C2S for Red Hat Enterprise Linux 6

CCE ID | Rule Title | Description | Rationale | Variable Setting | NIST 800-53 Mapping

CCE-26435-8

Ensure /tmp Located On Separate Partition

The `/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.

The `/tmp` partition is used as temporary storage by many programs. Placing `/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.

SC-32

CCE-26499-4

Add nodev Option to /tmp

The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.

The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

CM-7
MP-2

CCE-26762-5

Add nosuid Option to /tmp

The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

CM-7
MP-2

CCE-26720-3

Add noexec Option to /tmp

The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.

Allowing users to execute binaries from world-writable directories such as `/tmp` should never be necessary in normal operation and can expose the system to potential compromise.

CM-7
MP-2

CCE-26639-5

Ensure /var Located On Separate Partition

The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM.

Ensuring that `/var` is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the `/var` directory to contain world-writable directories installed by other software packages.

SC-32

CCE-26582-7

Bind Mount /var/tmp To /tmp

The `/var/tmp` directory is a world-writable directory. Bind-mount it to `/tmp` in order to consolidate temporary storage into one location protected by the same techniques as `/tmp`. To do so, edit `/etc/fstab` and add the following line:

    /tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0

See the `mount(8)` man page for further explanation of bind mounting.

Having multiple locations for temporary storage is not required. Unless absolutely necessary to meet requirements, the storage location `/var/tmp` should be bind mounted to `/tmp` and thus share the same protections.

CM-7

CCE-26215-4 | Ensure /var/log Located On Separate Partition | System logs are stored in the `/var/log` directory. Ensure that it has its own partition or logical volume at installation time, or migrate it using LVM. | Placing `/var/log` in its own partition enables better separation between log files and other files in `/var/`. |  | AU-9 SC-32

CCE-26436-6

Ensure /var/log/audit Located On Separate Partition

Audit logs are stored in the `/var/log/audit` directory. Ensure that it has its own partition or logical volume at installation time, or migrate it later using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.

Placing `/var/log/audit` in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space.

AU-4
AU-9
SC-32

CCE-26557-9

Ensure /home Located On Separate Partition

If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.

Ensuring that `/home` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.

SC-32

CCE-27045-4

Add nodev Option to Non-Root Local Partitions

The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any non-root local partitions.

The `nodev` mount option prevents files from being interpreted as character or block devices. The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails, for which it is not advised to set `nodev` on these filesystems.

CM-7

CCE-26860-7

Add nodev Option to Removable Media Partitions

The `nodev` mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.

The only legitimate location for device files is the `/dev` directory located on the root partition. An exception to this is chroot jails, and it is not advised to set `nodev` on partitions which contain their root filesystems.

AC-19(a)
AC-19(d)
AC-19(e)
CM-7
MP-2

CCE-27196-5

Add noexec Option to Removable Media Partitions

The `noexec` mount option prevents the direct execution of binaries on the mounted filesystem. Preventing the direct execution of binaries from removable media (such as a USB key) provides a defense against malicious software that may be present on such untrusted media. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.

Allowing users to execute binaries from removable media such as USB keys exposes the system to potential compromise.

AC-19(a)
AC-19(d)
AC-19(e)
CM-7
MP-2

CCE-27056-1

Add nosuid Option to Removable Media Partitions

The `nosuid` mount option prevents set-user-identifier (SUID) and set-group-identifier (SGID) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce SUID and SGID files into the system via partitions mounted from removeable media. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of any removable media partitions.

The presence of SUID and SGID executables should be tightly controlled. Allowing users to introduce SUID or SGID binaries from partitions mounted off of removable media would allow them to introduce their own highly-privileged programs.

AC-19(a)
AC-19(d)
AC-19(e)
CM-7
MP-2

CCE-26778-1

Add nodev Option to /dev/shm

The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.

The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

CM-7
MP-2

CCE-26486-1

Add nosuid Option to /dev/shm

The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.

The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

CM-7
MP-2

CCE-26622-1

Add noexec Option to /dev/shm

The `noexec` mount option can be used to prevent binaries from being executed out of `/dev/shm`. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as `/dev/shm`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.

Allowing users to execute binaries from world-writable directories such as `/dev/shm` can expose the system to potential compromise.

CM-7
MP-2

CCE-26840-9

Verify that All World-Writable Directories Have Sticky Bits Set

When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes.
To set the sticky bit on a world-writable directory DIR, run the following command:

    $ sudo chmod +t DIR

Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.
The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as `/tmp`), and for directories requiring global read/write access.

AC-6

CCE-26340-0

Disable Mounting of cramfs

To configure the system to prevent the `cramfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install cramfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26544-7

Disable Mounting of freevxfs

To configure the system to prevent the `freevxfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install freevxfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26670-0

Disable Mounting of jffs2

To configure the system to prevent the `jffs2` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install jffs2 /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26800-3

Disable Mounting of hfs

To configure the system to prevent the `hfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install hfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26361-6

Disable Mounting of hfsplus

To configure the system to prevent the `hfsplus` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install hfsplus /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26404-4

Disable Mounting of squashfs

To configure the system to prevent the `squashfs` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install squashfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26677-5

Disable Mounting of udf

To configure the system to prevent the `udf` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install udf /bin/true

This effectively prevents usage of this uncommon filesystem.

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

CM-7

CCE-26506-6

Ensure Red Hat GPG Key Installed

To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run:

    $ sudo subscription-manager register

If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in `/media/cdrom`, use the following command as the root user to import it into the keyring:

    $ sudo rpm --import /media/cdrom/RPM-GPG-KEY

The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat.

SI-7
MA-1(b)

CCE-26709-6

Ensure gpgcheck Enabled In Main Yum Configuration

The `gpgcheck` option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in `/etc/yum.conf` in the `[main]` section:

    gpgcheck=1

Ensuring the validity of packages' cryptographic signatures prior to installation ensures the authenticity of the software and protects against malicious tampering.

SI-7
MA-1(b)

CCE-26647-8

Ensure gpgcheck Enabled For All Yum Package Repositories

To ensure signature checking is not disabled for any repos, remove any lines from files in `/etc/yum.repos.d` of the form:

    gpgcheck=0

Ensuring all packages' cryptographic signatures are valid prior to installation ensures the authenticity of the software and protects against malicious tampering.

SI-7
MA-1(b)

CCE-26846-6

Disable Red Hat Network Service (rhnsd)

The Red Hat Network service automatically queries Red Hat Network servers to determine whether there are any actions that should be executed, such as package updates. This only occurs if the system was registered to an RHN server or satellite and managed as such. The `rhnsd` service can be disabled with the following command:

    $ sudo chkconfig rhnsd off

Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not desirable for some environments. However, if the system is being managed by RHN or RHN Satellite Server the `rhnsd` daemon can remain on.

CM-7

CCE-26731-0

Verify and Correct File Permissions with RPM

The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. After locating a file with incorrect permissions which can be found with

    $ rpm -Va | grep '^.M'

, run the following command to determine which package owns it:

    $ rpm -qf FILENAME

Next, run the following command to reset its permissions to the correct values:

    $ sudo rpm --setperms PACKAGENAME

Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated.

AC-6
CM-6(d)
SI-7

CCE-27223-7

Verify File Hashes with RPM

The RPM package management system can check the hashes of installed software packages, including many that are important to system security. Run the following command to list which files on the system have hashes that differ from what is expected by the RPM database:

    $ rpm -Va | grep '^..5'

A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:

    $ rpm -qf FILENAME

The package can be reinstalled from a yum repository using the command:

    $ sudo yum reinstall PACKAGENAME

Alternatively, the package can be reinstalled from trusted media using the command:

    $ sudo rpm -Uvh PACKAGENAME

The hashes of important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system.

CM-6(d)
SI-7

CCE-27024-9

Install AIDE

Install the AIDE package with the command:

    $ sudo yum install aide

The AIDE package must be installed if it is to be available for integrity checking.

CM-3(d)
CM-3(e)
CM-6(d)
SC-28
SI-7

CCE-27221-1

Disable Prelinking

The prelinking feature changes binaries in an attempt to decrease their startup time. In order to disable it, change or add the following line inside the file `/etc/sysconfig/prelink`:

    PRELINKING=no

Next, run the following command to return binaries to a normal, non-prelinked state:

    $ sudo /usr/sbin/prelink -ua

Because the prelinking feature changes binaries, it can interfere with the operation of certain software and/or modes such as AIDE, FIPS, etc.

CM-6(d)
SC-28
SI-7

CCE-27135-3

Build and Test AIDE Database

Run the following command to generate a new database:

    $ sudo /usr/sbin/aide --init

By default, the database will be written to the file `/var/lib/aide/aide.db.new.gz`. Storing the database, the configuration file `/etc/aide.conf`, and the binary `/usr/sbin/aide` (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:

    $ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

To initiate a manual check, run the following command:

    $ sudo /usr/sbin/aide --check

If this check produces any unexpected output, investigate.

For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.

CM-3(d)
CM-3(e)
CM-6(d)
SC-28
SI-7

CCE-27222-9

Configure Periodic Execution of AIDE

To implement a daily execution of AIDE at 4:05am using cron, add the following line to `/etc/crontab`:

    05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files.

CM-3(d)
CM-3(e)
CM-6(d)
SC-28
SI-7

CCE-26956-3

Ensure SELinux Not Disabled in /etc/grub.conf

SELinux can be disabled at boot time by an argument in `/etc/grub.conf`. Remove any instances of `selinux=0` from the kernel arguments in that file to prevent SELinux from being disabled at boot.

Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation.

AC-3
AC-3(3)
AC-6
AU-9

CCE-26969-6

Ensure SELinux State is Enforcing

The SELinux state should be set to `` at system boot time. In the file `/etc/selinux/config`, add or correct the following line to configure the system to boot into enforcing mode:

    SELINUX=

Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges.

AC-3
AC-3(3)
AC-4
AC-6
AU-9

CCE-26875-5

Configure SELinux Policy

The SELinux `targeted` policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct the following line in `/etc/selinux/config`:

    SELINUXTYPE=

Other policies, such as `mls`, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.

Setting the SELinux policy to `targeted` or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services. Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in `permissive` mode. In such temporary cases, SELinux policies should be developed, and once work is completed, the system should be reconfigured to ``.

AC-3
AC-3(3)
AC-4
AC-6
AU-9

CCE-27421-7

Uninstall setroubleshoot Package

The SETroubleshoot service notifies desktop users of SELinux denials. The service provides information around configuration errors, unauthorized intrusions, and other potential errors. The `setroubleshoot` package can be removed with the following command:

    $ sudo yum erase setroubleshoot

The SETroubleshoot service is an unnecessary daemon to have running on a server

CCE-27404-3

Uninstall mcstrans Package

The `mcstransd` daemon provides category label information to client processes requesting information. The label translations are defined in `/etc/selinux/targeted/setrans.conf`. The `mcstrans` package can be removed with the following command:

    $ sudo yum erase mcstrans

Since this service is not used very often, disable it to reduce the amount of potentially vulnerable code running on the system. NOTE: This rule was added in support of the CIS RHEL6 v1.2.0 benchmark. Please note that Red Hat does not feel this rule is security relevant.

CCE-27111-4

Ensure No Daemons are Unconfined by SELinux

Daemons for which the SELinux policy does not contain rules will inherit the context of the parent process. Because daemons are launched during startup and descend from the `init` process, they inherit the `initrc_t` context.
To check for unconfined daemons, run the following command:

    $ sudo ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'

It should produce no output in a well-configured system.

Daemons which run with the `initrc_t` context may cause AVC denials, or allow privileges that the daemon does not require.

AC-6
AU-9
CM-7

CCE-26995-1

Verify /etc/grub.conf User Ownership

The file `/etc/grub.conf` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `/etc/grub.conf`, run the command:

    $ sudo chown root /etc/grub.conf

Only root should be able to modify important boot parameters.

AC-6(7)

CCE-27022-3

Verify /etc/grub.conf Group Ownership

The file `/etc/grub.conf` should be group-owned by the `root` group to prevent destruction or modification of the file. To properly set the group owner of `/etc/grub.conf`, run the command:

    $ sudo chgrp root /etc/grub.conf

The `root` group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.

AC-6(7)

CCE-26949-8

Verify /boot/grub/grub.conf Permissions

File permissions for `/boot/grub/grub.conf` should be set to 600, which is the default. To properly set the permissions of `/boot/grub/grub.conf`, run the command:

    $ sudo chmod 600 /boot/grub/grub.conf

Proper permissions ensure that only the root user can modify important boot parameters.

AC-6(7)

CCE-26911-8

Set Boot Loader Password

The grub boot loader should have password protection enabled to protect boot-time settings. To do so, select a password and then generate a hash from it by running the following command:

    $ grub-crypt --sha-512

When prompted to enter a password, insert the following line into `/etc/grub.conf` immediately after the header comments. (Use the output from `grub-crypt` as the value of password-hash):

    password --encrypted password-hash

NOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password.

Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.

IA-2(1)
IA-5(e) AC-3

CCE-27040-5

Require Authentication for Single User Mode

Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected.
To require entry of the root password even if the system is started in single-user mode, add or correct the following line in the file `/etc/sysconfig/init`:

    SINGLE=/sbin/sulogin

This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.

IA-2(1)
AC-3

CCE-27043-9

Disable Interactive Boot

To disable the ability for users to perform interactive startups, perform both of the following:

1. Edit the file `/etc/sysconfig/init`. Add or correct the line:

       PROMPT=no

2. Inspect the kernel boot arguments (which follow the word `kernel`) in `/etc/grub.conf` and ensure the `confirm` argument is not present.

Both the `PROMPT` option of the `/etc/sysconfig/init` file and the `confirm` kernel boot argument of the `/etc/grub.conf` file allow the console user to perform an interactive system startup, in which it is possible to select the set of services which are started on boot.

Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security.

SC-2
AC-3

CCE-27033-0

Disable Core Dumps for All Users

To disable core dumps for all users, add the following line to `/etc/security/limits.conf`:

    *     hard   core    0

A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

SC-5

CCE-27044-7

Disable Core Dumps for SUID programs

To set the runtime status of the `fs.suid_dumpable` kernel parameter, run the following command:

    $ sudo sysctl -w fs.suid_dumpable=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    fs.suid_dumpable = 0

The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data.

SI-11

CCE-27007-4

Enable ExecShield

To set the runtime status of the `kernel.exec-shield` kernel parameter, run the following command:

    $ sudo sysctl -w kernel.exec-shield=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    kernel.exec-shield = 1

ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range.

SC-39

CCE-26999-3

Enable Randomized Layout of Virtual Address Space

To set the runtime status of the `kernel.randomize_va_space` kernel parameter, run the following command:

    $ sudo sysctl -w kernel.randomize_va_space=2

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    kernel.randomize_va_space = 2

Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.

SC-30(2)

CCE-27073-6

Uninstall telnet-server Package

The `telnet-server` package can be uninstalled with the following command:

    $ sudo yum erase telnet-server

Removing the `telnet-server` package decreases the risk of the telnet service's accidental (or intentional) activation.

CM-7

CCE-27428-2

Remove telnet Clients

The telnet client allows users to start connections to other systems via the telnet protocol.

The `telnet` protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The `ssh` package provides an encrypted session and stronger security and is included in Red Hat Enterprise Linux.

CCE-27062-9

Uninstall rsh-server Package

The `rsh-server` package can be uninstalled with the following command:

    $ sudo yum erase rsh-server

The `rsh-server` package provides several obsolete and insecure network services. Removing it decreases the risk of those services' accidental (or intentional) activation.

CM-7

CCE-27359-9

Uninstal rsh Package

The `rsh` package contains the client commands for the rsh services

These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the `rsh` package removes the clients for `rsh`,`rcp`, and `rlogin`.

CCE-27372-2

Remove NIS Client

The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client (`ypbind`) was used to bind a system to an NIS server and receive the distributed configuration files.

The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed.

CCE-27079-3

Uninstall ypserv Package

The `ypserv` package can be uninstalled with the following command:

    $ sudo yum erase ypserv

Removing the `ypserv` package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.

CM-7

CCE-27448-0

Remove tftp

Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between systems. TFTP does not support authentication and can be easily hacked. The package `tftp` is a client program that allows for connections to a `tftp` server.

It is recommended that TFTP be remvoed, unless there is a specific need for TFTP (such as a boot server). In that case, use extreme caution when configuring the services.

CCE-26946-4

Uninstall tftp-server Package

The `tftp-server` package can be removed with the following command:

    $ sudo yum erase tftp-server

Removing the `tftp-server` package decreases the risk of the accidental (or intentional) activation of tftp services.

CM-7

CCE-27373-0

Uninstall talk Package

The `talk` package contains the client program for the Internet talk protocol, which allows the user to chat with other users on different systems. Talk is a communication program which copies lines from one terminal to the terminal of another user.

The talk software presents a security risk as it uses unencrypted protocols for communications. Removing the `talk` package decreases the risk of the accidental (or intentional) activation of talk client program.

CCE-27427-4

Uninstall talk-server Package

The `talk-server` package can be removed with the following command:

    $ sudo yum erase talk-server

The talk software presents a security risk as it uses unencrypted protocols for communications. Removing the `talk-server` package decreases the risk of the accidental (or intentional) activation of talk services.

CCE-27005-8

Uninstall xinetd Package

The `xinetd` package can be uninstalled with the following command:

    $ sudo yum erase xinetd

Removing the `xinetd` package decreases the risk of the xinetd service's accidental (or intentional) activation.

CM-7

CCE-27031-4

Set Daemon Umask

The file `/etc/init.d/functions` includes initialization parameters for most or all daemons started at boot time. The default umask of 022 prevents creation of group- or world-writable files. To set the default umask for daemons, edit the following line, inserting 022 or 027 for umask appropriately:

    umask

Setting the umask to too restrictive a setting can cause serious errors at runtime. Many daemons on the system already individually restrict themselves to a umask of 077 in their own init scripts.

The umask influences the permissions assigned to files created by a process at run time. An unnecessarily permissive umask could result in files being created with insecure permissions.

AC-6

CCE-27198-1

Remove the X Windows Package Group

Removing all packages which constitute the X Window System ensures users or malicious software cannot start X. To do so, run the following command:

    $ sudo yum groupremove "X Window System"

Unnecessary packages should not be installed to decrease the attack surface of the system.

CCE-27087-6

Disable Avahi Server Software

The `avahi-daemon` service can be disabled with the following command:

    $ sudo chkconfig avahi-daemon off

Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted.

CM-7

CCE-26899-5

Disable the CUPS Service

The `cups` service can be disabled with the following command:

    $ sudo chkconfig cups off

Turn off unneeded services to reduce attack surface.

CM-7

CCE-27120-5

Uninstall DHCP Server Package

If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The `dhcp` package can be removed with the following command:

    $ sudo yum erase dhcp

Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.

CM-7

CCE-27093-4

Enable the NTP Daemon

The `ntpd` service can be enabled with the following command:

    $ sudo chkconfig --level 2345 ntpd on

Enabling the `ntpd` service ensures that the `ntpd` service will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches.
The NTP daemon offers all of the functionality of `ntpdate`, which is now deprecated. Additional information on this is available at http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate

AU-8(1)

CCE-27098-3

Specify a Remote NTP Server

To specify a remote NTP server for time synchronization, edit the file `/etc/ntp.conf`. Add or correct the following lines, substituting the IP or hostname of a remote NTP server for ntpserver:

    server ntpserver

This instructs the NTP software to contact that remote server to obtain time data.

Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with real time events.

AU-8(1)

CCE-26958-9

Specify Additional Remote NTP Servers

Additional NTP servers can be specified for time synchronization in the file `/etc/ntp.conf`. To do so, add additional lines of the following form, substituting the IP address or hostname of a remote NTP server for ntpserver:

    server ntpserver

Specifying additional NTP servers increases the availability of accurate time data, in the event that one of the specified servers becomes unavailable. This is typical for a system acting as an NTP server for other systems.

AU-8(1)

CCE-26858-1

Uninstall openldap-servers Package

The `openldap-servers` package should be removed if not in use. Is this system the OpenLDAP server? If not, remove the package.

    $ sudo yum erase openldap-servers

The openldap-servers RPM is not installed by default on Red Hat Enterprise Linux 6 systems. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed.

The `openldap-servers` package is not installed by default on RHEL6 systems. It is needed only by the OpenLDAP server system, not clients which use LDAP for authentication. If the system is not intended for use as an LDAP server, `openldap-servers` should be removed.

CM-7

CCE-27104-9

Disable Network File System Lock Service (nfslock)

The Network File System Lock (nfslock) service starts the required remote procedure call (RPC) processes which allow clients to lock files on the server. If the local system is not configured to mount NFS filesystems then this service should be disabled. The `nfslock` service can be disabled with the following command:

    $ sudo chkconfig nfslock off

CCE-26864-9

Disable Secure RPC Client Service (rpcgssd)

The rpcgssd service manages RPCSEC GSS contexts required to secure protocols that use RPC (most often Kerberos and NFS). The rpcgssd service is the client-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled. The `rpcgssd` service can be disabled with the following command:

    $ sudo chkconfig rpcgssd off

CCE-26870-6

Disable RPC ID Mapping Service (rpcidmapd)

The rpcidmapd service is used to map user names and groups to UID and GID numbers on NFSv4 mounts. If NFS is not in use on the local system then this service should be disabled. The `rpcidmapd` service can be disabled with the following command:

    $ sudo chkconfig rpcidmapd off

CCE-27122-1

Disable Secure RPC Server Service (rpcsvcgssd)

The rpcsvcgssd service manages RPCSEC GSS contexts required to secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd service is the server-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled. The `rpcsvcgssd` service can be disabled with the following command:

    $ sudo chkconfig rpcsvcgssd off

Unnecessary services should be disabled to decrease the attack surface of the system.

CCE-27430-8

Disable RPC Bind service (rpcbind)

The rpcbind utility is a server that converts RPC program numbers into universal addresses. If RPC calls are not made to servers on the local system then this service should be disabled. The `rpcbind` service can be disabled with the following command:

    $ sudo chkconfig rpcbind off

CCE-27030-6

Uninstall bind Package

To remove the `bind` package, which contains the `named` service, run the following command:

    $ sudo yum erase bind

If there is no need to make DNS server software available, removing it provides a safeguard against its activation.

CM-7

CCE-26687-4

Uninstall vsftpd Package

The `vsftpd` package can be removed with the following command:

    $ sudo yum erase vsftpd

Removing the vsftpd package decreases the risk of its accidental activation.

CM-7

CCE-27133-8

Uninstall httpd Package

The `httpd` package can be removed with the following command:

    $ sudo yum erase httpd

If there is no need to make the web server software available, removing it provides a safeguard against its activation.

CM-7

CCE-27039-7

Uninstall dovecot Package

The `dovecot` package can be uninstalled with the following command:

    $ sudo yum erase dovecot

If there is no need to make the Dovecot software available, removing it provides a safeguard against its activation.

CCE-27102-3

Uninstall samba Package

The `samba` package can be removed with the following command:

    $ sudo yum erase samba

If there is no need to mount directories and file systems to Windows systems, then this service can be deleted to reduce the potential attack surface.

CCE-26977-9

Uninstall squid Package

The `squid` package can be removed with the following command:

    $ sudo yum erase squid

If there is no need to make the proxy server software available, removing it provides a safeguard against its activation.

CCE-26332-7

Uninstall net-snmp Package

The `net-snmp` package provides the snmpd service. The `net-snmp` package can be removed with the following command:

    $ sudo yum erase net-snmp

If there is no need to run SNMP server software, removing the package provides a safeguard against its activation.

CCE-26780-7

Disable Postfix Network Listening

Edit the file `/etc/postfix/main.cf` to ensure that only the following `inet_interfaces` line appears:

    inet_interfaces = localhost

This ensures `postfix` accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack.

CM-7

CCE-26866-4

Disable Kernel Parameter for IP Forwarding

To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.ip_forward=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.ip_forward = 0

IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.

CM-7
SC-5

CCE-27001-7

Disable Kernel Parameter for Sending ICMP Redirects by Default

To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.default.send_redirects = 0

Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for systems acting as routers.

AC-4
CM-7
SC-5
SC-7

CCE-27004-1

Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces

To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.all.send_redirects = 0

Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for systems acting as routers.

CM-7
SC-5(1)

CCE-27037-1

Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces

To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.all.accept_source_route = 0

Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

CM-7
SC-5

CCE-26983-7

Configure Kernel Parameter for Accepting Source-Routed Packets By Default

To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.default.accept_source_route = 0

Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

AC-4
CM-7
SC-5
SC-7

CCE-27027-2

Configure Kernel Parameter for Accepting ICMP Redirects for All Interfaces

To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.all.accept_redirects = 0

Accepting ICMP redirects has few legitimate uses. It should be disabled unless it is absolutely required.

CM-7
SC-5

CCE-27015-7

Configure Kernel Parameter for Accepting ICMP Redirects By Default

To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.default.accept_redirects = 0

This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

AC-4
CM-7
SC-5
SC-7

CCE-26854-0

Configure Kernel Parameter for Accepting Secure Redirects for All Interfaces

To set the runtime status of the `net.ipv4.conf.all.secure_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.all.secure_redirects = 0

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

AC-4
CM-7
SC-5

CCE-26831-8

Configure Kernel Parameter for Accepting Secure Redirects By Default

To set the runtime status of the `net.ipv4.conf.default.secure_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.default.secure_redirects = 0

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

AC-4
CM-7
SC-5
SC-7

CCE-27066-0

Configure Kernel Parameter to Log Martian Packets

To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.all.log_martians=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.all.log_martians = 1

The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

AC-3(10)
CM-7
SC-5(3)

CCE-26883-9

Configure Kernel Parameter to Ignore ICMP Broadcast Echo Requests

To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.icmp_echo_ignore_broadcasts = 1

Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

CM-7
SC-5

CCE-26993-6

Configure Kernel Parameter to Ignore Bogus ICMP Error Responses

To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.icmp_ignore_bogus_error_responses = 1

Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.

CM-7
SC-5

CCE-26979-5

Configure Kernel Parameter to Use Reverse Path Filtering for All Interfaces

To set the runtime status of the `net.ipv4.conf.all.rp_filter` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.all.rp_filter = 1

Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.

AC-4
SC-5
SC-7

CCE-26915-9

Configure Kernel Parameter to Use Reverse Path Filtering by Default

To set the runtime status of the `net.ipv4.conf.default.rp_filter` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.conf.default.rp_filter = 1

Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.

AC-4
SC-5
SC-7

CCE-27053-8

Configure Kernel Parameter to Use TCP Syncookies

To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv4.tcp_syncookies=1

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv4.tcp_syncookies = 1

A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.

AC-4
SC-5(2)
SC-5(3)

CCE-26878-9

Disable WiFi or Bluetooth in BIOS

Some systems that include built-in wireless support offer the ability to disable the device through the BIOS. This is system-specific; consult your hardware manual or explore the BIOS setup during boot.

Disabling wireless support in the BIOS prevents easy activation of the wireless interface, generally requiring administrators to reboot the system first.

AC-18(a)
AC-18(d)
AC-18(3)
CM-7

CCE-27057-9

Deactivate Wireless Network Interfaces

Deactivating wireless network interfaces should prevent normal usage of the wireless capability.
First, identify the interfaces available with the command:

    $ ifconfig -a

Additionally, the following command may be used to determine whether wireless support is included for a particular interface, though this may not always be a clear indicator:

    $ iwconfig

After identifying any wireless interfaces (which may have names like `wlan0`, `ath0`, `wifi0`, `em1` or `eth0`), deactivate the interface with the command:

    $ sudo ifdown interface

These changes will only last until the next reboot. To disable the interface for future boots, remove the appropriate interface file from `/etc/sysconfig/network-scripts`:

    $ sudo rm /etc/sysconfig/network-scripts/ifcfg-interface

The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.

AC-18(a)
AC-18(d)
AC-18(3)
CM-7

CCE-27164-3

Configure Accepting IPv6 Router Advertisements

To set the runtime status of the `net.ipv6.conf.default.accept_ra` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv6.conf.default.accept_ra = 0

An illicit router advertisement message could result in a man-in-the-middle attack.

CM-7

CCE-27166-8

Configure Accepting IPv6 Redirects By Default

To set the runtime status of the `net.ipv6.conf.default.accept_redirects` kernel parameter, run the following command:

    $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0

If this is not the system's default value, add the following line to `/etc/sysctl.conf`:

    net.ipv6.conf.default.accept_redirects = 0

An illicit ICMP redirect message could result in a man-in-the-middle attack.

CM-7

CCE-27161-9

Disable Interface Usage of IPv6

To disable interface usage of IPv6, add or correct the following lines in `/etc/sysconfig/network`:

    NETWORKING_IPV6=no
    IPV6INIT=no

CCE-26448-1

Disable DCCP Support

The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the `dccp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install dccp /bin/true

Disabling DCCP protects the system against exploitation of any flaws in its implementation.

CM-7

CCE-26410-1

Disable SCTP Support

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the `sctp` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install sctp /bin/true

Disabling SCTP protects the system against exploitation of any flaws in its implementation.

CM-7

CCE-26239-4

Disable RDS Support

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high- bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the `rds` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install rds /bin/true

Disabling RDS protects the system against exploitation of any flaws in its implementation.

CM-7

CCE-26696-5

Disable TIPC Support

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the `tipc` kernel module from being loaded, add the following line to a file in the directory `/etc/modprobe.d`:

    install tipc /bin/true

Disabling TIPC protects the system against exploitation of any flaws in its implementation.

CM-7

CCE-27018-1

Verify iptables Enabled

The `iptables` service can be enabled with the following command:

    $ sudo chkconfig --level 2345 iptables on

The `iptables` service provides the system's host-based firewalling capability for IPv4 and ICMP.

AC-4
CA-3(c)
CM-7

CCE-27006-6

Verify ip6tables Enabled if Using IPv6

The `ip6tables` service can be enabled with the following command:

    $ sudo chkconfig --level 2345 ip6tables on

The `ip6tables` service provides the system's host-based firewalling capability for IPv6 and ICMPv6.

AC-4
CA-3(c)
CM-7

CCE-26809-4

Ensure rsyslog is Installed

Rsyslog is installed by default. The `rsyslog` package can be installed with the following command:

    $ sudo yum install rsyslog

The rsyslog package provides the rsyslog daemon, which provides system logging services.

AU-9(2)

CCE-26807-8

Enable rsyslog Service

The `rsyslog` service provides syslog-style logging by default on Red Hat Enterprise Linux 6. The `rsyslog` service can be enabled with the following command:

    $ sudo chkconfig --level 2345 rsyslog on

The `rsyslog` service must be running in order to provide logging services, which are essential to system administration.

AU-12

CCE-27190-8

Ensure System Log Files Have Correct Permissions

The file permissions for all log files written by `rsyslog` should be set to 600, or more restrictive. These log files are determined by the second part of each Rule line in `/etc/rsyslog.conf` and typically all appear in `/var/log`. For each log file LOGFILE referenced in `/etc/rsyslog.conf`, run the following command to inspect the file's permissions:

    $ ls -l LOGFILE

If the permissions are not 600 or more restrictive, run the following command to correct this:

    $ sudo chmod 0600 LOGFILE

Log files can contain valuable information regarding system configuration. If the system log files are not protected unauthorized users could change the logged data, eliminating their forensic value.

SI-11

CCE-26801-1

Ensure Logs Sent To Remote Host

To configure rsyslog to send logs to a remote log server, open `/etc/rsyslog.conf` and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting `loghost.example.com` appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:

    *.* @loghost.example.com

To use TCP for log message delivery:

    *.* @@loghost.example.com

To use RELP for log message delivery:

    *.* :omrelp:loghost.example.com

A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise.

AU-3(2)
AU-9

CCE-26803-7

Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server

The `rsyslog` daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the network, ensure the following lines are not found in `/etc/rsyslog.conf`:

    $ModLoad imtcp
    $InputTCPServerRun port
    $ModLoad imudp
    $UDPServerRun port
    $ModLoad imrelp
    $InputRELPServerRun port

Any process which receives messages from the network incurs some risk of receiving malicious messages. This risk can be eliminated for rsyslog by configuring it not to listen on the network.

AU-9(2)
AC-4

CCE-27550-3

Configure auditd Max Log File Size

Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting the correct value of for STOREMB:

    max_log_file = STOREMB

Set the value to `6` (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.

The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained.

AU-1(b)
AU-11
IR-5

CCE-27238-5

Configure auditd space_left Action on Low Disk Space

The `auditd` service can be configured to take an action when disk space starts to run low. Edit the file `/etc/audit/auditd.conf`. Modify the following line, substituting ACTION appropriately:

    space_left_action = ACTION

Possible values for ACTION are described in the `auditd.conf` man page. These include:

- `ignore`
- `syslog`
- `email`
- `exec`
- `suspend`
- `single`
- `halt`

Set this to `email` (instead of the default, which is `suspend`) as it is more likely to get prompt attention. Acceptable values also include `suspend`, `single`, and `halt`.

Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

AU-1(b)
AU-4
AU-5(b)
IR-5

CCE-27241-9

Configure auditd mail_acct Action on Low Disk Space

The `auditd` service can be configured to send email to a designated account in certain situations. Add or correct the following line in `/etc/audit/auditd.conf` to ensure that administrators are notified via email for those situations:

    action_mail_acct =

Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.

AU-1(b)
AU-4
AU-5(a)
IR-5

CCE-27239-3

Configure auditd admin_space_left Action on Low Disk Space

The `auditd` service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file `/etc/audit/auditd.conf`. Add or modify the following line, substituting ACTION appropriately:

    admin_space_left_action = ACTION

Set this value to `single` to cause the system to switch to single-user mode for corrective action. Acceptable values also include `suspend` and `halt`. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the `auditd.conf` man page.

Administrators should be made aware of an inability to record audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur.

AU-1(b)
AU-4
AU-5(b)
IR-5

CCE-27237-7

Configure auditd max_log_file_action Upon Reaching Maximum Log Size

The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by `auditd`, add or correct the line in `/etc/audit/auditd.conf`:

    max_log_file_action = ACTION

Possible values for ACTION are described in the `auditd.conf` man page. These include:

- `ignore`
- `syslog`
- `suspend`
- `rotate`
- `keep_logs`

Set the `ACTION` to `rotate` to ensure log rotation occurs. This is the default. The setting is case-insensitive.

Automatically rotating logs (by setting this to `rotate`) minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, `keep_logs` can be employed.

AU-1(b)
AU-4
AU-11
IR-5

CCE-27058-7

Enable auditd Service

The `auditd` service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The `auditd` service can be enabled with the following command:

    $ sudo chkconfig --level 2345 auditd on

Ensuring the `auditd` service is active ensures audit records generated by the kernel can be written to disk, or that appropriate actions will be taken if other obstacles exist.

AC-17(1)
AU-1(b)
AU-10
AU-12(a)
AU-12(c)
IR-5

CCE-26785-6

Enable Auditing for Processes Which Start Prior to the Audit Daemon

To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument `audit=1` to the kernel line in `/etc/grub.conf`, in the manner below:

    kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1

Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although `auditd` takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.

AC-17(1)
AU-14(1)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-10
IR-5

CCE-26242-8

Record attempts to alter time through adjtimex

On a 32-bit system, add the following to `/etc/audit/audit.rules`:

    # audit_time_rules
    -a always,exit -F arch=b32 -S adjtimex -k audit_time_rules

On a 64-bit system, add the following to `/etc/audit/audit.rules`:

    # audit_time_rules
    -a always,exit -F arch=b64 -S adjtimex -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

    -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-27203-9

Record attempts to alter time through settimeofday

On a 32-bit system, add the following to `/etc/audit/audit.rules`:

    # audit_time_rules
    -a always,exit -F arch=b32 -S settimeofday -k audit_time_rules

On a 64-bit system, add the following to `/etc/audit/audit.rules`:

    # audit_time_rules
    -a always,exit -F arch=b64 -S settimeofday -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

    -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-27169-2

Record Attempts to Alter Time Through stime

Add the following line to `/etc/audit/audit.rules` for both 32-bit and 64-bit systems:

    # audit_time_rules
    -a always,exit -F arch=b32 -S stime -k audit_time_rules

Since the 64-bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64-bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32-bit and 64-bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

    -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-27172-6

Record Attempts to Alter the localtime File

Add the following to `/etc/audit/audit.rules`:

    -w /etc/localtime -p wa -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used.

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26664-3

Record Events that Modify User/Group Information

Add the following to `/etc/audit/audit.rules`, in order to capture events that modify account changes:

    # audit_rules_usergroup_modification
    -w /etc/group -p wa -k audit_rules_usergroup_modification
    -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

AC-2(4)
AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26648-6

Record Events that Modify the System's Network Environment

Add the following to `/etc/audit/audit.rules`, setting ARCH to either b32 or b64 as appropriate for your system:

    # audit_rules_networkconfig_modification
    -a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
    -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26657-7

Record Events that Modify the System's Mandatory Access Controls

Add the following to `/etc/audit/audit.rules`:

    -w /etc/selinux/ -p wa -k MAC-policy

The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26691-6

Record Attempts to Alter Login and Logout Events

The audit system already collects login info for all users and root. To watch for attempted manual edits of files involved in storing login events, add the following to `/etc/audit/audit.rules`:

    -w /var/log/tallylog -p wa -k logins
    -w /var/run/faillock/ -p wa -k logins
    -w /var/log/lastlog -p wa -k logins

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

AC-3(10)
AU-1(b)
AU-12(a)
AU-12(c)
IR-5

CCE-26610-6

Record Attempts to Alter Process and Session Initiation Information

The audit system already collects process information for all users and root. To watch for attempted manual edits of files involved in storing such process information, add the following to `/etc/audit/audit.rules`:

    -w /var/run/utmp -p wa -k session
    -w /var/log/btmp -p wa -k session
    -w /var/log/wtmp -p wa -k session

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26712-0

Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)

At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to `/etc/audit/audit.rules`:

    -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
    -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access

If the system is 64 bit then also add the following:

    -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
    -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26457-2

Ensure auditd Collects Information on the Use of Privileged Commands

At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition PART:

    $ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null

Then, for each setuid / setgid program on the system, add a line of the following form to `/etc/audit/audit.rules`, where SETUID_PROG_PATH is the full path to each setuid / setgid program in the list:

    -a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

AC-3(10))
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AC-6(9)
AU-12(a)
AU-12(c)
IR-5

CCE-26573-6

Ensure auditd Collects Information on Exporting to Media (successful)

At a minimum the audit system should collect media exportation events for all users and root. Add the following to `/etc/audit/audit.rules`, setting ARCH to either b32 or b64 as appropriate for your system:

    -a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k export

The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26651-0

Ensure auditd Collects File Deletion Events by User

At a minimum the audit system should collect file deletion events for all users and root. Add the following to `/etc/audit/audit.rules`, setting ARCH to either b32 or b64 as appropriate for your system:

    -a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26662-7

Ensure auditd Collects System Administrator Actions

At a minimum the audit system should collect administrator actions for all users and root. Add the following to `/etc/audit/audit.rules`:

    -w /etc/sudoers -p wa -k actions

The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.

AC-2(7)(b)
AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26611-4

Ensure auditd Collects Information on Kernel Module Loading and Unloading

Add the following to `/etc/audit/audit.rules` in order to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:

    -w /sbin/insmod -p x -k modules
    -w /sbin/rmmod -p x -k modules
    -w /sbin/modprobe -p x -k modules
    -a always,exit -F arch=ARCH -S init_module -S delete_module -k modules

The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.

AC-3(10)
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
AU-12(a)
AU-12(c)
IR-5

CCE-26612-2

Make the auditd Configuration Immutable

Add the following to `/etc/audit/audit.rules` in order to make the configuration immutable:

    -e 2

With this setting, a reboot will be required to change any audit rules.

Making the audit configuration immutable prevents accidental as well as malicious modification of the audit rules, although it may be problematic if legitimate changes are needed during system operation

AC-6
AU-1(b)
AU-2(a)
AU-2(c)
AU-2(d)
IR-5

CCE-27014-0

Ensure Logrotate Runs Periodically

The `logrotate` utility allows for the automatic rotation of log files. The frequency of rotation is specified in `/etc/logrotate.conf`, which triggers a cron task. To configure logrotate to run daily, add or correct the following line in `/etc/logrotate.conf`:

    # rotate log files frequency
    daily

Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.

AU-9

CCE-27070-2

Enable cron Service

The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `crond` service can be enabled with the following command:

    $ sudo chkconfig --level 2345 crond on

Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.

CM-7

CCE-27249-2

Disable At Service (atd)

The `at` and `batch` commands can be used to schedule tasks that are meant to be executed only once. This allows delayed execution in a manner similar to cron, except that it is not recurring. The daemon `atd` keeps track of tasks scheduled via `at` and `batch`, and executes them at the specified time. The `atd` service can be disabled with the following command:

    $ sudo chkconfig atd off

The `atd` service could be used by an unsophisticated insider to carry out activities outside of a normal login session, which could complicate accountability. Furthermore, the need to schedule tasks with `at` or `batch` is not common.

CM-7

CCE-27072-8

Allow Only SSH Protocol 2

Only SSH protocol version 2 connections should be permitted. The default setting in `/etc/ssh/sshd_config` is correct, and can be verified by ensuring that the following line appears:

    Protocol 2

SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used.

AC-3(10)
IA-5(1)(c)

CCE-27124-7

Disable SSH Support for .rhosts Files

SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via `.rhosts` files.
To ensure this behavior is disabled, add or correct the following line in `/etc/ssh/sshd_config`:

    IgnoreRhosts yes

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

AC-3

CCE-27091-8

Disable Host-Based Authentication

SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization.
To disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config`:

    HostbasedAuthentication no

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

AC-3

CCE-27100-7

Disable SSH Root Login

The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in `/etc/ssh/sshd_config`:

    PermitRootLogin no

Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.

AC-3
AC-6(2)
IA-2(1)

CCE-26887-0

Disable SSH Access via Empty Passwords

To explicitly disallow remote login from accounts with empty passwords, add or correct the following line in `/etc/ssh/sshd_config`:

    PermitEmptyPasswords no

Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

AC-3

CCE-26555-3

Use Only Approved Ciphers

Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in `/etc/ssh/sshd_config` demonstrates use of FIPS-approved ciphers:

    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The man page `sshd_config(5)` contains a list of supported ciphers.

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

AC-3
AC-17(2)
SI-7
IA-5(1)(c)
IA-7

CCE-26919-1

Set SSH Idle Timeout Interval

SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out.
To set an idle timeout interval, edit the following line in `/etc/ssh/sshd_config` as follows:

    ClientAliveInterval

The timeout interval is given in seconds. To have a timeout of 15 minutes, set interval to 900.
If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made here. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.

Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another.

AC-2(5)
SA-8

CCE-27556-0

Limit Users' SSH Access

By default, the SSH configuration allows any user with an account to access the system. In order to specify the users that are allowed to login via SSH and deny all other users, add or correct the following line in the `/etc/ssh/sshd_config` file:

    DenyUsers USER1 USER2

Where `USER1` and `USER2` are valid user names.

Specifying which accounts are allowed SSH access into the system reduces the possibility of unauthorized access to the system.

AC-3

CCE-27112-2

Enable SSH Warning Banner

To enable the warning banner and ensure it is consistent across the system, add or correct the following line in `/etc/ssh/sshd_config`:

    Banner /etc/issue

Another section contains information on how to create an appropriate system-wide warning banner.

The warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.

AC-8(a)

CCE-26844-1

Set Deny For Failed Password Attempts

To configure the system to lock out accounts after a number of incorrect login attempts using `pam_faillock.so`, modify the content of both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` as follows:

- Add the following line immediately `before` the `pam_unix.so` statement in the `AUTH` section:

      auth required pam_faillock.so preauth silent deny= unlock_time= fail_interval=

- Add the following line immediately `after` the `pam_unix.so` statement in the `AUTH` section:

      auth [default=die] pam_faillock.so authfail deny= unlock_time= fail_interval=

- Add the following line immediately `before` the `pam_unix.so` statement in the `ACCOUNT` section:

      account required pam_faillock.so

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks.

AC-7(a)

CCE-26741-9

Limit Password Reuse

Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_unix` or `pam_pwhistory` PAM modules. In the file `/etc/pam.d/system-auth`, append `remember=` to the line which refers to the `pam_unix.so` or `pam_pwhistory.so`module, as shown below:

- for the `pam_unix.so` case:

      password sufficient pam_unix.so existing_options remember=

- for the `pam_pwhistory.so` case:

      password requisite pam_pwhistory.so existing_options remember=

The DoD STIG requirement is 5 passwords.

Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.

IA-5(f)
IA-5(1)(e)

CCE-26891-2

Direct root Logins Not Allowed

To further limit access to the `root` account, administrators can disable root logins at the console by editing the `/etc/securetty` file. This file lists all devices the root user is allowed to login to. If the file does not exist at all, the root user can login through any communication device on the system, whether via the console or via a raw network interface. This is dangerous as user can login to his machine as root via Telnet, which sends the password in plain text over the network. By default, Red Hat Enteprise Linux's `/etc/securetty` file only allows the root user to login at the console physically attached to the machine. To prevent root from logging in, remove the contents of this file. To prevent direct root logins, remove the contents of this file by typing the following command:

    $ sudo echo > /etc/securetty

Disabling direct root logins ensures proper accountability and multifactor authentication to privileged accounts. Users will first login, then escalate to privileged (root) access via su / sudo. This is required for FISMA Low and FISMA Moderate systems.

IA-2(1)

CCE-26985-2

Set Password Maximum Age

To specify password maximum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line:

    PASS_MAX_DAYS

A value of 180 days is sufficient for many environments. The DoD requirement is 60.

Setting the password maximum age ensures users are required to periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

IA-5(f)
IA-5(g)
IA-5(1)(d)

CCE-27013-2

Set Password Minimum Age

To specify password minimum age for new accounts, edit the file `/etc/login.defs` and add or correct the following line:

    PASS_MIN_DAYS

A value of 1 day is considered sufficient for many environments. The DoD requirement is 1.

Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.

IA-5(f)
IA-5(1)(d)

CCE-26988-6

Set Password Warning Age

To specify how many days prior to password expiration that a warning will be issued to users, edit the file `/etc/login.defs` and add or correct the following line:

    PASS_WARN_AGE

The DoD requirement is 7.

Setting the password warning age enables users to make the change at a practical time.

AC-2(2)
IA-5(f)

CCE-26966-2

Ensure that System Accounts Do Not Run a Shell Upon Login

Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell.
The login shell for each local account is stored in the last field of each line in `/etc/passwd`. System accounts are those user accounts with a user ID less than UID_MIN, where value of the UID_MIN directive is set in /etc/login.defs configuration file. In the default configuration UID_MIN is set to 500, thus system accounts are those user accounts with a user ID less than 500. The user ID is stored in the third field. If any system account SYSACCT (other than root) has a login shell, disable it with the command:

    $ sudo usermod -s /sbin/nologin SYSACCT

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

AC-2

CCE-26917-5

Ensure the Default Bash Umask is Set Correctly

To ensure the default umask for users of the Bash shell is set properly, add or correct the `umask` setting in `/etc/bashrc` to read as follows:

    umask

The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

SA-8

CCE-26669-2

Ensure the Default Umask is Set Correctly in /etc/profile

To ensure the default umask controlled by `/etc/profile` is set properly, add or correct the `umask` setting in `/etc/profile` to read as follows:

    umask

The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

SA-8

CCE-27283-1

Set Account Expiration Following Inactivity

To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following lines in `/etc/default/useradd`, substituting `NUM_DAYS` appropriately:

    INACTIVE=

A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the `useradd` man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.

Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.

AC-2(2)
AC-2(3)

CCE-26974-6

Modify the System Login Banner

To configure the system login banner:
Edit `/etc/issue`. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either:
`You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.`
OR:
`Use of this or any other DoD interest computer system constitutes consent to monitoring at all times.
This is a DoD interest computer system. All DoD interest computer systems and related equipment are intended for the communication, transmission, processing, and storage of official U.S. Government or other authorized information only. All DoD interest computer systems are subject to monitoring at all times to ensure proper functioning of equipment and systems including security devices and systems, to prevent unauthorized use and violations of statutes and security regulations, to deter criminal activity, and for other similar purposes. Any user of a DoD interest computer system should be aware that any information placed in the system is subject to monitoring and is not subject to any expectation of privacy.
If monitoring of this or any other DoD interest computer system reveals possible evidence of violation of criminal statutes, this evidence and any other related information, including identification information about the user, may be provided to law enforcement officials. If monitoring of this or any other DoD interest computer systems reveals violations of security regulations or unauthorized use, employees who violate security regulations or make unauthorized use of DoD interest computer systems are subject to appropriate disciplinary action.
Use of this or any other DoD interest computer system constitutes consent to monitoring at all times.`
OR:
`I've read & consent to terms in IS user agreem't.`

An appropriate warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers.

AC-8(a)
AC-8(b)
AC-8(c)

CCE-27195-7

Enable GUI Warning Banner

To enable displaying a login warning banner in the GNOME Display Manager's login screen, run the following command:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /apps/gdm/simple-greeter/banner_message_enable true

To display a banner, this setting must be enabled and then banner text must also be set.

An appropriate warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers.

AC-8(a)
AC-8(b)
AC-8(c)

CCE-27017-3

Set GUI Warning Banner Text

To set the text shown by the GNOME Display Manager in the login screen, run the following command:

    $ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type string \
      --set /apps/gdm/simple-greeter/banner_message_text \
      "Text of the warning banner here"

When entering a warning banner that spans several lines, remember to begin and end the string with `"`. This command writes directly either to the `/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml` if it exists or to the file `/etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml`. Either of these files can later be edited directly if necessary.

An appropriate warning message reinforces policy awareness during the login process and facilitates possible legal action against attackers.

AC-8(a)
AC-8(b)
AC-8(c)

CCE-26868-0

Verify Permissions on passwd File

To properly set the permissions of `/etc/passwd`, run the command:

    $ sudo chmod 0644 /etc/passwd

If the `/etc/passwd` file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

AC-6

CCE-26992-8

Verify Permissions on shadow File

To properly set the permissions of `/etc/shadow`, run the command:

    $ sudo chmod 0000 /etc/shadow

The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

AC-6

CCE-26951-4

Verify Permissions on gshadow File

To properly set the permissions of `/etc/gshadow`, run the command:

    $ sudo chmod 0000 /etc/gshadow

The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.

AC-6

CCE-26954-8

Verify Permissions on group File

To properly set the permissions of `/etc/group`, run the command:

    $ sudo chmod 644 /etc/group

The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

AC-6

CCE-26953-0

Verify User Who Owns passwd File

To properly set the owner of `/etc/passwd`, run the command:

    $ sudo chown root /etc/passwd

The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.

AC-6

CCE-26856-5

Verify Group Who Owns passwd File

To properly set the group owner of `/etc/passwd`, run the command:

    $ sudo chgrp root /etc/passwd

The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.

AC-6

CCE-26947-2

Verify User Who Owns shadow File

To properly set the owner of `/etc/shadow`, run the command:

    $ sudo chown root /etc/shadow

The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

AC-6

CCE-26967-0

Verify Group Who Owns shadow File

To properly set the group owner of `/etc/shadow`, run the command:

    $ sudo chgrp root /etc/shadow

The `/etc/shadow` file stores password hashes. Protection of this file is critical for system security.

AC-6

CCE-27026-4

Verify User Who Owns gshadow File

To properly set the owner of `/etc/gshadow`, run the command:

    $ sudo chown root /etc/gshadow

The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.

AC-6

CCE-26975-3

Verify Group Who Owns gshadow File

To properly set the group owner of `/etc/gshadow`, run the command:

    $ sudo chgrp root /etc/gshadow

The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.

AC-6

CCE-26822-7

Verify User Who Owns group File

To properly set the owner of `/etc/group`, run the command:

    $ sudo chown root /etc/group

The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

AC-6

CCE-26930-8

Verify Group Who Owns group File

To properly set the group owner of `/etc/group`, run the command:

    $ sudo chgrp root /etc/group

The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

AC-6

CCE-27289-8

Verify that System Executables Have Restrictive Permissions

System executables are stored in the following directories by default:

    /bin
    /sbin
    /usr/bin
    /usr/libexec
    /usr/local/bin
    /usr/local/sbin
    /usr/sbin

All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:

    $ sudo chmod go-w FILE

System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

AC-6

CCE-26910-0

Ensure No World-Writable Files Exist

It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as `sysfs` or `procfs`.

Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.

AC-6

CCE-27032-2

Ensure All Files Are Owned by a User

If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user.

Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.

AC-6

CCE-26872-2

Ensure All Files Are Owned by a Group

If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group.

Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.

AC-6

CCE-26497-8

Ensure All SUID Executables Are Authorized

The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SUID files.

Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.

AC-6(1)

CCE-26769-0

Ensure All SGID Executables Are Authorized

The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SGID files.

Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system.

AC-6(1)

CCE-27038-9

Prevent Log In to Accounts With Empty Password

If an account is configured for password authentication but does not have an assigned password, it may be possible to log onto the account without authentication. Remove any instances of the `nullok` option in `/etc/pam.d/system-auth` to prevent logins with empty passwords.

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

IA-5(b)
IA-5(c)
IA-5(1)(a)

CCE-26971-2

Verify Only Root Has UID 0

If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.

An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

AC-6
IA-2(1)

CCE-27125-4

Root Path Must Be Vendor Default

Assuming root shell is bash, edit the following files:

    ~/.profile

    ~/.bashrc

Change any `PATH` variables to the vendor default for root and remove any empty `PATH` entries or references to relative paths.

The root account's executable search path must be the vendor default, and must contain only absolute paths.

SA-8

CCE-26981-1

Ensure that User Home Directories are not Group-Writable or World-Readable

For each human user of the system, view the permissions of the user's home directory:

    $ sudo ls -ld /home/USER

Ensure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions:

    $ sudo chmod g-w /home/USER
    $ sudo chmod o-rwx /home/USER

User home directories contain many configuration files which affect the behavior of a user's account. No user should ever have write permission to another user's home directory. Group shared directories can be configured in sub-directories or elsewhere in the filesystem if they are needed. Typically, user home directories should not be world-readable, as it would disclose file names to other users. If a subset of users need read access to one another's home directories, this can be provided using groups or ACLs.

AC-6(7)

CCE-27270-8

Remove Rsh Trust Files

The files `/etc/hosts.equiv` and `~/.rhosts` (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location:

    $ sudo rm /etc/hosts.equiv

    $ rm ~/.rhosts

Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.

CM-7

CCE-27379-7 | All GIDs referenced in /etc/passwd must be defined in /etc/group | Add a group to the system for each GID referenced without a corresponding group. | Inconsistency in GIDs between `/etc/passwd` and `/etc/group` could lead to a user having unintended rights. |  |
CCE-27609-7 | Ensure All Accounts on the System Have Unique Names | Change usernames, or delete accounts, so each has a unique name. | Unique usernames allow for accountability on the system. |  |

CCE-27225-2

Verify No netrc Files Exist

The `.netrc` files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any `.netrc` files should be removed.

Unencrypted passwords for remote FTP servers may be stored in `.netrc` files. DoD policy requires passwords be encrypted in storage and not used in access scripts.

IA-5(h)
AC-3