting net.ipv4.con ... CCE-91217-0 Implement Periodic Execution of File Integrity (Scored) Implement periodic file checking, in compliance with site policy. CCE-91232-9 Set Permissions on /etc/ssh/sshd_config (Scored) The /etc/ssh/sshd_config file contains configuration specifications for sshd. The command below sets the owner and group of the file to root. CCE-91172-7 Enable Ignore Broadcast Requests (Scored) Setting net.ipv4.icmp_echo_ignore_broadcasts to 1 will cause the system to ignore all ICMP echo and timestamp requests to broadcast and multicast addresses. CCE-91229-5 Limit Password Reuse (Scored) The /etc/security/opasswd file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. CCE-91157-8 Ensure FTP Server is not enabled (Not Scored) The File Transfer Protocol (FTP) provides networked computers with the ability to transfer files. CCE-91134-7 Disable Prelink (Scored) The prelinking feature changes binaries in an attempt to decrease their startup time. CCE-91245-1 Restrict Access to the su Command (Scored) The su command allows a user to run a command or shell as another user. The program has been superseded by sudo, which allows for more granular control over privileged access. Normally, the su command can be executed by any user. By uncommenting the pam_wh ... CCE-91283-2 Monitor for unsuccessful attempts to access files. The parameters below are associated with system calls that control creation (creat), opening (open, openat) and truncation (truncate, ftruncate) of files. An audit log record will only be written if the user is a non- privileged user (auid > = 500), ... CCE-91222-0 Set User/Group Owner and Permission on /etc/cron.daily (Scored) The /etc/cron.daily directory contains system cron jobs that need to run on a daily basis. The files in this directory cannot be manipulated by the crontab command, but are instead edited by system administrators using a text editor. T ... CCE-91219-6 Enable cron Daemon (Scored) The cron daemon is used to execute batch jobs on the system. CCE-91124-8 Disable Mounting of squashfs Filesystems (Not Scored) The squashfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems (similar to cramfs). A squashfs image can be used without having to first decompress the image. CCE-91260-0 Verify User/Group Ownership on /etc/shadow (Scored) The /etc/shadow file contains the one-way cipher text passwords for each user defined in the /etc/passwd file. The command below sets the user and group ownership of the file to root. CCE-91185-9 Disable SCTP (Not Scored) The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-orie ... CCE-91162-8 Ensure SNMP Server is not enabled (Not Scored) The Simple Network Management Protocol (SNMP) server is used to listen for SNMP commands from an SNMP management system, execute the commands or collect the information and then send results back to the requesting system. CCE-91147-9 Ensure discard is not enabled (Scored) discard is a network service that simply discards all data it receives. This service is intended for debugging and testing purposes. It is recommended that this service be disabled. CCE-91256-8 Verify Permissions on /etc/passwd (Scored) The /etc/passwd file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate. CCE-91210-5 Install the rsyslog package (Scored) The rsyslog package is a third party package that provides many enhancements to syslog, such as multi-threading, TCP communication, message filtering and data base support. CCE-91233-7 Disable SSH X11 Forwarding (Scored) The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. CCE-91173-5 Enable Bad Error Message Protection (Scored) Setting icmp_ignore_bogus_error_responses to 1 prevents the kernel from logging bogus responses (RFC-1122 non-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages. CCE-91150-3 Ensure Avahi Server is not enabled (Scored) Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, a user can plu ... CCE-91284-0 Collect Successful File System Mounts (Scored) Monitor the use of the mount system call. The mount (and umount) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privilege ... CCE-91223-8 Set User/Group Owner and Permission on /etc/cron.weekly (Scored) The /etc/cron.weekly directory contains system cron jobs that need to run on a weekly basis. The files in this directory cannot be manipulated by the crontab command, but are instead edited by system administrators using a text editor ... CCE-91261-8 Verify User/Group Ownership on /etc/group (Scored) The /etc/group file contains a list of all the valid groups defined in the system. The command below allows read/write access for root and read access for everyone else. CCE-91163-6 Configure Mail Transfer Agent for Local-Only Mode (Scored) Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the M ... CCE-91140-4 Ensure talk client is not installed (Scored) The talk software makes it possible for users to send and receive messages across systems through a terminal session. CCE-91125-5 Disable Mounting of udf Filesystems (Not Scored) The udf filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing ... CCE-91148-7 Ensure time is not enabled (Scored) time is a network service that responds with the server's current date and time as a 32 bit integer. This service is intended for debugging and testing purposes. It is recommended that this service be disabled. CCE-91186-7 Disable RDS (Not Scored) The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation. CCE-91234-5 Set SSH MaxAuthTries to 4 or Less (Scored) The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. CCE-91257-6 Verify Permissions on /etc/shadow (Scored) The /etc/shadow file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information. CCE-91211-3 Ensure the rsyslog Service is activated (Scored) Once the rsyslog package is installed it needs to be activated. CCE-91174-3 Enable RFC-recommended Source Route Validation (Scored) Setting net.ipv4.conf.all.rp_filter and net.ipv4.conf.default.rp_filter to 1 forces the Linux kernel to utilize reverse path filtering on a received packet to determine if the packet was valid. Essentially, with reverse path filtering, if the ... CCE-91151-1 Ensure print server is not enabled (Not Scored) The Common Unix Print System (CUPS) provides the ability to print to both local and network printers. A system running CUPS can also accept print jobs from remote systems and print them to local printers. It also provides a web based remote administra ... CCE-91159-4 Ensure IMAP and POP server is not enabled (Not Scored) Dovecot is an open source IMAP and POP3 server for Linux based systems. CCE-91136-2 Ensure NIS is not installed (Scored) The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. CCE-91138-8 Ensure rsh client is not installed (Scored) The rsh package contains the client commands for the rsh services. CCE-91285-7 Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for the unlink (remove a file), unlinkat (remove a file attribute), rename (rename a file) and renameat (rename a file attribute) system calls and ta ... CCE-91224-6 Set User/Group Owner and Permission on /etc/cron.monthly (Scored) The /etc/cron.monthly directory contains system cron jobs that need to run on a monthly basis. The files in this directory cannot be manipulated by the crontab command, but are instead edited by system administrators using a text edi ... CCE-91164-4 Ensure rsync service is not enabled (Scored) The rsyncd service can be used to synchronize files between systems over network links. CCE-91141-2 Ensure telnet server is not enabled (Scored) The telnet-server package contains the telnet daemon, which accepts connections from users from other systems via the telnet protocol. CCE-91149-5 Ensure the X Window system is not installed (Scored) The X Window system provides a Graphical User Interface (GUI) where users can have multiple windows in which to run programs and various add on. The X Window system is typically used on desktops where users login, but not on servers where users t ... CCE-91126-3 Disable Automounting (Scored) autofs allows automatic mounting of devices, typically including CD/DVDs and USB drives. CCE-91187-5 Disable TIPC (Not Scored) The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes. CCE-91258-4 Verify Permissions on /etc/group (Scored) The /etc/group file contains a list of all the valid groups defined in the system. The command below allows read/write access for root and read access for everyone else. CCE-91235-2 Set SSH IgnoreRhosts to Yes (Scored) The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication. CCE-91190-9 Configure Audit Log Storage Size (Not Scored) Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started. CCE-91175-0 Enable TCP SYN Cookies (Scored) When tcp_syncookies is set, the kernel will handle TCP SYN packets normally until the half-open connection queue is full, at which time, the SYN cookie functionality kicks in. SYN cookies work by not using the SYN queue at all. Instead, the kernel simply replies to t ... CCE-91152-9 Ensure DHCP Server is not enabled (Scored) The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. CCE-91137-0 Ensure rsh server is not enabled (Scored) The Berkeley rsh-server (rsh, rlogin, rcp) package contains legacy services that exchange credentials in clear-text. CCE-91240-2 Use Only Approved Cipher in Counter Mode (Scored) This variable limits the types of ciphers that SSH can use during communication. CCE-91139-6 Ensure talk server is not enabled (Scored) The talk software makes it possible for users to send and receive messages across systems through a terminal session. The talk client (allows initiate of talk sessions) is installed by default. CCE-91225-3 Set User/Group Owner and Permission on /etc/cron.d (Scored) The /etc/cron.d directory contains system cron jobs that need to run in a similar manner to the hourly, daily weekly and monthly jobs from /etc/crontab, but require more granular control as to when they run. The files in this directory can ... CCE-91165-1 Ensure Biosdevname is not enabled (Scored) "'biosdevname' is an external tool that works with the udev framework for naming devices. 'biosdevname' uses three methods to determine NIC names: 1. PCI firmware spec.3.1 2. smbios (matches # after ""em"" to OEM # printed on board or housing) 3. PCI ... CCE-91237-8 Disable SSH Root Login (Scored) The PermitRootLogin parameter specifies if the root user can log in using ssh(1). The default is no. CCE-91142-0 Ensure tftp-server is not enabled (Scored) Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot machines from a boot server. The packages tftp and atftp are both used to define and support a TFTP server. CCE-91127-1 Set User/Group Owner on bootloader config (Scored) Set the owner and group of your boot loaders config file to the root user. These instructions default to GRUB stored at /boot/grub/grub.cfg. CCE-91274-1 Install and Enable auditd Service (Scored) Install and turn on the auditd daemon to record system events. CCE-91236-0 Set SSH HostbasedAuthentication to No (Scored) The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication. This option only applies to SSH Protocol Versi ... CCE-91251-9 Set Default umask for Users (Scored) The default umask determines the permissions of files created by users. The user creating the file has the discretion of making their files and directories readable by others via the chmod command. Users who wish to allow their files and directories to be readab ... CCE-91259-2 Verify User/Group Ownership on /etc/passwd (Scored) The /etc/passwd file contains a list of all the valid userIDs defined in the system, but not the passwords. The command below sets the owner and group of the file to root. CCE-91176-8 Disable IPv6 Router Advertisements (Not Scored) This setting disables the systems ability to accept router advertisements CCE-91153-7 Configure Network Time Protocol (NTP) (Scored) The Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on NTP can be found at http://www.ntp.org. NTP can be configured to be a client and/or a ser ... CCE-91287-3 Collect System Administrator Actions (sudolog) (Scored) Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands w ... CCE-91226-1 Restrict at/cron to Authorized Users (Scored) Configure /etc/cron.allow and /etc/at.allow to allow specific users to use these services. If /etc/cron.allow or /etc/at.allow do not exist, then /etc/at.deny and /etc/cron.deny are checked. Any user not specifically defined in those files is allowed to ... CCE-91249-3 Disable System Accounts (Scored) There are a number of accounts provided with Ubuntu that are used to manage applications and are not intended to provide an interactive shell. CCE-91189-1 Ensure Firewall is active (Scored) IPtables is an application that allows a system administrator to configure the IPv4 tables, chains and rules provided by the Linux kernel firewall. ufw was developed to ease IPtables firewall configuration. CCE-91181-8 The /etc/hosts.allow file contains networking information that is used by many applications and therefore must be readable for these applications to operate. Rationale: It is critical to ensure that the /etc/hosts.allow file is protected from unauthorized write access. Although it is protected by d ... CCE-91238-6 Set SSH PermitEmptyPasswords to No (Scored) The PermitEmptyPasswords parameter specifies if the server allows login to accounts with empty password strings. CCE-91166-9 Disable IP Forwarding (Scored) The net.ipv4.ip_forward flag is used to tell the server whether it can forward packets or not. If the server is not to be used as a router, set the flag to 0. CCE-91120-6 Disable Mounting of freevxfs Filesystems (Not Scored) The freevxfs filesystem type is a free version of the Veritas type filesystem. This is the primary filesystem type for HP-UX operating systems. CCE-91143-8 Ensure xinetd is not enabled (Scored) The eXtended InterNET Daemon (xinetd) is an open source super daemon that replaced the original inetd daemon. The xinetd daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests. Note: Several other se ... CCE-91290-7 Accept Remote rsyslog Messages Only on Designated Log Hosts (Not Scored) By default, rsyslog does not listen for log messages coming in from remote systems. The ModLoad tells rsyslog to load the imtcp.so module so it can listen over a network via TCP. The InputTCPServerRun option instructs rsyslogd ... CCE-91128-9 Set the owner and group of your boot loaders config file to the root user. These instructions default to GRUB stored at /boot/grub/grub.cfg. Rationale: Setting the owner and group to root prevents non-root users from changing the file. CCE-91214-7 Configure rsyslog to Send Logs to a Remote Log Host (Scored) The rsyslog utility supports the ability to send logs it gathers to a remote log host running syslogd(8) or to receive messages from remote hosts, reducing administrative overhead. CCE-91131-3 Restrict Core Dumps (Scored) A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overr ... CCE-91177-6 Disable IPv6 Redirect Acceptance (Not Scored) This setting prevents the system from accepting ICMP redirects. ICMP redirects tell the system about alternate routes for sending traffic. CCE-91154-5 Ensure LDAP is not enabled (Not Scored) The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database. CCE-91244-4 The file /etc/securetty contains a list of valid terminals that may be logged in directly as root. Rationale: Since the system console has special properties to handle emergency situations, it is important to ensure that the console is in a physically secure location and that unauthorized consoles ... CCE-91218-8 The system includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageable large. The file /etc/logrotate.d/rsyslog is the configuration file used to rotate log files created by rsyslog. Rationale: By keeping the log files smaller and ... CCE-91278-2 Record changes to network environment files or system calls. The below parameters monitor the sethostname (set the systems host name) or setdomainname (set the systems domainname) system calls, and write an audit event on system call exit. The other parameters monitor the /etc/issue and /etc/issue.n ... CCE-91279-0 Monitor SELinux mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/selinux directory. Rationale: Changes to files in this directory could indicate that an unauthorized u ... CCE-91272-5 The auditd daemon can be configured to halt the system when the audit logs are full. Rationale: In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the systems availability. CCE-91246-9 The PASS_MAX_DAYS parameter in /etc/login.defs allows an administrator to force passwords to expire once they reach a defined age. It is recommended that the PASS_MAX_DAYS parameter be set to less than or equal to 60 days. Rationale: The window of opportunity for an attacker to leverage compromised ... CCE-91247-7 The PASS_MIN_DAYS parameter in /etc/login.defs allows an administrator to prevent users from changing their password until a minimum number of days have passed since the last time the user changed their password. It is recommended that PASS_MIN_DAYS parameter be set to 7 or more days. Rationale: By ... CCE-91273-3 Normally, auditd will hold 4 logs of maximum log file size before deleting older log files. Rationale: In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history. CCE-91180-0 The /etc/hosts.allow file specifies which IP addresses are permitted to connect to the host. It is intended to be used in conjunction with the /etc/hosts.deny file. Rationale: The /etc/hosts.allow file supports access control by IP and helps ensure that only authorized systems can connect to the se ... CCE-91286-5 Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers will be written to ... CCE-91248-5 The PASS_WARN_AGE parameter in /etc/login.defs allows an administrator to notify users that their password will expire in a defined number of days. It is recommended that the PASS_WARN_AGE parameter be set to 7 or more days. Rationale: Providing an advance warning that a password will be expiring g ... CCE-91241-0 The two options ClientAliveInterval and ClientAliveCountMax control the timeout of ssh sessions. When the ClientAliveInterval variable is set, ssh sessions that have no activity for the specified length of time are terminated. When the ClientAliveCountMax variable is set, sshd will send client alive ... CCE-91252-7 User accounts that have been inactive for over a given period of time can be automatically disabled. It is recommended that accounts that are inactive for 35 or more days be disabled. Rationale: Inactive accounts pose a threat to system security since the users are not logging in to notice failed l ... CCE-91275-8 Configure grub or lilo so that processes that are capable of being audited can be audited even if they start up prior to auditd startup. Rationale: Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected. CCE-91182-6 The /etc/hosts.deny file specifies which IP addresses are not permitted to connect to the host. It is intended to be used in conjunction with the /etc/hosts.allow file. Rationale: The /etc/hosts.deny file serves as a failsafe so that any host not specified in /etc/hosts.allow is denied access to th ... |
