| Reference (nist) | Rule Title | Description | Rationale | Variable Setting |
| CM-6 | Ensure /tmp Located On Separate Partition |
The /tmp directory is a world-writable directory used
for temporary file storage. Ensure that it has its own partition or
logical volume at installation time, or migrate it using LVM.
|
The /tmp partition is used as temporary storage by many programs.
Placing /tmp in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.
|
|
| CM-6 | Ensure /var Located On Separate Partition | The /var directory is used by daemons and other system
services to store frequently-changing data. Ensure that /var has its own partition
or logical volume at installation time, or migrate it using LVM.
|
Ensuring that /var is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the /var directory to contain
world-writable directories, installed by other software packages.
|
|
| CM-6 | Ensure /var/log Located On Separate Partition |
System logs are stored in the /var/log directory.
Ensure that it has its own partition or logical
volume at installation time, or migrate it using LVM.
|
Placing /var/log in its own partition
enables better separation between log files
and other files in /var/.
|
|
| CM-6 | Ensure /var/log/audit Located On Separate Partition |
Audit logs are stored in the /var/log/audit directory. Ensure that it
has its own partition or logical volume at installation time, or migrate it
later using LVM. Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.
|
Placing /var/log/audit in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.
|
|
| CM-6 | Ensure /home Located On Separate Partition |
If user home directories will be stored locally, create a separate partition
for /home at installation time (or migrate it later using LVM). If
/home will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.
|
Ensuring that /home is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.
|
|
| SI-2 | Ensure Red Hat GPG Key Installed |
To ensure that the system can cryptographically verify base software
packages come from Red Hat (and to connect to the Red Hat Network to
receive them if desired), the Red Hat GPG key must properly be installed.
To ensure that the GPG key is installed, run:
# rhn_register |
This key is necessary to cryptographically verify that packages are from Red Hat. | |
| SI-2 | Ensure gpgcheck Enabled In Main Yum Configuration | The gpgcheck option should be used to ensure that
checking of an RPM package’s signature always occurs prior to its
installation. To configure yum to check package signatures before installing
them, ensure that the following line appears in /etc/yum.conf in
the [main] section:
gpgcheck=1 |
Ensuring the validity of packages' cryptographic signatures prior to installation ensures the provenance of the software and protects against malicious tampering. | |
| SI-2 | Ensure gpgcheck Enabled For All Yum Package Repositories | To ensure that signature checking is not disabled for
any repos, remove any lines from files in /etc/yum.repos.d of the form:
gpgcheck=0 |
Ensuring that all packages' cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering. | |
| SI-2 | Ensure Software Patches Installed | The following command prints a list of packages that
need to be updated:
# yum check-updateTo actually install these updates, run: # yum update |
Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. | |
| CM-6 | Install AIDE |
Install the AIDE package with the command:
# yum install aide |
The AIDE package must be installed if it is to be available for integrity checking. | |
| CM-6 | Disable Prelinking |
The prelinking feature
changes binaries in an attempt to decrease their startup time.
In order to disable it, change or add the following line inside the file /etc/sysconfig/prelink:
PRELINKING=noNext, the following command to return binaries to a normal, non-prelinked state: # /usr/sbin/prelink -ua |
The prelinking feature can interfere with the operation of AIDE, because it changes binaries. | |
| SC-28 | Build and Test AIDE Database | Run the following command to generate a new database:
# /usr/sbin/aide --initBy default, the database will be written to the file /var/lib/aide/aide.db.new.gz.
Storing the database, the configuration file /etc/aide.conf, and the binary
/usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:
# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gzTo initiate a manual check, run the following command: # /usr/sbin/aide --checkIf this check produces any unexpected output, investigate. |
For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files. | |
| CM-6 | Configure Periodic Execution of AIDE |
AIDE should be executed on a periodic basis to check for changes.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --checkAIDE can be executed periodically through other means; this is merely one example. |
By default, AIDE does not install itself for periodic execution. Periodically running AIDE may reveal unexpected changes in installed files. | |
| SC-28 | Manually Verify Integrity of AIDE |
Manually verify the integrity of the AIDE binaries, configuration file, and database. Possibilities for doing
so include:
1. Use sha1sum or md5sum to generate checksums on the files and then visually compare them to those generated from the safely stored versions. This does not, of course, preclude the possibility that such output could also be faked. 2. Mount the stored versions on read-only media and run /bin/diff to verify that there are no differences
between the files.
3. Copying the files to another system and performing the hash or file comparisons there may impart additional confidence that the manual verification process is not being interfered with. |
Because integrity checking is a means of intrusion detection and not intrusion prevention, it cannot be guaranteed that the AIDE binaries, configuration files, or database have not been tampered with. An attacker could disable or alter these files after a successful intrusion. Because of this, manual and frequent checks on these files is recommended. The safely stored copies (or hashes) of the database, binary, and configuration file were created earlier for this purpose. | |
| SI-7 | Verify File Permissions with RPM | The RPM package management system can check file access
permissions of installed software packages, including many that are
important to system security. The following command will list which
files on the system have permissions that are different from what
is expected by the RPM database:
# rpm -Va | grep '^.M' |
Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated. | |
| SI-7 | Verify File Hashes with RPM | The RPM package management system can check the hashes of
installed software packages, including many that are important to system
security. Run the following command to list which files on the system
have hashes that differ from what is expected by the RPM database:
# rpm -Va | grep '^..5'A “c” in the second column indicates that a file is a configuration file, which may appropriately be expected to change. |
The MD5 hash on important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system. | |
| CM-6 | Add nodev Option to Non-Root Local Partitions | Legitimate character and block devices should exist in
the /dev directory on the root patition or within chroot
jails built for system services. All other locations should not allow
character and block devices. |
The nodev mount option prevents files from being
interpreted as character or block devices. The only legitimate location
for device files is the /dev directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set nodev on these filesystems. |
|
| CM-7 | Add nodev Option to Removable Media Partitions | Removable Media partitions should be mounted with the
nodev option. |
The nodev mount option prevents files from being
interpreted as character or block devices. The only legitimate location
for device files is the /dev directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set nodev on these filesystems. |
|
| CM-7 | Add noexec Option to Removable Media Partitions | The noexec mount option prevents the direct
execution of binaries on the mounted filesystem. Users should not
be allowed to execute binaries that exist on partitions mounted
from removable media (such as a USB key). The noexec
option prevents code from being executed directly from the media
itself, and may therefore provide a line of defense against
certain types of worms or malicious code. |
Allowing users to execute binaries from removable media such as USB keys exposes the system to potential compromise. | |
| CM-7 | Add nosuid Option to Removable Media Partitions | The nosuid mount option prevents set-user-identifier (suid)
and set-group-identifier (sgid) permissions from taking effect. These permissions
allow users to execute binaries with the same permissions as the owner and group
of the file respectively. Users should not be allowed to introduce suid and guid
files into the system via partitions mounted from removeable media. |
The presence of suid and sgid executables should be tightly controlled. Users should not be able to execute suid or sgid binaries from partitions mounted off of removable media. | |
| CM-7 | Add nodev Option to /tmp | Legitimate character and block devices should not exist
within temporary directories like /tmp. The nodev
mount option should be specified for /tmp. |
The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails. | |
| CM-7 | Add noexec Option to /tmp | It can be dangerous to allow the execution of binaries
from world-writeable temporary storage directories such as /tmp.
The noexec mount option prevents binaries from being executed
out of /tmp. |
Allowing users to execute binaries from world-writeable directories such as /tmp can expose the system to potential compromise. | |
| CM-7 | Add nosuid Option to /tmp | The nosuid mount option should be set for temporary
storage partitions such as /tmp. The suid/sgid permissions
should not be required in these world-writeable directories. |
The presence of suid and sgid executables should be tightly controlled. Users should not be able to execute suid or sgid binaries from temporary storage partitions. | |
| CM-7 | Add nodev Option to /dev/shm | Legitimate character and block devices should not exist
within temporary directories like /dev/shm. The nodev
mount option should specified for /dev/shm. |
The only legitimate location for device files is the /dev directory located on the root partition. The only exception to this is chroot jails. | |
| CM-7 | Add noexec Option to /dev/shm | It can be dangerous to allow the execution of binaries
from world-writeable temporary storage directories such as /dev/shm.
The noexec mount option prevents binaries from being executed
out of /dev/shm. |
Allowing users to execute binaries from world-writeable directories such as /dev/shm can expose the system to potential compromise. | |
| CM-7 | Add nosuid Option to /dev/shm | The nosuid mount option should be set for temporary
storage partitions such as /dev/shm. The suid/sgid permissions
should not be required in these world-writeable directories. |
The presence of suid and sgid executables should be tightly controlled. Users should not be able to execute suid or sgid binaries from temporary storage partitions. | |
| CM-6 | Bind Mount /var/tmp To /tmp | The /var/tmp directory should be bind mounted to /tmp
in order to consolidate temporary storage into one location protected by the same
techniques as /tmp. This is done by editing /etc/fstab and adding
the following line if needed:
/tmp /var/tmp none rw,nodev,noexec,nosuid,bind 0 0See the mount(8) man page for further explanation of bind mounting. |
Having multiple locations for temporary storage is not required. Unless absolutely necessary to meet requirements, the storage location /var/tmp should be bind mounted to /tmp and thus share the same protections. | |
| AC-6 | Restrict Console Device Access to Desktop Workstations | If the display manager has been altered to allow remote users to log in and the host is configured to run at runlevel 5, change console as well as the xconsole directive in the /etc/security/console.perms to the following:
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :0\.[0-9] :0 <xconsole>=:0\.[0-9] :0 |
When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for pam_console for more information |
|
| AC-6 | Restrict Console Device Access to Servers | If the display manager has been altered to allow remote users to log in and the host is configured to run at runlevel 5, change console as well as the xconsole directive in the /etc/security/console.perms to the following:
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* |
When a user logs in, the module pam_console.so called via the command login, or by some of the graphics program of logging, such as gdm, kdm, and xdm. If this user is the first to log into the physical console - called the console user - the user module assures the mastery of a wide variety of devices normally belong to root. Administrative privileges should be limited for non-root users. Review the man page for pam_console for more information |
|
| CM-6 | Disable Modprobe Loading of USB Storage Driver |
If USB storage devices should not be used, the modprobe program
used for automatic kernel module loading should be configured to not load
the USB storage driver upon demand. Add the following line to the appropriate
file in /etc/modprobe.d/ to prevent loading of the usb-storage
kernel module:
install usb-storage /bin/trueThis will prevent the modprobe program from loading the usb-storage
module, but will not prevent an administrator (or another program) from using the
insmod program to load the module manually. |
USB storage devices such as thumb drives can be used to introduce unauthorized software and other vulnerabilities. Support for these devices should be disabled and the devices themselves should be tightly controlled. | |
| CM-6 | Disable Kernel Support for USB via Bootloader Configuration |
Another means of disabling USB storage is to disable all USB support provided
by the operating system. This can be accomplished by adding the nousb
argument to the kernel’s boot loader configuration. To disable kernel support
for USB, append “nousb” to the kernel line in /etc/grub.conf as follows:
kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousbWARNING: Disabling all kernel support for USB will cause problems for systems with USB-based keyboards, mice, or printers. This guidance is inappropriate for systems which require USB connectivity. |
Disabling the USB subsystem within the Linux kernel at system boot will also disable USB storage devices if they are plugged into the sytem. Support for these devices should be disabled and the devices themselves should be tightly controlled. | |
| CM-6 | Disable Booting from USB Devices | An attacker with physical access could try to boot the system from a USB flash drive and then access any data on the system’s hard drive, circumventing the normal operating system’s access controls. To prevent this, configure the BIOS to disallow booting from USB drives. Also configure the BIOS or firmware password as described in the section titled "Set BIOS Password" to prevent unauthorized configuration changes. | Booting a system from a USB device would allow an attacker to circumvent any security measures offered by the native OS. Attackers could mount partitions and modify the configuration of the native OS. The BIOS should be configured to disallow booting from USB media. | |
| CM-6 | Disable the Automounter | The autofs daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as /misc/cd.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it is
almost always possible to configure filesystem mounts statically by editing /etc/fstab
rather than relying on the automounter.
If the autofs service is not needed to dynamically mount NFS filesystems
or removable media, disable the service for all runlevels:
# chkconfig --level 0123456 autofs off |
All filesystems that are required for the successful operation of the system should be explicitly listed in /etc/fstab by and administrator. New filesystems should not be arbitrarily introduced via the automounter. | |
| CM-6 | Disable GNOME Automounting | The system’s default desktop environment, GNOME, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. Disable automount and autorun within GNOME by running the following:
# gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/nautilus/preferences/media_automount false # gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/nautilus/preferences/media_autorun_never trueThese settings can be verified by running the following: $ gconftool-2 --direct \ --config-source xml:read:/etc/gconf/gconf.xml.mandatory \ --get /apps/nautilus/preferences/media_automount $ gconftool-2 --direct \ --config-source xml:read:/etc/gconf/gconf.xml.mandatory \ --get /apps/nautilus/preferences/media_autorun_never |
The system’s capabilities for automatic mounting should be configured to match whatever is defined by security policy. Disabling USB storage as described in the USB section will prevent the use of USB storage devices, but this step should also be taken as an additional layer of protection to prevent automatic mounting of CDs and DVDs. | |
| CM-6 | Disable Mounting of cramfs | Using the install command inside the appropriate .conf file inside/etc/modprobe.d
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable Mounting of freevxfs | Using the install command inside the appropriate /etc/modprobe.d configuration file.
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable Mounting of jffs2 | Using the install command inside the appropriate /etc/modprobe.d configuration file.
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable Mounting of hfs | Using the install command inside the appropriate /etc/modprobe.d configuration file.
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable Mounting of hfsplus | Using the install command inside the appropriate /etc/modprobe.d configuration file.
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable Mounting of squashfs | Using the install command inside the appropriate /etc/modprobe.d configuration file.
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable Mounting of udf | Using the install command inside the appropriate /etc/modprobe.d configuration file.
instructs the kernel module loading system to run the command
specified (here, /bin/true) instead of inserting the module in the
kernel as normal. This effectively prevents usage of these uncommon
filesystems. |
Linux kernel modules which implement filesystems that are not needed by the local system should be disabled. | |
| CM-6 | Disable All GNOME Thumbnailers | The system’s default desktop environment, GNOME, uses
a number of different thumbnailer programs to generate thumbnails
for any new or modified content in an opened folder. The following
command can disable the execution of these thumbnail applications:
# gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /desktop/gnome/thumbnailers/disable_all trueThis effectively prevents an attacker from gaining access to a system through a flaw in GNOME’s Nautilus thumbnail creators. |
An attacker with knowledge of a flaw in a GNOME thumbnailer application could craft a malicious file to exploit this flaw. Assuming the attacker could place the malicious file on the local filesystem (via a web upload for example) and assuming a user browses the same location using Nautilus, the malicious file would exploit the thumbnailer with the potential for malicious code execution. It is best to disable these thumbnailer applications unless they are explicitly required. | |
| AC-3 | Verify User Who Owns shadow File |
To properly set the owner of /etc/shadow, run the command:
# chown root /etc/shadow |
The /etc/shadow file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture. |
|
| AC-3 | Verify Group Who Owns shadow File |
To properly set the group owner of /etc/shadow, run the command:
# chgrp root /etc/shadow |
The /etc/shadow file stores password hashes. Protection of this file is
critical for system security. |
|
| AC-3 | Verify Permissions on shadow File |
To properly set the permissions of /etc/shadow, run the command:
# chmod 0000 /etc/shadow |
The /etc/shadow file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture. |
|
| AC-3 | Verify User Who Owns group File |
To properly set the owner of /etc/group, run the command:
# chown root /etc/group |
The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
|
| AC-3 | Verify Group Who Owns group File |
To properly set the group owner of /etc/group, run the command:
# chgrp root /etc/group |
The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
|
| AC-3 | Verify Permissions on group File |
To properly set the permissions of /etc/group, run the command:
# chmod 644 /etc/group |
The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
|
| AC-3 | Verify User Who Owns gshadow File |
To properly set the owner of /etc/gshadow, run the command:
# chown root /etc/gshadow |
The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
|
| AC-3 | Verify Group Who Owns gshadow File |
To properly set the group owner of /etc/gshadow, run the command:
# chgrp root /etc/gshadow |
The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
|
| AC-3 | Verify Permissions on gshadow File |
To properly set the permissions of /etc/gshadow, run the command:
# chmod 0000 /etc/gshadow |
The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security. | |
| AC-3 | Verify User Who Owns passwd File |
To properly set the owner of /etc/passwd, run the command:
# chown root /etc/passwdThe /etc/passwd file should be owned by
root. |
The /etc/passwd contains information about the users that are configured on
the system. Protection of this file is critical for system security. |
|
| AC-3 | Verify Group Who Owns passwd File |
To properly set the group owner of /etc/passwd, run the command:
# chgrp root /etc/passwd |
The /etc/passwd file contains information about the users that are configured on
the system. Protection of this file is critical for system security. |
|
| AC-3 | Verify Permissions on passwd File |
To properly set the permissions of /etc/passwd, run the command:
# chmod 0644 /etc/passwd |
If the /etc/passwd file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
acounts on the system and associated information, and protection of this file
is critical for system security. |
|
| CM-6 | Verify that All World-Writable Directories Have Sticky Bits Set | When the so-called 'sticky bit' is set on a directory,
only the owner of a given file may remove that file from the
directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky
bit prevents users from removing each other's files. In cases where
there is no reason for a directory to be world-writable, a better
solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application,
consult that application's documentation instead of blindly
changing modes.
To set the sticky bit on a world-writable directory DIR, run the following command: # chmod +t DIR |
||
| CM-6 | Ensure No World-Writable Files Exist | Data in world-writable files can be modified by any
user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk
caused by world-writable files.
It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. |
||
| CM-6 | Ensure All Setgid Executables Are Authorized | The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SGID files. | Executable files with the SGID permission run with the privileges of the owner of the file. SGID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system. | |
| AC-3 | Ensure All SUID Executables Are Authorized | The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorized SGID files is determine if any were not installed as part of an RPM package, which is cryptographically verified. Investigate the origin of any unpackaged SUID files. | Executable files with the SUID permission run with the privileges of the owner of the file. SUID files of uncertain provenance could allow for unprivileged users to elevate privileges. The presence of these files should be strictly controlled on the system. | |
| AC-3 | Ensure All Files Are Owned by a User | If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. | Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so that they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. | |
| AC-3 | Ensure All Files Are Owned by a Group | If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group. | Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so that they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed. | |
| AC-3 | Ensure All World-Writable Directories Are Owned by a System Account | All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group. | Allowing a user account to own a world-writeable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users. | |
| AC-3 | Set Daemon Umask | The file /etc/init.d/functions includes initialization
parameters for most or all daemons started at boot time. The default umask of
022 prevents creation of group- or world-writable files. To set the default
umask for daemons, edit the following line, inserting 022 or 027 for
UMASK appropriately:
umask UMASKSetting the umask to too restrictive a setting can cause serious errors at runtime. Many daemons on the system already individually restrict themselves to a umask of 077 in their own init scripts. |
The umask influences the permissions assigned to files created by a process at run time. An unnecessarily permissive umask could result in files being created with insecure permissions. | |
| SC-5 | Disable Core Dumps for All Users | To disable core dumps for all users, add the following line to
/etc/security/limits.conf:
* hard core 0 |
A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems. | |
| SI-11 | Disable Core Dumps for SUID programs |
To set the runtime status of the fs.suid_dumpable kernel parameter,
run the following command:
# sysctl -w fs.suid_dumpable0 |
The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data. | |
| CM-7 | Enable ExecShield |
To set the runtime status of the kernel.exec-shield kernel parameter,
run the following command:
# sysctl -w kernel.exec-shield1 |
ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range. | |
| AC-3 | Enable Randomized Layout of Virtual Address Space |
To set the runtime status of the kernel.randomize_va_space kernel parameter,
run the following command:
# sysctl -w kernel.randomize_va_space1 |
Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. ASLR also makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques. | |
| CM-7 | Install PAE Kernel on Supported 32-bit x86 Systems | Systems that are using the 64-bit x86 kernel package
do not need to install the kernel-PAE package because the 64-bit
x86 kernel already includes this support. However, if the system is
32-bit and also supports the PAE and NX features as
determined in the previous section, the kernel-PAE package should
be installed to enable XD or NX support:
# yum install kernel-PAEThe installation process should also have configured the bootloader to load the new kernel at boot. Verify this at reboot and modify /etc/grub.conf if necessary. |
On 32-bit systems that support the XD or NX bit, the vendor-supplied PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support. | |
| CM-6 | Enable NX or XD Support in the BIOS | Reboot the system and enter the BIOS or Setup configuration menu. Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX) on AMD-based systems. | Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will allow users to turn the feature on or off at will. | |
| AC-3 | Ensure SELinux Not Disabled in /etc/grub.conf | SELinux can be disabled at boot time by an argument in
/etc/grub.conf.
Remove any instances of selinux=0 from the kernel arguments in that
file to prevent SELinux from being being disabled at boot.
|
Disabling a major host protection feature, such as SELinux, at boot time prevents it from confining system services at boot time. Further, it increases the chances that it will remain off during system operation. | |
| CM-6 | Ensure SELinux State is Enforcing | The SELinux state should be set to enforcing at
system boot time. In the file /etc/selinux/config, add or correct the
line SELINUX=enforcing to configure the system to boot into enforcing
mode.
|
Setting the SELinux state to enforcing ensures that SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. | |
| CM-6 | Configure SELinux Policy | The SELinux targeted policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in /etc/selinux/config:
SELINUXTYPE=targetedOther policies, such as mls, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.
|
Setting the SELinux policy to targeted or a more specialized policy
ensures that the system will confine processes that are likely to be
targeted for exploitation, such as network services or system services.
|
|
| AC-3 | Enable the SELinux Context Restoration Service (restorecond) | The restorecond service utilizes inotify to look
for the creation of new files listed in the
/etc/selinux/restorecond.conf configuration file. When a file is
created, restorecond ensures that the file receives the proper SELinux
security context.
The restorecond service can be enabled with the following command:
# chkconfig restorecond on |
The restorecond service helps ensure that the default SELinux
file context is applied to files. This allows automatic correction
of file contexts created by some programs. |
|
| AC-6 | Ensure No Daemons are Unconfined by SELinux |
Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the init process, they inherit the initrc_t context.
To check for unconfined daemons, run the following command: # ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
It should produce no output in a well-configured system.
|
Daemons which run with the initrc_t context may cause AVC denials,
or allow privileges that the daemon does not require.
|
|
| CM-6 | Ensure No Device Files are Unlabeled by SELinux | Device files are used for communication with important system resources.
SELinux contexts should exist for these. By checking for unlabeled_t file
contexts, we can determine if the system is optimally configured. |
If a device file is not labeled, then misconfiguration is likely. | |
| CM-6 | Restrict Virtual Console Root Logins |
To restrict root logins through the (deprecated) virtual console devices,
ensure lines of this form do not appear in /etc/securetty:
vc/1 vc/2 vc/3 vc/4 |
Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account. | |
| AC-3 | Restrict Serial Port Root Logins | To restrict root logins on serial ports,
ensure lines of this form do not appear in /etc/securetty:
ttyS0 ttyS1 |
Preventing direct root login to serial port interfaces helps ensure accountability for actions taken on the systems using the root account. | |
| AC-3 | Ensure that System Accounts Do Not Run a Shell Upon Login |
Some accounts are not associated with a human
user of the system, and exist to perform some administrative
function. Should an attacker be able to log into these accounts,
he or she should not be granted access to a shell.
Ensure that no shells are granted to system accounts. First, obtain a listing of all users, their UIDs, and their shells, by running: $ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd
Identify the system accounts from this listing. These will
primarily be the accounts with UID numbers less than 500, other
than root.
|
Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts. | |
| AC-3 | Verify Only Root Has UID 0 | If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. | An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a provilieged account. Proper configuration of sudo is recommended to afford multiple System Administrators access to the root account. | |
| AC-3 | Prevent Log In to Accounts With Empty Password | If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the nullok
option in /etc/pam.d/system-auth-ac to
prevent logins with empty passwords.
|
If an account has an empty password, anybody may log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments. | |
| IA-5 | Verify All Account Password Hashes are Shadowed |
If any password hashes are stored in /etc/passwd (in the second field,
instead of an x), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.
|
The hashes for all user account passwords should be stored in
the file /etc/shadow and never in /etc/passwd,
which is readable by all users.
|
|
| IA-5 | Verify No netrc Files Exist | The .netrc files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used. Any .netrc files should be removed.
|
Unencrypted passwords for remote FTP servers may be stored in .netrc
files. DoD policy requires passwords be encrypted in storage and not used
in access scripts.
|
|
| CM-6 | Set Password Minimum Length in login.defs | To specify password length requirements for new accounts,
edit the file /etc/login.defs and add or correct the following
lines:
PASS_MIN_LEN LENGTH The DoD requirement is 14.
If a program consults /etc/login.defs and also another PAM module
(such as pam_cracklib) during a password change operation,
then the most restrictive must be satisfied. See PAM section
for more information about enforcing password quality requirements.
|
Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result. | |
| CM-6 | Set Password Minimum Age | To specify password minimum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line, replacing DAYS appropriately:
PASS_MIN_DAYS DAYSThe DoD requirement is 7. |
Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement. | |
| CM-6 | Set Password Maximum Age | To specify password maximum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line, replacing DAYS appropriately:
PASS_MAX_DAYS DAYSA value of 180 days is sufficient for many environments. The DoD requirement is 60. |
Setting the password maximum age ensures that users are required to periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. | |
| CM-6 | Set Password Warning Age | To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file /etc/login.defs and add or correct
the following line:
PASS_WARN_AGE DAYSA value of 7 days is considered for appropriate for many environments. |
Setting the password warning age enables users to make the change at a practical time. | |
| IA-5 | Set Password Retry Prompts Permitted Per-session | The pam_cracklib module's retry= parameter controls how many times a program
will re-prompt a user after an incorrect password entry, on a per-session basis. To configure this, open:
/etc/pam.d/system-authLocate the retry= parameter, the DoD required value is 3.
|
Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module. | |
| IA-5 | Set Password Strength Minimum Digit Characters | The pam_cracklib module's dcredit= parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each digit.
|
Requiring digits makes password guessing attacks more difficult by ensuring a larger search space. | |
| IA-5 | Set Password Strength Minimum Uppercase Characters | The pam_cracklib module's ucredit= parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each uppercase character.
|
Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space. | |
| IA-5 | Set Password Strength Minimum Special Characters | The pam_cracklib module's ocredit= parameter controls requirements for
usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to
contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each special character.
|
Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space. | |
| IA-5 | Set Password Strength Minimum Lowercase Characters | The pam_cracklib module's lcredit= parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each lowercase character.
|
Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space. | |
| IA-5 | Set Password Strength Minimum Different Characters | The pam_cracklib module's difok= parameter controls requirements for
usage of different characters during a password change.
|
Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however. | |
| AC-7 | Set Deny For Failed Password Attempts | This requires further investigation. | Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. | |
| IA-5 | Set Password Hashing Algorithm | The system's default algorithm for storing password hashes in
/etc/shadow is SHA-512.
In order to ensure the system is still configured to use SHA-512 algorithm,
the following line must appear in /etc/login.defs:
ENCRYPT_METHOD SHA512Also ensure that the pam_unix.so module in the password section in
/etc/pam.d/system-auth includes the argument sha512.
If this is not the case, the following command can be run to fix: # /usr/sbin/authconfig --passalgo=sha512 --updateThis ensures that when users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. |
Using a stronger hashing algorithm makes password cracking attacks more difficult. | |
| IA-5 | Limit Password Reuse | Do not allow users to reuse recent passwords. This can
be accomplished by using the remember option for the pam_unix PAM
module. In order to prevent a user from re-using any of their
last passwords,
append remember= to
the password line which uses the pam_unix module in the file
/etc/pam.d/system-auth, as shown:
password sufficient pam_unix.so existing_options remember=Old (and thus no longer valid) passwords are stored in the file /etc/security/opasswd. The DoD requirement is currently 24 passwords. |
Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. | |
| CM6 | Ensure that Root's Path Does Not Include Relative Paths or Null Directories |
Ensure that none of the directories in root's path is equal to a single
. character, or
that it contains any instances that lead to relative path traversal, such as
.. or beginning a path without the slash (/) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
PATH=:/bin PATH=/bin: PATH=/bin::/sbinThese empty elements have the same effect as a single . character.
|
Including these entries increases the risk that root could execute code from an untrusted location. | |
| CM6 | Ensure that Root's Path Does Not Include World or Group-Writable Directories |
For each element in root's path, run:
# ls -ld DIRand ensure that write permissions are disabled for group and other. |
Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code. | |
| AC-3 | Ensure that User Home Directories are not Group-Writable or World-Readable | For each human user USER of the system, view the
permissions of the user's home directory:
# ls -ld /home/USEREnsure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions: # chmod g-w /home/USER # chmod o-rwx /home/USER |
User home directories contain many configuration files which affect the behavior of a user's account. No user should ever have write permission to another user's home directory. Group shared directories can be configured in subdirectories or elsewhere in the filesystem if they are needed. Typically, user home directories should not be world-readable, as it would disclose file names to other users. If a subset of users need read access to one another's home directories, this can be provided using groups or ACLs. | |
| CM-6 | Ensure the Default Bash Umask is Set Correctly |
To ensure the default umask for users of the Bash shell is set properly,
add or correct the umask setting in /etc/bashrc to read
as follows:
umask 077 |
The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and/or written to by unauthorized users. | |
| CM-6 | Ensure the Default C Shell Umask is Set Correctly |
To ensure the default umask for users of the C shell is set properly,
add or correct the umask setting in /etc/csh.cshrc to read as follows:
umask 077 |
The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and/or written to by unauthorized users. | |
| CM-6 | Ensure the Default Umask is Set Correctly in /etc/profile |
To ensure the default umask controlled by /etc/profile is set properly,
add or correct the umask setting in /etc/profile to read as follows:
umask 077 |
The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and/or written to by unauthorized users. | |
| CM-6 | Ensure the Default Umask is Set Correctly in login.defs |
To ensure the default umask controlled by /etc/login.defs is set properly,
add or correct the umask setting in /etc/login.defs to read as follows:
umask 077 |
The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read and/or written to by unauthorized users. | |
| AC-3 | Verify /boot/grub/grub.conf User Ownership | The file /etc/grub.conf is a symbolic link to
/boot/grub/grub.conf which should be owned by the root user
to prevent destruction or modification of the file.
To properly set the owner of /boot/grub/grub.conf, run the command:
# chown root /boot/grub/grub.conf |
Only root should be able to modify important boot parameters. | |
| AC-3 | Verify /boot/grub/grub.conf Group Ownership | The file /etc/grub.conf is a symbolic link to
/boot/grub/grub.conf which should be group-owned by the root
group to prevent destruction or modification of the file.
To properly set the group owner of /boot/grub/grub.conf, run the command:
# chgrp /boot/grub/grub.conf |
The root group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.
|
|
| AC-3 | Verify /boot/grub/grub.conf Permissions | File permissions for /boot/grub/grub.conf should be set to 600, which
is the default.
To properly set the permissions of /boot/grub/grub.conf, run the command:
# chmod /boot/grub/grub.conf |
Proper permissions ensure that only the root user can modify important boot parameters. | |
| CM-7 | Set Boot Loader Password | The grub boot loader should have password protection
enabled to protect boot-time settings.
To do so, select a password and then generate a hash from it by running:
# grub-crypt --sha-512You will then be prompted to enter a password. Insert the following line into /etc/grub.conf immediately
after the header comments. (Use the output from grub-crypt as the
value of password-hash):
password --encrypted password-hash |
Password protection on the boot loader configuration ensures that users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode. | |
| AC-6 | Require Authentication for Single User Mode | Single-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup. By default, no authentication
is performed if single-user mode is selected.
To require entry of the root password even if the system is started in single-user mode, add or correct the following line in the file /etc/sysconfig/init:
SINGLE=/sbin/sulogin |
This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password. | |
| CM-7 | Disable Interactive Boot |
To disable the ability for users to perform interactive startups,
edit the file /etc/sysconfig/init.
Add or correct the line:
PROMPT=noThe PROMPT option allows the console user to perform an
interactive system startup, in which it is possible to select the
set of services which are started on boot.
|
Using interactive boot, the console user could disable auditing, firewalls, or other services, weakening system security. | |
| AC-3 | Set GNOME Login Inactivity Timeout |
The idle time-out value for period of inactivity GNOME
desktop lockout should be 15 minutes.
# gconftool-2 \ --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type int \ --set /apps/gnome-screensaver/idle_delay 15 |
Setting the idle delay controls when the screensaver will start, and can be combined with screen locking to prevent access from passersby. | |
| CM-6 | GNOME Desktop Screensaver Mandatory Use | Idle activation of the screen saver should be
enabled
# gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/gnome-screensaver/idle_activation_enabled true |
Enabling idle activation of the screen saver ensures that the screensaver will be activated after the idle delay. | |
| AC-3 | Enable Screen Lock Activation After Idle Period | Idle activation of the screen lock should be
enabled.
# gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /apps/gnome-screensaver/lock_enabled true |
Enabling the activation of the screen lock after an idle period ensures that password entry will be required in order to access the system, preventing access by passersby. | |
| CM-6 | Implement Blank Screen Saver |
The screen saver should be blank.
# gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type string \ --set /apps/gnome-screensaver/mode blank-only |
Setting the screensaver mode to blank-only conceals the contents of the display from passersby. | |
| CM-6 | Install the vlock Package |
To enable console screen locking, install the vlock package:
# yum install vlockInstruct users to invoke the program when necessary, in order to prevent passersby from abusing their login: $ vlockThe -a option can be used to prevent switching to other
virtual consoles.
|
Installing vlock ensures that a console locking capability is available for users who may need to suspend console logins. | |
| AC-3 | Modify the System Login Banner |
The contents of the file /etc/issue are
displayed on the screen just above the login prompt for users
logging directly into a terminal. Remote login programs such as
SSH or FTP can be configured to display /etc/issue as well.
Instructions for configuring these daemons are available later.
By default, the system will display the version of the OS, the kernel version, and the host name. Edit /etc/issue. Replace the default text with a message
compliant with the local site policy or a legal disclaimer.
|
Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. | |
| AC-3 | Enable GUI Warning Banner |
To enable displaying a login warning banner in the GNOME
Display Manager's login screen, run the following command:
sudo -u gdm gconftool-2 \ --type bool \ --set /apps/gdm/simple-greeter/banner_message_enable trueTo display a banner, this setting must be enabled and then banner text must also be set. |
Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. | |
| AC-3 | Set GUI Warning Banner Text |
To set the text shown by the GNOME Display Manager
in the login screen, run the following command:
sudo -u gdm gconftool-2 \ --type string \ --set /apps/gdm/simple-greeter/banner_message_text \ "Text of the warning banner here"When entering a warning banner that spans several lines, remember to begin and end the string with ". This command writes
directly to the file /var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml,
and this file can later be edited directly if necessary.
|
Although unlikely to dissuade a serious attacker, the warning message reinforces policy awareness during the logon process. | |
| AC-23 | Disable the User List | GDM's list of previously logged in users should not be displayed. | ||
| CM-6 | Disable Unused Interfaces | If the system does not require network communications but still
needs to use the loopback interface, remove all files of the form
ifcfg-interface except for ifcfg-lo from
/etc/sysconfig/network-scripts:
# rm /etc/sysconfig/network-scripts/ifcfg-interfaceIf the system is a standalone machine with no need for network access or even communication over the loopback device, then disable this service. The network service can be disabled with the following command:
# chkconfig network off |
The network interfaces expand the attack surface of a system. Although unusual, if they are not needed they should be disabled. | |
| CM-6 | Disable Zeroconf Networking | Zeroconf networking allows the system to assign itself an IP
address and engage in IP communication without a statically-assigned address or
even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not
recommended. To disable Zeroconf automatic route assignment in the 169.245.0.0
subnet, add or correct the following line in /etc/sysconfig/network:
NOZEROCONF=yes |
Zeroconf addresses are in the network 169.254.0.0. The networking scripts add entries to the system’s routing table for these addresses. Zeroconf address assignment commonly occurs when the system is configured to use DHCP but fails to receive an address assignment from the DHCP server. | |
| CM-6 | Ensure System is Not Acting as a Network Sniffer | The system should not be acting as a network sniffer, which can
capture all traffic on the network to which it is connected. Run the following
to determine if any interface is running in promiscuous mode:
$ ip link | grep PROMISC |
If any results are returned then a sniffing process (such as tcpdump or wireshark) is likely to be using the interface and this should be investigated. | |
| AC-4 | Disable Kernel Parameter for Sending ICMP Redirects by Default |
To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.default.send_redirects0 |
Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for routers. | |
| CM-6 | Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces |
To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.all.send_redirects0 |
Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for routers. | |
| AC-3 | Disable Kernel Parameter for IP Forwarding |
To set the runtime status of the net.ipv4.ip_forward kernel parameter,
run the following command:
# sysctl -w net.ipv4.ip_forward0 |
IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for routers. | |
| CM-7 | Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces |
To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.all.accept_source_route0 |
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. | |
| CM-7 | Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces |
To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.all.accept_redirects0 |
Accepting ICMP redirects has few legitimate uses. It should be disabled unless it is absolutely required. | |
| CM-7 | Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces |
To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.all.secure_redirects0 |
Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. | |
| CM-7 | Enable Kernel Parameter to Log Martian Packets |
To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.all.log_martians1 |
The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected. | |
| AC-4 | Disable Kernel Parameter for Accepting Source-Routed Packets By Default |
To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.default.accept_source_route0 |
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. | |
| AC-4 | Disable Kernel Parameter for Accepting ICMP Redirects By Default |
To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.default.accept_redirects0 |
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. | |
| AC-4 | Disable Kernel Parameter for Accepting Secure Redirects By Default |
To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.default.secure_redirects0 |
Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required. | |
| AC-3 | Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests |
To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter,
run the following command:
# sysctl -w net.ipv4.icmp_echo_ignore_broadcasts1 |
Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network. | |
| AC-3 | Enable Kernel Parameter to Ignore Bogus ICMP Error Responses |
To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter,
run the following command:
# sysctl -w net.ipv4.icmp_ignore_bogus_error_responses1 |
Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged. | |
| CM-6 | Enable Kernel Parameter to Use TCP Syncookies |
To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter,
run the following command:
# sysctl -w net.ipv4.tcp_syncookies1 |
A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests. | |
| AC-4 | Enable Kernel Parameter to Use Reverse Path Filtering for All Interfaces |
To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.all.rp_filter1 |
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. | |
| AC-4 | Enable Kernel Parameter to Use Reverse Path Filtering by Default |
To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter,
run the following command:
# sysctl -w net.ipv4.conf.default.rp_filter1 |
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks. | |
| CM-7 | Disable WiFi or Bluetooth BIOS | Some systems that include built-in wireless support offer the ability to disable the device through the BIOS. This is system-specific; consult your hardware manual or explore the BIOS setup during boot. | Disabling wireless support in the BIOS prevents easy activation of the wireless interface, generally requiring administrators to reboot the system first. | |
| CM-7 | Deactivate Wireless Network Interfaces | Deactivating wireless network interfaces should prevent
normal usage of the wireless capability.
First, identify the interfaces available with the command: # ifconfig -a>Additionally,the following command may also be used to determine whether wireless support ('extensions') is included for a particular interface, though this may not always be a clear indicator: # iwconfigAfter identifying any wireless interfaces (which may have names like wlan0, ath0, wifi0, em1 or
eth0), deactivate the interface with the command:
# ifdown interfaceThese changes will only last until the next reboot. To disable the interface for future boots, remove the appropriate interface file from /etc/sysconfig/network-scripts:
# rm /etc/sysconfig/network-scripts/ifcfg-interface |
Wireless networking allows attackers within physical proximity to launch network-based attacks against systems, including those against local LAN protocols which were not designed with security in mind. | |
| AC-18 | Disable Bluetooth Service |
The bluetooth service can be disabled with the following command:
# chkconfig bluetooth off |
Disabling the bluetooth service prevents the system from attempting
connections to to Bluetooth devices, which entails some security risk.
Nevertheless, variation in this risk decision may be expected due to the
utility of Bluetooth connectivity and its limited range. |
|
| AC-18 | Disable Bluetooth Kernel Modules | The kernel's module loading system can be configured to prevent
loading of the Bluetooth module. Add the following to
the appropriate /etc/modprobe.d configuration file
to prevent the loading of the Bluetooth module:
install net-pf-31 /bin/true install bluetooth /bin/true |
If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation. | |
| CM-6 | Disable IPv6 Networking Support Automatic Loading | To prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack, add the following line to /etc/modprobe.d/disabled.conf (or another file in /etc/modprobe.d):
options ipv6 disable=1This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol. |
Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation. | |
| CM-6 | Disable Interface Usage of IPv6 | To prevent configuration of IPv6 for all interfaces, add or correct the following lines in /etc/sysconfig/network:
NETWORKING_IPV6=no IPV6INIT=noFor each network interface IFACE , add or correct the following lines in /etc/sysconfig/network-scripts/ ifcfg-IFACE as an additional prevention mechanism:
IPV6INIT=no |
||
| CM-6 | Disable Support for RPC IPv6 | RPC services for NFSv4 try to load transport modules for udp6 and tcp6 by default, even if IPv6 has been disabled in /etc/modprobe.d. To prevent RPC services such as rpc.mountd from attempting to start IPv6 network listeners, remove or comment out the following two lines in /etc/netconfig:
udp6 tpi_clts v inet6 udp - - tcp6 tpi_cots_ord v inet6 tcp - - |
||
| CM-7 | Disable Accepting IPv6 Router Advertisements | The default setting for accepting IPv6 router
advertisements should be: /etc/sysctl.conf to limit the configuration information requested from other systems, and accepted from the network:
net.ipv6.conf.default.accept_ra = |
||
| CM-6 | Disable Accepting IPv6 Redirects | The setting for accepting IPv6 redirects should be: /etc/sysctl.conf to limit the configuration information requested from other systems, and accepted from the network:
net.ipv6.conf.default.accept_redirects = |
An illicit ICMP redirect message could result in a man-in-the-middle attack. | |
| CM-6 | Manually Assign Global IPv6 Address | To manually assign an IP address for an interface IFACE , edit the file /etc/sysconfig/network-scripts/ifcfg-IFACE. Add or correct the following line (substituting the correct IPv6 address):
IPV6ADDR=2001:0DB8::ABCD/64Manually assigning an IP address is preferable to accepting one from routers or from the network otherwise. The example address here is an IPv6 address reserved for documentation purposes, as defined by RFC3849. |
||
| CM-6 | Use Privacy Extensions for Address | To introduce randomness into the automatic generation of IPv6 addresses, add or correct the following line in /etc/sysconfig/network-scripts/ifcfg-IFACE:
IPV6_PRIVACY=rfc3041Automatically-generated IPv6 addresses are based on the underlying hardware (e.g. Ethernet) address, and so it becomes possible to track a piece of hardware over its lifetime using its traffic. If it is important for a system's IP address to not trivially reveal its hardware address, this setting should be applied. |
||
| CM-6 | Manually Assign IPv6 Router Address | Edit the file /etc/sysconfig/network-scripts/ifcfg-IFACE, and add or correct the following line (substituting your gateway IP as appropriate):
IPV6_DEFAULTGW=2001:0DB8::0001Router addresses should be manually set and not accepted via any autoconfiguration or router advertisement. |
||
| CM-6 | Limit Network-Transmitted Configuration | Add the following lines to /etc/sysctl.conf to limit the configuration information requested from other systems, and accepted from the network:
net.ipv6.conf.default.router_solicitations = 0 net.ipv6.conf.default.accept_ra_rtr_pref = 0 net.ipv6.conf.default.accept_ra_pinfo = 0 net.ipv6.conf.default.accept_ra_defrtr = 0 net.ipv6.conf.default.autoconf = 0 net.ipv6.conf.default.dad_transmits = 0 net.ipv6.conf.default.max_addresses = 1The router_solicitations setting determines how many router solicitations are sent when bringing up the interface. If addresses are statically assigned, there is no need to send any solicitations.
The accept_ra_pinfo setting controls whether the system will accept prefix info from the router.
The accept_ra_defrtr setting controls whether the system will accept Hop Limit settings from a router advertisement. Setting it to 0 prevents a router from changing your default IPv6 Hop Limit for outgoing packets.
The autoconf setting controls whether router advertisements can cause the system to assign a global unicast address to an interface.
The dad_transmits setting determines how many neighbor solicitations to send out per address (global and link-local) when bringing up an interface to ensure the desired address is unique on the network.
The max_addresses setting determines how many global unicast IPv6 addresses can be assigned to each interface. The default is 16, but it should be set to exactly the number of statically configured global addresses required.
|
||
| CM-6 | Verify ip6tables Enabled |
The ip6tables service can be enabled with the following command:
# chkconfig ip6tables on |
The ip6tables service provides the system's host-based firewalling
capability for IPv6 and ICMPv6.
|
|
| CM-6 | Verify iptables Enabled |
The iptables service can be enabled with the following command:
# chkconfig iptables on |
The iptables service provides the system's host-based firewalling
capability for IPv4 and ICMP.
|
|
| AC-4 | Set Default Iptables Policy for Incoming Packets | To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
/etc/sysconfig/iptables:
:INPUT DROP [0:0] |
In iptables the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to DROP implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted. |
|
| AC-4 | Set Default Iptables Policy for Forwarded Packets | To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
/etc/sysconfig/iptables:
:FORWARD DROP [0:0] |
In iptables the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to DROP implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted. |
|
| CM-6 | Disable DCCP Support |
The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.
To configure the system to prevent the dccp
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install dccp /bin/true |
Disabling DCCP protects the system against exploitation of any flaws in its implementation. | |
| CM-6 | Disable SCTP Support |
The Stream Control Transmission Protocol (SCTP) is a
transport layer protocol, designed to support the idea of
message-oriented communication, with several streams of messages
within one connection.
To configure the system to prevent the sctp
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install sctp /bin/true |
Disabling SCTP protects the system against exploitation of any flaws in its implementation. | |
| CM-6 | Disable RDS Support |
The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high- bandwidth,
low-latency communications between nodes in a cluster.
To configure the system to prevent the rds
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install rds /bin/true |
Disabling RDS protects the system against exploitation of any flaws in its implementation. | |
| CM-6 | Disable TIPC Support |
The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.
To configure the system to prevent the tipc
kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:
install tipc /bin/true |
Disabling TIPC protects the system against exploitation of any flaws in its implementation. | |
| AC-17 | Install openswan Package | The Openswan package provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks.
The openswan package can be installed with the following command:
# yum install openswan |
Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network. | |
| AU-2 | Ensure rsyslog is Installed |
Rsyslog is installed by default.
The rsyslog package can be installed with the following command:
# yum install rsyslog |
The rsyslog package provides the rsyslog daemon, which provides system logging services. | |
| AU-12 | Enable rsyslog Service | The rsyslog service provides syslog-style logging by default on RHEL 6.
The rsyslog service can be enabled with the following command:
# chkconfig rsyslog on |
The rsyslog service must be running in order to provide
logging services, which are essential to system administration.
|
|
| AC-3 | Ensure Log Files Exist |
The log files written by rsyslog are determined by the second part of each rule line in
/etc/rsyslog.conf. These typically all appear in /var/log.
For any log file LOGFILE referenced in /etc/rsyslog.conf which
does not already exist the following commands will create it and apply proper
permissions:
# touch LOGFILE # chown root:root LOGFILE # chmod 0600 LOGFILE |
If a log file referenced by rsyslog does not exist, rsyslog will not create it and important log messages can be lost. | |
| AC-3 | Ensure Log Files Are Owned By Appropriate User | The owner of all log files written by
rsyslog should be root.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf typically all appear in /var/log.
For each log file LOGFILE referenced in /etc/rsyslog.conf,
run the following command to inspect the file's owner:
$ ls -l LOGFILEIf the owner is not root, run the following command to
correct this:
# chown root LOGFILE |
The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access. | |
| AC-3 | Ensure Log Files Are Owned By Appropriate Group | The group-owner of all log files written by
rsyslog should be root.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
For each log file LOGFILE referenced in /etc/rsyslog.conf,
run the following command to inspect the file's group owner:
$ ls -l LOGFILEIf the owner is not root, run the following command to
correct this:
# chgrp root LOGFILE |
The log files generated by rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Log files should be protected from unauthorized access. | |
| AC-3 | Ensure System Log Files Have Correct Permissions | The file permissions for all log files written by
rsyslog should be set to 600, or more restrictive.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
For each log file LOGFILE referenced in /etc/rsyslog.conf,
run the following command to inspect the file's permissions:
$ ls -l LOGFILEIf the permissions are not 600 or more restrictive, run the following command to correct this: # chmod 0600 LOGFILE |
Log files can contain valuable information regarding system configuratation. If the system log files are not protected unauthorized users could change the logged data, eliminaating their foresive value. | |
| AU-2 | Ensure Logs Sent To Remote Host |
To configure rsyslog to send logs to a remote log server,
open /etc/rsyslog.conf and read and understand the last section of the file,
which describes the multiple directives necessary to activate remote
logging.
Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting loghost.example.com appropriately.
The choice of protocol depends on the environment of the system;
although TCP and RELP provide more reliable message delivery,
they may not be supported in all environments.
To use UDP for log message delivery: *.* @loghost.example.com To use TCP for log message delivery: *.* @@loghost.example.com To use RELP for log message delivery: *.* :omrelp:loghost.example.com |
A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise. | |
| AU-2 | Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server | The rsyslog daemon should not accept remote messages
unless the system acts as a log server.
To ensure that it is not listening on the network, ensure the following lines are
not found in /etc/rsyslog.conf:
$ModLoad imtcp.so $InputTCPServerRun port $ModLoad imudp.so $InputUDPServerRun port $ModLoad imrelp.so $InputRELPServerRun port |
Any process which receives messages from the network incurs some risk of receiving malicious messages. This risk can be eliminated for rsyslog by configuring it not to listen on the network. | |
| AU-2 | Enable rsyslog to Accept Messages via TCP, if Acting As Log Server | The rsyslog daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
/etc/rsyslog.conf to enable reception of messages over TCP:
$ModLoad imtcp.so $InputTCPServerRun 514 |
If the system needs to act as a log server, this ensures that it can receive messages over a reliable TCP connection. | |
| AU-2 | Enable rsyslog to Accept Messages via UDP, if Acting As Log Server | The rsyslog daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
/etc/rsyslog.conf to enable reception of messages over UDP:
$ModLoad imudp.so $InputUDPServerRun 514 |
Many devices, such as switches, routers, and other Unix-like systems, may only support the traditional syslog transmission over UDP. If the system must act as a log server, this enables it to receive their messages as well. | |
| AU-2 | Ensure Logrotate Runs Periodically | The logrotate service should be
enabled. |
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full. | |
| CM-6 | Enable auditd Service | The auditd service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
disk.
The auditd service can be enabled with the following command:
# chkconfig auditd on |
Ensuring that the auditd service is active ensures that
audit records generated by the kernel can be written to disk, or that appropriate
actions will be taken if other obstacles exist.
|
|
| AU-2 | Enable Auditing for Processes Which Start Prior to the Audit Daemon | To ensure that all processes can be audited, even
those which start prior to the audit daemon, add the argument
audit=1 to the kernel line in /etc/grub.conf, in the manner below:
kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1 |
Each process on the system carries an "auditable" flag which
indicates whether its activities can be audited. Although auditd
takes care of enabling this for all processes which launch after it
does, adding the kernel argument ensures that it is set for every
process during boot.
|
|
| AU-2(a) | Record attempts to alter time through adjtimex | On a 32-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b32 -S adjtimex -k audit_time_rulesOn a 64-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b64 -S adjtimex -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules |
Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. | |
| AU-2(a) | Record attempts to alter time through settimeofday | On a 32-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b32 -S settimeofday -k audit_time_rulesOn a 64-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b64 -S settimeofday -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules |
Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. | |
| AU-2(a) | Record Attempts to Alter Time Through stime | On a 32-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b32 -S stime -k audit_time_rulesOn a 64-bit system, the "-S time" is not necessary. The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules |
Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. | |
| AU-2(a) | Record Attempts to Alter Time Through clock_settime | On a 32-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b32 -S clock_settime -k audit_time_rulesOn a 64-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules -a always,exit -F arch=b64 -S clock_settime -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls: -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k audit_time_rules |
Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. | |
| AU-2(a) | Record Attempts to Alter the localtime File | Add the following to /etc/audit/audit.rules:
-w /etc/localtime -p wa -k audit_time_rulesThe -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used. |
Arbitrary changes to the system time can be used to obfuscate nefarious activites in log files as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. | |
| AU-2(a) | Record Events that Modify User/Group Information | Add the following to /etc/audit/audit.rules, in order
to capture events that modify account changes:
# audit_account_changes -w /etc/group -p wa -k audit_account_changes -w /etc/passwd -p wa -k audit_account_changes -w /etc/gshadow -p wa -k audit_account_changes -w /etc/shadow -p wa -k audit_account_changes -w /etc/security/opasswd -p wa -k audit_account_changes |
In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. | |
| AU-2(a) | Record Events that Modify the System's Network Environment | Add the following to /etc/audit/audit.rules, setting
ARCH to either b32 or b64 as appropriate for your system:
# audit_network_modifications -a exit,always -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications -w /etc/issue -p wa -k audit_network_modifications -w /etc/issue.net -p wa -k audit_network_modifications -w /etc/hosts -p wa -k audit_network_modifications -w /etc/sysconfig/network -p wa -k audit_network_modifications |
The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited. | |
| AU-2 | Record Events that Modify the System's Mandatory Access Controls | Add the following to /etc/audit/audit.rules:
-w /etc/selinux/ -p wa -k MAC-policy |
The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - chmod | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - chown | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - fchmod | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - fchmodat | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - fchown | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - fchownat | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - fremovexattr | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - fsetxattr | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - lchown | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - lremovexattr | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - lsetxattr | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - removexattr | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2 | Record Events that Modify the System's Discretionary Access Controls - setxattr | At a minimum the audit system should collect file
permission changes for all users and root. Add the following to
/etc/audit/audit.rules:
-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 \
-k perm_mod
|
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse amoung both authorized and unauthorized users. | |
| AU-2.1 (v) | Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) | At a minimum the audit system should collect
unauthorized file accesses for all users and root. Add the following
to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as
appropriate for your system:
-a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
-S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=ARCH -S creat -S open -S openat -S truncate \
-S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
|
Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise. | |
| AU-2 | Ensure auditd Collects Information on the Use of Privileged Commands | At a minimum the audit system should collect the
execution of privileged commands for all users and root.
To find the relevant setuid programs:
# find / -type f -perm -4000 -o -perm -2000 2>/dev/nullThen, for each setuid program on the system, add a line of the following form to /etc/audit/audit.rules, where SETUID_PROG_PATH is the full path to each setuid program
in the list:
-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged |
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity. | |
| AU-2 | Ensure auditd Collects Information on Exporting to Media (successful) | At a minimum the audit system should collect media
exportation events for all users and root. Add the following to
/etc/audit/audit.rules, setting ARCH to either b32 or b64 as
appropriate for your system:
-a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k export |
The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss. | |
| AU-2 | Ensure auditd Collects File Deletion Events by User | At a minimum the audit system should collect file
deletion events for all users and root. Add the following to
/etc/audit/audit.rules, setting ARCH to either b32 or b64 as
appropriate for your system:
-a always,exit -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat \
-F auid>=500 -F auid!=4294967295 -k delete
|
Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting as well as detecting malicious processes that attempt to delete log files to conceal their presence. | |
| AU-2 | Ensure auditd Collects System Administrator Actions | At a minimum the audit system should collect
administrator actions for all users and root. Add the following to
/etc/audit/audit.rules:
-w /etc/sudoers -p wa -k actions |
The actions taken by system administrators should be audited to keep a record of what was executed on the system as well as for accountability purposes. | |
| AU-2 | Ensure auditd Collects Information on Kernel Module Loading and Unloading | Add the following to /etc/audit/audit.rules in order
to capture kernel module loading and unloading events:
-w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -S init_module -S delete_module -k modules |
The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel. | |
| AU-2 | Make the auditd Configuration Immutable | Add the following to /etc/audit/audit.rules in order
to make the configuration immutable:
-e 2With this setting, a reboot will be required to change any audit rules. |
Making the audit configuration immutable prevents accidential as well as malicious modification of the audit rules, although it may be problematic if legitimate changes are needed during system operation | |
| CM-6 | Disable Automatic Bug Reporting Tool (abrtd) | The Automatic Bug Reporting Tool (abrtd) daemon collects
and reports crash data when an application crash is detected. Using a variety
of plugins, abrtd can email crash reports to system administrators, log crash
reports to files, or forward crash reports to a centralized issue tracking
system such as RHTSupport.
The abrtd service can be disabled with the following command:
# chkconfig abrtd off |
Mishandling crash data could expose sensitive information about vulnerablities in software executing on the local machine, as well as sensitive information from within a process's address space or registers. | |
| CM-6 | Disable Advanced Configuration and Power Interface (acpid) | The Advanced Configuration and Power Interface Daemon (acpid)
dispatches ACPI events (such as power/reset button depressed) to userspace
programs.
The acpid service can be disabled with the following command:
# chkconfig acpid off |
ACPI support is highly desirable for systems in some network roles, such as laptops or desktops. For other systems, such as servers, it may permit accidental or trivially achievable denial of service situations and disabling it may be prudent. | |
| CM-6 | Disable At Service (atd) | The at and batch commands can be used to
schedule tasks that are meant to be executed only once. This allows delayed
execution in a manner similar to cron, except that it is not
recurring. The daemon atd keeps track of tasks scheduled via
at and batch, and executes them at the specified time.
The atd service can be disabled with the following command:
# chkconfig atd off |
The atd service could be used by an unsophisticated insider to carry
out activities outside of a normal login session, which could complicate
accountability. Furthermore, the need to schedule tasks with at or
batch is not common.
|
|
| CM-6 | Disable Certmonger Service (certmonger) | Certmonger is a D-Bus based service that attempts to simplify interaction
with certifying authorities on networks which use public-key infrastructure. It is often
combined with Red Hat's IPA (Identity Policy Audit) security information management
solution to aid in the management of certificates.
The certmonger service can be disabled with the following command:
# chkconfig certmonger off |
The services provided by certmonger may be essential for systems fulfilling some roles a PKI infrastructure, but its functionality is not necesssary for many other use cases. | |
| CM-6 | Disable Control Group Config (cgconfig) | Control groups allow an administrator to allocate system resources (such as CPU,
memory, network bandwidth, etc) among a defined group (or groups) of processes executing on
a system. The cgconfig daemon starts at boot and establishes the predefined control groups.
The cgconfig service can be disabled with the following command:
# chkconfig cgconfig off |
Unless control groups are used to manage system resources, running the cgconfig service is not necessary. | |
| CM-6 | Disable Control Group Rules Engine (cgred) | The cgred service moves tasks into control groups according to
parameters set in the /etc/cgrules.conf configuration file.
The cgred service can be disabled with the following command:
# chkconfig cgred off |
Unless control groups are used to manage system resources, running the cgred service service is not necessary. | |
| CM-6 | Disable CPU Speed (cpuspeed) | The cpuspeed service can adjust the clock speed of supported CPUs based upon
the current processing load thereby conserving power and reducing heat.
The cpuspeed service can be disabled with the following command:
# chkconfig cpuspeed off |
The cpuspeed service is only necessary if adjusting the CPU clock speed
provides benefit. Traditionally this has included laptops (to enhance battery life),
but may also apply to server or desktop environments where conserving power is
highly desirable or necessary.
|
|
| CM-6 | Disable Hardware Abstraction Layer Service (haldaemon) | The Hardware Abstraction Layer Daemon (haldaemon) collects
and maintains information about the system's hardware configuration.
This service is required on a workstation
running a desktop environment, and may be necessary on any system which
deals with removable media or devices.
The haldaemon service can be disabled with the following command:
# chkconfig haldaemon off |
The haldaemon provides essential functionality on systems that use removable media or devices, but can be disabled for systems that do not require these. | |
| CM-6 | Enable IRQ Balance (irqbalance) | The irqbalance service optimizes the balance between
power savings and performance through distribution of hardware interrupts across
multiple processors.
The irqbalance service can be enabled with the following command:
# chkconfig irqbalance on |
In an environment with multiple processors (now common), the irqbalance service provides potential speedups for handling interrupt requests. | |
| CM-6 | Disable KDump Kernel Crash Analyzer (kdump) | The kdump service provides a kernel crash dump analyzer. It uses the kexec
system call to boot a secondary kernel ("capture" kernel) following a system
crash, which can load information from the crashed kernel for analysis.
The kdump service can be disabled with the following command:
# chkconfig kdump off |
Unless the system is used for kernel development or testing, there is little need to run the kdump service. | |
| CM-6 | Disable Software RAID Monitor (mdmonitor) | The mdmonitor service is used for monitoring a software RAID (hardware
RAID setups do not use this service).
The mdmonitor service can be disabled with the following command:
# chkconfig mdmonitor off |
If software RAID monitoring is not required (and it is uncommon), there is no need to run the service. | |
| CM-6 | Disable D-Bus IPC Service (messagebus) | D-Bus provides an IPC mechanism used by
a growing list of programs, such as those used for Gnome, Bluetooth, and Avahi.
Due to these dependencies, disabling D-Bus may not be practical for
many systems.
The messagebus service can be disabled with the following command:
# chkconfig messagebus off |
If no services which require D-Bus are needed, then it can be disabled. As a broker for IPC between processes of different privilege levels, it could be a target for attack. However, disabling D-Bus is likely to be impractical for any system which needs to provide a graphical login session. | |
| CM-6 | Disable Network Console (netconsole) | The netconsole service is responsible for loading the
netconsole kernel module, which logs kernel printk messages over UDP to a
syslog server. This allows debugging of problems where disk logging fails and
serial consoles are impractical.
The netconsole service can be disabled with the following command:
# chkconfig netconsole off |
The netconsole service is not necessary unless there is a need to debug
kernel panics, which is not common.
|
|
| AU-8 | Disable ntpdate Service (ntpdate) | The ntpdate service sets the local hardware clock by polling NTP servers
when the system boots. It synchronizes to the NTP servers listed in
/etc/ntp/step-tickers or /etc/ntp.conf
and then sets the local hardware clock to the newly synchronized
system time.
The ntpdate service can be disabled with the following command:
# chkconfig ntpdate off |
The ntpdate service may only be suitable for systems which
are rebooted frequently enough that clock drift does not cause problems between
reboots. In any event, the functionality of the ntpdate service is now
available in the ntpd program and should be considered deprecated. |
|
| AC-6 | Disable Odd Job Daemon (oddjobd) | The oddjobd service exists to provide an interface and
access control mechanism through which
specified privileged tasks can run tasks for unprivileged client
applications. Communication with oddjobd through the system message bus.
The oddjobd service can be disabled with the following command:
# chkconfig oddjobd off |
The oddjobd service may provide necessary functionality in
some environments but it can be disabled if it is not needed. Execution of
tasks by privileged programs, on behalf of unprivileged ones, has traditionally
been a source of privilege escalation security issues. |
|
| CM-6 | Disable Portreserve (portreserve) | The portreserve service is a TCP port reservation utility that can
be used to prevent portmap from binding to well known TCP ports that are
required for other services.
The portreserve service can be disabled with the following command:
# chkconfig portreserve off |
The portreserve service provides helpful functionality by
preventing conflicting usage of ports in the reserved port range, but it can be
disabled if not needed. |
|
| AU-12 | Enable Process Accounting (psacct) | The process accounting service (psacct) works with programs
including acct and ac to allow system administrators to view
user activity, such as commands issued by users of the system.
The psacct service can be enabled with the following command:
# chkconfig psacct on |
The psacct service can provide administrators a convenient
view into some user activities. However, it should be noted that the auditing
system and its audit records provide more authoritative and comprehensive
records. |
|
| CM-6 | Disable Apache Qpid (qpidd) | The qpidd service provides high speed, secure,
guaranteed delivery services. It is an implementation of the Advanced Message
Queuing Protocol. By default the qpidd service will bind to port 5672 and
listen for connection attempts.
The qpidd service can be disabled with the following command:
# chkconfig qpidd off |
The qpidd service is automatically installed when the "base"
package selection is selected during installation. The qpidd service listens
for network connections which increases the attack surface of the system. If
the system is not intended to receive AMQP traffic then the qpidd
service is not needed and should be disabled or removed. |
|
| CM-6 | Disable Quota Netlink (quota_nld) | The quota_nld service provides notifications to
users of disk space quota violations. It listens to the kernel via a netlink
socket for disk quota violations and notifies the appropriate user of the
violation using D-Bus or by sending a message to the terminal that the user has
last accessed.
The quota_nld service can be disabled with the following command:
# chkconfig quota_nld off |
If disk quotas are enforced on the local system, then the
quota_nld service likely provides useful functionality and should
remain enabled. However, if disk quotas are not used or user notification of
disk quota violation is not desired then there is no need to run this
service. |
|
| AC-4 | Disable Network Router Discovery Daemon (rdisc) | The rdisc service implements the client side of the ICMP
Internet Router Discovery Protocol (IRDP), which allows discovery of routers on
the local subnet. If a router is discovered then the local routing table is
updated with a corresponding default route. By default this daemon is disabled.
The rdisc service can be disabled with the following command:
# chkconfig rdisc off |
General-purpose systems typically have their network and routing information configured statically by a system administrator. Workstations or some special-purpose systems often use DHCP (instead of IRDP) to retrieve dynamic network configuration information. | |
| CM-6 | Disable Red Hat Network Service (rhnsd) | The Red Hat Network service automatically queries Red Hat Network
servers to determine whether there are any actions that should be executed,
such as package updates. This only occurs if the system was registered to an
RHN server or satellite and managed as such.
The rhnsd service can be disabled with the following command:
# chkconfig rhnsd off |
Although systems management and patching is extremely important to system security, management by a system outside the enterprise enclave is not desirable for some environments. | |
| CM-6 | Disable Red Hat Subscription Manager Daemon (rhsmcertd) | The Red Hat Subscription Manager (rhsmcertd) periodically checks for
changes in the entitlement certificates for a registered system and updates it
accordingly.
The rhsmcertd service can be disabled with the following command:
# chkconfig rhsmcertd off |
The rhsmcertd service can provide administrators with some
additional control over which of their systems are entitled to particular
subscriptions. However, for systems that are managed locally or which are not
expected to require remote changes to their subscription status, it is
unnecessary and can be disabled. |
|
| CM-6 | Disable Cyrus SASL Authentication Daemon (saslauthd) | The saslauthd service handles plaintext authentication requests on
behalf of the SASL library. The service isolates all code requiring superuser
privileges for SASL authentication into a single process, and can also be used
to provide proxy authentication services to clients that do not understand SASL
based authentication.
The saslauthd service can be disabled with the following command:
# chkconfig saslauthd off |
The saslauthd service provides essential functionality for
performing authentication in some directory environments, such as those which
use Kerberos and LDAP. For others, however, in which only local files may be
consulted, it is not necessary and should be disabled. |
|
| CM-6 | Disable SMART Disk Monitoring Service (smartd) | SMART (Self-Monitoring, Analysis, and Reporting Technology) is a
feature of hard drives that allows them to detect symptoms of disk failure and
relay an appropriate warning.
The smartd service can be disabled with the following command:
# chkconfig smartd off |
SMART can help protect against denial of service due to failing hardware. Nevertheless, if it is not needed or the system's drives are not SMART-capable (such as solid state drives), it can be disabled. | |
| CM-6 | Disable System Statistics Reset Service (sysstat) | The sysstat service resets various I/O and CPU
performance statistics to zero in order to begin counting from a fresh state
at boot time.
The sysstat service can be disabled with the following command:
# chkconfig sysstat off |
By default the sysstat service merely runs a program at
boot to reset the statistics, which can be retrieved using programs such as
sar and sadc. These may provide useful insight into system
operation, but unless used this service can be disabled. |
|
| CM-6 | Enable cron Service | The crond service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
The crond service can be enabled with the following command:
# chkconfig crond on |
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential. | |
| CM-6 | Disable atd Service |
The at service can be disabled with the following command:
# chkconfig at off |
Many of the periodic or delayed execution features of the at daemon can be provided through the cron daemon instead. | |
| CM-6 | Disable Avahi Server Software |
The avahi-daemon service can be disabled with the following command:
# chkconfig avahi-daemon off |
Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted. | |
| CM-6 | Serve Avahi Only via Required Protocol |
If you are using only IPv4, edit /etc/avahi/avahi-daemon.conf and ensure
the following line exists in the [server] section:
use-ipv6=noSimilarly, if you are using only IPv6, disable IPv4 sockets with the line: use-ipv4=no |
||
| AC-4 | Check Avahi Responses' TTL Field |
To make Avahi ignore packets unless the TTL field is 255, edit
/etc/avahi/avahi-daemon.conf and ensure the following line
appears in the [server] section:
check-response-ttl=yes |
This helps to ensure that only mDNS responses from the local network are processed, because the TTL field in a packet is decremented from its initial value of 255 whenever it is routed from one network to another. Although a properly-configured router or firewall should not allow mDNS packets into the local network at all, this option provides another check to ensure they are not permitted. | |
| AC-4 | Prevent Other Programs from Using Avahi's Port |
To prevent other mDNS stacks from running, edit /etc/avahi/avahi-daemon.conf
and ensure the following line appears in the [server] section:
disallow-other-stacks=yes |
This helps ensure that only Avahi is responsible for mDNS traffic coming from that port on the system. | |
| AC-4 | Disable Avahi Publishing |
To prevent other mDNS stacks from running, edit /etc/avahi/avahi-daemon.conf
and ensure the following line appears in the [server] section:
disallow-other-stacks=yes |
This helps ensure that only Avahi is responsible for mDNS traffic coming from that port on the system. | |
| CM-7 | Disable the CUPS Service |
The cups service can be disabled with the following command:
# chkconfig cups off |
Turn off unneeded services to reduce attack surface. | |
| CM-7 | Disable Firewall Access to Printing Service | If the system does not need to act as a network print server, edit
the files /etc/sysconfig/iptables and
/etc/sysconfig/ip6tables (if IPv6 is in use). In each file, locate and
delete the lines:
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT |
By default, inbound connections to the Internet Printing Protocol port are allowed. If the print server does not need to be accessed, either because the machine is not running the print service at all or because the machine is not providing a remote network printer to other machines, this exception should be removed from the firewall configuration. | |
| TODO:NIST | Disable Print Server Capabilities | To prevent remote users from potentially connecting to and using
locally configured printers, disable the CUPS print server sharing
capabilities. To do so, limit how the server will listen for print jobs by
removing the more generic port directive from /etc/cups/cupsd.conf:
Port 631and replacing it with the Listen directive: Listen localhost:631This will prevent remote users from printing to locally configured printers while still allowing local users on the machine to print normally. |
By default, locally configured printers will not be shared over the network, but if this functionality has somehow been enabled, these recommendations will disable it again. Be sure to disable outgoing printer list broadcasts, or remote users will still be able to see the locally configured printers, even if they cannot actually print to them. To limit print serving to a particular set of users, use the Policy directive. | |
| CM-6 | Disable DHCP Service | The dhcpd service should be disabled on
any system that does not need to act as a DHCP server.
The dhcpd service can be disabled with the following command:
# chkconfig dhcpd off |
Unmanaged or unintentionally activate DHCP servers may provide faulty information to clients, interfering with the operation of a legitimate site DHCP server if there is one. | |
| CM-6 | Uninstall DHCP Server Package | If the system does not need to act as a DHCP server,
the dhcp package can be uninstalled.
The dhcp package can be removed with the following command:
# yum erase dhcp |
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation. | |
| CM-6 | Disable DHCP Client |
For each interface IFACE on the system (e.g. eth0), edit
/etc/sysconfig/network-scripts/ifcfg-IFACE and make the
following changes:
|
DHCP relies on trusting the local network. If the local network is not trusted, then it should not be used. However, the automatic configuration provided by DHCP is commonly used and the alternative, manual configuration, presents an unacceptable burden in many circumstances. | |
| CM-6 | Enable Postfix (postfix) | The Postfix mail transfer agent is used for local mail delivery within
the system. The default configuration only listens for connections to the default SMTP
port (port 25) on the loopback interface (127.0.0.1).
It is recommended to leave this
service enabled for local mail delivery.
The postfix service can be enabled with the following command:
# chkconfig postfix on |
Local mail delivery is essential to some system maintenance and notification tasks. | |
| CM-7 | Disable Postfix Network Listening |
Edit the file /etc/postfix/main.cf to ensure that only the following
inet_interfaces line appears:
inet_interfaces = localhost |
This ensures that postfix accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack.
|
|
| AC-4 | Configure iptables to Allow Access to the Mail Server | Edit /etc/sysconfig/iptables. Add the following line, ensuring that it appears before the final LOG and
DROP lines for the RH-Firewall-1-INPUT chain:
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT |
The default Iptables configuration does not allow inbound access to the SMTP service. This modification allows that access, while keeping other ports on the server in their default protected state. | |
| AC-6 | Verify System Logging and Log Permissions for Mail | Edit the file /etc/rsyslog.conf. Add or correct the following line if necessary (this is the default):
mail.* -/var/log/maillogRun the following commands to ensure correct permissions on the mail log: # chown root:root /var/log/maillog # chmod 600 /var/log/maillogEnsure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of /etc/logrotate.d/syslog (this is the default):
/var/log/maillog |
||
| AC-6 | Install the SSL Certificate | Create the PKI directory for mail certificates, if it does not already exist:
# mkdir /etc/pki/tls/mail # chown root:root /etc/pki/tls/mail # chmod 755 /etc/pki/tls/mailUsing removable media or some other secure transmission format, install the files generated in the previous step onto the mail server: /etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem /etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pemVerify the ownership and permissions of these files: # chown root:root /etc/pki/tls/mail/serverkey.pem # chown root:root /etc/pki/tls/mail/servercert.pem # chmod 600 /etc/pki/tls/mail/serverkey.pem # chmod 644 /etc/pki/tls/mail/servercert.pemVerify that the CA’s public certificate file has been installed as /etc/pki/tls/CA/cacert.pem, and has the
correct permissions:
# chown root:root /etc/pki/tls/CA/cacert.pem # chmod 644 /etc/pki/tls/CA/cacert.pem |
||
| SC-5 | Limit Denial of Service Attacks | Edit /etc/postfix/main.cf. Add or correct the following lines:
default_process_limit = 100 smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 30 queue_minfree = 20971520 header_size_limit = 51200 message_size_limit = 10485760 smtpd_recipient_limit = 100 |
These configuration options serve to make it more difficult for attackers to consume resources on the MTA host.
The default_process_limit parameter controls how many smtpd processes can exist at a time, while
smtpd_client_connection_count_limit controls the number of those which can be occupied by any one
remote sender, and smtpd_client_connection_rate_limit controls the number of connections any one client
can make per minute. By default, local hosts (those in mynetworks) are exempted from per-client rate limiting.
The queue_minfree parameter establishes a free space threshold, in order to stop e-mail receipt before the
queue filesystem is entirely full. The header_size_limit, message_size_limit, and smtpd_recipient_limit
parameters place bounds on the legal sizes of messages received via SMTP.
|
|
| AC-22 | Configure SMTP Greeting Banner | Edit /etc/postfix/main.cf, and add or correct the following line, substituting some other wording for the
banner information if you prefer:
smtpd_banner = $myhostname ESMTP |
The default greeting banner discloses that the listening mail process is Postfix. When remote mail senders connect to the MTA on port 25, they are greeted by an initial banner as part of the SMTP dialogue. This banner is necessary, but it frequently gives away too much information, including the MTA software which is in use, and sometimes also its version number. Remote mail senders do not need this information in order to send mail, so the banner should be changed to reveal only the hostname (which is already known and may be useful) and the word ESMTP, to indicate that the modern SMTP protocol variant is supported. | |
| IA-8 | Configure Trusted Networks and Hosts | Edit /etc/postfix/main.cf, and configure the contents of the mynetworks variable in one of the following
ways:
|
The mynetworks variable must contain only the set of machines for which this MTA should unconditionally
relay mail. This is a trust relationship — if spammers gain access to these machines, your site will effectively
become an open relay. It is recommended that only machines which are managed by you or by another trusted
organization be placed in mynetworks, and users of all other machines be required to use SMTP AUTH to send
mail.
|
|
| SI-8 | Allow Unlimited Relaying for Trusted Networks Only | Edit /etc/postfix/main.cf, and add or correct the smtpd_recipient_restrictions definition so that it
contains at least:
smtpd_recipient_restrictions =
...
permit_mynetworks,
reject_unauth_destination,
...
|
The full contents of smtpd_recipient_restrictions will vary by site, since this is a common place
to put spam restrictions and other site-specific options. The permit_mynetworks option allows all mail to be
relayed from the machines in mynetworks. Then, the reject_unauth_destination option denies all mail
whose destination address is not local, preventing any other machines from relaying. These two options should always appear in
this order, and should usually follow one another immediately unless SMTP AUTH is used.
|
|
| IA-8 | Require SMTP AUTH Before Relaying from Untrusted Clients | SMTP authentication allows remote clients to relay mail safely by requiring them to authenticate before submit-
ting mail. Postfix’s SMTP AUTH uses an authentication library called SASL, which is not part of Postfix itself.
This section describes how to configure authentication using the Cyrus-SASL implementation. See below for a
discussion of other options.
To enable the use of SASL authentication, edit /etc/postfix/main.cf and add or correct the following
settings:
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =
...
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
...
Then edit /usr/lib/sasl2/smtpd.conf and add or correct the following line with the correct authentication
mechanism for SASL to use:
pwcheck_method: saslauthdThe saslauthd service can be enabled with the following command:
# chkconfig saslauthd on |
Postfix can use either the Cyrus library or Dovecot as a source for SASL authentication. If this host is running
Dovecot for some other reason, it is recommended that Dovecot’s SASL support be used instead of running the
Cyrus code as well. See http://www.postfix.org/SASL_README.html for instructions on implementing that
configuration, which is not described in this guide.
In Postfix’s configuration, the directive smtpd_sasl_auth_enable tells smtpd to allow the use of the SMTP AUTH
command during the SMTP dialogue, and to support that command by getting authentication information from
SASL. The smtpd_recipient_restrictions directive is changed so that, if the client is not connecting from a
trusted address, it is allowed to attempt authentication (permit_sasl_authenticated) in order to relay mail.
The file /usr/lib/sasl2/smtpd.conf is the Cyrus-SASL configuration file. The pwcheck_method directive tells
SASL how to find passwords. The simplest method, described above, is to run a separate authentication daemon,
saslauthd, which is able to communicate with the system authentication system. On RHEL6, saslauthd uses
PAM by default, which should work in most cases. If you have a centralized authentication system which does not
work via PAM, look at the saslauthd(8) manpage to find out how to configure saslauthd for your environment.
|
|
| IA-8 | Require TLS for SMTP AUTH | Edit /etc/postfix/main.cf, and add or correct the following lines:
smtpd_tls_CApath = /etc/pki/tls/CA smtpd_tls_CAfile = /etc/pki/tls/CA/cacert.pem smtpd_tls_cert_file = /etc/pki/tls/mail/servercert.pem smtpd_tls_key_file = /etc/pki/tls/mail/serverkey.pem smtpd_tls_security_level = may smtpd_tls_auth_only = yes |
These options tell Postfix to protect all SMTP AUTH transactions using TLS. The first four options describe
the locations of the necessary TLS key files.
The smtpd_tls_security_level directive tells smtpd to allow the STARTTLS command during the SMTP protocol
exchange, but not to require it for mail senders. (Unless your site receives mail only from other trusted sites
whose sysadmins can be asked to maintain a copy of your site certificate, you do not want to require TLS for all
SMTP exchanges.)
The smtpd_tls_auth_only directive tells smtpd to require the STARTTLS command before allowing the client to
attempt to authenticate for relaying using SMTP AUTH. It may not be possible to use this directive if you must
allow relaying from non-TLS-capable client software. If this is the case, simply omit that line.
|
|
| CM-6 | Uninstall openldap-servers Package | The openldap-servers package should be removed if not in use.
Is this machine the OpenLDAP server? If not, remove the package:
# yum erase openldap-serversThe openldap-servers RPM is not installed by default on RHEL6 machines. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed. |
||
| AC-2 | Configure Domain-Specific Parameters | The ldap server should be configured to use a domain specific suffix.
Is this system an OpenLDAP server? If so,
edit the ldap configuration file at
/etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif
to include suffix information relevant to your domain.
olcSuffix: "dc=example,dc=com " olcRootDN: "cn=Manager,dc=example,dc=com "where dc=example,dc=com is the same root you will use on the LDAP clients. These are basic LDAP configuration directives. The suffix parameter gives the root name of all information served by this LDAP server, and should be some name related to your domain. The rootdn parameter names LDAP’s privileged user, who is allowed to read or write all data managed by this LDAP server. |
||
| AC-6 | LDAP Configuration File Security | Is this system an OpenLDAP server? If so,
ensure that the configuration files are protected from unauthorized
access or modification.
Edit the ldap configuration file at /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif.
Ensure that the configuration file has reasonable permissions:
# chown root:ldap /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif
# chmod 640 /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif
Protect configuration files containing the hashed password the same way you would protect other files, such as
/etc/shadow, which contain hashed authentication data.
|
||
| AC-2 | Configure LDAP Root Password | Is this system an OpenLDAP server? If so,
ensure that the RootDN uses a secure password.
Generate a hashed password using the slappasswd utility: # slappasswd New password: Re-enter new password:This will output a hashed password string. Edit the file /etc/openldap/slapd.d/cn=config/olcDatabase={*}bdb.ldif, and add or correct
the line:
olcRootPW: {SSHA}hashed-password-string
Be sure to select a secure password for the LDAP root user, since this user has permission to read and write all
LDAP data, so a compromise of the LDAP root password will probably enable a full compromise of your site.
In addition, be sure to use a reasonably strong hash function. The default hash function should be used. The default hash function is a salted SHA-1 algorith which is FIPS 160-1 compliant. Insecure schemes such as crypt should not be used.
|
||
| AC-6 | Protect LDAP Certificate Files | Create the PKI directory for LDAP certificates if it does not already exist:
# mkdir /etc/pki/tls/ldap # chown root:root /etc/pki/tls/ldap # chmod 755 /etc/pki/tls/ldapUsing removable media or some other secure transmission format, install the files generated in the previous step onto the LDAP server:
# chown root:ldap /etc/pki/tls/ldap/serverkey.pem # chown root:ldap /etc/pki/tls/ldap/servercert.pem # chmod 640 /etc/pki/tls/ldap/serverkey.pem # chmod 640 /etc/pki/tls/ldap/servercert.pemVerify that the CA’s public certificate file has been installed as /etc/pki/tls/CA/cacert.pem, and has the
correct permissions:
# mkdir /etc/pki/tls/CA # chown root:root /etc/pki/tls/CA/cacert.pem # chmod 644 /etc/pki/tls/CA/cacert.pemAs a result of these steps, the LDAP server will have access to its own private certificate and the key with which that certificate is encrypted, and to the public certificate file belonging to the CA. Note that it would be possible for the key to be protected further, so that processes running as ldap could not read it. If this were done, the LDAP server process would need to be restarted manually whenever the server rebooted. |
||
| AC-2 | Configure slapd to Protect Authentication Information | Use ldapmodify to add these entries to the database. Add or correct the following access specifications:
1. Protect the user’s password by allowing the user himself or the LDAP administrators to change it,
allowing the anonymous user to authenticate against it, and allowing no other access:
olcAccess: to attrs=userPassword
by self write
by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
by anonymous auth
by * none
olcAccess: to attrs=shadowLastChange
by self write
by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
by * read
2. Allow anyone to read other information, and allow the administrators to change it:
olcAccess: to *
by group/groupOfUniqueNames/uniqueMember="cn=admins ,ou=groups,dc=example,dc=com " write
by * read
Access rules are applied in the order encountered, so more specific rules should appear first. In particular,
the rule restricting access to userPassword must appear before the rule allowing access to all data. The
shadowLastChange attribute is a timestamp, and is only critical if your site implements password expiration. If
your site does not have an LDAP administrators group, the LDAP root user (called Manager in this guide) will
be able to change data without an explicit access statement.
|
||
| AC-6 | Correct Permissions on LDAP Server Files | Correct the permissions on the ldap server’s files:
# chown ldap:root /var/lib/ldap/*Some manual methods of inserting information into the LDAP database may leave these files with incorrect permissions. This will prevent slapd from starting correctly. |
||
| AC-4 | Configure iptables to Allow Access to the LDAP Server | Determine an appropriate network block, netwk , and network mask, mask , representing the machines on
your network which will synchronize to this server.
Edit /etc/sysconfig/iptables. Add the following lines, ensuring that they appear before the final LOG and
DROP lines for the RH-Firewall-1-INPUT chain:
-A RH-Firewall-1-INPUT -s netwk /mask -m state --state NEW -p tcp --dport 389 -j ACCEPT -A RH-Firewall-1-INPUT -s netwk /mask -m state --state NEW -p tcp --dport 636 -j ACCEPTThe default Iptables configuration does not allow inbound access to any services. These modifications allow access to the LDAP primary (389) and encrypted-only (636) ports, while keeping all other ports on the server in their default protected state. Note: Even if the LDAP server restricts connections so that only encrypted queries are allowed, it will probably be necessary to allow traffic to the default port 389. This is true because many LDAP clients implement encryption by connecting to the primary port and issuing the STARTTLS command. |
||
| AC-6 | Configure Logging for LDAP |
/var/log/ldap.log, and will include that file in the standard log rotation for syslog files.
By default, LDAP’s logging is quite verbose. The loglevel parameter is a space-separated list of items to be
logged. Specifying stats2 will reduce the log output somewhat, but this level will still produce some logging
every time an LDAP query is made. (This may be appropriate, depending on your site’s auditing requirements.)
In order to capture only slapd startup messages, specify loglevel none.
See slapd.conf(5) for detailed information about the loglevel parameter.
|
||
| CM-6 | Disable DNS Server |
The named service can be disabled with the following command:
# chkconfig named off |
All network services involve some risk of compromise due to implementation flaws and should be disabled if possible. | |
| CM-6 | Uninstall bind Package | To remove the bind package, which contains the
named service, run the following command:
# yum erase bind |
If there is no need to make DNS server software available, removing it provides a safeguard against its activation. | |
| CM-6 | Disable vsftpd Service |
The vsftpd service can be disabled with the following command:
# chkconfig vsftpd off |
Running FTP server software provides a network-based avenue of attack, and should be disabled if not needed. Furthermore, the FTP protocol is unencrypted and creates a risk of compromising sensitive information. | |
| CM-6 | Uninstall vsftpd Package |
The vsftpd package can be removed with the following command:
# yum erase vsftpd |
Removing the vsftpd package decreases the risk of its accidental activation. | |
| CM-6 | Install vsftpd Package | If this machine must operate as an FTP server, install the vsftpd package via the standard channels:
# yum install vsftpd |
After RHEL 2.1, Red Hat switched from distributing wu-ftpd with RHEL to distributing vsftpd. For security and for consistency with future Red Hat releases, the use of vsftpd is recommended. | |
| CM-6 | Disable httpd Service |
The httpd service can be disabled with the following command:
# chkconfig httpd off |
Running web server software provides a network-based avenue of attack, and should be disabled if not needed. | |
| CM-6 | Uninstall httpd Package |
The httpd package can be removed with the following command:
# yum erase httpd |
If there is no need to make the web server software available, removing it provides a safeguard against its activation. | |
| CM-6 | Set httpd ServerTokens Directive to Prod |
ServerTokens Prod restricts information in page headers, returning only the word "Apache."
Add or correct the following directive in /etc/httpd/conf/httpd.conf:
ServerTokens Prod |
Information disclosed to clients about the configuration of the web server and system could be used to plan an attack on the given system. This information disclosure should be restricted to a minimum. | |
| CM-6 | Set httpd ServerSignature Directive to Off |
ServerSignature Off restricts httpd from displaying server version number
on error pages.
Add or correct the following directive in /etc/httpd/conf/httpd.conf:
ServerSignature Off |
Information disclosed to clients about the configuration of the web server and system could be used to plan an attack on the given system. This information disclosure should be restricted to a minimum. | |
| CM-6 | Set Permissions on the /var/log/httpd/ Directory |
Ensure that the permissions on the web server log directory is set to 700:
# chmod 700 /var/log/httpd/This is its default setting. |
Access to the web server's log files may allow an unauthorized user or attacker to access information about the web server or alter the server's log files. | |
| CM-6 | Set Permissions on All Configuration Files Inside /etc/httpd/conf/ |
Set permissions on the web server configuration files to 640:
# chmod 640 /etc/httpd/conf/* |
Access to the web server's configuration files may allow an unauthorized user or attacker to access information about the web server or to alter the server's configuration files. |