Evaluation Characteristics

Target machineforeman.local.lan
Benchmark URL/tmp/ssg-rhel6-ds.xml
Benchmark IDxccdf_org.ssgproject.content_benchmark_RHEL-6
Profile IDxccdf_org.ssgproject.content_profile_usgcb-rhel6-server
Started at2014-11-01T12:06:33
Finished at2014-11-01T12:08:24
Performed byslukasik

CPE Platforms

    Addresses

    • IPv4  127.0.0.1
    • IPv4  192.168.122.246
    • IPv6  0:0:0:0:0:0:0:1
    • IPv6  fe80:0:0:0:5054:1ff:fe1b:1048
    • MAC  00:00:00:00:00:00
    • MAC  52:54:01:1B:10:48

    Compliance and Scoring

    The target system did not satisfy the conditions of 130 rules! Furthermore, the results of 2 rules were inconclusive. Please review rule results and consider applying remediation.

    Rule results

    87 passed
    130 failed
    6 other

    Severity of failed rules

    0 other
    91 low
    35 medium
    4 high

    Score

    Scoring systemScoreMaximumPercent
    urn:xccdf:scoring:default61.747299100.000000
    61.75%

    Rule Overview

    TitleSeverityResult
    Guide to the Secure Configuration of Red Hat Enterprise Linux 6 130x fail 2x unknown 4x notchecked
    Introduction
    General Principles
    Encrypt Transmitted Data Whenever Possible
    Minimize Software to Minimize Vulnerability
    Run Different Network Services on Separate Systems
    Configure Security Tools to Improve System Robustness
    Least Privilege
    How to Use This Guide
    Read Sections Completely and in Order
    Test in Non-Production Environment
    Root Shell Environment Assumed
    Formatting Conventions
    Reboot Required
    System Settings 112x fail 2x unknown 4x notchecked
    Installing and Maintaining Software 9x fail 1x notchecked
    Disk Partitioning 5x fail
    Ensure /tmp Located On Separate Partitionlow
    fail
    Ensure /var Located On Separate Partitionlow
    fail
    Ensure /var/log Located On Separate Partitionlow
    fail
    Ensure /var/log/audit Located On Separate Partitionlow
    fail
    Ensure /home Located On Separate Partitionlow
    fail
    Encrypt Partitionslow
    notselected
    Updating Software 2x fail 1x notchecked
    Ensure Red Hat GPG Key Installedhigh
    fail
    Ensure gpgcheck Enabled In Main Yum Configurationhigh
    pass
    Ensure gpgcheck Enabled For All Yum Package Repositorieshigh
    fail
    Ensure Software Patches Installedhigh
    notchecked
    Software Integrity Checking 2x fail
    Verify Integrity with AIDE 1x fail
    Install AIDEmedium
    fail
    Disable Prelinkinglow
    notselected
    Build and Test AIDE Databasemedium
    notselected
    Configure Periodic Execution of AIDEmedium
    notselected
    Verify Integrity with RPM 1x fail
    Verify and Correct File Permissions with RPMlow
    fail
    Verify File Hashes with RPMlow
    pass
    Additional Security Software
    Install Intrusion Detection Softwarehigh
    notselected
    Install Virus Scanning Softwarelow
    notselected
    File Permissions and Masks 24x fail 1x notchecked
    Restrict Partition Mount Options 11x fail
    Add nodev Option to Non-Root Local Partitionslow
    fail
    Add nodev Option to Removable Media Partitionslow
    fail
    Add noexec Option to Removable Media Partitionslow
    fail
    Add nosuid Option to Removable Media Partitionslow
    fail
    Add nodev Option to /tmplow
    fail
    Add noexec Option to /tmplow
    fail
    Add nosuid Option to /tmplow
    fail
    Add nodev Option to /dev/shmlow
    fail
    Add noexec Option to /dev/shmlow
    fail
    Add nosuid Option to /dev/shmlow
    fail
    Bind Mount /var/tmp To /tmplow
    fail
    Restrict Dynamic Mounting and Unmounting of Filesystems 7x fail
    Disable Modprobe Loading of USB Storage Driverlow
    notselected
    Disable Kernel Support for USB via Bootloader Configurationlow
    notselected
    Disable Booting from USB Devices in Boot Firmwarelow
    notselected
    Assign Password to Prevent Changes to Boot Firmware Configurationlow
    notselected
    Disable the Automounterlow
    pass
    Disable GNOME Automountinglow
    notselected
    Disable Mounting of cramfslow
    fail
    Disable Mounting of freevxfslow
    fail
    Disable Mounting of jffs2low
    fail
    Disable Mounting of hfslow
    fail
    Disable Mounting of hfspluslow
    fail
    Disable Mounting of squashfslow
    fail
    Disable Mounting of udflow
    fail
    Disable All GNOME Thumbnailerslow
    notselected
    Verify Permissions on Important Files and Directories 1x fail
    Verify Permissions on Files with Local Account Information and Credentials
    Verify User Who Owns shadow Filemedium
    pass
    Verify Group Who Owns shadow Filemedium
    pass
    Verify Permissions on shadow Filemedium
    pass
    Verify User Who Owns group Filemedium
    pass
    Verify Group Who Owns group Filemedium
    pass
    Verify Permissions on group Filemedium
    pass
    Verify User Who Owns gshadow Filemedium
    pass
    Verify Group Who Owns gshadow Filemedium
    pass
    Verify Permissions on gshadow Filemedium
    pass
    Verify User Who Owns passwd Filemedium
    pass
    Verify Group Who Owns passwd Filemedium
    pass
    Verify Permissions on passwd Filemedium
    pass
    Verify File Permissions Within Some Important Directories
    Verify that Shared Library Files Have Restrictive Permissionsmedium
    notselected
    Verify that Shared Library Files Have Root Ownershipmedium
    notselected
    Verify that System Executables Have Restrictive Permissionsmedium
    notselected
    Verify that System Executables Have Root Ownershipmedium
    notselected
    Verify that All World-Writable Directories Have Sticky Bits Setlow
    pass
    Ensure No World-Writable Files Existmedium
    pass
    Ensure All SGID Executables Are Authorizedlow
    fail
    Ensure All SUID Executables Are Authorizedlow
    pass
    Ensure All Files Are Owned by a Userlow
    pass
    Ensure All Files Are Owned by a Grouplow
    pass
    Ensure All World-Writable Directories Are Owned by a System Accountlow
    pass
    Restrict Programs from Dangerous Execution Patterns 5x fail 1x notchecked
    Daemon Umask 1x fail
    Set Daemon Umasklow
    fail
    Disable Core Dumps 2x fail
    Disable Core Dumps for All Userslow
    fail
    Disable Core Dumps for SUID programslow
    fail
    Enable ExecShield 2x fail
    Enable ExecShieldmedium
    fail
    Enable Randomized Layout of Virtual Address Spacemedium
    fail
    Enable Execute Disable (XD) or No Execute (NX) Support on x86 Systems 1x notchecked
    Install PAE Kernel on Supported 32-bit x86 Systemslow
    notchecked
    Enable NX or XD Support in the BIOSlow
    notselected
    Restrict Access to Kernel Message Bufferlow
    notselected
    SELinux 1x notchecked
    Ensure SELinux Not Disabled in /etc/grub.confmedium
    pass
    Ensure SELinux State is Enforcingmedium
    pass
    Configure SELinux Policylow
    pass
    Enable the SELinux Context Restoration Service (restorecond)low
    notselected
    Uninstall setroubleshoot Packagelow
    notselected
    Uninstall mcstrans Packagelow
    notselected
    Ensure No Daemons are Unconfined by SELinuxmedium
    notchecked
    Ensure No Device Files are Unlabeled by SELinuxlow
    pass
    Account and Access Control 27x fail
    Protect Accounts by Restricting Password-Based Login 7x fail
    Restrict Root Logins 2x fail
    Direct root Logins Not Allowedmedium
    notselected
    Restrict Virtual Console Root Loginsmedium
    fail
    Restrict Serial Port Root Loginslow
    fail
    Restrict Web Browser Use for Administrative Accountslow
    notselected
    Ensure that System Accounts Do Not Run a Shell Upon Loginmedium
    notselected
    Verify Only Root Has UID 0medium
    pass
    Root Path Must Be Vendor Defaultlow
    notselected
    Verify Proper Storage and Existence of Password Hashes 1x fail
    Prevent Log In to Accounts With Empty Passwordhigh
    fail
    Verify All Account Password Hashes are Shadowedmedium
    pass
    All GIDs referenced in /etc/passwd must be defined in /etc/grouplow
    notselected
    Verify No netrc Files Existmedium
    notselected
    Set Password Expiration Parameters 3x fail
    Set Password Minimum Length in login.defsmedium
    fail
    Set Password Minimum Agemedium
    notselected
    Set Password Maximum Agemedium
    fail
    Set Password Warning Agelow
    fail
    Set Account Expiration Parameters 1x fail
    Set Account Expiration Following Inactivitylow
    fail
    Ensure All Accounts on the System Have Unique Nameslow
    notselected
    Assign Expiration Date to Temporary Accountslow
    notselected
    Protect Accounts by Configuring PAM 8x fail
    Set Password Quality Requirements 6x fail
    Set Password Quality Requirements, if using pam_cracklib 6x fail
    Set Password Retry Prompts Permitted Per-Sessionlow
    fail
    Set Password to Maximum of Three Consecutive Repeating Characterslow
    notselected
    Set Password Strength Minimum Digit Characterslow
    fail
    Set Password Strength Minimum Uppercase Characterslow
    fail
    Set Password Strength Minimum Special Characterslow
    fail
    Set Password Strength Minimum Lowercase Characterslow
    fail
    Set Password Strength Minimum Different Characterslow
    fail
    Set Password Strength Minimum Different Categorieslow
    notselected
    Set Lockouts for Failed Password Attempts 2x fail
    Set Deny For Failed Password Attemptsmedium
    fail
    Set Lockout Time For Failed Password Attemptsmedium
    notselected
    Set Interval For Counting Failed Password Attemptsmedium
    notselected
    Limit Password Reusemedium
    fail
    Set Password Hashing Algorithm
    Set Password Hashing Algorithm in /etc/pam.d/system-authmedium
    pass
    Set Password Hashing Algorithm in /etc/login.defsmedium
    pass
    Set Password Hashing Algorithm in /etc/libuser.confmedium
    notselected
    Set Last Logon/Access Notificationlow
    notselected
    Secure Session Configuration Files for Login Accounts 5x fail
    Ensure that No Dangerous Directories Exist in Root's Path 1x fail
    Ensure that Root's Path Does Not Include Relative Paths or Null Directorieslow
    pass
    Ensure that Root's Path Does Not Include World or Group-Writable Directorieslow
    fail
    Ensure that Users Have Sensible Umask Values 3x fail
    Ensure the Default Bash Umask is Set Correctlylow
    fail
    Ensure the Default C Shell Umask is Set Correctlylow
    fail
    Ensure the Default Umask is Set Correctly in /etc/profilelow
    fail
    Ensure the Default Umask is Set Correctly in login.defslow
    pass
    Limit the Number of Concurrent Login Sessions Allowed Per Userlow
    notselected
    Ensure that User Home Directories are not Group-Writable or World-Readablelow
    fail
    Protect Physical Console Access 6x fail
    Set Boot Loader Password 1x fail
    Verify /etc/grub.conf User Ownershipmedium
    pass
    Verify /etc/grub.conf Group Ownershipmedium
    pass
    Verify /boot/grub/grub.conf Permissionsmedium
    pass
    Set Boot Loader Passwordmedium
    fail
    Configure Screen Locking 4x fail
    Configure GUI Screen Locking 4x fail
    Set GNOME Login Inactivity Timeoutmedium
    fail
    GNOME Desktop Screensaver Mandatory Usemedium
    fail
    Enable Screen Lock Activation After Idle Periodmedium
    fail
    Implement Blank Screensaverlow
    fail
    Configure Console Screen Locking
    Install the screen Packagelow
    notselected
    Hardware Tokens for Authentication
    Enable Smart Card Loginmedium
    notselected
    Require Authentication for Single User Modemedium
    notselected
    Disable Ctrl-Alt-Del Reboot Activationhigh
    notselected
    Disable Interactive Bootmedium
    fail
    Warning Banners for System Accesses 1x fail
    Implement a GUI Warning Banner
    Enable GUI Warning Bannermedium
    pass
    Set GUI Warning Banner Textmedium
    notselected
    Modify the System Login Bannermedium
    fail
    Disable the User Listlow
    notselected
    Network Configuration and Firewalls 23x fail 1x notchecked
    Disable Unused Interfaces
    Kernel Parameters Which Affect Networking 10x fail
    Network Parameters for Hosts Only 2x fail
    Disable Kernel Parameter for Sending ICMP Redirects by Defaultmedium
    fail
    Disable Kernel Parameter for Sending ICMP Redirects for All Interfacesmedium
    fail
    Disable Kernel Parameter for IP Forwardingmedium
    pass
    Network Related Kernel Runtime Parameters for Hosts and Routers 8x fail
    Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfacesmedium
    notselected
    Disable Kernel Parameter for Accepting ICMP Redirects for All Interfacesmedium
    fail
    Disable Kernel Parameter for Accepting Secure Redirects for All Interfacesmedium
    fail
    Enable Kernel Parameter to Log Martian Packetslow
    fail
    Disable Kernel Parameter for Accepting Source-Routed Packets By Defaultmedium
    pass
    Disable Kernel Parameter for Accepting ICMP Redirects By Defaultlow
    fail
    Disable Kernel Parameter for Accepting Secure Redirects By Defaultmedium
    fail
    Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requestslow
    fail
    Enable Kernel Parameter to Ignore Bogus ICMP Error Responseslow
    fail
    Enable Kernel Parameter to Use TCP Syncookiesmedium
    pass
    Enable Kernel Parameter to Use Reverse Path Filtering for All Interfacesmedium
    fail
    Enable Kernel Parameter to Use Reverse Path Filtering by Defaultmedium
    pass
    Wireless Networking 1x fail 1x notchecked
    Disable Wireless Through Software Configuration 1x fail 1x notchecked
    Disable WiFi or Bluetooth in BIOSlow
    notchecked
    Deactivate Wireless Network Interfaceslow
    pass
    Disable Bluetooth Servicemedium
    pass
    Disable Bluetooth Kernel Modulesmedium
    fail
    IPv6 4x fail
    Disable Support for IPv6 Unless Needed 2x fail
    Disable IPv6 Networking Support Automatic Loadingmedium
    fail
    Disable Interface Usage of IPv6low
    notselected
    Disable Support for RPC IPv6low
    fail
    Configure IPv6 Settings if Necessary 2x fail
    Disable Automatic Configuration 2x fail
    Disable Accepting IPv6 Router Advertisementslow
    fail
    Disable Accepting IPv6 Redirectsmedium
    fail
    Limit Network-Transmitted Configuration if Using Static IPv6 Addresses
    Manually Assign Global IPv6 Addresslow
    notselected
    Use Privacy Extensions for Addresslow
    notselected
    Manually Assign IPv6 Router Addresslow
    notselected
    iptables and ip6tables 3x fail
    Inspect and Activate Default Rules 1x fail
    Verify ip6tables Enabled if Using IPv6medium
    pass
    Set Default ip6tables Policy for Incoming Packetsmedium
    notselected
    Verify iptables Enabledmedium
    fail
    Strengthen the Default Ruleset 2x fail
    Restrict ICMP Message Types
    Log and Drop Packets with Suspicious Source Addresses
    Set Default iptables Policy for Incoming Packetsmedium
    fail
    Set Default iptables Policy for Forwarded Packetsmedium
    fail
    Transport Layer Security Support
    Uncommon Network Protocols 4x fail
    Disable DCCP Supportmedium
    fail
    Disable SCTP Supportmedium
    fail
    Disable RDS Supportlow
    fail
    Disable TIPC Supportmedium
    fail
    IPSec Support
    Install openswan Packagelow
    notselected
    Disable Zeroconf Networkinglow
    fail
    Ensure System is Not Acting as a Network Snifferlow
    notselected
    Configure Syslog 1x fail 2x unknown
    Ensure Proper Configuration of Log Files 2x unknown
    Ensure Log Files Are Owned By Appropriate Usermedium
    pass
    Ensure Log Files Are Owned By Appropriate Groupmedium
    unknown
    Ensure System Log Files Have Correct Permissionsmedium
    unknown
    Rsyslog Logs Sent To Remote Host 1x fail
    Ensure Logs Sent To Remote Hostlow
    fail
    Configure rsyslogd to Accept Remote Messages If Acting as a Log Server
    Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Serverlow
    pass
    Enable rsyslog to Accept Messages via TCP, if Acting As Log Serverlow
    notselected
    Enable rsyslog to Accept Messages via UDP, if Acting As Log Serverlow
    notselected
    Ensure All Logs are Rotated by logrotate
    Ensure Logrotate Runs Periodicallylow
    pass
    Configure Logwatch on the Central Log Server
    Configure Logwatch HostLimit Linelow
    notselected
    Configure Logwatch SplitHosts Linelow
    notselected
    Ensure rsyslog is Installedmedium
    pass
    Enable rsyslog Servicemedium
    pass
    Disable Logwatch on Clients if a Logserver Existslow
    notselected
    System Accounting with auditd 28x fail
    Configure auditd Data Retention
    Configure auditd Number of Logs Retainedmedium
    notselected
    Configure auditd Max Log File Sizemedium
    notselected
    Configure auditd max_log_file_action Upon Reaching Maximum Log Sizemedium
    notselected
    Configure auditd space_left Action on Low Disk Spacemedium
    notselected
    Configure auditd admin_space_left Action on Low Disk Spacemedium
    notselected
    Configure auditd mail_acct Action on Low Disk Spacemedium
    notselected
    Configure auditd to use audispd pluginmedium
    notselected
    Configure auditd Rules for Comprehensive Auditing 27x fail
    Records Events that Modify Date and Time Information 4x fail
    Record attempts to alter time through adjtimexlow
    fail
    Record attempts to alter time through settimeofdaylow
    fail
    Record Attempts to Alter Time Through stimelow
    pass
    Record Attempts to Alter Time Through clock_settimelow
    fail
    Record Attempts to Alter the localtime Filelow
    fail
    Record Events that Modify the System's Discretionary Access Controls 13x fail
    Record Events that Modify the System's Discretionary Access Controls - chmodlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - chownlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - fchmodlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - fchmodatlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - fchownlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - fchownatlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - fremovexattrlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - fsetxattrlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - lchownlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - lremovexattrlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - lsetxattrlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - removexattrlow
    fail
    Record Events that Modify the System's Discretionary Access Controls - setxattrlow
    fail
    Record Events that Modify User/Group Informationlow
    fail
    Record Events that Modify the System's Network Environmentlow
    fail
    System Audit Logs Must Have Mode 0640 or Less Permissivelow
    notselected
    System Audit Logs Must Be Owned By Rootlow
    notselected
    Record Events that Modify the System's Mandatory Access Controlslow
    fail
    Record Attempts to Alter Logon and Logout Eventslow
    notselected
    Record Attempts to Alter Process and Session Initiation Informationlow
    notselected
    Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)low
    fail
    Ensure auditd Collects Information on the Use of Privileged Commandslow
    fail
    Ensure auditd Collects Information on Exporting to Media (successful)low
    fail
    Ensure auditd Collects File Deletion Events by Userlow
    fail
    Ensure auditd Collects System Administrator Actionslow
    fail
    Ensure auditd Collects Information on Kernel Module Loading and Unloadinglow
    fail
    Make the auditd Configuration Immutablelow
    fail
    Enable auditd Servicemedium
    pass
    Enable Auditing for Processes Which Start Prior to the Audit Daemonmedium
    fail
    Services 18x fail
    Obsolete Services 3x fail
    Xinetd 2x fail
    Disable xinetd Servicemedium
    fail
    Uninstall xinetd Packagelow
    fail
    Telnet
    Disable telnet Servicehigh
    pass
    Uninstall telnet-server Packagehigh
    pass
    Remove telnet Clientslow
    notselected
    Rlogin, Rsh, and Rexec
    Uninstall rsh-server Packagehigh
    pass
    Disable rexec Servicehigh
    notselected
    Disable rsh Servicehigh
    notselected
    Uninstal rsh Packagelow
    notselected
    Disable rlogin Servicehigh
    notselected
    Remove Rsh Trust Fileshigh
    notselected
    NIS
    Uninstall ypserv Packagemedium
    pass
    Disable ypbind Servicemedium
    pass
    Remove NIS Clientlow
    notselected
    TFTP Server 1x fail
    Disable tftp Servicemedium
    pass
    Uninstall tftp-server Packagemedium
    fail
    Remove tftplow
    notselected
    Ensure tftp Daemon Uses Secure Modehigh
    notselected
    Chat/Messaging Services
    Uninstall talk-server Packagemedium
    notselected
    Uninstall talk Packagelow
    notselected
    Base Services 1x fail
    Disable Automatic Bug Reporting Tool (abrtd)low
    notselected
    Disable Advanced Configuration and Power Interface (acpid)low
    notselected
    Disable Certmonger Service (certmonger)low
    notselected
    Disable Control Group Config (cgconfig)low
    notselected
    Disable Control Group Rules Engine (cgred)low
    notselected
    Disable CPU Speed (cpuspeed)low
    notselected
    Disable Hardware Abstraction Layer Service (haldaemon)low
    notselected
    Enable IRQ Balance (irqbalance)low
    notselected
    Disable KDump Kernel Crash Analyzer (kdump)low
    fail
    Disable Software RAID Monitor (mdmonitor)low
    notselected
    Disable D-Bus IPC Service (messagebus)low
    notselected
    Disable Network Console (netconsole)low
    notselected
    Disable ntpdate Service (ntpdate)low
    notselected
    Disable Odd Job Daemon (oddjobd)low
    notselected
    Disable Portreserve (portreserve)low
    pass
    Enable Process Accounting (psacct)low
    notselected
    Disable Apache Qpid (qpidd)low
    notselected
    Disable Quota Netlink (quota_nld)low
    notselected
    Disable Network Router Discovery Daemon (rdisc)low
    notselected
    Disable Red Hat Network Service (rhnsd)low
    pass
    Disable Red Hat Subscription Manager Daemon (rhsmcertd)low
    notselected
    Disable Cyrus SASL Authentication Daemon (saslauthd)low
    notselected
    Disable SMART Disk Monitoring Service (smartd)low
    notselected
    Disable System Statistics Reset Service (sysstat)low
    notselected
    Cron and At Daemons 1x fail
    Restrict at and cron to Authorized Users if Necessary
    Enable cron Servicemedium
    pass
    Disable anacron Servicelow
    notselected
    Disable At Service (atd)low
    fail
    SSH Server 7x fail
    Configure OpenSSH Server if Necessary 7x fail
    Strengthen Firewall Configuration if Possible
    Allow Only SSH Protocol 2high
    pass
    Limit Users' SSH Accesslow
    notselected
    Set SSH Idle Timeout Intervallow
    fail
    Set SSH Client Alive Countlow
    fail
    Disable SSH Support for .rhosts Filesmedium
    pass
    Disable Host-Based Authenticationmedium
    pass
    Disable SSH Root Loginmedium
    fail
    Disable SSH Access via Empty Passwordshigh
    fail
    Enable SSH Warning Bannermedium
    fail
    Do Not Allow SSH Environment Optionslow
    fail
    Use Only Approved Ciphersmedium
    fail
    Disable SSH Server If Possible (Unusual)low
    notselected
    Remove SSH Server iptables Firewall exception (Unusual)low
    notselected
    X Window System
    Disable X Windows
    Disable X Windows Startup By Setting Runlevellow
    notselected
    Remove the X Windows Package Grouplow
    notselected
    Avahi Server
    Disable Avahi Server if Possible
    Disable Avahi Server Softwarelow
    pass
    Configure Avahi if Necessary
    Serve Avahi Only via Required Protocollow
    notselected
    Check Avahi Responses' TTL Fieldlow
    notselected
    Prevent Other Programs from Using Avahi's Portlow
    notselected
    Disable Avahi Publishinglow
    notselected
    Restrict Information Published by Avahilow
    notselected
    Print Support
    Configure the CUPS Service if Necessary
    Disable Printer Browsing Entirely if Possiblelow
    notselected
    Disable Print Server Capabilitieslow
    notselected
    Disable the CUPS Servicelow
    notselected
    DHCP
    Disable DHCP Server
    Disable DHCP Servicemedium
    pass
    Uninstall DHCP Server Packagemedium
    pass
    Disable DHCP Server
    Minimize Served Information
    Do Not Use Dynamic DNSlow
    notselected
    Deny Decline Messageslow
    notselected
    Deny BOOTP Querieslow
    notselected
    Configure Logginglow
    notselected
    Disable DHCP Client
    Disable DHCP Clientlow
    notselected
    Configure DHCP Client if Necessary
    Minimize the DHCP-Configured Options
    Network Time Protocol
    Enable the NTP Daemonmedium
    pass
    Specify a Remote NTP Servermedium
    pass
    Specify Additional Remote NTP Serverslow
    notselected
    Mail Server Software
    Configure SMTP For Mail Clients
    Disable Postfix Network Listeningmedium
    pass
    Configure Operating System to Protect Mail Server
    Configure SSL Certificates for Use with SMTP AUTH
    Ensure Security of Postfix SSL Certificate
    Configure Postfix if Necessary
    Configure Postfix Resource Usage to Limit Denial of Service Attacks
    Control Mail Relaying
    Configure Trusted Networks and Hosts
    Enact SMTP Relay Restrictions
    Enact SMTP Recipient Restrictions
    Require SMTP AUTH Before Relaying from Untrusted Clients
    Use TLS for SMTP AUTH
    Configure SMTP Greeting Bannermedium
    notselected
    Enable Postfix Servicelow
    notselected
    Uninstall Sendmail Packagemedium
    pass
    LDAP
    Configure OpenLDAP Clients
    Configure LDAP Client to Use TLS For All Transactionsmedium
    pass
    Configure Certificate Directives for LDAP Use of TLSmedium
    pass
    Configure OpenLDAP Server
    Install and Protect LDAP Certificate Files
    Uninstall openldap-servers Packagelow
    pass
    NFS and RPC 4x fail
    Disable All NFS Services if Possible 4x fail
    Disable Services Used Only by NFS 3x fail
    Disable Network File System Lock Service (nfslock)low
    fail
    Disable Secure RPC Client Service (rpcgssd)low
    fail
    Disable RPC ID Mapping Service (rpcidmapd)low
    fail
    Disable netfs if Possible 1x fail
    Disable Network File Systems (netfs)low
    fail
    Configure All Machines which Use NFS
    Make Each Machine a Client or a Server, not Both
    Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2)
    Configure lockd to use static TCP portlow
    notselected
    Configure lockd to use static UDP portlow
    notselected
    Configure statd to use static portlow
    notselected
    Configure mountd to use static portlow
    notselected
    Configure NFS Clients
    Disable NFS Server Daemons
    Specify UID and GID for Anonymous NFS Connectionslow
    notselected
    Disable Network File System (nfs)low
    notselected
    Disable Secure RPC Server Service (rpcsvcgssd)low
    pass
    Mount Remote Filesystems with Restrictive Options
    Mount Remote Filesystems with nodevmedium
    pass
    Mount Remote Filesystems with nosuidmedium
    pass
    Configure NFS Servers
    Configure the Exports File Restrictively
    Use Access Lists to Enforce Authorization Restrictions
    Export Filesystems Read-Only if Possible
    Use Root-Squashing on All Exportslow
    notselected
    Restrict NFS Clients to Privileged Portslow
    notselected
    Ensure Insecure File Locking is Not Allowedmedium
    notselected
    DNS Server
    Disable DNS Server
    Disable DNS Serverlow
    pass
    Uninstall bind Packagelow
    pass
    Isolate DNS from Other Services
    Run DNS Software on Dedicated Servers
    Run DNS Software in a chroot Jail
    Protect DNS Data from Tampering or Attack
    Run Separate DNS Servers for External and Internal Queries
    Use Views to Partition External and Internal Information
    Disable Zone Transfers from the Nameserverlow
    notselected
    Authenticate Zone Transferslow
    notselected
    Disable Dynamic Updateslow
    notselected
    FTP Server
    Disable vsftpd if Possible
    Disable vsftpd Servicelow
    pass
    Uninstall vsftpd Packagelow
    pass
    Use vsftpd to Provide FTP Service if Necessary
    Install vsftpd Packagelow
    notselected
    Use vsftpd to Provide FTP Service if Necessary
    Restrict the Set of Users Allowed to Access FTP
    Limit Users Allowed FTP Access if Necessary
    Restrict Access to Anonymous Users if Possiblelow
    notselected
    Configure Firewalls to Protect the FTP Server
    Enable Logging of All FTP Transactionslow
    notselected
    Create Warning Banners for All FTP Usersmedium
    notselected
    Disable FTP Uploads if Possiblelow
    notselected
    Place the FTP Home Directory on its Own Partitionlow
    notselected
    Web Server 2x fail
    Disable Apache if Possible 2x fail
    Disable httpd Servicelow
    fail
    Uninstall httpd Packagelow
    fail
    Install Apache if Necessary
    Confirm Minimal Built-in Modules Installed
    Secure Apache Configuration
    Restrict Web Server Information Leakage
    Set httpd ServerTokens Directive to Prodlow
    notselected
    Set httpd ServerSignature Directive to Offlow
    notselected
    Minimize Web Server Loadable Modules
    httpd Core Modules
    Minimize Modules for HTTP Basic Authentication
    Minimize Various Optional Components
    Minimize Configuration Files Included
    Disable HTTP Digest Authenticationlow
    notselected
    Disable HTTP mod_rewritelow
    notselected
    Disable LDAP Supportlow
    notselected
    Disable Server Side Includeslow
    notselected
    Disable MIME Magiclow
    notselected
    Disable WebDAV (Distributed Authoring and Versioning)low
    notselected
    Disable Server Activity Statuslow
    notselected
    Disable Web Server Configuration Displaylow
    notselected
    Disable URL Correction on Misspelled Entrieslow
    notselected
    Disable Proxy Supportlow
    notselected
    Disable Cache Supportlow
    notselected
    Disable CGI Supportlow
    notselected
    Directory Restrictions
    Restrict Root Directorylow
    notselected
    Restrict Web Directorylow
    notselected
    Restrict Other Critical Directorieslow
    notselected
    Limit Available Methodslow
    notselected
    Use Appropriate Modules to Improve httpd's Security
    Deploy mod_ssl
    Install mod_ssllow
    notselected
    Deploy mod_security
    Install mod_securitylow
    notselected
    Use Denial-of-Service Protection Modules
    Configure PHP Securely
    Configure Operating System to Protect Web Server
    Restrict File and Directory Access
    Set Permissions on the /var/log/httpd/ Directorylow
    notselected
    Set Permissions on the /etc/httpd/conf/ Directorylow
    notselected
    Set Permissions on All Configuration Files Inside /etc/httpd/conf/low
    notselected
    Configure iptables to Allow Access to the Web Server
    Run httpd in a chroot Jail if Practical
    IMAP and POP3 Server
    Disable Dovecot
    Disable Dovecot Servicelow
    pass
    Uninstall dovecot Packagelow
    pass
    Configure Dovecot if Necessary
    Support Only the Necessary Protocols
    Enable SSL Support
    Enable the SSL flag in /etc/dovecot.conflow
    notselected
    Configure Dovecot to Use the SSL Certificate filelow
    notselected
    Configure Dovecot to Use the SSL Key filelow
    notselected
    Disable Plaintext Authenticationlow
    notselected
    Allow IMAP Clients to Access the Server
    Samba(SMB) Microsoft Windows File Sharing Server
    Disable Samba if Possible
    Disable Sambalow
    pass
    Configure Samba if Necessary
    Restrict SMB File Sharing to Configured Networks
    Restrict Printer Sharing
    Disable Root Access to SMB Shareslow
    notselected
    Require Client SMB Packet Signing, if using smbclientlow
    pass
    Require Client SMB Packet Signing, if using mount.cifslow
    pass
    Proxy Server
    Disable Squid if Possible
    Disable Squidlow
    pass
    Uninstall squid Packagelow
    pass
    SNMP Server
    Disable SNMP Server if Possible
    Disable snmpd Servicelow
    pass
    Uninstall net-snmp Packagelow
    pass
    Configure SNMP Server if Necessary
    Configure SNMP Service to Use Only SNMPv3 or Newer medium
    notselected
    Ensure Default Password Is Not Usedmedium
    notselected
    Documentation to Support DISA OS SRG Mapping
    Product Meets this Requirementlow
    notselected
    Product Meets this Requirementlow
    notselected
    Product Meets this Requirementlow
    notselected
    Guidance Does Not Meet this Requirement Due to Impracticality or Scopelow
    notselected
    Implementation of the Requirement is Not Supportedlow
    notselected
    Guidance Does Not Meet this Requirement Due to Impracticality or Scopelow
    notselected
    A process for prompt installation of OS updates must exist.low
    notselected

    Result Details

    Ensure /tmp Located On Separate Partitionxccdf_org.ssgproject.content_rule_partition_for_tmp CCE-26435-8

    Ensure /tmp Located On Separate Partition

    Rule IDxccdf_org.ssgproject.content_rule_partition_for_tmp
    Result
    fail
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-26435-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1208,

    The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.

    Ensure /var Located On Separate Partitionxccdf_org.ssgproject.content_rule_partition_for_var CCE-26639-5

    Ensure /var Located On Separate Partition

    Rule IDxccdf_org.ssgproject.content_rule_partition_for_var
    Result
    fail
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-26639-5

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1208,

    The /var directory is used by daemons and other system services to store frequently-changing data. Ensure that /var has its own partition or logical volume at installation time, or migrate it using LVM.

    Ensure /var/log Located On Separate Partitionxccdf_org.ssgproject.content_rule_partition_for_var_log CCE-26215-4

    Ensure /var/log Located On Separate Partition

    Rule IDxccdf_org.ssgproject.content_rule_partition_for_var_log
    Result
    fail
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-26215-4

    references:  AU-9, 1208,

    System logs are stored in the /var/log directory. Ensure that it has its own partition or logical volume at installation time, or migrate it using LVM.

    Ensure /var/log/audit Located On Separate Partitionxccdf_org.ssgproject.content_rule_partition_for_var_log_audit CCE-26436-6

    Ensure /var/log/audit Located On Separate Partition

    Rule IDxccdf_org.ssgproject.content_rule_partition_for_var_log_audit
    Result
    fail
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-26436-6

    references:  AU-4, AU-9, 137, 138, 1208,

    Audit logs are stored in the /var/log/audit directory. Ensure that it has its own partition or logical volume at installation time, or migrate it later using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.

    Ensure /home Located On Separate Partitionxccdf_org.ssgproject.content_rule_partition_for_home CCE-26557-9

    Ensure /home Located On Separate Partition

    Rule IDxccdf_org.ssgproject.content_rule_partition_for_home
    Result
    fail
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-26557-9

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1208,

    If user home directories will be stored locally, create a separate partition for /home at installation time (or migrate it later using LVM). If /home will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.

    Encrypt Partitionsxccdf_org.ssgproject.content_rule_encrypt_partitions CCE-27596-6

    Encrypt Partitions

    Rule IDxccdf_org.ssgproject.content_rule_encrypt_partitions
    Result
    notselected
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-27596-6

    references:  SC-13, SC-28, 1019, 1199, 1200

    Red Hat Enterprise Linux 6 natively supports partition encryption through the Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to encrypt a partition is during installation time.



    For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.



    For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:

    part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
    Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.



    Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:

    https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html

    Ensure Red Hat GPG Key Installedxccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed CCE-26506-6

    Ensure Red Hat GPG Key Installed

    Rule IDxccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed
    Result
    fail
    Time2014-11-01T12:06:33
    Severityhigh
    Identifiers and References

    identifiers:  CCE-26506-6

    references:  SI-7, MA-1(b), 351,

    To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run:

    $ sudo rhn_register
    If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom, use the following command as the root user to import it into the keyring:
    $ sudo rpm --import /media/cdrom/RPM-GPG-KEY

    OVAL details

    Items violating Red Hat release key package is installed:

    namearchepochreleaseversionevrsignature keyidextended name
    gpg-pubkey(none)(none)4e0fd3a3c105b9de0:c105b9de-4e0fd3a30gpg-pubkey-0:c105b9de-4e0fd3a3.(none)
    gpg-pubkey(none)(none)4bd229420608b8950:0608b895-4bd229420gpg-pubkey-0:0608b895-4bd22942.(none)

    Items violating Red Hat auxiliary key package is installed:

    namearchepochreleaseversionevrsignature keyidextended name
    gpg-pubkey(none)(none)4e0fd3a3c105b9de0:c105b9de-4e0fd3a30gpg-pubkey-0:c105b9de-4e0fd3a3.(none)
    gpg-pubkey(none)(none)4bd229420608b8950:0608b895-4bd229420gpg-pubkey-0:0608b895-4bd22942.(none)
    Ensure gpgcheck Enabled In Main Yum Configurationxccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated CCE-26709-6

    Ensure gpgcheck Enabled In Main Yum Configuration

    Rule IDxccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
    Result
    pass
    Time2014-11-01T12:06:33
    Severityhigh
    Identifiers and References

    identifiers:  CCE-26709-6

    references:  SI-7, MA-1(b), 352, 663,

    The gpgcheck option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in /etc/yum.conf in the [main] section:

    gpgcheck=1

    Ensure gpgcheck Enabled For All Yum Package Repositoriesxccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled CCE-26647-8

    Ensure gpgcheck Enabled For All Yum Package Repositories

    Rule IDxccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
    Result
    fail
    Time2014-11-01T12:06:33
    Severityhigh
    Identifiers and References

    identifiers:  CCE-26647-8

    references:  SI-7, MA-1(b), 352, 663,

    To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form:

    gpgcheck=0

    OVAL details

    Items violating check for existence of gpgcheck=0 in /etc/yum.repos.d/ files:

    pathcontent
    /etc/yum.repos.d/foreman.repogpgcheck=0
    /etc/yum.repos.d/foreman-plugins.repogpgcheck=0
    Ensure Software Patches Installedxccdf_org.ssgproject.content_rule_security_patches_up_to_date CCE-27635-2

    Ensure Software Patches Installed

    Rule IDxccdf_org.ssgproject.content_rule_security_patches_up_to_date
    Result
    notchecked
    Time2014-11-01T12:06:33
    Severityhigh
    Identifiers and References

    identifiers:  CCE-27635-2

    references:  SI-2, MA-1(b), 1227, 1233,

    If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates:

    $ sudo yum update
    If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the Red Hat Network and installed using rpm.

    Install AIDExccdf_org.ssgproject.content_rule_package_aide_installed CCE-27024-9

    Install AIDE

    Rule IDxccdf_org.ssgproject.content_rule_package_aide_installed
    Result
    fail
    Time2014-11-01T12:06:33
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27024-9

    references:  CM-3(d), CM-3(e), CM-6(d), SC-28, SI-7, 1069,

    Install the AIDE package with the command:

    $ sudo yum install aide

    Remediation script:
    yum -y install aide
    
    Disable Prelinkingxccdf_org.ssgproject.content_rule_disable_prelink CCE-27221-1

    Disable Prelinking

    Rule IDxccdf_org.ssgproject.content_rule_disable_prelink
    Result
    notselected
    Time2014-11-01T12:06:33
    Severitylow
    Identifiers and References

    identifiers:  CCE-27221-1

    references:  CM-6(d), SC-28, SI-7

    The prelinking feature changes binaries in an attempt to decrease their startup time. In order to disable it, change or add the following line inside the file /etc/sysconfig/prelink:

    PRELINKING=no
    Next, run the following command to return binaries to a normal, non-prelinked state:
    $ sudo /usr/sbin/prelink -ua

    Build and Test AIDE Databasexccdf_org.ssgproject.content_rule_aide_build_database CCE-27135-3

    Build and Test AIDE Database

    Rule IDxccdf_org.ssgproject.content_rule_aide_build_database
    Result
    notselected
    Time2014-11-01T12:06:33
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27135-3

    references:  CM-3(d), CM-3(e), CM-6(d), SC-28, SI-7, 374, 416, 1069, 1263, 1297, 1589

    Run the following command to generate a new database:

    $ sudo /usr/sbin/aide --init
    By default, the database will be written to the file /var/lib/aide/aide.db.new.gz. Storing the database, the configuration file /etc/aide.conf, and the binary /usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:
    $ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
    To initiate a manual check, run the following command:
    $ sudo /usr/sbin/aide --check
    If this check produces any unexpected output, investigate.

    Configure Periodic Execution of AIDExccdf_org.ssgproject.content_rule_aide_periodic_cron_checking CCE-27222-9

    Configure Periodic Execution of AIDE

    Rule IDxccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
    Result
    notselected
    Time2014-11-01T12:06:33
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27222-9

    references:  CM-3(d), CM-3(e), CM-6(d), SC-28, SI-7, 374, 416, 1069, 1263, 1297, 1589

    To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:

    05 4 * * * root /usr/sbin/aide --check
    AIDE can be executed periodically through other means; this is merely one example.

    Verify and Correct File Permissions with RPMxccdf_org.ssgproject.content_rule_rpm_verify_permissions CCE-26731-0

    Verify and Correct File Permissions with RPM

    Rule IDxccdf_org.ssgproject.content_rule_rpm_verify_permissions
    Result
    fail
    Time2014-11-01T12:07:03
    Severitylow
    Identifiers and References

    identifiers:  CCE-26731-0

    references:  AC-6, CM-6(d), SI-7, 1493, 1494, 1495

    The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. After locating a file with incorrect permissions, run the following command to determine which package owns it:

    $ rpm -qf FILENAME
    Next, run the following command to reset its permissions to the correct values:
    $ sudo rpm --setperms PACKAGENAME

    OVAL details

    Items violating group ownership of all files matches local rpm database:

    nameepochversionreleasearchfilepathextended namesize differsmode differsmd5 differsdevice differslink mismatchownership differsgroup differsmtime differscapabilities differconfiguration filedocumentation fileghost filelicense filereadme file
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman(none)1.7.00.develop.201410101505git9645d89.el6noarch/etc/foreman/settings.yamlforeman-0:1.7.0-0.develop.201410101505git9645d89.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/bmc.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/dhcp.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/dns.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/puppet.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/puppetca.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/realm.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/tftp.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman(none)1.7.00.develop.201410101505git9645d89.el6noarch/etc/foreman/database.ymlforeman-0:1.7.0-0.develop.201410101505git9645d89.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    mlocate(none)0.22.24.el6x86_64/var/lib/mlocate/mlocate.dbmlocate-0:0.22.2-4.el6.x86_64passfailnot performedpasspasspassfailpasspassfalsefalsetruefalsefalse

    Items violating mode of all files matches local rpm database:

    nameepochversionreleasearchfilepathextended namesize differsmode differsmd5 differsdevice differslink mismatchownership differsgroup differsmtime differscapabilities differconfiguration filedocumentation fileghost filelicense filereadme file
    ca-certificates(none)2014.1.9865.0.el6_5noarch/etc/pki/ca-trust/extracted/java/cacertsca-certificates-0:2014.1.98-65.0.el6_5.noarchpassfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    ca-certificates(none)2014.1.9865.0.el6_5noarch/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crtca-certificates-0:2014.1.98-65.0.el6_5.noarchpassfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    ca-certificates(none)2014.1.9865.0.el6_5noarch/etc/pki/ca-trust/extracted/pem/email-ca-bundle.pemca-certificates-0:2014.1.98-65.0.el6_5.noarchpassfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    cronie-anacron(none)1.4.412.el6x86_64/var/spool/anacron/cron.monthlycronie-anacron-0:1.4.4-12.el6.x86_64passfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    cronie-anacron(none)1.4.412.el6x86_64/var/spool/anacron/cron.weeklycronie-anacron-0:1.4.4-12.el6.x86_64passfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    kernel(none)2.6.32431.el6x86_64/boot/initramfs-2.6.32-431.el6.x86_64.imgkernel-0:2.6.32-431.el6.x86_64passfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    puppet(none)2.7.252.el6noarch/var/log/puppetpuppet-0:2.7.25-2.el6.noarchpassfailnot performedpasspasspasspasspasspassfalsefalsefalsefalsefalse
    xinetd22.3.1439.el6_4x86_64/etc/xinetd.confxinetd-2:2.3.14-39.el6_4.x86_64failfailnot performedpasspasspasspassfailpasstruefalsefalsefalsefalse
    system-config-firewall-base(none)1.2.275.el6noarch/etc/sysconfig/system-config-firewallsystem-config-firewall-base-0:1.2.27-5.el6.noarchpassfailnot performedpasspasspasspasspasspasstruefalsetruefalsefalse
    ca-certificates(none)2014.1.9865.0.el6_5noarch/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pemca-certificates-0:2014.1.98-65.0.el6_5.noarchpassfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    ca-certificates(none)2014.1.9865.0.el6_5noarch/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemca-certificates-0:2014.1.98-65.0.el6_5.noarchpassfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    psacct(none)6.3.263.el6_3.3x86_64/var/account/pacctpsacct-0:6.3.2-63.el6_3.3.x86_64passfailnot performedpasspasspasspasspasspasstruefalsetruefalsefalse
    cronie-anacron(none)1.4.412.el6x86_64/var/spool/anacron/cron.dailycronie-anacron-0:1.4.4-12.el6.x86_64passfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    rubygem-hammer_cli_foreman(none)0.1.31.201409191432gitc38f9c8.el6noarch/etc/hammer/cli.modules.d/foreman.ymlrubygem-hammer_cli_foreman-0:0.1.3-1.201409191432gitc38f9c8.el6.noarchfailfailnot performedpasspasspasspassfailpasstruefalsefalsefalsefalse
    kernel(none)2.6.32431.29.2.el6x86_64/boot/initramfs-2.6.32-431.29.2.el6.x86_64.imgkernel-0:2.6.32-431.29.2.el6.x86_64passfailnot performedpasspasspasspasspasspassfalsefalsetruefalsefalse
    foreman(none)1.7.00.develop.201410101505git9645d89.el6noarch/etc/foreman/settings.yamlforeman-0:1.7.0-0.develop.201410101505git9645d89.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    mlocate(none)0.22.24.el6x86_64/var/lib/mlocate/mlocate.dbmlocate-0:0.22.2-4.el6.x86_64passfailnot performedpasspasspassfailpasspassfalsefalsetruefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/bmc.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/dhcp.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/dns.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/puppet.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/puppetca.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/realm.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman-proxy(none)1.7.00.develop.201410221520gitccd77aa.el6noarch/etc/foreman-proxy/settings.d/tftp.ymlforeman-proxy-0:1.7.0-0.develop.201410221520gitccd77aa.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    foreman(none)1.7.00.develop.201410101505git9645d89.el6noarch/etc/foreman/database.ymlforeman-0:1.7.0-0.develop.201410101505git9645d89.el6.noarchfailfailnot performedpasspasspassfailfailpasstruefalsefalsefalsefalse
    Verify File Hashes with RPMxccdf_org.ssgproject.content_rule_rpm_verify_hashes CCE-27223-7

    Verify File Hashes with RPM

    Rule IDxccdf_org.ssgproject.content_rule_rpm_verify_hashes
    Result
    pass
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27223-7

    references:  CM-6(d), SI-7, 1496

    The RPM package management system can check the hashes of installed software packages, including many that are important to system security. Run the following command to list which files on the system have hashes that differ from what is expected by the RPM database:

    $ rpm -Va | grep '^..5'
    A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:
    $ rpm -qf FILENAME
    The package can be reinstalled from a yum repository using the command:
    $ sudo yum reinstall PACKAGENAME
    Alternatively, the package can be reinstalled from trusted media using the command:
    $ sudo rpm -Uvh PACKAGENAME

    Install Intrusion Detection Softwarexccdf_org.ssgproject.content_rule_install_hids CCE-27409-2

    Install Intrusion Detection Software

    Rule IDxccdf_org.ssgproject.content_rule_install_hids
    Result
    notselected
    Time2014-11-01T12:07:34
    Severityhigh
    Identifiers and References

    identifiers:  CCE-27409-2

    references:  SC-7, 1263

    The base Red Hat platform already includes a sophisticated auditing system that can detect intruder activity, as well as SELinux, which provides host-based intrusion prevention capabilities by confining privileged programs and user sessions which may become compromised.

    In DoD environments, supplemental intrusion detection tools, such as, the McAfee Host-based Security System, are available to integrate with existing infrastructure. When these supplemental tools interfere with the proper functioning of SELinux, SELinux takes precedence.

    Install Virus Scanning Softwarexccdf_org.ssgproject.content_rule_install_antivirus CCE-27529-7

    Install Virus Scanning Software

    Rule IDxccdf_org.ssgproject.content_rule_install_antivirus
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27529-7

    references:  SC-28, SI-3, 1239, 1668

    Install virus scanning software, which uses signatures to search for the presence of viruses on the filesystem. The McAfee VirusScan Enterprise for Linux virus scanning tool is provided for DoD systems. Ensure virus definition files are no older than 7 days, or their last release. Configure the virus scanning software to perform scans dynamically on all accessed files. If this is not possible, configure the system to scan all altered files on the system on a daily basis. If the system processes inbound SMTP mail, configure the virus scanner to scan all received mail.

    Add nodev Option to Non-Root Local Partitionsxccdf_org.ssgproject.content_rule_mountopt_nodev_on_nonroot_partitions CCE-27045-4

    Add nodev Option to Non-Root Local Partitions

    Rule IDxccdf_org.ssgproject.content_rule_mountopt_nodev_on_nonroot_partitions
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27045-4

    references:  CM-7

    The nodev mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of any non-root local partitions.

    OVAL details

    Items violating nodev on local filesystems:

    mount pointdeviceuuidfs typemount optionsmount optionsmount optionsmount optionsmount optionstotal spacespace usedspace left
    /boot/dev/vda162fd0e28-da1f-4403-a1e6-626cc9c4a82fext4rwseclabelrelatimebarrier=1data=ordered12901018197110813
    Add nodev Option to Removable Media Partitionsxccdf_org.ssgproject.content_rule_mountopt_nodev_on_removable_partitions CCE-26860-7

    Add nodev Option to Removable Media Partitions

    Rule IDxccdf_org.ssgproject.content_rule_mountopt_nodev_on_removable_partitions
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26860-7

    references:  AC-19(a), AC-19(d), AC-19(e), CM-7, MP-2

    The nodev mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of any removable media partitions.

    Add noexec Option to Removable Media Partitionsxccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions CCE-27196-5

    Add noexec Option to Removable Media Partitions

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27196-5

    references:  AC-19(a), AC-19(d), AC-19(e), CM-7, MP-2, 87

    The noexec mount option prevents the direct execution of binaries on the mounted filesystem. Preventing the direct execution of binaries from removable media (such as a USB key) provides a defense against malicious software that may be present on such untrusted media. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of any removable media partitions.

    Add nosuid Option to Removable Media Partitionsxccdf_org.ssgproject.content_rule_mountopt_nosuid_on_removable_partitions CCE-27056-1

    Add nosuid Option to Removable Media Partitions

    Rule IDxccdf_org.ssgproject.content_rule_mountopt_nosuid_on_removable_partitions
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27056-1

    references:  AC-19(a), AC-19(d), AC-19(e), CM-7, MP-2

    The nosuid mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removeable media. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of any removable media partitions.

    Add nodev Option to /tmpxccdf_org.ssgproject.content_rule_mount_option_tmp_nodev CCE-26499-4

    Add nodev Option to /tmp

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26499-4

    references:  CM-7, MP-2

    The nodev mount option can be used to prevent device files from being created in /tmp. Legitimate character and block devices should not exist within temporary directories like /tmp. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /tmp.

    Add noexec Option to /tmpxccdf_org.ssgproject.content_rule_mount_option_tmp_noexec CCE-26720-3

    Add noexec Option to /tmp

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26720-3

    references:  CM-7, MP-2

    The noexec mount option can be used to prevent binaries from being executed out of /tmp. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /tmp.

    Add nosuid Option to /tmpxccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid CCE-26762-5

    Add nosuid Option to /tmp

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26762-5

    references:  CM-7, MP-2

    The nosuid mount option can be used to prevent execution of setuid programs in /tmp. The SUID and SGID permissions should not be required in these world-writable directories. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /tmp.

    Add nodev Option to /dev/shmxccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev CCE-26778-1

    Add nodev Option to /dev/shm

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26778-1

    references:  CM-7, MP-2

    The nodev mount option can be used to prevent creation of device files in /dev/shm. Legitimate character and block devices should not exist within temporary directories like /dev/shm. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

    OVAL details

    Items violating nodev on /dev/shm:

    mount pointdeviceuuidfs typemount optionsmount optionsmount optionstotal spacespace usedspace left
    /dev/shmtmpfstmpfsrwseclabelrelatime4233560423356
    Add noexec Option to /dev/shmxccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec CCE-26622-1

    Add noexec Option to /dev/shm

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26622-1

    references:  CM-7, MP-2

    The noexec mount option can be used to prevent binaries from being executed out of /dev/shm. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as /dev/shm. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

    OVAL details

    Items violating noexec on /dev/shm:

    mount pointdeviceuuidfs typemount optionsmount optionsmount optionstotal spacespace usedspace left
    /dev/shmtmpfstmpfsrwseclabelrelatime4233560423356
    Add nosuid Option to /dev/shmxccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid CCE-26486-1

    Add nosuid Option to /dev/shm

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26486-1

    references:  CM-7, MP-2

    The nosuid mount option can be used to prevent execution of setuid programs in /dev/shm. The SUID and SGID permissions should not be required in these world-writable directories. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

    OVAL details

    Items violating nosuid on /dev/shm:

    mount pointdeviceuuidfs typemount optionsmount optionsmount optionstotal spacespace usedspace left
    /dev/shmtmpfstmpfsrwseclabelrelatime4233560423356
    Bind Mount /var/tmp To /tmpxccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind_var CCE-26582-7

    Bind Mount /var/tmp To /tmp

    Rule IDxccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind_var
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26582-7

    references:  CM-7

    The /var/tmp directory is a world-writable directory. Bind-mount it to /tmp in order to consolidate temporary storage into one location protected by the same techniques as /tmp. To do so, edit /etc/fstab and add the following line:

    /tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0
    See the mount(8) man page for further explanation of bind mounting.

    Disable Modprobe Loading of USB Storage Driverxccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled CCE-27016-5

    Disable Modprobe Loading of USB Storage Driver

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27016-5

    references:  AC-19(a), AC-19(d), AC-19(e), 1250, 85

    To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install usb-storage /bin/false This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

    Disable Kernel Support for USB via Bootloader Configurationxccdf_org.ssgproject.content_rule_bootloader_nousb_argument CCE-27011-6

    Disable Kernel Support for USB via Bootloader Configuration

    Rule IDxccdf_org.ssgproject.content_rule_bootloader_nousb_argument
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27011-6

    references:  AC-19(a), AC-19(d), AC-19(e), 1250

    All USB support can be disabled by adding the nousb argument to the kernel's boot loader configuration. To do so, append "nousb" to the kernel line in /etc/grub.conf as shown:

    kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb
    WARNING: Disabling all kernel support for USB will cause problems for systems with USB-based keyboards, mice, or printers. This configuration is infeasible for systems which require USB devices, which is common.

    Disable Booting from USB Devices in Boot Firmwarexccdf_org.ssgproject.content_rule_bios_disable_usb_boot CCE-26923-3

    Disable Booting from USB Devices in Boot Firmware

    Rule IDxccdf_org.ssgproject.content_rule_bios_disable_usb_boot
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26923-3

    references:  AC-19(a), AC-19(d), AC-19(e), 1250

    Configure the system boot firmware (historically called BIOS on PC systems) to disallow booting from USB drives.

    Assign Password to Prevent Changes to Boot Firmware Configurationxccdf_org.ssgproject.content_rule_bios_assign_password CCE-27131-2

    Assign Password to Prevent Changes to Boot Firmware Configuration

    Rule IDxccdf_org.ssgproject.content_rule_bios_assign_password
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27131-2

    Assign a password to the system boot firmware (historically called BIOS on PC systems) to require a password for any configuration changes.

    Disable the Automounterxccdf_org.ssgproject.content_rule_service_autofs_disabled CCE-26976-1

    Disable the Automounter

    Rule IDxccdf_org.ssgproject.content_rule_service_autofs_disabled
    Result
    pass
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26976-1

    references:  AC-19(a), AC-19(d), AC-19(e), 1250, 85

    The autofs daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as /misc/cd. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing /etc/fstab rather than relying on the automounter.



    The autofs service can be disabled with the following command: # chkconfig autofs off

    Disable GNOME Automountingxccdf_org.ssgproject.content_rule_gconf_gnome_disable_automount CCE-27035-5

    Disable GNOME Automounting

    Rule IDxccdf_org.ssgproject.content_rule_gconf_gnome_disable_automount
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27035-5

    references:  AC-19(a), AC-19(d), AC-19(e)

    The system's default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME by running the following:

    $ sudo gconftool-2 --direct \
    	--config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
    	--type bool \
    	--set /apps/nautilus/preferences/media_automount false
    $ sudo gconftool-2 --direct \
    	--config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
    	--type bool \
    	--set /apps/nautilus/preferences/media_autorun_never true

    Disable Mounting of cramfsxccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled CCE-26340-0

    Disable Mounting of cramfs

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26340-0

    references:  CM-7

    To configure the system to prevent the cramfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install cramfs /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install cramfs /bin/false" > /etc/modprobe.d/cramfs.conf
    
    Disable Mounting of freevxfsxccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled CCE-26544-7

    Disable Mounting of freevxfs

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26544-7

    references:  CM-7

    To configure the system to prevent the freevxfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install freevxfs /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install freevxfs /bin/false" > /etc/modprobe.d/freevxfs.conf
    
    Disable Mounting of jffs2xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled CCE-26670-0

    Disable Mounting of jffs2

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26670-0

    references:  CM-7

    To configure the system to prevent the jffs2 kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install jffs2 /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install jffs2 /bin/false" > /etc/modprobe.d/jffs2.conf
    
    Disable Mounting of hfsxccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled CCE-26800-3

    Disable Mounting of hfs

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26800-3

    references:  CM-7

    To configure the system to prevent the hfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install hfs /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install hfs /bin/false" > /etc/modprobe.d/hfs.conf
    
    Disable Mounting of hfsplusxccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled CCE-26361-6

    Disable Mounting of hfsplus

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26361-6

    references:  CM-7

    To configure the system to prevent the hfsplus kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install hfsplus /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install hfsplus /bin/false" > /etc/modprobe.d/hfsplus.conf
    
    Disable Mounting of squashfsxccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled CCE-26404-4

    Disable Mounting of squashfs

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26404-4

    references:  CM-7

    To configure the system to prevent the squashfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install squashfs /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install squashfs /bin/false" > /etc/modprobe.d/squashfs.conf
    
    Disable Mounting of udfxccdf_org.ssgproject.content_rule_kernel_module_udf_disabled CCE-26677-5

    Disable Mounting of udf

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_udf_disabled
    Result
    fail
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-26677-5

    references:  CM-7

    To configure the system to prevent the udf kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install udf /bin/false This effectively prevents usage of this uncommon filesystem.

    Remediation script:
    echo "install udf /bin/false" > /etc/modprobe.d/udf.conf
    
    Disable All GNOME Thumbnailersxccdf_org.ssgproject.content_rule_disable_gnome_thumbnailers CCE-27224-5

    Disable All GNOME Thumbnailers

    Rule IDxccdf_org.ssgproject.content_rule_disable_gnome_thumbnailers
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitylow
    Identifiers and References

    identifiers:  CCE-27224-5

    references:  CM-7

    The system's default desktop environment, GNOME, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. The following command can disable the execution of these thumbnail applications:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /desktop/gnome/thumbnailers/disable_all true
    This effectively prevents an attacker from gaining access to a system through a flaw in GNOME's Nautilus thumbnail creators.

    Verify User Who Owns shadow Filexccdf_org.ssgproject.content_rule_userowner_shadow_file CCE-26947-2

    Verify User Who Owns shadow File

    Rule IDxccdf_org.ssgproject.content_rule_userowner_shadow_file
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26947-2

    references:  AC-6, 225,

    To properly set the owner of /etc/shadow, run the command: # chown root/etc/shadow

    Verify Group Who Owns shadow Filexccdf_org.ssgproject.content_rule_groupowner_shadow_file CCE-26967-0

    Verify Group Who Owns shadow File

    Rule IDxccdf_org.ssgproject.content_rule_groupowner_shadow_file
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26967-0

    references:  AC-6, 225,

    To properly set the group owner of /etc/shadow, run the command: # chgrp root/etc/shadow

    Verify Permissions on shadow Filexccdf_org.ssgproject.content_rule_file_permissions_etc_shadow CCE-26992-8

    Verify Permissions on shadow File

    Rule IDxccdf_org.ssgproject.content_rule_file_permissions_etc_shadow
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26992-8

    references:  AC-6, 225,

    To properly set the permissions of /etc/shadow, run the command: # chmod 0000/etc/shadow

    Verify User Who Owns group Filexccdf_org.ssgproject.content_rule_file_owner_etc_group CCE-26822-7

    Verify User Who Owns group File

    Rule IDxccdf_org.ssgproject.content_rule_file_owner_etc_group
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26822-7

    references:  AC-6,

    To properly set the owner of /etc/group, run the command: # chown root/etc/group

    Verify Group Who Owns group Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_group CCE-26930-8

    Verify Group Who Owns group File

    Rule IDxccdf_org.ssgproject.content_rule_file_groupowner_etc_group
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26930-8

    references:  AC-6, 225,

    To properly set the group owner of /etc/group, run the command: # chgrp root/etc/group

    Verify Permissions on group Filexccdf_org.ssgproject.content_rule_file_permissions_etc_group CCE-26954-8

    Verify Permissions on group File

    Rule IDxccdf_org.ssgproject.content_rule_file_permissions_etc_group
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26954-8

    references:  AC-6, 225,

    To properly set the permissions of /etc/group, run the command: # chmod 644/etc/group

    Verify User Who Owns gshadow Filexccdf_org.ssgproject.content_rule_file_owner_etc_gshadow CCE-27026-4

    Verify User Who Owns gshadow File

    Rule IDxccdf_org.ssgproject.content_rule_file_owner_etc_gshadow
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27026-4

    references:  AC-6, 225,

    To properly set the owner of /etc/gshadow, run the command: # chown root/etc/gshadow

    Verify Group Who Owns gshadow Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow CCE-26975-3

    Verify Group Who Owns gshadow File

    Rule IDxccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26975-3

    references:  AC-6, 225,

    To properly set the group owner of /etc/gshadow, run the command: # chgrp root/etc/gshadow

    Verify Permissions on gshadow Filexccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow CCE-26951-4

    Verify Permissions on gshadow File

    Rule IDxccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26951-4

    references:  AC-6, 225,

    To properly set the permissions of /etc/gshadow, run the command: # chmod 0000/etc/gshadow

    Verify User Who Owns passwd Filexccdf_org.ssgproject.content_rule_file_owner_etc_passwd CCE-26953-0

    Verify User Who Owns passwd File

    Rule IDxccdf_org.ssgproject.content_rule_file_owner_etc_passwd
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26953-0

    references:  AC-6, 225,

    To properly set the owner of /etc/passwd, run the command: # chown root/etc/passwd

    Verify Group Who Owns passwd Filexccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd CCE-26856-5

    Verify Group Who Owns passwd File

    Rule IDxccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26856-5

    references:  AC-6, 225,

    To properly set the group owner of /etc/passwd, run the command: # chgrp root/etc/passwd

    Verify Permissions on passwd Filexccdf_org.ssgproject.content_rule_file_permissions_etc_passwd CCE-26868-0

    Verify Permissions on passwd File

    Rule IDxccdf_org.ssgproject.content_rule_file_permissions_etc_passwd
    Result
    pass
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26868-0

    references:  AC-6, 225,

    To properly set the permissions of /etc/passwd, run the command: # chmod 0644/etc/passwd

    Verify that Shared Library Files Have Restrictive Permissionsxccdf_org.ssgproject.content_rule_file_permissions_library_dirs CCE-27381-3

    Verify that Shared Library Files Have Restrictive Permissions

    Rule IDxccdf_org.ssgproject.content_rule_file_permissions_library_dirs
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27381-3

    references:  AC-6, 1499,

    System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:

    /lib
    /lib64
    /usr/lib
    /usr/lib64
    
    Kernel modules, which can be added to the kernel during runtime, are stored in /lib/modules. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w FILE

    Verify that Shared Library Files Have Root Ownershipxccdf_org.ssgproject.content_rule_file_ownership_library_dirs CCE-27424-1

    Verify that Shared Library Files Have Root Ownership

    Rule IDxccdf_org.ssgproject.content_rule_file_ownership_library_dirs
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27424-1

    references:  AC-6, 1499,

    System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:

    /lib
    /lib64
    /usr/lib
    /usr/lib64
    
    Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules. All files in these directories should be owned by the root user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command:
    $ sudo chown root FILE

    Verify that System Executables Have Restrictive Permissionsxccdf_org.ssgproject.content_rule_file_permissions_binary_dirs CCE-27289-8

    Verify that System Executables Have Restrictive Permissions

    Rule IDxccdf_org.ssgproject.content_rule_file_permissions_binary_dirs
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27289-8

    references:  AC-6, 1499

    System executables are stored in the following directories by default:

    /bin
    /usr/bin
    /usr/local/bin
    /sbin
    /usr/sbin
    /usr/local/sbin
    All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:
    $ sudo chmod go-w FILE

    Verify that System Executables Have Root Ownershipxccdf_org.ssgproject.content_rule_file_ownership_binary_dirs CCE-27623-8

    Verify that System Executables Have Root Ownership

    Rule IDxccdf_org.ssgproject.content_rule_file_ownership_binary_dirs
    Result
    notselected
    Time2014-11-01T12:07:34
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27623-8

    references:  AC-6, 1499

    System executables are stored in the following directories by default:

    /bin
    /usr/bin
    /usr/local/bin
    /sbin
    /usr/sbin
    /usr/local/sbin
    All files in these directories should be owned by the root user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:
    $ sudo chown root FILE

    Verify that All World-Writable Directories Have Sticky Bits Setxccdf_org.ssgproject.content_rule_sticky_world_writable_dirs CCE-26840-9

    Verify that All World-Writable Directories Have Sticky Bits Set

    Rule IDxccdf_org.ssgproject.content_rule_sticky_world_writable_dirs
    Result
    pass
    Time2014-11-01T12:08:08
    Severitylow
    Identifiers and References

    identifiers:  CCE-26840-9

    references:  AC-6,

    When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes.

    To set the sticky bit on a world-writable directory DIR, run the following command:

    $ sudo chmod +t DIR

    Ensure No World-Writable Files Existxccdf_org.ssgproject.content_rule_world_writeable_files CCE-26910-0

    Ensure No World-Writable Files Exist

    Rule IDxccdf_org.ssgproject.content_rule_world_writeable_files
    Result
    pass
    Time2014-11-01T12:08:10
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26910-0

    references:  AC-6

    It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account.

    Ensure All SGID Executables Are Authorizedxccdf_org.ssgproject.content_rule_no_unpackaged_sgid_files CCE-26769-0

    Ensure All SGID Executables Are Authorized

    Rule IDxccdf_org.ssgproject.content_rule_no_unpackaged_sgid_files
    Result
    fail
    Time2014-11-01T12:08:12
    Severitylow
    Identifiers and References

    identifiers:  CCE-26769-0

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SGID files.

    OVAL details

    Items violating setgid files outside system RPMs:

    pathtypeUIDGIDsizepermissions
    /bin/cgclassifyregular049716352rwxr-sr-x 
    Ensure All SUID Executables Are Authorizedxccdf_org.ssgproject.content_rule_no_unpackaged_suid_files CCE-26497-8

    Ensure All SUID Executables Are Authorized

    Rule IDxccdf_org.ssgproject.content_rule_no_unpackaged_suid_files
    Result
    pass
    Time2014-11-01T12:08:13
    Severitylow
    Identifiers and References

    identifiers:  CCE-26497-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SUID files.

    Ensure All Files Are Owned by a Userxccdf_org.ssgproject.content_rule_no_files_unowned_by_user CCE-27032-2

    Ensure All Files Are Owned by a User

    Rule IDxccdf_org.ssgproject.content_rule_no_files_unowned_by_user
    Result
    pass
    Time2014-11-01T12:08:15
    Severitylow
    Identifiers and References

    identifiers:  CCE-27032-2

    references:  AC-6, 224

    If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user.

    Ensure All Files Are Owned by a Groupxccdf_org.ssgproject.content_rule_no_files_unowned_by_group CCE-26872-2

    Ensure All Files Are Owned by a Group

    Rule IDxccdf_org.ssgproject.content_rule_no_files_unowned_by_group
    Result
    pass
    Time2014-11-01T12:08:19
    Severitylow
    Identifiers and References

    identifiers:  CCE-26872-2

    references:  AC-6, 224

    If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group.

    Ensure All World-Writable Directories Are Owned by a System Accountxccdf_org.ssgproject.content_rule_world_writable_files_system_ownership CCE-26642-9

    Ensure All World-Writable Directories Are Owned by a System Account

    Rule IDxccdf_org.ssgproject.content_rule_world_writable_files_system_ownership
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26642-9

    references:  AC-6,

    All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.

    Set Daemon Umaskxccdf_org.ssgproject.content_rule_umask_for_daemons CCE-27031-4

    Set Daemon Umask

    Rule IDxccdf_org.ssgproject.content_rule_umask_for_daemons
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27031-4

    references:  AC-6,

    The file /etc/init.d/functions includes initialization parameters for most or all daemons started at boot time. The default umask of 022 prevents creation of group- or world-writable files. To set the default umask for daemons, edit the following line, inserting 022 or 027 for umask appropriately:

    umask 027
    Setting the umask to too restrictive a setting can cause serious errors at runtime. Many daemons on the system already individually restrict themselves to a umask of 077 in their own init scripts.

    OVAL details

    Items violating Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement:

    var refvalue
    oval:ssg:var:324418
    Remediation script:
    var_umask_for_daemons="027"
    grep -q ^umask /etc/init.d/functions && \
      sed -i "s/umask.*/umask $var_umask_for_daemons/g" /etc/init.d/functions
    if ! [ $? -eq 0 ]; then
        echo "umask $var_umask_for_daemons" >> /etc/init.d/functions
    fi
    
    Disable Core Dumps for All Usersxccdf_org.ssgproject.content_rule_disable_users_coredumps CCE-27033-0

    Disable Core Dumps for All Users

    Rule IDxccdf_org.ssgproject.content_rule_disable_users_coredumps
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27033-0

    references:  SC-5

    To disable core dumps for all users, add the following line to /etc/security/limits.conf:

    *     hard   core    0

    Remediation script:
    echo "*     hard   core    0" >> /etc/security/limits.conf
    
    Disable Core Dumps for SUID programsxccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable CCE-27044-7

    Disable Core Dumps for SUID programs

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27044-7

    references:  SI-11

    To set the runtime status of the fs.suid_dumpable kernel parameter, run the following command: # sysctl -w fs.suid_dumpable=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: fs.suid_dumpable = 0

    Remediation script:
    #
    # Set runtime for fs.suid_dumpable
    #
    /sbin/sysctl -q -n -w fs.suid_dumpable=0
    
    #
    # If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0"
    #	else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf
    #
    if grep --silent ^fs.suid_dumpable /etc/sysctl.conf ; then
    	sed -i 's/^fs.suid_dumpable.*/fs.suid_dumpable = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set fs.suid_dumpable to 0 per security requirements" >> /etc/sysctl.conf
    	echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf
    fi
    
    Enable ExecShieldxccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield CCE-27007-4

    Enable ExecShield

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27007-4

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf,

    To set the runtime status of the kernel.exec-shield kernel parameter, run the following command: # sysctl -w kernel.exec-shield=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: kernel.exec-shield = 1

    Remediation script:
    #
    # Set runtime for kernel.exec-shield
    #
    /sbin/sysctl -q -n -w kernel.exec-shield=1
    
    #
    # If kernel.exec-shield present in /etc/sysctl.conf, change value to "1"
    #	else, add "kernel.exec-shield = 1" to /etc/sysctl.conf
    #
    if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then
    	sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf
    	echo "kernel.exec-shield = 1" >> /etc/sysctl.conf
    fi
    
    Enable Randomized Layout of Virtual Address Spacexccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space CCE-26999-3

    Enable Randomized Layout of Virtual Address Space

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26999-3

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf,

    To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command: # sysctl -w kernel.randomize_va_space=2 If this is not the system's default value, add the following line to /etc/sysctl.conf: kernel.randomize_va_space = 2

    Remediation script:
    #
    # Set runtime for kernel.randomize_va_space
    #
    /sbin/sysctl -q -n -w kernel.randomize_va_space=2
    
    #
    # If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2"
    #	else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf
    #
    if grep --silent ^kernel.randomize_va_space /etc/sysctl.conf ; then
    	sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 2/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set kernel.randomize_va_space to 2 per security requirements" >> /etc/sysctl.conf
    	echo "kernel.randomize_va_space = 2" >> /etc/sysctl.conf
    fi
    
    Install PAE Kernel on Supported 32-bit x86 Systemsxccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32 CCE-27010-8

    Install PAE Kernel on Supported 32-bit x86 Systems

    Rule IDxccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32
    Result
    notchecked
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27010-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    Systems that are using the 64-bit x86 kernel package do not need to install the kernel-PAE package because the 64-bit x86 kernel already includes this support. However, if the system is 32-bit and also supports the PAE and NX features as determined in the previous section, the kernel-PAE package should be installed to enable XD or NX support:

    $ sudo yum install kernel-PAE
    The installation process should also have configured the bootloader to load the new kernel at boot. Verify this at reboot and modify /etc/grub.conf if necessary.

    Enable NX or XD Support in the BIOSxccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions CCE-27163-5

    Enable NX or XD Support in the BIOS

    Rule IDxccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27163-5

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    Reboot the system and enter the BIOS or Setup configuration menu. Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX) on AMD-based systems.

    Restrict Access to Kernel Message Bufferxccdf_org.ssgproject.content_rule_enable_dmesg_restriction CCE-27366-4

    Restrict Access to Kernel Message Buffer

    Rule IDxccdf_org.ssgproject.content_rule_enable_dmesg_restriction
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27366-4

    To set the runtime status of the kernel.dmesg_restrict kernel parameter, run the following command: # sysctl -w kernel.dmesg_restrict=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: kernel.dmesg_restrict = 1

    Ensure SELinux Not Disabled in /etc/grub.confxccdf_org.ssgproject.content_rule_enable_selinux_bootloader CCE-26956-3

    Ensure SELinux Not Disabled in /etc/grub.conf

    Rule IDxccdf_org.ssgproject.content_rule_enable_selinux_bootloader
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26956-3

    references:  AC-3, AC-3(3), AC-6, AU-9, 22, 32,

    SELinux can be disabled at boot time by an argument in /etc/grub.conf. Remove any instances of selinux=0 from the kernel arguments in that file to prevent SELinux from being disabled at boot.

    Ensure SELinux State is Enforcingxccdf_org.ssgproject.content_rule_selinux_state CCE-26969-6

    Ensure SELinux State is Enforcing

    Rule IDxccdf_org.ssgproject.content_rule_selinux_state
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26969-6

    references:  AC-3, AC-3(3), AC-4, AC-6, AU-9, 22, 32, 26,

    The SELinux state should be set to enforcing at system boot time. In the file /etc/selinux/config, add or correct the following line to configure the system to boot into enforcing mode:

    SELINUX=enforcing

    Configure SELinux Policyxccdf_org.ssgproject.content_rule_selinux_policytype CCE-26875-5

    Configure SELinux Policy

    Rule IDxccdf_org.ssgproject.content_rule_selinux_policytype
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26875-5

    references:  AC-3, AC-3(3), AC-4, AC-6, AU-9, 22, 32,

    The SELinux targeted policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in /etc/selinux/config:

    SELINUXTYPE=targeted
    Other policies, such as mls, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.

    Enable the SELinux Context Restoration Service (restorecond)xccdf_org.ssgproject.content_rule_service_restorecond_enabled CCE-26991-0

    Enable the SELinux Context Restoration Service (restorecond)

    Rule IDxccdf_org.ssgproject.content_rule_service_restorecond_enabled
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26991-0

    references:  AC-3, AC-3(3), AC-4, AC-6, AU-9

    The restorecond service utilizes inotify to look for the creation of new files listed in the /etc/selinux/restorecond.conf configuration file. When a file is created, restorecond ensures the file receives the proper SELinux security context. The restorecond service can be enabled with the following command: # chkconfig --level 2345 restorecond on

    Uninstall setroubleshoot Packagexccdf_org.ssgproject.content_rule_package_setroubleshoot_removed CCE-

    Uninstall setroubleshoot Package

    Rule IDxccdf_org.ssgproject.content_rule_package_setroubleshoot_removed
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-

    The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The setroubleshoot package can be removed with the following command: # yum erase setroubleshoot

    Uninstall mcstrans Packagexccdf_org.ssgproject.content_rule_package_mcstrans_removed CCE-

    Uninstall mcstrans Package

    Rule IDxccdf_org.ssgproject.content_rule_package_mcstrans_removed
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-

    The mcstransd daemon provides category label information to client processes requesting information. The label translations are defined in /etc/selinux/targeted/setrans.conf. The mcstrans package can be removed with the following command: # yum erase mcstrans

    Ensure No Daemons are Unconfined by SELinuxxccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons CCE-27111-4

    Ensure No Daemons are Unconfined by SELinux

    Rule IDxccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons
    Result
    notchecked
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27111-4

    references:  AC-6, AU-9, CM-7

    Daemons for which the SELinux policy does not contain rules will inherit the context of the parent process. Because daemons are launched during startup and descend from the init process, they inherit the initrc_t context.



    To check for unconfined daemons, run the following command:

    $ sudo ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
    It should produce no output in a well-configured system.

    Ensure No Device Files are Unlabeled by SELinuxxccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled CCE-26774-0

    Ensure No Device Files are Unlabeled by SELinux

    Rule IDxccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26774-0

    references:  AC-6, AU-9, CM-7, 22, 32,

    Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type unlabeled_t, investigate the cause and correct the file's context.

    Direct root Logins Not Allowedxccdf_org.ssgproject.content_rule_no_direct_root_logins CCE-26891-2

    Direct root Logins Not Allowed

    Rule IDxccdf_org.ssgproject.content_rule_no_direct_root_logins
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26891-2

    references:  IA-2(1),

    To further limit access to the root account, administrators can disable root logins at the console by editing the /etc/securetty file. This file lists all devices the root user is allowed to login to. If the file does not exist at all, the root user can login through any communication device on the system, whether via the console or via a raw network interface. This is dangerous as user can login to his machine as root via Telnet, which sends the password in plain text over the network. By default, Red Hat Enteprise Linux's /etc/securetty file only allows the root user to login at the console physically attached to the machine. To prevent root from logging in, remove the contents of this file. To prevent direct root logins, remove the contents of this file by typing the following command:

    $ sudo echo > /etc/securetty
    

    Restrict Virtual Console Root Loginsxccdf_org.ssgproject.content_rule_securetty_root_login_console_only CCE-26855-7

    Restrict Virtual Console Root Logins

    Rule IDxccdf_org.ssgproject.content_rule_securetty_root_login_console_only
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26855-7

    references:  AC-6(2), 770,

    To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in /etc/securetty:

    vc/1
    vc/2
    vc/3
    vc/4

    OVAL details

    Items violating virtual consoles /etc/securetty:

    pathcontent
    /etc/securettyvc/1
    /etc/securettyvc/2
    /etc/securettyvc/3
    /etc/securettyvc/4
    /etc/securettyvc/5
    /etc/securettyvc/6
    /etc/securettyvc/7
    /etc/securettyvc/8
    /etc/securettyvc/9
    /etc/securettyvc/10
    /etc/securettyvc/11
    Remediation script:
    sed -i '/^vc\//d' /etc/securetty
    
    Restrict Serial Port Root Loginsxccdf_org.ssgproject.content_rule_restrict_serial_port_logins CCE-27047-0

    Restrict Serial Port Root Logins

    Rule IDxccdf_org.ssgproject.content_rule_restrict_serial_port_logins
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27047-0

    references:  AC-6(2), 770,

    To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty:

    ttyS0
    ttyS1

    OVAL details

    Items violating serial ports /etc/securetty:

    pathcontent
    /etc/securettyttyS0
    Restrict Web Browser Use for Administrative Accountsxccdf_org.ssgproject.content_rule_no_root_webbrowsing CCE-26795-5

    Restrict Web Browser Use for Administrative Accounts

    Rule IDxccdf_org.ssgproject.content_rule_no_root_webbrowsing
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26795-5

    Enforce policy requiring administrative accounts use web browsers only for local service administration.

    Ensure that System Accounts Do Not Run a Shell Upon Loginxccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts CCE-26966-2

    Ensure that System Accounts Do Not Run a Shell Upon Login

    Rule IDxccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26966-2

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 178,

    Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell.



    The login shell for each local account is stored in the last field of each line in /etc/passwd. System accounts are those user accounts with a user ID less than 500. The user ID is stored in the third field. If any system account SYSACCT (other than root) has a login shell, disable it with the command:

    $ sudo usermod -s /sbin/nologin SYSACCT

    Verify Only Root Has UID 0xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero CCE-26971-2

    Verify Only Root Has UID 0

    Rule IDxccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26971-2

    references:  AC-6, IA-2(1), 366,

    If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.

    Root Path Must Be Vendor Defaultxccdf_org.ssgproject.content_rule_root_path_default CCE-27125-4

    Root Path Must Be Vendor Default

    Rule IDxccdf_org.ssgproject.content_rule_root_path_default
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27125-4

    references: 

    Assuming root shell is bash, edit the following files:

    ~/.profile
    ~/.bashrc
    Change any PATH variables to the vendor default for root and remove any empty PATH entries or references to relative paths.

    Prevent Log In to Accounts With Empty Passwordxccdf_org.ssgproject.content_rule_no_empty_passwords CCE-27038-9

    Prevent Log In to Accounts With Empty Password

    Rule IDxccdf_org.ssgproject.content_rule_no_empty_passwords
    Result
    fail
    Time2014-11-01T12:08:22
    Severityhigh
    Identifiers and References

    identifiers:  CCE-27038-9

    references:  IA-5(b), IA-5(c), IA-5(1)(a),

    If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the nullok option in /etc/pam.d/system-auth to prevent logins with empty passwords.

    OVAL details

    Items violating make sure nullok is not used in /etc/pam.d/system-auth:

    pathcontent
    /etc/pam.d/system-auth nullok
    Remediation script:
    sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/system-auth
    
    Verify All Account Password Hashes are Shadowedxccdf_org.ssgproject.content_rule_accounts_password_all_shadowed CCE-26476-2

    Verify All Account Password Hashes are Shadowed

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_all_shadowed
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26476-2

    references:  IA-5(h), 201,

    If any password hashes are stored in /etc/passwd (in the second field, instead of an x), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.

    All GIDs referenced in /etc/passwd must be defined in /etc/groupxccdf_org.ssgproject.content_rule_gid_passwd_group_same CCE-27379-7

    All GIDs referenced in /etc/passwd must be defined in /etc/group

    Rule IDxccdf_org.ssgproject.content_rule_gid_passwd_group_same
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27379-7

    references:  366,

    Add a group to the system for each GID referenced without a corresponding group.

    Verify No netrc Files Existxccdf_org.ssgproject.content_rule_no_netrc_files CCE-27225-2

    Verify No netrc Files Exist

    Rule IDxccdf_org.ssgproject.content_rule_no_netrc_files
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27225-2

    references:  IA-5(h), 196

    The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any .netrc files should be removed.

    Set Password Minimum Length in login.defsxccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs CCE-27002-5

    Set Password Minimum Length in login.defs

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27002-5

    references:  IA-5(f), IA-5(1)(a), 205,

    To specify password length requirements for new accounts, edit the file /etc/login.defs and add or correct the following lines:

    PASS_MIN_LEN 12




    The DoD requirement is 14. The FISMA requirement is 12. If a program consults /etc/login.defs and also another PAM module (such as pam_cracklib) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.

    OVAL details

    Items violating check PASS_MIN_LEN in /etc/login.defs:

    pathcontent
    /etc/login.defsPASS_MIN_LEN 5
    Remediation script:
    var_accounts_password_minlen_login_defs="12"
    grep -q ^PASS_MIN_LEN /etc/login.defs && \
      sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN     $var_accounts_password_minlen_login_defs/g" /etc/login.defs
    if ! [ $? -eq 0 ]; then
        echo "PASS_MIN_LEN      $var_accounts_password_minlen_login_defs" >> /etc/login.defs
    fi
    
    Set Password Minimum Agexccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs CCE-27013-2

    Set Password Minimum Age

    Rule IDxccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27013-2

    references:  IA-5(f), IA-5(1)(d), 198,

    To specify password minimum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

    PASS_MIN_DAYS 7
    A value of 1 day is considered for sufficient for many environments. The DoD requirement is 1.

    Set Password Maximum Agexccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs CCE-26985-2

    Set Password Maximum Age

    Rule IDxccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26985-2

    references:  IA-5(f), IA-5(g), IA-5(1)(d), 180, 199, 76,

    To specify password maximum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

    PASS_MAX_DAYS 60
    A value of 180 days is sufficient for many environments. The DoD requirement is 60.

    OVAL details

    Items violating the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs:

    pathcontent
    /etc/login.defsPASS_MAX_DAYS 99999
    Remediation script:
    var_accounts_maximum_age_login_defs="60"
    grep -q ^PASS_MAX_DAYS /etc/login.defs && \
      sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
    if ! [ $? -eq 0 ]; then
        echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" >> /etc/login.defs
    fi
    
    Set Password Warning Agexccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs CCE-26988-6

    Set Password Warning Age

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26988-6

    references:  IA-5(f),

    To specify how many days prior to password expiration that a warning will be issued to users, edit the file /etc/login.defs and add or correct the following line:

    PASS_WARN_AGE 14
    The DoD requirement is 7.

    OVAL details

    Items violating Tests the value of PASS_WARN_AGE in /etc/login.defs:

    pathcontent
    /etc/login.defsPASS_WARN_AGE 7 #
    Remediation script:
    var_accounts_password_warn_age_login_defs="14"
    grep -q ^PASS_WARN_AGE /etc/login.defs && \
      sed -i "s/PASS_WARN_AGE.*/PASS_WARN_AGE     $var_accounts_password_warn_age_login_defs/g" /etc/login.defs
    if ! [ $? -eq 0 ]; then
        echo "PASS_WARN_AGE      $var_accounts_password_warn_age_login_defs" >> /etc/login.defs
    fi
    
    Set Account Expiration Following Inactivityxccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration CCE-27283-1

    Set Account Expiration Following Inactivity

    Rule IDxccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27283-1

    references:  AC-2(2), AC-2(3), 16, 17, 795

    To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following lines in /etc/default/useradd, substituting NUM_DAYS appropriately:

    INACTIVE=NUM_DAYS
    A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.

    Remediation script:
    var_account_disable_post_pw_expiration="30"
    grep -q ^INACTIVE /etc/default/useradd && \
      sed -i "s/INACTIVE.*/INACTIVE=$var_account_disable_post_pw_expiration/g" /etc/default/useradd
    if ! [ $? -eq 0 ]; then
        echo "INACTIVE=$var_account_disable_post_pw_expiration" >> /etc/default/useradd
    fi
    
    Ensure All Accounts on the System Have Unique Namesxccdf_org.ssgproject.content_rule_account_unique_name CCE-27609-7

    Ensure All Accounts on the System Have Unique Names

    Rule IDxccdf_org.ssgproject.content_rule_account_unique_name
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27609-7

    references:  770, 804

    Change usernames, or delete accounts, so each has a unique name.

    Assign Expiration Date to Temporary Accountsxccdf_org.ssgproject.content_rule_account_temp_expire_date CCE-27474-6

    Assign Expiration Date to Temporary Accounts

    Rule IDxccdf_org.ssgproject.content_rule_account_temp_expire_date
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27474-6

    references:  AC-2(2), AC-2(3), 16, 1682

    In the event temporary or emergency accounts are required, configure the system to terminate them after a documented time period. For every temporary and emergency account, run the following command to set an expiration date on it, substituting USER and YYYY-MM-DD appropriately:

    $ sudo chage -E YYYY-MM-DD USER
    YYYY-MM-DD indicates the documented expiration date for the account.

    Set Password Retry Prompts Permitted Per-Sessionxccdf_org.ssgproject.content_rule_accounts_password_pam_retry CCE-27123-9

    Set Password Retry Prompts Permitted Per-Session

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_retry
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27123-9

    references:  IA-5(c), 1092,

    To configure the number of retry prompts that are permitted per-session:



    Edit the pam_cracklib.so statement in /etc/pam.d/system-auth to show retry=3, or a lower value if site policy is more restrictive.



    The DoD requirement is a maximum of 3 prompts per session.

    Set Password to Maximum of Three Consecutive Repeating Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_cracklib_maxrepeat CCE-27227-8

    Set Password to Maximum of Three Consecutive Repeating Characters

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_cracklib_maxrepeat
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27227-8

    references:  IA-5(c), 366

    The pam_cracklib module's maxrepeat parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Add maxrepeat=3 after pam_cracklib.so to prevent a run of (3 + 1) or more identical characters.

    Set Password Strength Minimum Digit Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit CCE-26374-9

    Set Password Strength Minimum Digit Characters

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26374-9

    references:  IA-5(b), IA-5(c), 194, 194,

    The pam_cracklib module's dcredit parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_cracklib will grant +1 additional length credit for each digit. Add dcredit=-1 after pam_cracklib.so to require use of a digit in passwords.

    Remediation script:
    var_password_pam_dcredit="-1"
    if grep -q "dcredit=" /etc/pam.d/system-auth; then
    	sed -i --follow-symlink "s/\(dcredit *= *\).*/\1$var_password_pam_dcredit/" /etc/pam.d/system-auth
    else
    	sed -i --follow-symlink "/pam_cracklib.so/ s/$/ dcredit=$var_password_pam_dcredit/" /etc/pam.d/system-auth
    fi
    
    Set Password Strength Minimum Uppercase Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit CCE-26601-5

    Set Password Strength Minimum Uppercase Characters

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26601-5

    references:  IA-5(b), IA-5(c), IA-5(1)(a), 192,

    The pam_cracklib module's ucredit= parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each uppercase character. Add ucredit=-1 after pam_cracklib.so to require use of an upper case character in passwords.

    Remediation script:
    var_password_pam_ucredit="-1"
    if grep -q "ucredit=" /etc/pam.d/system-auth; then   
    	sed -i --follow-symlink "s/\(ucredit *= *\).*/\1$var_password_pam_ucredit/" /etc/pam.d/system-auth
    else
    	sed -i --follow-symlink "/pam_cracklib.so/ s/$/ ucredit=$var_password_pam_ucredit/" /etc/pam.d/system-auth
    fi
    
    Set Password Strength Minimum Special Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit CCE-26409-3

    Set Password Strength Minimum Special Characters

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26409-3

    references:  IA-5(b), IA-5(c), IA-5(1)(a), 1619, 266,

    The pam_cracklib module's ocredit= parameter controls requirements for usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each special character. Add ocredit=-1 after pam_cracklib.so to require use of a special character in passwords.

    Remediation script:
    var_password_pam_ocredit="-1"
    if grep -q "ocredit=" /etc/pam.d/system-auth; then   
    	sed -i --follow-symlink "s/\(ocredit *= *\).*/\1$var_password_pam_ocredit/" /etc/pam.d/system-auth
    else
    	sed -i --follow-symlink "/pam_cracklib.so/ s/$/ ocredit=$var_password_pam_ocredit/" /etc/pam.d/system-auth
    fi
    
    Set Password Strength Minimum Lowercase Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit CCE-26631-2

    Set Password Strength Minimum Lowercase Characters

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26631-2

    references:  IA-5(b), IA-5(c), IA-5(1)(a), 193,

    The pam_cracklib module's lcredit= parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each lowercase character. Add lcredit=-1 after pam_cracklib.so to require use of a lowercase character in passwords.

    Remediation script:
    var_password_pam_lcredit="-1"
    if grep -q "lcredit=" /etc/pam.d/system-auth; then   
    	sed -i --follow-symlink "s/\(lcredit *= *\).*/\1$var_password_pam_lcredit/" /etc/pam.d/system-auth
    else
    	sed -i --follow-symlink "/pam_cracklib.so/ s/$/ lcredit=$var_password_pam_lcredit/" /etc/pam.d/system-auth
    fi
    
    Set Password Strength Minimum Different Charactersxccdf_org.ssgproject.content_rule_accounts_password_pam_difok CCE-26615-5

    Set Password Strength Minimum Different Characters

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_difok
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26615-5

    references:  IA-5(b), IA-5(c), IA-5(1)(b), 195,

    The pam_cracklib module's difok parameter controls requirements for usage of different characters during a password change. Add difok=3 after pam_cracklib.so to require differing characters when changing passwords. The DoD requirement is 4.

    Remediation script:
    var_password_pam_difok="3"
    if grep -q "difok=" /etc/pam.d/system-auth; then   
    	sed -i --follow-symlink "s/\(difok *= *\).*/\1$var_password_pam_difok/" /etc/pam.d/system-auth
    else
    	sed -i --follow-symlink "/pam_cracklib.so/ s/$/ difok=$var_password_pam_difok/" /etc/pam.d/system-auth
    fi
    
    Set Password Strength Minimum Different Categoriesxccdf_org.ssgproject.content_rule_accounts_password_pam_cracklib_minclass CCE-27115-5

    Set Password Strength Minimum Different Categories

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_cracklib_minclass
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27115-5

    references: 

    The pam_cracklib module's minclass parameter controls requirements for usage of different character classes, or types, of character that must exist in a password before it is considered valid. For example, setting this value to three (3) requires that any password must have characters from at least three different categories in order to be approved. The default value is zero (0), meaning there are no required classes. There are four categories available:

    * Upper-case characters
    * Lower-case characters
    * Digits
    * Special characters (for example, punctuation)
    
    Add minclass=3 after pam_cracklib.so entry into the /etc/pam.d/system-auth file in order to require 3 differing categories of characters when changing passwords. For example to require at least three character classes to be used in password, use minclass=3.

    Set Deny For Failed Password Attemptsxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny CCE-26844-1

    Set Deny For Failed Password Attempts

    Rule IDxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26844-1

    references:  AC-7(a), 44

    To configure the system to lock out accounts after a number of incorrect login attempts using pam_faillock.so, modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:



    • add the following line immediately before the pam_unix.so statement in the AUTH section:

      auth required pam_faillock.so preauth silent deny=5 unlock_time=604800 fail_interval=900

    • add the following line immediately after the pam_unix.so statement in the AUTH section:

      auth [default=die] pam_faillock.so authfail deny=5 unlock_time=604800 fail_interval=900

    • add the following line immediately before the pam_unix.so statement in the ACCOUNT section:

      account required pam_faillock.so

    Remediation script:
    var_accounts_passwords_pam_faillock_deny="5"
    AUTH_FILES[0]="/etc/pam.d/system-auth"
    AUTH_FILES[1]="/etc/pam.d/password-auth"
    
    for pamFile in "${AUTH_FILES[@]}"
    do
    	
    	# pam_faillock.so already present?
    	if grep -q "^auth.*pam_faillock.so.*" $pamFile; then
    
    		# pam_faillock.so present, deny directive present?
    		if grep -q "^auth.*[default=die].*pam_faillock.so.*authfail.*deny=" $pamFile; then
    
    			# both pam_faillock.so & deny present, just correct deny directive value
    			sed -i --follow-symlink "s/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\(deny *= *\).*/\1\2$var_accounts_passwords_pam_faillock_deny/" $pamFile
    			sed -i --follow-symlink "s/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\(deny *= *\).*/\1\2$var_accounts_passwords_pam_faillock_deny/" $pamFile
    
    		# pam_faillock.so present, but deny directive not yet
    		else
    
    			# append correct deny value to appropriate places
    			sed -i --follow-symlink "/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ deny=$var_accounts_passwords_pam_faillock_deny/" $pamFile
    			sed -i --follow-symlink "/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ deny=$var_accounts_passwords_pam_faillock_deny/" $pamFile
    		fi
    
    	# pam_faillock.so not present yet
    	else
    
    		# insert pam_faillock.so preauth & authfail rows with proper value of the 'deny' option
    		sed -i --follow-symlink "/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent deny=$var_accounts_passwords_pam_faillock_deny" $pamFile
    		sed -i --follow-symlink "/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail deny=$var_accounts_passwords_pam_faillock_deny" $pamFile
    		sed -i --follow-symlink "/^account.*required.*pam_unix.so/i account     required      pam_faillock.so" $pamFile
    	fi
    done
    
    Set Lockout Time For Failed Password Attemptsxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time CCE-27110-6

    Set Lockout Time For Failed Password Attempts

    Rule IDxccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27110-6

    references:  AC-7(b), 47

    To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using pam_faillock.so, modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:



    • add the following line immediately before the pam_unix.so statement in the AUTH section:

      auth required pam_faillock.so preauth silent deny=5 unlock_time=604800 fail_interval=900

    • add the following line immediately after the pam_unix.so statement in the AUTH section:

      auth [default=die] pam_faillock.so authfail deny=5 unlock_time=604800 fail_interval=900

    • add the following line immediately before the pam_unix.so statement in the ACCOUNT section:

      account required pam_faillock.so

    Set Interval For Counting Failed Password Attemptsxccdf_org.ssgproject.content_rule_accounts_passwords_pam_fail_interval CCE-27215-3

    Set Interval For Counting Failed Password Attempts

    Rule IDxccdf_org.ssgproject.content_rule_accounts_passwords_pam_fail_interval
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27215-3

    references:  AC-7(a), 1452

    Utilizing pam_faillock.so, the fail_interval directive configures the system to lock out accounts after a number of incorrect login attempts. Modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:



    • add the following line immediately before the pam_unix.so statement in the AUTH section:

      auth required pam_faillock.so preauth silent deny=5 unlock_time=604800 fail_interval=900

    • add the following line immediately after the pam_unix.so statement in the AUTH section:

      auth [default=die] pam_faillock.so authfail deny=5 unlock_time=604800 fail_interval=900

    • add the following line immediately before the pam_unix.so statement in the ACCOUNT section:

      account required pam_faillock.so

    Limit Password Reusexccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember CCE-26741-9

    Limit Password Reuse

    Rule IDxccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26741-9

    references:  IA-5(f), IA-5(1)(e), 200,

    Do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_unix PAM module. In the file /etc/pam.d/system-auth, append remember=24 to the line which refers to the pam_unix.so module, as shown:

    password sufficient pam_unix.so existing_options remember=24
    The DoD STIG requirement is 5 passwords.

    Remediation script:
    var_password_pam_unix_remember="24"
    if grep -q "remember=" /etc/pam.d/system-auth; then   
    	sed -i --follow-symlink "s/\(remember *= *\).*/\1$var_password_pam_unix_remember/" /etc/pam.d/system-auth
    else
    	sed -i --follow-symlink "/^password[[:space:]]\+sufficient[[:space:]]\+pam_unix.so/ s/$/ remember=$var_password_pam_unix_remember/" /etc/pam.d/system-auth
    fi
    
    Set Password Hashing Algorithm in /etc/pam.d/system-authxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth CCE-26303-8

    Set Password Hashing Algorithm in /etc/pam.d/system-auth

    Rule IDxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26303-8

    references:  IA-5(b), IA-5(c), IA-5(1)(c), IA-7, 803,

    In /etc/pam.d/system-auth, the password section of the file controls which PAM modules execute during a password change. Set the pam_unix.so module in the password section to include the argument sha512, as shown below:

    password    sufficient    pam_unix.so sha512 other arguments...
    This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.

    Set Password Hashing Algorithm in /etc/login.defsxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs CCE-27228-6

    Set Password Hashing Algorithm in /etc/login.defs

    Rule IDxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27228-6

    references:  IA-5(b), IA-5(c), IA-5(1)(c), IA-7, 803,

    In /etc/login.defs, add or correct the following line to ensure the system will use SHA-512 as the hashing algorithm:

    ENCRYPT_METHOD SHA512

    Set Password Hashing Algorithm in /etc/libuser.confxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf CCE-27229-4

    Set Password Hashing Algorithm in /etc/libuser.conf

    Rule IDxccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27229-4

    references:  IA-5(b), IA-5(c), IA-5(1)(c), IA-7, 803,

    In /etc/libuser.conf, add or correct the following line in its [defaults] section to ensure the system will use the SHA-512 algorithm for password hashing:

    crypt_style = sha512

    Set Last Logon/Access Notificationxccdf_org.ssgproject.content_rule_display_login_attempts CCE-27291-4

    Set Last Logon/Access Notification

    Rule IDxccdf_org.ssgproject.content_rule_display_login_attempts
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27291-4

    references:  366

    To configure the system to notify users of last logon/access using pam_lastlog, add the following line immediately after session required pam_limits.so:

    session       required     pam_lastlog.so showfailed

    Ensure that Root's Path Does Not Include Relative Paths or Null Directoriesxccdf_org.ssgproject.content_rule_root_path_no_dot CCE-26826-8

    Ensure that Root's Path Does Not Include Relative Paths or Null Directories

    Rule IDxccdf_org.ssgproject.content_rule_root_path_no_dot
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26826-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    Ensure that none of the directories in root's path is equal to a single . character, or that it contains any instances that lead to relative path traversal, such as .. or beginning a path without the slash (/) character. Also ensure that there are no "empty" elements in the path, such as in these examples:

    PATH=:/bin
    PATH=/bin:
    PATH=/bin::/sbin
    These empty elements have the same effect as a single . character.

    Ensure that Root's Path Does Not Include World or Group-Writable Directoriesxccdf_org.ssgproject.content_rule_root_path_no_groupother_writable CCE-26768-2

    Ensure that Root's Path Does Not Include World or Group-Writable Directories

    Rule IDxccdf_org.ssgproject.content_rule_root_path_no_groupother_writable
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26768-2

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    For each element in root's path, run:

    $ sudo ls -ld DIR
    and ensure that write permissions are disabled for group and other.

    Ensure the Default Bash Umask is Set Correctlyxccdf_org.ssgproject.content_rule_accounts_umask_bashrc CCE-26917-5

    Ensure the Default Bash Umask is Set Correctly

    Rule IDxccdf_org.ssgproject.content_rule_accounts_umask_bashrc
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26917-5

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 366,

    To ensure the default umask for users of the Bash shell is set properly, add or correct the umask setting in /etc/bashrc to read as follows:

    umask 077

    OVAL details

    Items violating Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement:

    var refvaluevaluevaluevaluevaluevaluevaluevalue
    oval:ssg:var:3242221818221818
    Remediation script:
    var_accounts_user_umask="077"
    grep -q umask /etc/bashrc && \
      sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/bashrc
    if ! [ $? -eq 0 ]; then
        echo "umask $var_accounts_user_umask" >> /etc/bashrc
    fi
    
    Ensure the Default C Shell Umask is Set Correctlyxccdf_org.ssgproject.content_rule_accounts_umask_cshrc CCE-27034-8

    Ensure the Default C Shell Umask is Set Correctly

    Rule IDxccdf_org.ssgproject.content_rule_accounts_umask_cshrc
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27034-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 366,

    To ensure the default umask for users of the C shell is set properly, add or correct the umask setting in /etc/csh.cshrc to read as follows:

    umask 077

    OVAL details

    Items violating Test the retrieved /etc/csh.cshrc umask value(s) match the var_accounts_user_umask requirement:

    var refvaluevaluevaluevaluevaluevaluevaluevalue
    oval:ssg:var:3238221818221818
    Remediation script:
    var_accounts_user_umask="077"
    grep -q umask /etc/csh.cshrc && \
      sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/csh.cshrc
    if ! [ $? -eq 0 ]; then
        echo "umask $var_accounts_user_umask" >> /etc/csh.cshrc
    fi
    
    Ensure the Default Umask is Set Correctly in /etc/profilexccdf_org.ssgproject.content_rule_accounts_umask_etc_profile CCE-26669-2

    Ensure the Default Umask is Set Correctly in /etc/profile

    Rule IDxccdf_org.ssgproject.content_rule_accounts_umask_etc_profile
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26669-2

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 366,

    To ensure the default umask controlled by /etc/profile is set properly, add or correct the umask setting in /etc/profile to read as follows:

    umask 077

    OVAL details

    Items violating Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement:

    var refvaluevaluevaluevaluevaluevaluevaluevalue
    oval:ssg:var:3246221818221818
    Remediation script:
    var_accounts_user_umask="077"
    grep -q umask /etc/profile && \
      sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/profile
    if ! [ $? -eq 0 ]; then
        echo "umask $var_accounts_user_umask" >> /etc/profile
    fi
    
    Ensure the Default Umask is Set Correctly in login.defsxccdf_org.ssgproject.content_rule_accounts_umask_login_defs CCE-26371-5

    Ensure the Default Umask is Set Correctly in login.defs

    Rule IDxccdf_org.ssgproject.content_rule_accounts_umask_login_defs
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26371-5

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 366,

    To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the UMASK setting in /etc/login.defs to read as follows:

    UMASK 077

    Limit the Number of Concurrent Login Sessions Allowed Per Userxccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions CCE-27457-1

    Limit the Number of Concurrent Login Sessions Allowed Per User

    Rule IDxccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27457-1

    references:  AC-10, 54

    Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. The DoD requirement is 10. To set the number of concurrent sessions per user add the following line in /etc/security/limits.conf:

    * hard maxlogins 1

    Ensure that User Home Directories are not Group-Writable or World-Readablexccdf_org.ssgproject.content_rule_homedir_perms_no_groupwrite_worldread CCE-26981-1

    Ensure that User Home Directories are not Group-Writable or World-Readable

    Rule IDxccdf_org.ssgproject.content_rule_homedir_perms_no_groupwrite_worldread
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26981-1

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    For each human user of the system, view the permissions of the user's home directory:

    $ sudo ls -ld /home/USER
    Ensure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions:
    $ sudo chmod g-w /home/USER
    $ sudo chmod o-rwx /home/USER

    OVAL details

    Items violating home directories:

    pathtypeUIDGIDsizepermissions
    /home/directory004096rwxr-xr-x 
    Verify /etc/grub.conf User Ownershipxccdf_org.ssgproject.content_rule_user_owner_grub_conf CCE-26995-1

    Verify /etc/grub.conf User Ownership

    Rule IDxccdf_org.ssgproject.content_rule_user_owner_grub_conf
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26995-1

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 225,

    The file /etc/grub.conf should be owned by the root user to prevent destruction or modification of the file. To properly set the owner of /etc/grub.conf, run the command: # chown root/etc/grub.conf

    Verify /etc/grub.conf Group Ownershipxccdf_org.ssgproject.content_rule_group_owner_grub_conf CCE-27022-3

    Verify /etc/grub.conf Group Ownership

    Rule IDxccdf_org.ssgproject.content_rule_group_owner_grub_conf
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27022-3

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 225,

    The file /etc/grub.conf should be group-owned by the root group to prevent destruction or modification of the file. To properly set the group owner of /etc/grub.conf, run the command: # chgrp root/etc/grub.conf

    Verify /boot/grub/grub.conf Permissionsxccdf_org.ssgproject.content_rule_permissions_grub_conf CCE-26949-8

    Verify /boot/grub/grub.conf Permissions

    Rule IDxccdf_org.ssgproject.content_rule_permissions_grub_conf
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26949-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 225,

    File permissions for /boot/grub/grub.conf should be set to 600, which is the default. To properly set the permissions of /boot/grub/grub.conf, run the command: # chmod 600/boot/grub/grub.conf

    Set Boot Loader Passwordxccdf_org.ssgproject.content_rule_bootloader_password CCE-26911-8

    Set Boot Loader Password

    Rule IDxccdf_org.ssgproject.content_rule_bootloader_password
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26911-8

    references:  IA-2(1), IA-5(e), 213,

    The grub boot loader should have password protection enabled to protect boot-time settings. To do so, select a password and then generate a hash from it by running the following command:

    $ grub-crypt --sha-512
    When prompted to enter a password, insert the following line into /etc/grub.conf immediately after the header comments. (Use the output from grub-crypt as the value of password-hash):
    password --encrypted password-hash
    NOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password.

    Set GNOME Login Inactivity Timeoutxccdf_org.ssgproject.content_rule_set_screensaver_inactivity_timeout CCE-26828-4

    Set GNOME Login Inactivity Timeout

    Rule IDxccdf_org.ssgproject.content_rule_set_screensaver_inactivity_timeout
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26828-4

    references:  AC-11(a), 57

    Run the following command to set the idle time-out value for inactivity in the GNOME desktop to 15 minutes:

    $ sudo gconftool-2 \
      --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type int \
      --set /desktop/gnome/session/idle_delay 15

    GNOME Desktop Screensaver Mandatory Usexccdf_org.ssgproject.content_rule_enable_screensaver_after_idle CCE-26600-7

    GNOME Desktop Screensaver Mandatory Use

    Rule IDxccdf_org.ssgproject.content_rule_enable_screensaver_after_idle
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26600-7

    references:  AC-11(a), 57

    Run the following command to activate the screensaver in the GNOME desktop after a period of inactivity:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /apps/gnome-screensaver/idle_activation_enabled true

    Enable Screen Lock Activation After Idle Periodxccdf_org.ssgproject.content_rule_enable_screensaver_password_lock CCE-26235-2

    Enable Screen Lock Activation After Idle Period

    Rule IDxccdf_org.ssgproject.content_rule_enable_screensaver_password_lock
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26235-2

    references:  AC-11(a), 57

    Run the following command to activate locking of the screensaver in the GNOME desktop when it is activated:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /apps/gnome-screensaver/lock_enabled true

    Implement Blank Screensaverxccdf_org.ssgproject.content_rule_set_blank_screensaver CCE-26638-7

    Implement Blank Screensaver

    Rule IDxccdf_org.ssgproject.content_rule_set_blank_screensaver
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26638-7

    references:  AC-11(b), 60

    Run the following command to set the screensaver mode in the GNOME desktop to a blank screen:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type string \
      --set /apps/gnome-screensaver/mode blank-only

    Install the screen Packagexccdf_org.ssgproject.content_rule_package_screen_installed CCE-26940-7

    Install the screen Package

    Rule IDxccdf_org.ssgproject.content_rule_package_screen_installed
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26940-7

    references:  58,

    To enable console screen locking, install the screen package:

    $ sudo yum install screen
    Instruct users to begin new terminal sessions with the following command:
    $ screen
    The console can now be locked with the following key combination:
    ctrl+a x

    Enable Smart Card Loginxccdf_org.ssgproject.content_rule_smartcard_auth CCE-27440-7

    Enable Smart Card Login

    Rule IDxccdf_org.ssgproject.content_rule_smartcard_auth
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27440-7

    references:  765, 766, 767, 768, 771, 772, 884

    To enable smart card authentication, consult the documentation at:

    • https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html
    For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:
    • https://access.redhat.com/solutions/82273

    Require Authentication for Single User Modexccdf_org.ssgproject.content_rule_require_singleuser_auth CCE-27040-5

    Require Authentication for Single User Mode

    Rule IDxccdf_org.ssgproject.content_rule_require_singleuser_auth
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27040-5

    references:  IA-2(1), 213,

    Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected.



    To require entry of the root password even if the system is started in single-user mode, add or correct the following line in the file /etc/sysconfig/init:

    SINGLE=/sbin/sulogin

    Disable Ctrl-Alt-Del Reboot Activationxccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot CCE-27567-7

    Disable Ctrl-Alt-Del Reboot Activation

    Rule IDxccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
    Result
    notselected
    Time2014-11-01T12:08:22
    Severityhigh
    Identifiers and References

    identifiers:  CCE-27567-7

    By default, the system includes the following line in /etc/init/control-alt-delete.conf to reboot the system when the Ctrl-Alt-Del key sequence is pressed:

    exec /sbin/shutdown -r now "Control-Alt-Delete pressed"


    To configure the system to log a message instead of rebooting the system, alter that line to read as follows:
    exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"

    Disable Interactive Bootxccdf_org.ssgproject.content_rule_disable_interactive_boot CCE-27043-9

    Disable Interactive Boot

    Rule IDxccdf_org.ssgproject.content_rule_disable_interactive_boot
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27043-9

    references:  SC-2, 213,

    To disable the ability for users to perform interactive startups, edit the file /etc/sysconfig/init. Add or correct the line:

    PROMPT=no
    The PROMPT option allows the console user to perform an interactive system startup, in which it is possible to select the set of services which are started on boot.

    Remediation script:
    grep -q ^PROMPT /etc/sysconfig/init && \
      sed -i "s/PROMPT.*/PROMPT=no/g" /etc/sysconfig/init
    if ! [ $? -eq 0 ]; then
        echo "PROMPT=no" >> /etc/sysconfig/init
    fi
    
    Enable GUI Warning Bannerxccdf_org.ssgproject.content_rule_enable_gdm_login_banner CCE-27195-7

    Enable GUI Warning Banner

    Rule IDxccdf_org.ssgproject.content_rule_enable_gdm_login_banner
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27195-7

    references:  AC-8(a), AC-8(b), AC-8(c), 48, 50

    To enable displaying a login warning banner in the GNOME Display Manager's login screen, run the following command:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /apps/gdm/simple-greeter/banner_message_enable true
    To display a banner, this setting must be enabled and then banner text must also be set.

    Set GUI Warning Banner Textxccdf_org.ssgproject.content_rule_set_gdm_login_banner_text CCE-27017-3

    Set GUI Warning Banner Text

    Rule IDxccdf_org.ssgproject.content_rule_set_gdm_login_banner_text
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27017-3

    references:  AC-8(a), AC-8(b), AC-8(c), 48, 1384, 1385, 1386, 1387, 1388

    To set the text shown by the GNOME Display Manager in the login screen, run the following command:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type string \
      --set /apps/gdm/simple-greeter/banner_message_text \
      "Text of the warning banner here"
    When entering a warning banner that spans several lines, remember to begin and end the string with ". This command writes directly either to the /etc/gconf/gconf.xml.mandatory/%gconf-tree.xml if it exists or to the file /etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml. Either of these files can later be edited directly if necessary.

    Modify the System Login Bannerxccdf_org.ssgproject.content_rule_set_system_login_banner CCE-26974-6

    Modify the System Login Banner

    Rule IDxccdf_org.ssgproject.content_rule_set_system_login_banner
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26974-6

    references:  AC-8(a), AC-8(b), AC-8(c), 48, 1384, 1385, 1386, 1387, 1388,

    To configure the system login banner:



    Edit /etc/issue. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either:



    You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:

    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

    -At any time, the USG may inspect and seize data stored on this IS.

    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.

    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.




    OR:



    I've read & consent to terms in IS user agreem't.

    Remediation script:
    login_banner_text="
    -- WARNING --[\s\n]*This system is for the use of authorized users only. Individuals[\s\n]*using this computer system without authority or in excess of their[\s\n]*authority are subject to having all their activities on this system[\s\n]*monitored and recorded by system personnel. Anyone using this[\s\n]*system expressly consents to such monitoring and is advised that[\s\n]*if such monitoring reveals possible evidence of criminal activity[\s\n]*system personal may provide the evidence of such monitoring to law[\s\n]*enforcement officials."
    # There was a regular-expression matching various banners, needs to be expanded
    expanded=$(echo "$login_banner_text" | sed 's/\[\\s\\n\][*+]/ /g;s/\\//g;')
    
    cat <<EOF >/etc/issue
    $expanded
    EOF
    
    Disable the User Listxccdf_org.ssgproject.content_rule_disable_user_list CCE-27230-2

    Disable the User List

    Rule IDxccdf_org.ssgproject.content_rule_disable_user_list
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27230-2

    references:  AC-23

    In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled.



    Run the following command to disable the user list:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /apps/gdm/simple-greeter/disable_user_list true

    Disable Kernel Parameter for Sending ICMP Redirects by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects CCE-27001-7

    Disable Kernel Parameter for Sending ICMP Redirects by Default

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27001-7

    references:  AC-4, CM-7, SC-5, SC-7, 1551,

    To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command: # sysctl -w net.ipv4.conf.default.send_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.default.send_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0:

    namevalue
    net.ipv4.conf.default.send_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.default.send_redirects
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.default.send_redirects=0
    
    #
    # If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.default.send_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.default.send_redirects.*/net.ipv4.conf.default.send_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.default.send_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Disable Kernel Parameter for Sending ICMP Redirects for All Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects CCE-27004-1

    Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27004-1

    references:  CM-7, 1551,

    To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command: # sysctl -w net.ipv4.conf.all.send_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.all.send_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0:

    namevalue
    net.ipv4.conf.all.send_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.all.send_redirects
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.all.send_redirects=0
    
    #
    # If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.all.send_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.all.send_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Disable Kernel Parameter for IP Forwardingxccdf_org.ssgproject.content_rule_sysctl_ipv4_ip_forward CCE-26866-4

    Disable Kernel Parameter for IP Forwarding

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_ipv4_ip_forward
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26866-4

    references:  CM-7, SC-5, 366,

    To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command: # sysctl -w net.ipv4.ip_forward=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.ip_forward = 0

    Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route CCE-27037-1

    Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27037-1

    references:  CM-7, 1551,

    To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command: # sysctl -w net.ipv4.conf.all.accept_source_route=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.all.accept_source_route = 0

    Disable Kernel Parameter for Accepting ICMP Redirects for All Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects CCE-27027-2

    Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27027-2

    references:  CM-7, 1503, 1551,

    To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command: # sysctl -w net.ipv4.conf.all.accept_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.all.accept_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0:

    namevalue
    net.ipv4.conf.all.accept_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.all.accept_redirects
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_redirects=0
    
    #
    # If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv4.conf.all.accept_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.all.accept_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Disable Kernel Parameter for Accepting Secure Redirects for All Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects CCE-26854-0

    Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26854-0

    references:  AC-4, CM-7, 1503, 1551,

    To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command: # sysctl -w net.ipv4.conf.all.secure_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.all.secure_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0:

    namevalue
    net.ipv4.conf.all.secure_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.all.secure_redirects
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.all.secure_redirects=0
    
    #
    # If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv4.conf.all.secure_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.all.secure_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.all.secure_redirects.*/net.ipv4.conf.all.secure_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.all.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Enable Kernel Parameter to Log Martian Packetsxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians CCE-27066-0

    Enable Kernel Parameter to Log Martian Packets

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27066-0

    references:  AC-3(10), CM-7, 126,

    To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command: # sysctl -w net.ipv4.conf.all.log_martians=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.all.log_martians = 1

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.all.log_martians set to 1:

    namevalue
    net.ipv4.conf.all.log_martians0
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.all.log_martians
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.all.log_martians=1
    
    #
    # If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to "1"
    #	else, add "net.ipv4.conf.all.log_martians = 1" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.all.log_martians /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.all.log_martians.*/net.ipv4.conf.all.log_martians = 1/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.all.log_martians to 1 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf
    fi
    
    Disable Kernel Parameter for Accepting Source-Routed Packets By Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route CCE-26983-7

    Disable Kernel Parameter for Accepting Source-Routed Packets By Default

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26983-7

    references:  AC-4, CM-7, SC-5, SC-7, 1551,

    To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command: # sysctl -w net.ipv4.conf.default.accept_source_route=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.default.accept_source_route = 0

    Disable Kernel Parameter for Accepting ICMP Redirects By Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects CCE-27015-7

    Disable Kernel Parameter for Accepting ICMP Redirects By Default

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27015-7

    references:  AC-4, CM-7, SC-5, SC-7, 1551,

    To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command: # sysctl -w net.ipv4.conf.default.accept_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.default.accept_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0:

    namevalue
    net.ipv4.conf.default.accept_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.default.accept_redirects
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.default.accept_redirects=0
    
    #
    # If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv4.conf.default.accept_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.default.accept_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.default.accept_redirects.*/net.ipv4.conf.default.accept_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Disable Kernel Parameter for Accepting Secure Redirects By Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects CCE-26831-8

    Disable Kernel Parameter for Accepting Secure Redirects By Default

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26831-8

    references:  AC-4, CM-7, SC-5, SC-7, 1551,

    To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command: # sysctl -w net.ipv4.conf.default.secure_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.default.secure_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0:

    namevalue
    net.ipv4.conf.default.secure_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.default.secure_redirects
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.default.secure_redirects=0
    
    #
    # If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv4.conf.default.secure_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.default.secure_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.default.secure_redirects.*/net.ipv4.conf.default.secure_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.default.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requestsxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts CCE-26883-9

    Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26883-9

    references:  CM-7, SC-5, 1551,

    To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command: # sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.icmp_echo_ignore_broadcasts = 1

    Remediation script:
    #
    # Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
    #
    /sbin/sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts=1
    
    #
    # If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to "1"
    #	else, add "net.ipv4.icmp_echo_ignore_broadcasts = 1" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.icmp_echo_ignore_broadcasts.*/net.ipv4.icmp_echo_ignore_broadcasts = 1/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.icmp_echo_ignore_broadcasts to 1 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf
    fi
    
    Enable Kernel Parameter to Ignore Bogus ICMP Error Responsesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses CCE-26993-6

    Enable Kernel Parameter to Ignore Bogus ICMP Error Responses

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26993-6

    references:  CM-7, SC-5,

    To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command: # sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.icmp_ignore_bogus_error_responses = 1

    Remediation script:
    #
    # Set runtime for net.ipv4.icmp_ignore_bogus_error_responses
    #
    /sbin/sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses=1
    
    #
    # If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to "1"
    #	else, add "net.ipv4.icmp_ignore_bogus_error_responses = 1" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.icmp_ignore_bogus_error_responses.*/net.ipv4.icmp_ignore_bogus_error_responses = 1/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.icmp_ignore_bogus_error_responses to 1 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.conf
    fi
    
    Enable Kernel Parameter to Use TCP Syncookiesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies CCE-27053-8

    Enable Kernel Parameter to Use TCP Syncookies

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27053-8

    references:  AC-4, 1092, 1095,

    To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter, run the following command: # sysctl -w net.ipv4.tcp_syncookies=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.tcp_syncookies = 1

    Enable Kernel Parameter to Use Reverse Path Filtering for All Interfacesxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter CCE-26979-5

    Enable Kernel Parameter to Use Reverse Path Filtering for All Interfaces

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26979-5

    references:  AC-4, SC-5, SC-7, 1551,

    To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command: # sysctl -w net.ipv4.conf.all.rp_filter=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.all.rp_filter = 1

    OVAL details

    Items violating kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1:

    namevalue
    net.ipv4.conf.all.rp_filter0
    Remediation script:
    #
    # Set runtime for net.ipv4.conf.all.rp_filter
    #
    /sbin/sysctl -q -n -w net.ipv4.conf.all.rp_filter=1
    
    #
    # If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to "1"
    #	else, add "net.ipv4.conf.all.rp_filter = 1" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf
    fi
    
    Enable Kernel Parameter to Use Reverse Path Filtering by Defaultxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter CCE-26915-9

    Enable Kernel Parameter to Use Reverse Path Filtering by Default

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26915-9

    references:  AC-4, SC-5, SC-7,

    To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command: # sysctl -w net.ipv4.conf.default.rp_filter=1 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv4.conf.default.rp_filter = 1

    Disable WiFi or Bluetooth in BIOSxccdf_org.ssgproject.content_rule_wireless_disable_in_bios CCE-26878-9

    Disable WiFi or Bluetooth in BIOS

    Rule IDxccdf_org.ssgproject.content_rule_wireless_disable_in_bios
    Result
    notchecked
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26878-9

    references:  AC-18(a), AC-18(d), AC-18(3), CM-7, 85

    Some systems that include built-in wireless support offer the ability to disable the device through the BIOS. This is system-specific; consult your hardware manual or explore the BIOS setup during boot.

    Deactivate Wireless Network Interfacesxccdf_org.ssgproject.content_rule_deactivate_wireless_interfaces CCE-27057-9

    Deactivate Wireless Network Interfaces

    Rule IDxccdf_org.ssgproject.content_rule_deactivate_wireless_interfaces
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27057-9

    references:  AC-18(a), AC-18(d), AC-18(3), CM-7, 85,

    Deactivating wireless network interfaces should prevent normal usage of the wireless capability.



    First, identify the interfaces available with the command:

    $ ifconfig -a
    Additionally, the following command may be used to determine whether wireless support is included for a particular interface, though this may not always be a clear indicator:
    $ iwconfig
    After identifying any wireless interfaces (which may have names like wlan0, ath0, wifi0, em1 or eth0), deactivate the interface with the command:
    $ sudo ifdown interface
    These changes will only last until the next reboot. To disable the interface for future boots, remove the appropriate interface file from /etc/sysconfig/network-scripts:
    $ sudo rm /etc/sysconfig/network-scripts/ifcfg-interface

    Disable Bluetooth Servicexccdf_org.ssgproject.content_rule_service_bluetooth_disabled CCE-27081-9

    Disable Bluetooth Service

    Rule IDxccdf_org.ssgproject.content_rule_service_bluetooth_disabled
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27081-9

    references:  AC-18(a), AC-18(d), AC-18(3), CM-7, 85, 1551,

    The bluetooth service can be disabled with the following command: # chkconfig bluetooth off

    $ sudo service bluetooth stop

    Disable Bluetooth Kernel Modulesxccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled CCE-26763-3

    Disable Bluetooth Kernel Modules

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26763-3

    references:  AC-18(a), AC-18(d), AC-18(3), CM-7, 85, 1551,

    The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate /etc/modprobe.d configuration file to prevent the loading of the Bluetooth module:

    install bluetooth /bin/false

    Remediation script:
    echo "install bluetooth /bin/false" > /etc/modprobe.d/bluetooth.conf
    
    Disable IPv6 Networking Support Automatic Loadingxccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled CCE-27153-6

    Disable IPv6 Networking Support Automatic Loading

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27153-6

    references:  CM-7, 1551,

    To prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack, add the following line to /etc/modprobe.d/disabled.conf (or another file in /etc/modprobe.d):

    options ipv6 disable=1
    This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol.

    Disable Interface Usage of IPv6xccdf_org.ssgproject.content_rule_network_ipv6_disable_interfaces CCE-27161-9

    Disable Interface Usage of IPv6

    Rule IDxccdf_org.ssgproject.content_rule_network_ipv6_disable_interfaces
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27161-9

    To disable interface usage of IPv6, add or correct the following lines in /etc/sysconfig/network:

    NETWORKING_IPV6=no
    IPV6INIT=no

    Disable Support for RPC IPv6xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc CCE-27232-8

    Disable Support for RPC IPv6

    Rule IDxccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27232-8

    references:  CM-7

    RPC services for NFSv4 try to load transport modules for udp6 and tcp6 by default, even if IPv6 has been disabled in /etc/modprobe.d. To prevent RPC services such as rpc.mountd from attempting to start IPv6 network listeners, remove or comment out the following two lines in /etc/netconfig:

    udp6       tpi_clts      v     inet6    udp     -       -
    tcp6       tpi_cots_ord  v     inet6    tcp     -       -

    OVAL details

    Items violating Test for udp6 based rpc services:

    pathcontent
    /etc/netconfigudp6 tpi_clts v inet6 udp - -

    Items violating Test for tcp6 based rpc services:

    pathcontent
    /etc/netconfigtcp6 tpi_cots_ord v inet6 tcp - -
    Disable Accepting IPv6 Router Advertisementsxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra CCE-27164-3

    Disable Accepting IPv6 Router Advertisements

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27164-3

    references:  CM-7

    To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command: # sysctl -w net.ipv6.conf.default.accept_ra=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv6.conf.default.accept_ra = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv6.conf.default.accept_ra set to 0:

    namevalue
    net.ipv6.conf.default.accept_ra1
    Remediation script:
    #
    # Set runtime for net.ipv6.conf.default.accept_ra
    #
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra=0
    
    #
    # If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv6.conf.default.accept_ra = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv6.conf.default.accept_ra /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv6.conf.default.accept_ra.*/net.ipv6.conf.default.accept_ra = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv6.conf.default.accept_ra to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf
    fi
    
    Disable Accepting IPv6 Redirectsxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects CCE-27166-8

    Disable Accepting IPv6 Redirects

    Rule IDxccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27166-8

    references:  CM-7, 1551

    To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command: # sysctl -w net.ipv6.conf.default.accept_redirects=0 If this is not the system's default value, add the following line to /etc/sysctl.conf: net.ipv6.conf.default.accept_redirects = 0

    OVAL details

    Items violating kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0:

    namevalue
    net.ipv6.conf.default.accept_redirects1
    Remediation script:
    #
    # Set runtime for net.ipv6.conf.default.accept_redirects
    #
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_redirects=0
    
    #
    # If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0"
    #	else, add "net.ipv6.conf.default.accept_redirects = 0" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv6.conf.default.accept_redirects /etc/sysctl.conf ; then
    	sed -i 's/^net.ipv6.conf.default.accept_redirects.*/net.ipv6.conf.default.accept_redirects = 0/g' /etc/sysctl.conf
    else
    	echo "" >> /etc/sysctl.conf
    	echo "# Set net.ipv6.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
    	echo "net.ipv6.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
    fi
    
    Manually Assign Global IPv6 Addressxccdf_org.ssgproject.content_rule_network_ipv6_static_address CCE-27233-6

    Manually Assign Global IPv6 Address

    Rule IDxccdf_org.ssgproject.content_rule_network_ipv6_static_address
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27233-6

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    To manually assign an IP address for an interface, edit the file /etc/sysconfig/network-scripts/ifcfg-interface. Add or correct the following line (substituting the correct IPv6 address):

    IPV6ADDR=2001:0DB8::ABCD/64
    Manually assigning an IP address is preferable to accepting one from routers or from the network otherwise. The example address here is an IPv6 address reserved for documentation purposes, as defined by RFC3849.

    Use Privacy Extensions for Addressxccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions CCE-27154-4

    Use Privacy Extensions for Address

    Rule IDxccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27154-4

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    To introduce randomness into the automatic generation of IPv6 addresses, add or correct the following line in /etc/sysconfig/network-scripts/ifcfg-interface:

    IPV6_PRIVACY=rfc3041
    Automatically-generated IPv6 addresses are based on the underlying hardware (e.g. Ethernet) address, and so it becomes possible to track a piece of hardware over its lifetime using its traffic. If it is important for a system's IP address to not trivially reveal its hardware address, this setting should be applied.

    Manually Assign IPv6 Router Addressxccdf_org.ssgproject.content_rule_network_ipv6_default_gateway CCE-27234-4

    Manually Assign IPv6 Router Address

    Rule IDxccdf_org.ssgproject.content_rule_network_ipv6_default_gateway
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27234-4

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

    Edit the file /etc/sysconfig/network-scripts/ifcfg-interface, and add or correct the following line (substituting your gateway IP as appropriate):

    IPV6_DEFAULTGW=2001:0DB8::0001
    Router addresses should be manually set and not accepted via any auto-configuration or router advertisement.

    Verify ip6tables Enabled if Using IPv6xccdf_org.ssgproject.content_rule_service_ip6tables_enabled CCE-27006-6

    Verify ip6tables Enabled if Using IPv6

    Rule IDxccdf_org.ssgproject.content_rule_service_ip6tables_enabled
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27006-6

    references:  AC-4, CA-3(c), CM-7, 32, 66, 1115, 1118, 1092, 1117, 1098, 1100, 1097, 1414,

    The ip6tables service can be enabled with the following command: # chkconfig --level 2345 ip6tables on

    Set Default ip6tables Policy for Incoming Packetsxccdf_org.ssgproject.content_rule_set_ip6tables_default_rule CCE-27317-7

    Set Default ip6tables Policy for Incoming Packets

    Rule IDxccdf_org.ssgproject.content_rule_set_ip6tables_default_rule
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27317-7

    references:  CM-7, 66, 1109, 1154, 1414

    To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in /etc/sysconfig/ip6tables:

    :INPUT DROP [0:0]
    If changes were required, reload the ip6tables rules:
    $ sudo service ip6tables reload

    Verify iptables Enabledxccdf_org.ssgproject.content_rule_service_iptables_enabled CCE-27018-1

    Verify iptables Enabled

    Rule IDxccdf_org.ssgproject.content_rule_service_iptables_enabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27018-1

    references:  AC-4, CA-3(c), CM-7, 32, 66, 1115, 1118, 1092, 1117, 1098, 1100, 1097, 1414,

    The iptables service can be enabled with the following command: # chkconfig --level 2345 iptables on

    OVAL details

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables0falsetrue

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables1falsetrue

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables2falsetrue

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables3falsetrue

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables4falsetrue

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables5falsetrue

    Items violating Runlevel test:

    service namerunlevelstartkill
    iptables6falsetrue
    Remediation script:
    #
    # Enable iptables for all run levels
    #
    /sbin/chkconfig --level 0123456 iptables on
    
    #
    # Start iptables if not currently running
    #
    /sbin/service iptables start
    
    Set Default iptables Policy for Incoming Packetsxccdf_org.ssgproject.content_rule_set_iptables_default_rule CCE-26444-0

    Set Default iptables Policy for Incoming Packets

    Rule IDxccdf_org.ssgproject.content_rule_set_iptables_default_rule
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26444-0

    references:  CM-7, 66, 1109, 1154, 1414

    To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in /etc/sysconfig/iptables:

    :INPUT DROP [0:0]

    OVAL details

    Items violating Check /etc/sysconfig/iptables for line :INPUT ACCEPT [0:0]:

    pathcontent
    /etc/sysconfig/iptables:INPUT ACCEPT [0:0]
    Remediation script:
    sed -i 's/^:INPUT ACCEPT.*/:INPUT DROP [0:0]/g' /etc/sysconfig/iptables
    
    Set Default iptables Policy for Forwarded Packetsxccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward CCE-27186-6

    Set Default iptables Policy for Forwarded Packets

    Rule IDxccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27186-6

    references:  CM-7, 1109

    To set the default policy to DROP (instead of ACCEPT) for the built-in FORWARD chain which processes packets that will be forwarded from one interface to another, add or correct the following line in /etc/sysconfig/iptables:

    :FORWARD DROP [0:0]

    OVAL details

    Items violating Check /etc/sysconfig/iptables for line :FORWARD ACCEPT [0:0]:

    pathcontent
    /etc/sysconfig/iptables:FORWARD ACCEPT [0:0]
    Remediation script:
    sed -i 's/^:FORWARD ACCEPT.*/:FORWARD DROP [0:0]/g' /etc/sysconfig/iptables
    
    Disable DCCP Supportxccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled CCE-26448-1

    Disable DCCP Support

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26448-1

    references:  CM-7, 382,

    The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the dccp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install dccp /bin/false

    Remediation script:
    echo "install dccp /bin/false" > /etc/modprobe.d/dccp.conf
    
    Disable SCTP Supportxccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled CCE-26410-1

    Disable SCTP Support

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26410-1

    references:  CM-7, 382,

    The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the sctp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install sctp /bin/false

    Remediation script:
    echo "install sctp /bin/false" > /etc/modprobe.d/sctp.conf
    
    Disable RDS Supportxccdf_org.ssgproject.content_rule_kernel_module_rds_disabled CCE-26239-4

    Disable RDS Support

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_rds_disabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26239-4

    references:  CM-7, 382,

    The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high- bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the rds kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install rds /bin/false

    Remediation script:
    echo "install rds /bin/false" > /etc/modprobe.d/rds.conf
    
    Disable TIPC Supportxccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled CCE-26696-5

    Disable TIPC Support

    Rule IDxccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled
    Result
    fail
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26696-5

    references:  CM-7, 382,

    The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the tipc kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d: install tipc /bin/false

    Remediation script:
    echo "install tipc /bin/false" > /etc/modprobe.d/tipc.conf
    
    Install openswan Packagexccdf_org.ssgproject.content_rule_package_openswan_installed CCE-27626-1

    Install openswan Package

    Rule IDxccdf_org.ssgproject.content_rule_package_openswan_installed
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27626-1

    references:  AC-17, MA-4, SC-8, 1130, 1131

    The Openswan package provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. The openswan package can be installed with the following command: # yum install openswan

    Disable Zeroconf Networkingxccdf_org.ssgproject.content_rule_network_disable_zeroconf CCE-27151-0

    Disable Zeroconf Networking

    Rule IDxccdf_org.ssgproject.content_rule_network_disable_zeroconf
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27151-0

    references:  CM-7

    Zeroconf networking allows the system to assign itself an IP address and engage in IP communication without a statically-assigned address or even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not recommended. To disable Zeroconf automatic route assignment in the 169.254.0.0 subnet, add or correct the following line in /etc/sysconfig/network:

    NOZEROCONF=yes

    Remediation script:
    echo "NOZEROCONF=yes" >> /etc/sysconfig/network
    
    Ensure System is Not Acting as a Network Snifferxccdf_org.ssgproject.content_rule_network_sniffer_disabled CCE-27152-8

    Ensure System is Not Acting as a Network Sniffer

    Rule IDxccdf_org.ssgproject.content_rule_network_sniffer_disabled
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27152-8

    references:  CM-7, MA-3

    The system should not be acting as a network sniffer, which can capture all traffic on the network to which it is connected. Run the following to determine if any interface is running in promiscuous mode:

    $ ip link | grep PROMISC

    Ensure Log Files Are Owned By Appropriate Userxccdf_org.ssgproject.content_rule_userowner_rsyslog_files CCE-26812-8

    Ensure Log Files Are Owned By Appropriate User

    Rule IDxccdf_org.ssgproject.content_rule_userowner_rsyslog_files
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26812-8

    references:  AC-6, 1314,

    The owner of all log files written by rsyslog should be root. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's owner:

    $ ls -l LOGFILE
    If the owner is not root, run the following command to correct this:
    $ sudo chown root LOGFILE

    Ensure Log Files Are Owned By Appropriate Groupxccdf_org.ssgproject.content_rule_groupowner_rsyslog_files CCE-26821-9

    Ensure Log Files Are Owned By Appropriate Group

    Rule IDxccdf_org.ssgproject.content_rule_groupowner_rsyslog_files
    Result
    unknown
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26821-9

    references:  AC-6, 1314,

    The group-owner of all log files written by rsyslog should be root. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's group owner:

    $ ls -l LOGFILE
    If the owner is not root, run the following command to correct this:
    $ sudo chgrp root LOGFILE

    Ensure System Log Files Have Correct Permissionsxccdf_org.ssgproject.content_rule_rsyslog_file_permissions CCE-27190-8

    Ensure System Log Files Have Correct Permissions

    Rule IDxccdf_org.ssgproject.content_rule_rsyslog_file_permissions
    Result
    unknown
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27190-8

    references:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf, 1314,

    The file permissions for all log files written by rsyslog should be set to 600, or more restrictive. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's permissions:

    $ ls -l LOGFILE
    If the permissions are not 600 or more restrictive, run the following command to correct this:
    $ sudo chmod 0600 LOGFILE

    Ensure Logs Sent To Remote Hostxccdf_org.ssgproject.content_rule_rsyslog_send_messages_to_logserver CCE-26801-1

    Ensure Logs Sent To Remote Host

    Rule IDxccdf_org.ssgproject.content_rule_rsyslog_send_messages_to_logserver
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26801-1

    references:  AU-3(2), AU-9, 1348, 136

    To configure rsyslog to send logs to a remote log server, open /etc/rsyslog.conf and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting loghost.example.com appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.

    To use UDP for log message delivery:

    *.* @loghost.example.com


    To use TCP for log message delivery:
    *.* @@loghost.example.com


    To use RELP for log message delivery:
    *.* :omrelp:loghost.example.com

    Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Serverxccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_none CCE-26803-7

    Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server

    Rule IDxccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_none
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26803-7

    references:  AU-9(2)

    The rsyslog daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the network, ensure the following lines are not found in /etc/rsyslog.conf:

    $ModLoad imtcp
    $InputTCPServerRun port
    $ModLoad imudp
    $UDPServerRun port
    $ModLoad imrelp
    $InputRELPServerRun port

    Enable rsyslog to Accept Messages via TCP, if Acting As Log Serverxccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp CCE-27235-1

    Enable rsyslog to Accept Messages via TCP, if Acting As Log Server

    Rule IDxccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27235-1

    references:  AU-9

    The rsyslog daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to /etc/rsyslog.conf to enable reception of messages over TCP:

    $ModLoad imtcp
    $InputTCPServerRun 514

    Enable rsyslog to Accept Messages via UDP, if Acting As Log Serverxccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp CCE-27236-9

    Enable rsyslog to Accept Messages via UDP, if Acting As Log Server

    Rule IDxccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27236-9

    references:  AU-9

    The rsyslog daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to /etc/rsyslog.conf to enable reception of messages over UDP:

    $ModLoad imudp
    $UDPServerRun 514

    Ensure Logrotate Runs Periodicallyxccdf_org.ssgproject.content_rule_ensure_logrotate_activated CCE-27014-0

    Ensure Logrotate Runs Periodically

    Rule IDxccdf_org.ssgproject.content_rule_ensure_logrotate_activated
    Result
    pass
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27014-0

    references:  AU-9, 366

    The logrotate utility allows for the automatic rotation of log files. The frequency of rotation is specified in /etc/logrotate.conf, which triggers a cron task. To configure logrotate to run daily, add or correct the following line in /etc/logrotate.conf:

    # rotate log files frequency
    daily

    Configure Logwatch HostLimit Linexccdf_org.ssgproject.content_rule_configure_logwatch_hostlimit CCE-27197-3

    Configure Logwatch HostLimit Line

    Rule IDxccdf_org.ssgproject.content_rule_configure_logwatch_hostlimit
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27197-3

    On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate on the logserver itself. The HostLimit setting tells Logwatch to report on all hosts, not just the one on which it is running.

     HostLimit = no 

    Configure Logwatch SplitHosts Linexccdf_org.ssgproject.content_rule_configure_logwatch_splithosts CCE-27069-4

    Configure Logwatch SplitHosts Line

    Rule IDxccdf_org.ssgproject.content_rule_configure_logwatch_splithosts
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27069-4

    If SplitHosts is set, Logwatch will separate entries by hostname. This makes the report longer but significantly more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that information is almost always necessary

     SplitHosts = yes 

    Ensure rsyslog is Installedxccdf_org.ssgproject.content_rule_package_rsyslog_installed CCE-26809-4

    Ensure rsyslog is Installed

    Rule IDxccdf_org.ssgproject.content_rule_package_rsyslog_installed
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26809-4

    references:  AU-9(2), 1311, 1312,

    Rsyslog is installed by default. The rsyslog package can be installed with the following command: # yum install rsyslog

    Enable rsyslog Servicexccdf_org.ssgproject.content_rule_service_rsyslog_enabled CCE-26807-8

    Enable rsyslog Service

    Rule IDxccdf_org.ssgproject.content_rule_service_rsyslog_enabled
    Result
    pass
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26807-8

    references:  AU-12, 1557, 1312, 1311,

    The rsyslog service provides syslog-style logging by default on RHEL 6. The rsyslog service can be enabled with the following command: # chkconfig --level 2345 rsyslog on

    Disable Logwatch on Clients if a Logserver Existsxccdf_org.ssgproject.content_rule_disable_logwatch_for_logserver CCE-27162-7

    Disable Logwatch on Clients if a Logserver Exists

    Rule IDxccdf_org.ssgproject.content_rule_disable_logwatch_for_logserver
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-27162-7

    Does your site have a central logserver which has been configured to report on logs received from all systems? If so:

     
    $ sudo rm /etc/cron.daily/0logwatch 
    
    If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier and less time-intensive for administrators.

    Configure auditd Number of Logs Retainedxccdf_org.ssgproject.content_rule_configure_auditd_num_logs CCE-27522-2

    Configure auditd Number of Logs Retained

    Rule IDxccdf_org.ssgproject.content_rule_configure_auditd_num_logs
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27522-2

    references:  AU-1(b), AU-11, IR-5,

    Determine how many log files auditd should retain when it rotates logs. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting NUMLOGS with the correct value of 5:

    num_logs = NUMLOGS
    Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation.

    Configure auditd Max Log File Sizexccdf_org.ssgproject.content_rule_configure_auditd_max_log_file CCE-27550-3

    Configure auditd Max Log File Size

    Rule IDxccdf_org.ssgproject.content_rule_configure_auditd_max_log_file
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27550-3

    references:  AU-1(b), AU-11, IR-5,

    Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting the correct value of 6 for STOREMB:

    max_log_file = STOREMB
    Set the value to 6 (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.

    Configure auditd max_log_file_action Upon Reaching Maximum Log Sizexccdf_org.ssgproject.content_rule_configure_auditd_max_log_file_action CCE-27237-7

    Configure auditd max_log_file_action Upon Reaching Maximum Log Size

    Rule IDxccdf_org.ssgproject.content_rule_configure_auditd_max_log_file_action
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27237-7

    references:  AU-1(b), AU-4, AU-11, IR-5,

    The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by auditd, add or correct the line in /etc/audit/auditd.conf:

    max_log_file_action = ACTION
    Possible values for ACTION are described in the auditd.conf man page. These include:
    • ignore
    • syslog
    • suspend
    • rotate
    • keep_logs
    Set the ACTION to rotate to ensure log rotation occurs. This is the default. The setting is case-insensitive.

    Configure auditd space_left Action on Low Disk Spacexccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action CCE-27238-5

    Configure auditd space_left Action on Low Disk Space

    Rule IDxccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27238-5

    references:  AU-1(b), AU-4, AU-5(b), IR-5, 140, 143,

    The auditd service can be configured to take an action when disk space starts to run low. Edit the file /etc/audit/auditd.conf. Modify the following line, substituting ACTION appropriately:

    space_left_action = ACTION
    Possible values for ACTION are described in the auditd.conf man page. These include:
    • ignore
    • syslog
    • email
    • exec
    • suspend
    • single
    • halt
    Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.

    Configure auditd admin_space_left Action on Low Disk Spacexccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action CCE-27239-3

    Configure auditd admin_space_left Action on Low Disk Space

    Rule IDxccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27239-3

    references:  AU-1(b), AU-4, AU-5(b), IR-5, 140, 1343,

    The auditd service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting ACTION appropriately:

    admin_space_left_action = ACTION
    Set this value to single to cause the system to switch to single user mode for corrective action. Acceptable values also include suspend and halt. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the auditd.conf man page.

    Configure auditd mail_acct Action on Low Disk Spacexccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct CCE-27241-9

    Configure auditd mail_acct Action on Low Disk Space

    Rule IDxccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-27241-9

    references:  AU-1(b), AU-4, AU-5(a), IR-5, 139, 144

    The auditd service can be configured to send email to a designated account in certain situations. Add or correct the following line in /etc/audit/auditd.conf to ensure that administrators are notified via email for those situations:

    action_mail_acct = root

    Configure auditd to use audispd pluginxccdf_org.ssgproject.content_rule_configure_auditd_audispd CCE-26933-2

    Configure auditd to use audispd plugin

    Rule IDxccdf_org.ssgproject.content_rule_configure_auditd_audispd
    Result
    notselected
    Time2014-11-01T12:08:22
    Severitymedium
    Identifiers and References

    identifiers:  CCE-26933-2

    references:  AU-1(b), AU-3(2), IR-5, 136

    To configure the auditd service to use the audispd plugin, set the active line in /etc/audisp/plugins.d/syslog.conf to yes. Restart the auditdservice:

    $ sudo service auditd restart

    Record attempts to alter time through adjtimexxccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex CCE-26242-8

    Record attempts to alter time through adjtimex

    Rule IDxccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers and References

    identifiers:  CCE-26242-8

    references:  AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), IR-5, 1487, 169

    On a 32-bit system, add the following to /etc/audit/audit.rules:

    # audit_time_rules
    -a always,exit -F arch=b32 -S adjtimex -k audit_time_rules
    On a 64-bit system, add the following to /etc/audit/audit.rules:
    # audit_time_rules
    -a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
    The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
    -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
    -k audit_time_rules

    Record attempts to alter time through settimeofdayxccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday CCE-27203-9

    Record attempts to alter time through settimeofday

    Rule IDxccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday
    Result
    fail
    Time2014-11-01T12:08:22
    Severitylow
    Identifiers a