This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 5. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at

.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for Red Hat Enterprise Linux 5, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Applicable platforms

  • cpe:/o:redhat:enterprise_linux:4
  • cpe:/o:centos:centos:4
  • cpe:/o:redhat:enterprise_linux:5
  • cpe:/o:centos:centos:5

Version: 0.1.31

Revision history

  • draft (as of 2017-03-27)

1. Remediation functions used by the SCAP Security Guide Project

XCCDF form of the various remediation functions as used by remediation scripts from the SCAP Security Guide Project

2. Introduction

The purpose of this guidance is to provide security configuration recommendations and baselines for the Red Hat Enterprise Linux 5 operating system. Recommended settings for the basic operating system are provided, as well as for many network services that the system can provide to other systems. The guide is intended for system administrators. Readers are assumed to possess basic system administration skills for Unix-like systems, as well as some familiarity with the product's documentation and administration conventions. Some instructions within this guide are complex. All directions should be followed completely and with understanding of their effects in order to avoid serious adverse effects on the system and its security.

2.1. General Principles

The following general principles motivate much of the advice in this guide and should also influence any configuration decisions that are not explicitly covered.

2.1.1. Encrypt Transmitted Data Whenever Possible

Data transmitted over a network, whether wired or wireless, is susceptible to passive monitoring. Whenever practical solutions for encrypting such data exist, they should be applied. Even if data is expected to be transmitted only over a local network, it should still be encrypted. Encrypting authentication data, such as passwords, is particularly important. Networks of Red Hat Enterprise Linux 5 machines can and should be configured so that no unencrypted authentication data is ever transmitted between machines.

2.1.2. Minimize Software to Minimize Vulnerability

The simplest way to avoid vulnerabilities in software is to avoid installing that software. On Red Hat Enterprise Linux 5, the RPM Package Manager (originally Red Hat Package Manager, abbreviated RPM) allows for careful management of the set of software packages installed on a system. Installed software contributes to system vulnerability in several ways. Packages that include setuid programs may provide local attackers a potential path to privilege escalation. Packages that include network services may give this opportunity to network-based attackers. Packages that include programs which are predictably executed by local users (e.g. after graphical login) may provide opportunities for trojan horses or other attack code to be run undetected. The number of software packages installed on a system can almost always be significantly pruned to include only the software for which there is an environmental or operational need.

2.1.3. Run Different Network Services on Separate Systems

Whenever possible, a server should be dedicated to serving exactly one network service. This limits the number of other services that can be compromised in the event that an attacker is able to successfully exploit a software flaw in one network service.

2.1.4. Configure Security Tools to Improve System Robustness

Several tools exist which can be effectively used to improve a system's resistance to and detection of unknown attacks. These tools can improve robustness against attack at the cost of relatively little configuration effort. In particular, this guide recommends and discusses the use of host-based firewalling, SELinux for protection against vulnerable services, and a logging and auditing infrastructure for detection of problems.

2.1.5. Least Privilege

Grant the least privilege necessary for user accounts and software to perform tasks. For example, sudo can be implemented to limit authorization to super user accounts on the system only to designated personnel. Another example is to limit logins on server systems to only those administrators who need to log into them in order to perform administration tasks. Using SELinux also follows the principle of least privilege: SELinux policy can confine software to perform only actions on the system that are specifically allowed. This can be far more restrictive than the actions permissible by the traditional Unix permissions model.

2.2. How to Use This Guide

Readers should heed the following points when using the guide.

2.2.1. Read Sections Completely and in Order

Each section may build on information and recommendations discussed in prior sections. Each section should be read and understood completely; instructions should never be blindly applied. Relevant discussion may occur after instructions for an action.

2.2.2. Test in Non-Production Environment

This guidance should always be tested in a non-production environment before deployment. This test environment should simulate the setup in which the system will be deployed as closely as possible.

2.2.3. Root Shell Environment Assumed

Most of the actions listed in this document are written with the assumption that they will be executed by the root user running the /bin/bash shell. Commands preceded with a hash mark (#) assume that the administrator will execute the commands as root, i.e. apply the command via sudo whenever possible, or use su to gain root privileges if sudo cannot be used. Commands which can be executed as a non-root user are are preceded by a dollar sign ($) prompt.

2.2.4. Formatting Conventions

Commands intended for shell execution, as well as configuration file text, are featured in a monospace font. Italics are used to indicate instances where the system administrator must substitute the appropriate information into a command or configuration file.

2.2.5. Reboot Required

A system reboot is implicitly required after some actions in order to complete the reconfiguration of the system. In many cases, the changes will not take effect until a reboot is performed. In order to ensure that changes are applied properly and to test functionality, always reboot the system after applying a set of recommendations from this guide.

3. System Settings

Contains rules that check correct system settings.

Table of Contents

3.1. Installing and Maintaining Software

The following sections contain information on security-relevant choices during the initial operating system installation process and the setup of software updates.

3.1.1. Disk Partitioning

To ensure separation and protection of data, there are top-level system directories which should be placed on their own physical partition or logical volume. The installer's default partitioning scheme creates separate logical volumes for /, /boot, and swap.

  • If starting with any of the default layouts, check the box to "Review and modify partitioning." This allows for the easy creation of additional logical volumes inside the volume group already created, though it may require making /'s logical volume smaller to create space. In general, using logical volumes is preferable to using partitions because they can be more easily adjusted later.

  • If creating a custom layout, create the partitions mentioned in the previous paragraph (which the installer will require anyway), as well as separate ones described in the following sections.

If a system has already been installed, and the default partitioning scheme was used, it is possible but nontrivial to modify it to create separate logical volumes for the directories listed above. The Logical Volume Manager (LVM) makes this possible. See the LVM HOWTO at http://tldp.org/HOWTO/LVM-HOWTO/ for more detailed information on LVM.

3.1.1.a. Ensure /tmp Located On Separate Partition

The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.

The /tmp partition is used as temporary storage by many programs. Placing /tmp in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.

Security identifiers

  • GEN003624

3.1.1.b. Ensure /var Located On Separate Partition

The /var directory is used by daemons and other system services to store frequently-changing data. Ensure that /var has its own partition or logical volume at installation time, or migrate it using LVM.

Ensuring that /var is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the /var directory to contain world-writable directories, installed by other software packages.

Security identifiers

  • GEN003621

3.1.1.c. Ensure /var/log/audit Located On Separate Partition

Audit logs are stored in the /var/log/audit directory. Ensure that it has its own partition or logical volume at installation time, or migrate it later using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.

Placing /var/log/audit in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space.

Security identifiers

  • GEN003623

3.1.1.d. Ensure /home Located On Separate Partition

If user home directories will be stored locally, create a separate partition for /home at installation time (or migrate it later using LVM). If /home will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.

Ensuring that /home is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.

Security identifiers

  • GEN003620

3.1.2. Updating Software

The yum command line tool is used to install and update software packages. The system also provides a graphical software update tool in the System menu, in the Administration submenu, called Software Update.

Red Hat Enterprise Linux systems contain an installed software catalog called the RPM database, which records metadata of installed packages. Consistently using yum or the graphical Software Update for all software installation allows for insight into the current inventory of installed software on the system.

3.1.2.a. Ensure gpgcheck Enabled For All Yum Package Repositories

To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form:

gpgcheck=0

Ensuring all packages' cryptographic signatures are valid prior to installation ensures the authenticity of the software and protects against malicious tampering.

Remediation script

                    grep -R gpgcheck /etc/yum.repos.d/* /etc/yum.conf /root/rpmrc /usr/lib/rpm/redhat/rpmrc /usr/lib/rpm/rpmrc /etc/rpmrc 2>/dev/null | grep -v 'gpgcheck=1' | cut -d: -f1 | sort -u | while read YUM_FILE; do
	sed -i 's/gpgcheck=.*/gpgcheck=1/g' ${YUM_FILE}
done

                  

Security identifiers

  • GEN008800

3.1.2.b. Ensure Software Patches Installed

If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates:

# yum update
If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the Red Hat Network and installed using rpm.

Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities.

Remediation script

                    yum -y update

                  

Security identifiers

  • GEN000120

3.1.3. Software Integrity Checking

Both the AIDE (Advanced Intrusion Detection Environment) software and the RPM package management system provide mechanisms for verifying the integrity of installed software. AIDE uses snapshots of file metadata (such as hashes) and compares these to current system files in order to detect changes. The RPM package management system can conduct integrity checks by comparing information in its metadata database with files installed on the system.

Integrity checking cannot prevent intrusions, but can detect that they have occurred. Requirements for software integrity checking may be highly dependent on the environment in which the system will be used. Snapshot-based approaches such as AIDE may induce considerable overhead in the presence of frequent software updates.

3.1.3.1. Verify Integrity with AIDE

AIDE conducts integrity checks by comparing information about files with previously-gathered information. Ideally, the AIDE database is created immediately after initial system configuration, and then again after any software update. AIDE is highly configurable, with further configuration information located in /usr/share/doc/aide-VERSION.

3.1.3.1.a. Build and Test AIDE Database

Run the following command to generate a new database:

# /usr/sbin/aide --init
By default, the database will be written to the file /var/lib/aide/aide.db.new.gz. Storing the database, the configuration file /etc/aide.conf, and the binary /usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:
# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
To initiate a manual check, run the following command:
# /usr/sbin/aide --check
If this check produces any unexpected output, investigate.

For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.

Remediation script

                      /usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

                    

Security identifiers

  • GEN000140-2

3.1.3.1.b. Configure Periodic Execution of AIDE

To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:

05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.

By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files.

Remediation script

                      echo "/usr/sbin/aide --config=/etc/aide.conf --check" > /etc/cron.weekly/aide
chmod 700 /etc/cron.weekly/aide

                    

Security identifiers

  • GEN000220

3.1.3.2. Verify Integrity with RPM

The RPM package management system includes the ability to verify the integrity of installed packages by comparing the installed files with information about the files taken from the package metadata stored in the RPM database. Although an attacker could corrupt the RPM database (analogous to attacking the AIDE database as described above), this check can still reveal modification of important files. To list which files on the system differ from what is expected by the RPM database:

# rpm -qVa
See the man page for rpm to see a complete explanation of each column.

3.1.3.2.a. Verify File Hashes with RPM

The RPM package management system can check the hashes of installed software packages, including many that are important to system security. Run the following command to list which files on the system have hashes that differ from what is expected by the RPM database:

# rpm -Va | grep '^..5'
A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:
# rpm -qf FILENAME
The package can be reinstalled from a yum repository using the command:
yum reinstall PACKAGENAME
Alternatively, the package can be reinstalled from trusted media using the command:
rpm -Uvh PACKAGENAME

The hashes of important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity on the system.

Security identifiers

  • GEN006565

3.1.3.3. Additional Security Software

Additional security software that is not provided or supported by Red Hat can be installed to provide complementary or duplicative security capabilities to those provided by the base platform. Add-on software may not be appropriate for some specialized systems.

3.1.3.3.a. Install Intrusion Detection Software

The Red Hat platform includes a sophisticated auditing system and SELinux, which provide host-based intrusion detection capabilities.

Host-based intrusion detection tools provide a system-level defense when an intruder gains access to a system or network.

Security identifiers

  • GEN006480

3.1.3.3.b. Install Virus Scanning Software

Install virus scanning software, which uses signatures to search for the presence of viruses on the filesystem. The McAfee uvscan virus scanning tool is provided for DoD systems. Ensure virus definition files are no older than 7 days, or their last release. Configure the virus scanning software to perform scans dynamically on all accessed files. If this is not possible, configure the system to scan all altered files on the system on a daily basis. If the system processes inbound SMTP mail, configure the virus scanner to scan all received mail.

Virus scanning software can be used to detect if a system has been compromised by computer viruses, as well as to limit their spread to other systems.

Security identifiers

  • GEN006640

3.1.3.3.c. Create a Baseline For Device Files

A baseline of device files needs to be generated, and verified on at least a weekly basis.

If an unauthorized device is allowed to exist on the system, there is the possibility the system may perform unauthorized operations.

Remediation script

                      # Generate a device file baseline
find / -type b -o -type c 2>/dev/null | sort  > /var/log/device-file-list
chmod 640 /var/log/device-file-list
chown root:root /var/log/device-file-list

# Generate a weekly cron job to check the device file baseline and report differences
cat > /etc/cron.weekly/baseline_checker.sh <<'STOP_HERE'
#!/bin/sh
echo "Baseline check started on $(date +"%m-%d-%Y") at $(date +"%H:%M:%S")" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
echo "Gathering current baseline." | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
rm -f /tmp/*BASELINE.tmp /tmp/*list.tmp
find / -perm -4000 2>/dev/null | sort > /tmp/suid-file-list.tmp
find / -perm -2000 2>/dev/null | sort > /tmp/sgid-file-list.tmp
find / -type b -o -type c 2>/dev/null | sort  > /tmp/device-file-list.tmp
echo "Comparing the current baseline with the last known good configuration." | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
diff /var/log/suid-file-list /tmp/suid-file-list.tmp > /tmp/SUID_BASELINE.tmp
diff /var/log/sgid-file-list /tmp/sgid-file-list.tmp > /tmp/SGID_BASELINE.tmp
diff /var/log/device-file-list /tmp/device-file-list.tmp > /tmp/DEVICE_BASELINE.tmp
if [ -s /tmp/SUID_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/SUID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the suid bit added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/SUID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/SUID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the suid bit removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/SUID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
if [ -s /tmp/SGID_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/SGID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the sgid bit added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/SGID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/SGID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the sgid bit removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/SGID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
if [ -s /tmp/DEVICE_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/DEVICE_BASELINE.tmp) != 0 ]; then
		echo "The following device files were detected to have been added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/DEVICE_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/DEVICE_BASELINE.tmp) != 0 ]; then
		echo "The following device files were detected to have removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/DEVICE_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
rm -f /tmp/*BASELINE.tmp /tmp/*list.tmp
echo "Baseline check completed on $(date +"%m-%d-%Y") at $(date +"%H:%M:%S")" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
echo "####################################################################" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
chmod 640 /var/log/baseline.log
chown root:root /var/log/baseline.log
STOP_HERE
chmod 700 /etc/cron.weekly/baseline_checker.sh
chown root:root /etc/cron.weekly/baseline_checker.sh

                    

Security identifiers

  • GEN002260

3.1.3.3.d. Create a Baseline For SGID Files

A baseline of sgid files needs to be generated, and verified on at least a weekly basis.

Files with the setgid bit set will allow anyone running these files to be temporarily assigned the group id of the file. While many system files depend on these attributes for proper operation, security problems can result if setgid is assigned to programs allowing reading and writing of files, or shell escapes.

Remediation script

                      # Generate a sgid file baseline
find / -perm -2000 -type f  2>/dev/null | sort > /var/log/sgid-file-list
chmod 640 /var/log/sgid-file-list
chown root:root /var/log/sgid-file-list

# Generate a weekly cron job to check the sgid file baseline and report differences
cat > /etc/cron.weekly/baseline_checker.sh <<'STOP_HERE'
#!/bin/sh
echo "Baseline check started on $(date +"%m-%d-%Y") at $(date +"%H:%M:%S")" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
echo "Gathering current baseline." | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
rm -f /tmp/*BASELINE.tmp /tmp/*list.tmp
find / -perm -4000 2>/dev/null | sort > /tmp/suid-file-list.tmp
find / -perm -2000 2>/dev/null | sort > /tmp/sgid-file-list.tmp
find / -type b -o -type c 2>/dev/null | sort  > /tmp/device-file-list.tmp
echo "Comparing the current baseline with the last known good configuration." | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
diff /var/log/suid-file-list /tmp/suid-file-list.tmp > /tmp/SUID_BASELINE.tmp
diff /var/log/sgid-file-list /tmp/sgid-file-list.tmp > /tmp/SGID_BASELINE.tmp
diff /var/log/device-file-list /tmp/device-file-list.tmp > /tmp/DEVICE_BASELINE.tmp
if [ -s /tmp/SUID_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/SUID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the suid bit added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/SUID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/SUID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the suid bit removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/SUID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
if [ -s /tmp/SGID_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/SGID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the sgid bit added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/SGID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/SGID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the sgid bit removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/SGID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
if [ -s /tmp/DEVICE_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/DEVICE_BASELINE.tmp) != 0 ]; then
		echo "The following device files were detected to have been added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/DEVICE_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/DEVICE_BASELINE.tmp) != 0 ]; then
		echo "The following device files were detected to have removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/DEVICE_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
rm -f /tmp/*BASELINE.tmp /tmp/*list.tmp
echo "Baseline check completed on $(date +"%m-%d-%Y") at $(date +"%H:%M:%S")" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
echo "####################################################################" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
chmod 640 /var/log/baseline.log
chown root:root /var/log/baseline.log
STOP_HERE
chmod 700 /etc/cron.weekly/baseline_checker.sh
chown root:root /etc/cron.weekly/baseline_checker.sh

                    

Security identifiers

  • GEN002460

3.1.3.3.e. Create a Baseline For SUID Files

A baseline of suid files needs to be generated, and verified on at least a weekly basis.

Files with the setuid bit set will allow anyone running these files to be temporarily assigned the UID of the file. While many system files depend on these attributes for proper operation, security problems can result if setuid is assigned to programs allowing reading and writing of files, or shell escapes.

Remediation script

                      # Generate a suid file baseline
find / -perm -4000 -type f 2>/dev/null | sort > /var/log/suid-file-list
chmod 640 /var/log/suid-file-list
chown root:root /var/log/suid-file-list


# Generate a weekly cron job to check the suid file baseline and report differences
cat > /etc/cron.weekly/baseline_checker.sh <<'STOP_HERE'
#!/bin/sh
echo "Baseline check started on $(date +"%m-%d-%Y") at $(date +"%H:%M:%S")" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
echo "Gathering current baseline." | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
rm -f /tmp/*BASELINE.tmp /tmp/*list.tmp
find / -perm -4000 2>/dev/null | sort > /tmp/suid-file-list.tmp
find / -perm -2000 2>/dev/null | sort > /tmp/sgid-file-list.tmp
find / -type b -o -type c 2>/dev/null | sort  > /tmp/device-file-list.tmp
echo "Comparing the current baseline with the last known good configuration." | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
diff /var/log/suid-file-list /tmp/suid-file-list.tmp > /tmp/SUID_BASELINE.tmp
diff /var/log/sgid-file-list /tmp/sgid-file-list.tmp > /tmp/SGID_BASELINE.tmp
diff /var/log/device-file-list /tmp/device-file-list.tmp > /tmp/DEVICE_BASELINE.tmp
if [ -s /tmp/SUID_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/SUID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the suid bit added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/SUID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/SUID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the suid bit removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/SUID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
if [ -s /tmp/SGID_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/SGID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the sgid bit added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/SGID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/SGID_BASELINE.tmp) != 0 ]; then
		echo "The following files were detected to have the sgid bit removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/SGID_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
if [ -s /tmp/DEVICE_BASELINE.tmp ]; then
   if [ $(grep -c "^>" /tmp/DEVICE_BASELINE.tmp) != 0 ]; then
		echo "The following device files were detected to have been added:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^>" /tmp/DEVICE_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
	if [ $(grep -c "^<" /tmp/DEVICE_BASELINE.tmp) != 0 ]; then
		echo "The following device files were detected to have removed:" | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
		grep "^<" /tmp/DEVICE_BASELINE.tmp | awk '{ print $2 }' | tee -a /var/log/baseline.log
		echo -e \\n | tee -a /var/log/baseline.log
	fi
fi
rm -f /tmp/*BASELINE.tmp /tmp/*list.tmp
echo "Baseline check completed on $(date +"%m-%d-%Y") at $(date +"%H:%M:%S")" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
echo "####################################################################" | tee -a /var/log/baseline.log
echo -e \\n | tee -a /var/log/baseline.log
chmod 640 /var/log/baseline.log
chown root:root /var/log/baseline.log
STOP_HERE
chmod 700 /etc/cron.weekly/baseline_checker.sh
chown root:root /etc/cron.weekly/baseline_checker.sh

                    

Security identifiers

  • GEN002400

3.2. File Permissions and Masks

Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which they should not have access.

Several of the commands in this section search filesystems for files or directories with certain characteristics, and are intended to be run on every local partition on a given system. When the variable PART appears in one of the commands below, it means that the command is intended to be run repeatedly, with the name of each local partition substituted for PART in turn.

The following command prints a list of all xfs partitions on the local system, which is the default filesystem for Red Hat Enterprise Linux 7 installations:

$ mount -t xfs | awk '{print $3}'
For any systems that use a different local filesystem type, modify this command as appropriate.

3.2.1. Restrict Partition Mount Options

System partitions can be mounted with certain options that limit what files on those partitions can do. These options are set in the /etc/fstab configuration file, and can be used to make certain types of malicious behavior more difficult.

3.2.1.a. Add nodev Option to Removable Media Partitions

The nodev mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices should exist only in the /dev directory on the root partition or within chroot jails built for system services. Add the nodev option to the fourth column of /etc/fstab for the line which controls mounting of any removable media partitions.

The only legitimate location for device files is the /dev directory located on the root partition. An exception to this is chroot jails, and it is not advised to set nodev on partitions which contain their root filesystems.

Security identifiers

  • GEN002430

3.2.1.b. Add nosuid Option to Removable Media Partitions

The nosuid mount option prevents set-user-identifier (suid) and set-group-identifier (sgid) permissions from taking effect. These permissions allow users to execute binaries with the same permissions as the owner and group of the file respectively. Users should not be allowed to introduce suid and guid files into the system via partitions mounted from removeable media. Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of any removable media partitions.

The presence of suid and sgid executables should be tightly controlled. Allowing users to introduce suid or sgid binaries from partitions mounted off of removable media would allow them to introduce their own highly-privileged programs.

Security identifiers

  • GEN002420

3.2.2. Restrict Dynamic Mounting and Unmounting of Filesystems

Linux includes a number of facilities for the automated addition and removal of filesystems on a running system. These facilities may be necessary in many environments, but this capability also carries some risk -- whether direct risk from allowing users to introduce arbitrary filesystems, or risk that software flaws in the automated mount facility itself could allow an attacker to compromise the system.

This command can be used to list the types of filesystems that are available to the currently executing kernel:

# find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'
If these filesystems are not required then they can be explicitly disabled in a configuratio file in /etc/modprobe.d.

3.2.2.a. Disable Modprobe Loading of USB Storage Driver

To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install usb-storage /bin/true
This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

USB storage devices such as thumb drives can be used to introduce malicious software.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install usb-storage /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install usb-storage /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN008480

3.2.2.b. Disable Kernel Support for USB via Bootloader Configuration

All USB support can be disabled by adding the nousb argument to the kernel's boot loader configuration. To do so, append "nousb" to the kernel line in /etc/grub.conf as shown:

kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb
WARNING: Disabling all kernel support for USB will cause problems for systems with USB-based keyboards, mice, or printers. This configuration is infeasible for systems which require USB devices, which is common.

Disabling the USB subsystem within the Linux kernel at system boot will protect against potentially malicious USB devices, although it is only practical in specialized systems.

Remediation script

                    USB_KEYBOARD=$(grep 'Product=' /proc/bus/usb/devices 2>/dev/null| egrep -ic '(ps2 to usb adapter|keyboard|kvm|sc reader)')
if [ "${USB_KEYBOARD}" = "0" ]; then
	sed -i '/^[ |\t]*kernel/s/$/ nousb/' /boot/grub/grub.conf
# else
	# A USB keyboard was detected so this fix has been skipped.
fi

                  

Security identifiers

  • GEN008460

3.2.2.c. Disable the Automounter

The autofs daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as /misc/cd. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing /etc/fstab rather than relying on the automounter.

The autofs service can be disabled with the following command:

$ sudo chkconfig autofs off

Disabling the automounter permits the administrator to statically control filesystem mounting through /etc/fstab.

Remediation script

                    #
# Disable autofs for all run levels
#
/sbin/chkconfig --level 0123456 autofs off

#
# Stop autofs if currently running
#
/sbin/service autofs stop 1>/dev/null

                  

Security identifiers

  • GEN008440

3.2.3. Verify Permissions on Important Files and Directories

Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses important permission restrictions which can be verified to ensure that no harmful discrepancies have arisen.

3.2.3.a. Verify User Who Owns aliases File

To properly set the owner of /etc/aliases, run the command:

$ sudo chown root /etc/aliases

Remediation script

                    chown root /etc/postfix/aliases /etc/postfix/aliases.db /etc/aliases /etc/aliases.db 2>/dev/null
                  

Security identifiers

  • GEN004400

3.2.3.b. Verify Group Who Owns aliases File

To properly set the group owner of /etc/aliases, run the command:

$ sudo chgrp root /etc/aliases

Remediation script

                    chown :root /etc/postfix/aliases /etc/postfix/aliases.db /etc/aliases /etc/aliases.db 2>/dev/null
                  

Security identifiers

  • GEN004410

3.2.3.c. Verify Permissions on aliases File

To properly set the permissions of /etc/aliases, run the command:

$ sudo chmod 0644 /etc/aliases

Remediation script

                    chmod 644 /etc/postfix/aliases /etc/postfix/aliases.db /etc/aliases /etc/aliases.db 2>/dev/null
                  

Security identifiers

  • GEN004420

3.2.3.d. Verify Extended ACLs on Aliases

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/aliases /etc/aliases.db /etc/postfix/aliases /etc/postfix/aliases.db 2>/dev/null
                  

Security identifiers

  • GEN004430

3.2.3.e. Verify User Who Owns aliases File

To properly set the owner of /etc/aliases, run the command:

$ sudo chown root /etc/aliases

Remediation script

                    grep "/" /etc/aliases /etc/aliases.db | grep -v "#" | grep ^/ | sed 's/.*[\s|\t]\//\//' | xargs chown root
                  

Security identifiers

  • GEN004360

3.2.3.f. Verify Group Who Owns aliases File

To properly set the group owner of /etc/aliases, run the command:

$ sudo chgrp root /etc/aliases

Remediation script

                    grep "/" /etc/aliases /etc/aliases.db | grep -v "#" | grep ^/ | sed 's/.*[\s|\t]\//\//' | xargs chown :root
                  

Security identifiers

  • GEN004370

3.2.3.g. Verify Permissions on aliases File

To properly set the permissions of /etc/aliases, run the command:

$ sudo chmod 0755 /etc/aliases

Remediation script

                    grep "/" /etc/aliases /etc/aliases.db | grep -v "#" | grep ^/ | sed 's/.*[\s|\t]\//\//' | xargs chmod 755
                  

Security identifiers

  • GEN004380

3.2.3.h. Verify Extended ACLs on Aliases Files

No extended ACLs should be applied.

Remediation script

                    grep / /etc/aliases | grep -v "#" | sed s/^[^\/]*// | xargs setfacl --remove-all
                  

Security identifiers

  • GEN004390

3.2.3.i. Verify User Who Owns Audio Device Files

To properly set the owner of /dev/audio, run the command:

$ sudo chown root /dev/audio

Remediation script

                    chown root /dev/audio* /dev/snd/*
                  

Security identifiers

  • GEN002340

3.2.3.j. Verify Group Who Owns Audio Device Files

To properly set the group owner of /dev/audio, run the command:

$ sudo chgrp root /dev/audio

Remediation script

                    chown :root /dev/audio* /dev/snd/*
if [[ "`uname -r`" = "2.6.9"* ]]; then
	sed -i 's/\(^audio\*:[a-z]*:\)[a-z]*:/\1sys:/' /etc/udev/permissions.d/50-udev.permissions
elif [[ "`uname -r`" = "2.6.18"* ]]; then
	sed -i '/^<console>  [0-9]* <sound>/s/<sound>.*/<sound>      0600 root.root/' /etc/security/console.perms.d/50-default.perms
fi

                  

Security identifiers

  • GEN002360

3.2.3.k. Verify Permissions on Audio Device Files

To properly set the permissions of /dev/audio, run the command:

$ sudo chmod 0660 /dev/audio

Remediation script

                    chmod 660 /dev/audio* /dev/snd/*
sed -i '/[audio|snd]/s/MODE="[0-9]*"/MODE="660"/' /etc/udev/rules.d/50-udev.rules
                  

Security identifiers

  • GEN002320

3.2.3.l. Verify Extended ACLs on Audio Device Files

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /dev/audio* /dev/snd/* 2>/dev/null
                  

Security identifiers

  • GEN002330

3.2.3.m. Verify User Who Owns Audit Log Files

To properly set the owner of /var/log/audit/audit.log, run the command:

$ sudo chown root /var/log/audit/audit.log

Remediation script

                    if [ -e /etc/audit/auditd.conf ]; then
	grep ^log_file /etc/audit/auditd.conf | awk '{ print $3 }' | xargs chown root
if [ -e /etc/auditd.conf ]; then
	grep ^log_file /etc/auditd.conf | awk '{ print $3 }' | xargs chown root
fi

                  

Security identifiers

  • GEN002680

3.2.3.n. Verify Group Who Owns Audit Log Files

To properly set the group owner of /var/log/audit/audit.log, run the command:

$ sudo chgrp root /var/log/audit/audit.log

Remediation script

                    if [ -e /etc/audit/auditd.conf ]; then
	grep ^log_file /etc/audit/auditd.conf | awk '{ print $3 }' | xargs chown :root
if [ -e /etc/auditd.conf ]; then
	grep ^log_file /etc/auditd.conf | awk '{ print $3 }' | xargs chown :root
fi

                  

Security identifiers

  • GEN002690

3.2.3.o. Verify Permissions on Audit Log Files

System Audit Log Directory Must Have Mode 0755 or Less Permissive and System Audit Logs Must Have Mode 0640 or Less Permissive. Change the mode of the audit log directory with the following command:

# chmod 0755 /var/log/audit/
Change the mode of the audit log files with the following command:
# chmod 0640 audit_file

If users can write to audit logs, audit trails can be modified or destroyed.

Remediation script

                    if [ -e /etc/audit/auditd.conf ]; then
	grep ^log_file /etc/audit/auditd.conf | awk '{ print $3 }' | xargs chmod 640
elif [ -e /etc/auditd.conf ]; then
	grep ^log_file /etc/auditd.conf | awk '{ print $3 }' | xargs chmod 640
fi

                  

Security identifiers

  • GEN002700

3.2.3.p. Verify Extended ACLs on Audit Log Files

No extended ACLs should be applied.

Remediation script

                    if [ -e /etc/audit/auditd.conf ]; then
	grep "^log_file" /etc/audit/auditd.conf | sed s/^[^\/]*// | xargs setfacl --remove-all
elif [ -e /etc/auditd.conf ]; then
	grep "^log_file" /etc/auditd.conf | sed s/^[^\/]*// | xargs setfacl --remove-all
fi

                  

Security identifiers

  • GEN002710

3.2.3.q. Verify User Who Owns Audit Tool Files

To properly set the owner of /sbin/au*, run the command:

$ sudo chown root /sbin/au*

Remediation script

                    chown root /sbin/auditctl /sbin/auditd /sbin/ausearch /sbin/aureport /sbin/autrace /sbin/audispd
                  

Security identifiers

  • GEN002715

3.2.3.r. Verify Group Who Owns Audit Tool Files

To properly set the group owner of /sbin/au*, run the command:

$ sudo chgrp root /sbin/au*

Remediation script

                    chown :root /sbin/auditctl /sbin/auditd /sbin/ausearch /sbin/aureport /sbin/autrace /sbin/audispd
                  

Security identifiers

  • GEN002716

3.2.3.s. Verify Permissions on Audit Tool Files

To properly set the permissions of /sbin/au*, run the command:

$ sudo chmod 0750 /sbin/au*

Remediation script

                    chmod 750 /sbin/auditctl /sbin/auditd /sbin/ausearch /sbin/aureport /sbin/autrace /sbin/audispd
                  

Security identifiers

  • GEN002717

3.2.3.t. Verify Extended ACLs on Audit Tool Files

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /sbin/auditctl /sbin/auditd /sbin/ausearch /sbin/aureport /sbin/autrace /sbin/audispd
                  

Security identifiers

  • GEN002718

3.2.3.u. Verify User Who Owns Traceroute

To properly set the owner of /bin/traceroute, run the command:

$ sudo chown root /bin/traceroute

Remediation script

                    chown root /bin/traceroute
                  

Security identifiers

  • GEN003960

3.2.3.v. Verify Group Who Owns Traceroute

To properly set the group owner of /bin/traceroute, run the command:

$ sudo chgrp root /bin/traceroute

Remediation script

                    chown :root /bin/traceroute
                  

Security identifiers

  • GEN003980

3.2.3.w. Verify Permissions on Traceroute

To properly set the permissions of /bin/traceroute, run the command:

$ sudo chmod 0700 /bin/traceroute

Remediation script

                    chmod 700 /bin/traceroute

                  

Security identifiers

  • GEN004000

3.2.3.x. Verify Extended ACLs on Traceroute

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /bin/traceroute
                  

Security identifiers

  • GEN004010

3.2.3.y. Verify User Who Owns Core Dump Directory

To properly set the owner of /var/crash, run the command:

$ sudo chown root /var/crash

Remediation script

                    grep path.*/ /etc/kdump.conf | awk '{ print $2 }' | chown root
                  

Security identifiers

  • GEN003520

3.2.3.z. Verify Group Who Owns Core Dump Directory

To properly set the group owner of /var/crash, run the command:

$ sudo chgrp root /var/crash

Remediation script

                    grep path.*/ /etc/kdump.conf | awk '{ print $2 }' | xargs chown :root
                  

Security identifiers

  • GEN003521

3.2.3.aa. Verify Permissions on Core Dump Directory

To properly set the permissions of /var/crash, run the command:

$ sudo chmod 0700 /var/crash

Remediation script

                    grep path.*/ /etc/kdump.conf | awk '{ print $2 }' | xargs chmod 700
                  

Security identifiers

  • GEN003522

3.2.3.ab. Verify Extended ACLs on Core Dump Directory

No extended ACLs should be applied.

Remediation script

                    grep path /etc/kdump.conf | grep -v "#" | awk '{ print $2 }' | xargs setfacl --remove-all
                  

Security identifiers

  • GEN003523

3.2.3.ac. Verify Permissions on Cron Log Files

To properly set the permissions of /var/log/cron, run the command:

$ sudo chmod 0600 /var/log/cron

Remediation script

                    grep ^cron /etc/syslog.conf | awk '{ print $2 }' | xargs chmod 0600

                  

Security identifiers

  • GEN003180

3.2.3.ad. Verify Extended ACLs on Cron Log Files

No extended ACLs should be applied.

Remediation script

                    grep cron /etc/syslog.conf | grep -v "#" | awk '{ print $2 }' | xargs setfacl --remove-all
                  

Security identifiers

  • GEN003190

3.2.3.ae. Verify User Who Owns Crontab Directories

To properly set the owner of /var/spool/cron, run the command:

$ sudo chown root /var/spool/cron

Remediation script

                    chown root /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /var/spool/cron 2>/dev/null
                  

Security identifiers

  • GEN003120

3.2.3.af. Verify Group Who Owns Crontab Directories

To properly set the group owner of /var/spool/cron, run the command:

$ sudo chgrp root /var/spool/cron

Remediation script

                    chown :root /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /var/spool/cron 2>/dev/null
                  

Security identifiers

  • GEN003140

3.2.3.ag. Verify Permissions on Crontab Directories

To properly set the permissions of /var/spool/cron, run the command:

$ sudo chmod 0755 /var/spool/cron

Remediation script

                    chmod 755 /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /var/spool/cron 2>/dev/null

                  

Security identifiers

  • GEN003100

3.2.3.ah. Verify Extended ACLs on Crontab Directories

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /var/spool/cron 2>/dev/null
                  

Security identifiers

  • GEN003110

3.2.3.ai. Verify User Who Owns Crontab Files

To properly set the owner of /etc/cron*, run the command:

$ sudo chown root /etc/cron*

Remediation script

                    chown root /etc/crontab /etc/cron.d/* /var/spool/cron/* 2>/dev/null
                  

Security identifiers

  • GEN003040

3.2.3.aj. Verify Group Who Owns Crontab Files

To properly set the group owner of /etc/cron*, run the command:

$ sudo chgrp root /etc/cron*

Remediation script

                    chown :root /etc/crontab /etc/cron.d/* /var/spool/cron/* 2>/dev/null
                  

Security identifiers

  • GEN003050

3.2.3.ak. Verify Permissions on Crontab Files

To properly set the permissions of /etc/cron*, run the command:

$ sudo chmod 0600 /etc/cron*

Remediation script

                    chmod 600 /etc/crontab /etc/cron.d/* /var/spool/cron/* 2>/dev/null
                  

Security identifiers

  • GEN003080

3.2.3.al. Verify Extended ACLs on Crontab Files

No extended ACLs should be applied.

Remediation script

                    find /etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /var/spool/cron  -type f 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN003090

3.2.3.am. Verify Permissions on Cron Files

To properly set the permissions of /etc/cron*, run the command:

$ sudo chmod 0700 /etc/cron*

Remediation script

                    chmod 0700 /etc/cron.daily/* /etc/cron.hourly/* /etc/cron.monthly/* /etc/cron.weekly/* 2>/dev/null
                  

Security identifiers

  • GEN003080-2

3.2.3.an. Verify User Who Owns at.allow

To properly set the owner of /etc/at.allow, run the command:

$ sudo chown root /etc/at.allow

Remediation script

                    chown root /etc/at.allow
                  

Security identifiers

  • GEN003460

3.2.3.ao. Verify Group Who Owns at.allow

To properly set the group owner of /etc/at.allow, run the command:

$ sudo chgrp root /etc/at.allow

Remediation script

                    chown :root /etc/at.allow
                  

Security identifiers

  • GEN003470

3.2.3.ap. Verify Permissions on at.allow

To properly set the permissions of /etc/at.allow, run the command:

$ sudo chmod 0600 /etc/at.allow

Remediation script

                    chmod 0600 /etc/at.allow

                  

Security identifiers

  • GEN003340

3.2.3.aq. Verify Extended ACLs on at.allow

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/at.allow
                  

Security identifiers

  • GEN003245

3.2.3.ar. Verify User Who Owns at.deny

To properly set the owner of /etc/at.deny, run the command:

$ sudo chown root /etc/at.deny

Remediation script

                    chown root /etc/at.deny
                  

Security identifiers

  • GEN003480

3.2.3.as. Verify Group Who Owns at.deny

To properly set the group owner of /etc/at.deny, run the command:

$ sudo chgrp root /etc/at.deny

Remediation script

                    chown :root /etc/at.deny
                  

Security identifiers

  • GEN003490

3.2.3.at. Verify Permissions on at.deny

To properly set the permissions of /etc/at.deny, run the command:

$ sudo chmod 0600 /etc/at.deny

Remediation script

                    chmod 0600 /etc/at.deny

                  

Security identifiers

  • GEN003252

3.2.3.au. Verify Extended ACLs on at.deny

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/at.deny
                  

Security identifiers

  • GEN003255

3.2.3.av. Verify User Who Owns cron.allow

To properly set the owner of /etc/cron.allow, run the command:

$ sudo chown root /etc/cron.allow

Remediation script

                    chown root /etc/cron.allow
                  

Security identifiers

  • GEN003240

3.2.3.aw. Verify Group Who Owns cron.allow

To properly set the group owner of /etc/cron.allow, run the command:

$ sudo chgrp root /etc/cron.allow

Remediation script

                    chown :root /etc/cron.allow
                  

Security identifiers

  • GEN003250

3.2.3.ax. Verify Permissions on cron.allow

To properly set the permissions of /etc/cron.allow, run the command:

$ sudo chmod 0600 /etc/cron.allow

Remediation script

                    chmod 0600 /etc/cron.allow

                  

Security identifiers

  • GEN002980

3.2.3.ay. Verify Extended ACLs on cron.allow

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/cron.allow
                  

Security identifiers

  • GEN002990

3.2.3.az. Verify User Who Owns cron.deny

To properly set the owner of /etc/cron.deny, run the command:

$ sudo chown root /etc/cron.deny

Remediation script

                    chown root /etc/cron.deny
                  

Security identifiers

  • GEN003260

3.2.3.ba. Verify Group Who Owns cron.deny

To properly set the group owner of /etc/cron.deny, run the command:

$ sudo chgrp root /etc/cron.deny

Remediation script

                    chown :root /etc/cron.deny
                  

Security identifiers

  • GEN003270

3.2.3.bb. Verify Permissions on cron.deny

To properly set the permissions of /etc/cron.deny, run the command:

$ sudo chmod 0600 /etc/cron.deny

Remediation script

                    chmod 0600 /etc/cron.deny

                  

Security identifiers

  • GEN003200

3.2.3.bc. Verify Extended ACLs on cron.deny

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/cron.deny
                  

Security identifiers

  • GEN003210

3.2.3.bd. Verify User Who Owns printers.conf

To properly set the owner of /etc/cups/printers.conf, run the command:

$ sudo chown root /etc/cups/printers.conf

Remediation script

                    chown root /etc/cups/printers.conf
                  

Security identifiers

  • GEN003920

3.2.3.be. Verify Group Who Owns printers.conf

To properly set the group owner of /etc/cups/printers.conf, run the command:

$ sudo chgrp root /etc/cups/printers.conf

Remediation script

                    chown :root /etc/cups/printers.conf
                  

Security identifiers

  • GEN003930

3.2.3.bf. Verify Permissions on printers.conf

To properly set the permissions of /etc/cups/printers.conf, run the command:

$ sudo chmod 0644 /etc/cups/printers.conf

Remediation script

                    chmod 0644 /etc/cups/printers.conf

                  

Security identifiers

  • GEN003940

3.2.3.bg. Verify Extended ACLs on printers.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/cups/printers.conf
                  

Security identifiers

  • GEN003950

3.2.3.bh. Verify User Who Owns Exports

To properly set the owner of /etc/exports, run the command:

$ sudo chown root /etc/exports

Remediation script

                    chown root /etc/exports
                  

Security identifiers

  • GEN005740

3.2.3.bi. Verify Group Who Owns Exports

To properly set the group owner of /etc/exports, run the command:

$ sudo chgrp root /etc/exports

Remediation script

                    chown :root /etc/exports
                  

Security identifiers

  • GEN005750

3.2.3.bj. Verify Permissions on Exports

To properly set the permissions of /etc/exports, run the command:

$ sudo chmod 0644 /etc/exports

Remediation script

                    chmod 0644 /etc/exports

                  

Security identifiers

  • GEN005760

3.2.3.bk. Verify Extended ACLs on Exports

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/exports
                  

Security identifiers

  • GEN005770

3.2.3.bl. Verify User Who Owns Hosts

To properly set the owner of /etc/hosts, run the command:

$ sudo chown root /etc/hosts

Remediation script

                    chown root /etc/hosts
                  

Security identifiers

  • GEN001366

3.2.3.bm. Verify Group Who Owns Hosts

To properly set the group owner of /etc/hosts, run the command:

$ sudo chgrp root /etc/hosts

Remediation script

                    chown :root /etc/hosts
                  

Security identifiers

  • GEN001367

3.2.3.bn. Verify Permissions on Hosts

To properly set the permissions of /etc/hosts, run the command:

$ sudo chmod 0644 /etc/hosts

Remediation script

                    chmod 0644 /etc/hosts

                  

Security identifiers

  • GEN001368

3.2.3.bo. Verify Extended ACLs on Hosts

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/hosts
                  

Security identifiers

  • GEN001369

3.2.3.bp. Verify User Who Owns ldap.conf

To properly set the owner of /etc/ldap.conf, run the command:

$ sudo chown root /etc/ldap.conf

Remediation script

                    chown root /etc/ldap.conf
                  

Security identifiers

  • GEN008080

3.2.3.bq. Verify Group Who Owns ldap.conf

To properly set the group owner of /etc/ldap.conf, run the command:

$ sudo chgrp root /etc/ldap.conf

Remediation script

                    chown :root /etc/ldap.conf
                  

Security identifiers

  • GEN008100

3.2.3.br. Verify Permissions on ldap.conf

To properly set the permissions of /etc/ldap.conf, run the command:

$ sudo chmod 0644 /etc/ldap.conf

Remediation script

                    chmod 0644 /etc/ldap.conf

                  

Security identifiers

  • GEN008060

3.2.3.bs. Verify Extended ACLs on ldap.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/ldap.conf
                  

Security identifiers

  • GEN008120

3.2.3.bt. Verify Permissions on infeed.conf

To properly set the permissions of /etc/news/infeed.conf, run the command:

$ sudo chmod 0600 /etc/news/infeed.conf

Remediation script

                    chmod 0600 /etc/news/infeed.conf

                  

Security identifiers

  • GEN006280

3.2.3.bu. Verify Extended ACLs on infeed.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/news/infeed.conf
                  

Security identifiers

  • GEN006290

3.2.3.bv. Verify Permissions on incoming.conf

To properly set the permissions of /etc/news/incoming.conf, run the command:

$ sudo chmod 0600 /etc/news/incoming.conf

Remediation script

                    chmod 0600 /etc/news/incoming.conf

                  

Security identifiers

  • GEN006260

3.2.3.bw. Verify Extended ACLs on incoming.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/news/incoming.conf
                  

Security identifiers

  • GEN006270

3.2.3.bx. Verify Extended ACLs on nnrp.access

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/news/nnrp.access
                  

Security identifiers

  • GEN006310

3.2.3.by. Verify Permissions on passwd.nntp

To properly set the permissions of /etc/news/passwd.nntp, run the command:

$ sudo chmod 0600 /etc/news/passwd.nntp

Remediation script

                    chmod 0600 /etc/news/passwd.nntp

                  

Security identifiers

  • GEN006320

3.2.3.bz. Verify Extended ACLs on passwd.nntp

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/news/passwd.nntp
                  

Security identifiers

  • GEN006330

3.2.3.ca. Verify User Who Owns nsswitch.conf

To properly set the owner of /etc/nsswitch.conf, run the command:

$ sudo chown root /etc/nsswitch.conf

Remediation script

                    chown root /etc/nsswitch.conf
                  

Security identifiers

  • GEN001371

3.2.3.cb. Verify Group Who Owns nsswitch.conf

To properly set the group owner of /etc/nsswitch.conf, run the command:

$ sudo chgrp root /etc/nsswitch.conf

Remediation script

                    chown :root /etc/nsswitch.conf
                  

Security identifiers

  • GEN001372

3.2.3.cc. Verify Permissions on nsswitch.conf

To properly set the permissions of /etc/nsswitch.conf, run the command:

$ sudo chmod 0644 /etc/nsswitch.conf

Remediation script

                    chmod 0644 /etc/nsswitch.conf

                  

Security identifiers

  • GEN001373

3.2.3.cd. Verify Extended ACLs on nsswitch.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/nsswitch.conf
                  

Security identifiers

  • GEN001374

3.2.3.ce. Verify User Who Owns ntp.conf

To properly set the owner of /etc/ntp.conf, run the command:

$ sudo chown root /etc/ntp.conf

Remediation script

                    chown root /etc/ntp.conf
                  

Security identifiers

  • GEN000250

3.2.3.cf. Verify Group Who Owns ntp.conf

To properly set the group owner of /etc/ntp.conf, run the command:

$ sudo chgrp root /etc/ntp.conf

Remediation script

                    chown :root /etc/ntp.conf
                  

Security identifiers

  • GEN000251

3.2.3.cg. Verify Permissions on ntp.conf

To properly set the permissions of /etc/ntp.conf, run the command:

$ sudo chmod 0644 /etc/ntp.conf

Remediation script

                    chmod 0640 /etc/ntp.conf

                  

Security identifiers

  • GEN000252

3.2.3.ch. Verify Extended ACLs on ntp.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/ntp.conf
                  

Security identifiers

  • GEN000253

3.2.3.ci. Verify User Who Owns resolv.conf

To properly set the owner of /etc/resolv.conf, run the command:

$ sudo chown root /etc/resolv.conf

Remediation script

                    chown root /etc/resolv.conf
                  

Security identifiers

  • GEN001362

3.2.3.cj. Verify Group Who Owns resolv.conf

To properly set the group owner of /etc/resolv.conf, run the command:

$ sudo chgrp root /etc/resolv.conf

Remediation script

                    chown :root /etc/resolv.conf
                  

Security identifiers

  • GEN001363

3.2.3.ck. Verify Permissions on resolv.conf

To properly set the permissions of /etc/resolv.conf, run the command:

$ sudo chmod 0644 /etc/resolv.conf

Remediation script

                    chmod 0644 /etc/resolv.conf

                  

Security identifiers

  • GEN001364

3.2.3.cl. Verify Extended ACLs on resolv.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/resolv.conf
                  

Security identifiers

  • GEN001365

3.2.3.cm. Verify User Who Owns smb.conf

To properly set the owner of /etc/samba/smb.conf, run the command:

$ sudo chown root /etc/samba/smb.conf

Remediation script

                    chown root /etc/samba/smb.conf
                  

Security identifiers

  • GEN006100

3.2.3.cn. Verify Group Who Owns smb.conf

To properly set the group owner of /etc/samba/smb.conf, run the command:

$ sudo chgrp root /etc/samba/smb.conf

Remediation script

                    chown :root /etc/samba/smb.conf
                  

Security identifiers

  • GEN006120

3.2.3.co. Verify Permissions on smb.conf

To properly set the permissions of /etc/samba/smb.conf, run the command:

$ sudo chmod 0644 /etc/samba/smb.conf

Remediation script

                    chmod 0644 /etc/samba/smb.conf
                  

Security identifiers

  • GEN006140

3.2.3.cp. Verify Extended ACLs on smb.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/samba/smb.conf
                  

Security identifiers

  • GEN006150

3.2.3.cq. Verify User Who Owns Samba Password Files

To properly set the owner of /etc/samba/passdb.tdb, run the command:

$ sudo chown root /etc/samba/passdb.tdb

Remediation script

                    chown root /etc/samba/passdb.tdb /etc/samba/secrets.tdb
                  

Security identifiers

  • GEN006160

3.2.3.cr. Verify Group Who Owns Samba Password Files

To properly set the group owner of /etc/samba/passdb.tdb, run the command:

$ sudo chgrp root /etc/samba/passdb.tdb

Remediation script

                    chown :root /etc/samba/passdb.tdb /etc/samba/secrets.tdb
                  

Security identifiers

  • GEN006180

3.2.3.cs. Verify Permissions on Samba Password Files

To properly set the permissions of /etc/samba/passdb.tdb, run the command:

$ sudo chmod 0600 /etc/samba/passdb.tdb

Remediation script

                    chmod 0600 /etc/samba/passdb.tdb /etc/samba/secrets.tdb
                  

Security identifiers

  • GEN006200

3.2.3.ct. Verify Extended ACLs on Samba Password Files

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/samba/passdb.tdb /etc/samba/secrets.tdb
                  

Security identifiers

  • GEN006210

3.2.3.cu. Verify User Who Owns securetty

To properly set the owner of /etc/securetty, run the command:

$ sudo chown root /etc/securetty

Remediation script

                    chown root /etc/securetty
                  

Security identifiers

  • GEN000000-LNX00640

3.2.3.cv. Verify Group Who Owns securetty

To properly set the group owner of /etc/securetty, run the command:

$ sudo chgrp root /etc/securetty

Remediation script

                    chown :root /etc/securetty
                  

Security identifiers

  • GEN000000-LNX00620

3.2.3.cw. Verify Permissions on securetty

To properly set the permissions of /etc/securetty, run the command:

$ sudo chmod 0600 /etc/securetty

Remediation script

                    chmod 0600 /etc/securetty

                  

Security identifiers

  • GEN000000-LNX00660

3.2.3.cx. Verify User Who Owns access.conf

To properly set the owner of /etc/access.conf, run the command:

$ sudo chown root /etc/access.conf

Remediation script

                    chown root /etc/security/access.conf
                  

Security identifiers

  • GEN000000-LNX00400

3.2.3.cy. Verify Group Who Owns access.conf

To properly set the group owner of /etc/access.conf, run the command:

$ sudo chgrp root /etc/access.conf

Remediation script

                    chown :root /etc/security/access.conf
                  

Security identifiers

  • GEN000000-LNX00420

3.2.3.cz. Verify Permissions on access.conf

To properly set the permissions of /etc/access.conf, run the command:

$ sudo chmod 0640 /etc/access.conf

Remediation script

                    chmod 0640 /etc/security/access.conf

                  

Security identifiers

  • GEN000000-LNX00440

3.2.3.da. Verify Extended ACLs on access.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/security/access.conf
                  

Security identifiers

  • GEN000000-LNX00450

3.2.3.db. Verify User Who Owns services

To properly set the owner of /etc/services, run the command:

$ sudo chown root /etc/services

Remediation script

                    chown root /etc/services
                  

Security identifiers

  • GEN003760

3.2.3.dc. Verify Group Who Owns services

To properly set the group owner of /etc/services, run the command:

$ sudo chgrp root /etc/services

Remediation script

                    chown :root /etc/services
                  

Security identifiers

  • GEN003770

3.2.3.dd. Verify Permissions on services

To properly set the permissions of /etc/services, run the command:

$ sudo chmod 0640 /etc/services

Remediation script

                    chmod 0644 /etc/services

                  

Security identifiers

  • GEN003780

3.2.3.de. Verify Extended ACLs on services

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/services
                  

Security identifiers

  • GEN003790

3.2.3.df. Verify User Who Owns Skeleton Files

To properly set the owner of /etc/skel/*, run the command:

$ sudo chown root /etc/skel/*

Remediation script

                    chown root /etc/skel/*
                  

Security identifiers

  • GEN001820

3.2.3.dg. Verify Group Who Owns Skeleton Files

To properly set the group owner of /etc/skel/*, run the command:

$ sudo chgrp root /etc/skel/*

Remediation script

                    chown :root /etc/skel/*
                  

Security identifiers

  • GEN001830

3.2.3.dh. Verify Permissions on Skeleton Files

To properly set the permissions of /etc/skel/*, run the command:

$ sudo chmod 0640 /etc/skel/*

Remediation script

                    chmod 0644 /etc/skel/*
                  

Security identifiers

  • GEN001800

3.2.3.di. Verify Extended ACLs on Skeleton Files

No extended ACLs should be applied.

Remediation script

                    find /etc/skel 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN001810

3.2.3.dj. Verify User Who Owns sysctl.conf

To properly set the owner of /etc/sysctl.conf, run the command:

$ sudo chown root /etc/sysctl.conf

Remediation script

                    chown root /etc/sysctl.conf
                  

Security identifiers

  • GEN000000-LNX00480

3.2.3.dk. Verify Group Who Owns sysctl.conf

To properly set the group owner of /etc/sysctl.conf, run the command:

$ sudo chgrp root /etc/sysctl.conf

Remediation script

                    chown :root /etc/sysctl.conf
                  

Security identifiers

  • GEN000000-LNX00500

3.2.3.dl. Verify Permissions on sysctl.conf

To properly set the permissions of /etc/sysctl.conf, run the command:

$ sudo chmod 0600 /etc/sysctl.conf

Remediation script

                    chmod 0600 /etc/sysctl.conf

                  

Security identifiers

  • GEN000000-LNX00520

3.2.3.dm. Verify Extended ACLs on sysctl.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/sysctl.conf
                  

Security identifiers

  • GEN000000-LNX00530

3.2.3.dn. Verify User Who Owns syslog.conf

To properly set the owner of /etc/syslog.conf, run the command:

$ sudo chown root /etc/syslog.conf

Remediation script

                    chown root /etc/syslog.conf
                  

Security identifiers

  • GEN005400

3.2.3.do. Verify Group Who Owns syslog.conf

To properly set the group owner of /etc/syslog.conf, run the command:

$ sudo chgrp root /etc/syslog.conf

Remediation script

                    chown :root /etc/syslog.conf
                  

Security identifiers

  • GEN005420

3.2.3.dp. Verify Permissions on syslog.conf

To properly set the permissions of /etc/syslog.conf, run the command:

$ sudo chmod 0640 /etc/syslog.conf

Remediation script

                    chmod 0640 /etc/syslog.conf

                  

Security identifiers

  • GEN005390

3.2.3.dq. Verify Extended ACLs on syslog.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/syslog.conf
                  

Security identifiers

  • GEN005395

3.2.3.dr. Verify User Who Owns xinetd.conf

To properly set the owner of /etc/xinetd.conf, run the command:

$ sudo chown root /etc/xinetd.conf

Remediation script

                    chown root /etc/xinetd.conf
                  

Security identifiers

  • GEN003720

3.2.3.ds. Verify Group Who Owns xinetd.conf

To properly set the group owner of /etc/xinetd.conf, run the command:

$ sudo chgrp root /etc/xinetd.conf

Remediation script

                    chown :root /etc/xinetd.conf
                  

Security identifiers

  • GEN003730

3.2.3.dt. Verify Permissions on xinetd.conf

To properly set the permissions of /etc/xinetd.conf, run the command:

$ sudo chmod 0640 /etc/xinetd.conf

Remediation script

                    chmod 0640 /etc/xinetd.conf /etc/xinetd.d/*
                  

Security identifiers

  • GEN003740

3.2.3.du. Verify Extended ACLs on xinetd.conf

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/xinetd.conf
                  

Security identifiers

  • GEN003745

3.2.3.dv. Verify Permissions on xinet.d Directory

To properly set the permissions of /etc/xinet.d/, run the command:

$ sudo chmod 0640 /etc/xinet.d/

Remediation script

                    chmod 0755 /etc/xinet.d/*
                  

Security identifiers

  • GEN003750

3.2.3.dw. Verify Extended ACLs on xinet.d Directory

No extended ACLs should be applied.

Remediation script

                    find /etc/xinetd.d -type f 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN003755

3.2.3.dx. Verify User Who Owns Exports Directories

To properly set the owner of /etc/exports, run the command:

$ sudo chown root /etc/exports

Remediation script

                    cat /etc/exports | awk '{ print $1 }' | xargs chown root
                  

Security identifiers

  • GEN005800

3.2.3.dy. Verify Group Who Owns Exports Directories

To properly set the group owner of /etc/exports, run the command:

$ sudo chgrp root /etc/exports

Remediation script

                    cat /etc/exports | awk '{ print $1 }' | xargs chown :root
                  

Security identifiers

  • GEN005810

3.2.3.dz. Verify User Who Owns ftpusers

To properly set the owner of /etc/ftpusers, run the command:

$ sudo chown root /etc/ftpusers

Security identifiers

  • GEN004920

3.2.3.ea. Verify Group Who Owns ftpusers

To properly set the group owner of /etc/ftpusers, run the command:

$ sudo chgrp root /etc/ftpusers

Security identifiers

  • GEN004930

3.2.3.eb. Verify Permissions on ftpusers

To properly set the permissions of /etc/ftpusers, run the command:

$ sudo chmod 0640 /etc/ftpusers

Remediation script

                    chmod 0640 /etc/ftpusers /etc/vsftpd.ftpusers /etc/vsftpd/ftpusers 2>/dev/null
                  

Security identifiers

  • GEN004940

3.2.3.ec. Verify Extended ACLs on ftpusers

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/ftpusers /etc/vsftpd.ftpusers /etc/vsftpd/ftpusers
                  

Security identifiers

  • GEN004950

3.2.3.ed. Verify User Who Owns Global Initialization Files

To properly set the owner of /etc/profile, run the command:

$ sudo chown root /etc/profile

Security identifiers

  • GEN001740

3.2.3.ee. Verify Group Who Owns Global Initialization Files

To properly set the group owner of /etc/profile, run the command:

$ sudo chgrp root /etc/profile

Security identifiers

  • GEN001760

3.2.3.ef. Verify Permissions on Global Initialization Files

To properly set the permissions of /etc/profile, run the command:

$ sudo chmod 0644 /etc/profile

Remediation script

                    chmod -R 0644 /etc/bashrc /etc/csh.cshrc /etc/csh.login /etc/csh.logout /etc/environment /etc/ksh.kshrc /etc/profile /etc/suid_profile /etc/profile.d 2>/dev/null
                  

Security identifiers

  • GEN001720

3.2.3.eg. Verify Extended ACLs on Global Initialization Files

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /etc/bashrc /etc/csh.cshrc /etc/csh.login /etc/csh.logout /etc/environment /etc/ksh.kshrc /etc/profile /etc/suid_profile /etc/profile.d/*
                  

Security identifiers

  • GEN001730

3.2.3.eh. Verify Messaging is Disabled in Global Initialization Files

No global messaging should be enabled.

Remediation script

                    echo mesg n | tee -a /etc/profile &>/dev/null

                  

Security identifiers

  • GEN001780

3.2.3.ei. Verify User Who Owns Home Directories

To properly set the owner of /home/*, run the command:

$ sudo chown root /home/*

Security identifiers

  • GEN001500

3.2.3.ej. Verify Group Who Owns Home Directories

To properly set the group owner of /home/*, run the command:

$ sudo chgrp root /home/*

Security identifiers

  • GEN001520

3.2.3.ek. Ensure that User Home Directories are not Group-Writable or World-Readable

For each human user of the system, view the permissions of the user's home directory:

# ls -ld /home/USER
Ensure that the directory is not group-writable and that it is not world-readable. If necessary, repair the permissions:
# chmod g-w /home/USER
# chmod o-rwx /home/USER

This action may involve modifying user home directories. Notify your user community, and solicit input if appropriate, before making this type of change.

User home directories contain many configuration files which affect the behavior of a user's account. No user should ever have write permission to another user's home directory. Group shared directories can be configured in sub-directories or elsewhere in the filesystem if they are needed. Typically, user home directories should not be world-readable, as it would disclose file names to other users. If a subset of users need read access to one another's home directories, this can be provided using groups or ACLs.

Security identifiers

  • GEN001480

3.2.3.el. Verify Extended ACLs on Home Directories

No extended ACLs should be applied.

Remediation script

                    cut -d: -f6 /etc/passwd | sort -u | xargs setfacl --remove-all 2>/dev/null
                  

Security identifiers

  • GEN001490

3.2.3.em. Verify User Who Owns Home Files

To properly set the owner of /home/*/*, run the command:

$ sudo chown root /home/*/*

Security identifiers

  • GEN001540

3.2.3.en. Verify Group Who Owns Home Files

To properly set the group owner of /home/*/*, run the command:

$ sudo chgrp root /home/*/*

Security identifiers

  • GEN001550

3.2.3.eo. Verify Permissions on Home Files

To properly set the permissions of /home/*/*, run the command:

$ sudo chmod 0750 /home/*/*

Remediation script

                    find /root /home/* -perm -1 -o -perm -2 -o -perm -4 -o -perm -20 2>/dev/null | xargs -I entry chmod o-rwx,g-w "entry"

                  

Security identifiers

  • GEN001560

3.2.3.ep. Verify Extended ACLs on Home Files

No extended ACLs should be applied.

Remediation script

                    find /home -type f 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN001570

3.2.3.eq. Verify User Who Owns LDAP CA Certificates

To properly set the owner of tls_cacert, run the command:

$ sudo chown root tls_cacert

Remediation script

                    grep -i '^tls_cacert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chown -R root
                  

Security identifiers

  • GEN008140

3.2.3.er. Verify Group Who Owns LDAP CA Certificates

To properly set the group owner of tls_cacert, run the command:

$ sudo chgrp root tls_cacert

Remediation script

                    grep -i '^tls_cacert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chown -R :root
                  

Security identifiers

  • GEN008160

3.2.3.es. Verify Permissions on LDAP CA Certificates

To properly set the permissions of tls_cacert, run the command:

$ sudo chmod 0640 tls_cacert

Remediation script

                    KEY_PATH="`grep -i '^tls_cacert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }'`"
if [ -d "${KEY_PATH}" ]; then
	chmod 755 "${KEY_PATH}"
	chmod 644 "${KEY_PATH}"/*
elif [ -e "${KEY_PATH}" ]; then
	chmod 644 "${KEY_PATH}"
fi

                  

Security identifiers

  • GEN008180

3.2.3.et. Verify Extended ACLs on LDAP CA Certificates

No extended ACLs should be applied.

Remediation script

                    grep -i '^tls_cacert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs setfacl --remove-all
                  

Security identifiers

  • GEN008200

3.2.3.eu. Verify User Who Owns LDAP Certificates

To properly set the owner of tls_cert, run the command:

$ sudo chown root tls_cert

Remediation script

                    grep -i '^tls_cert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chown -R root
                  

Security identifiers

  • GEN008220

3.2.3.ev. Verify Group Who Owns LDAP Certificates

To properly set the group owner of tls_cert, run the command:

$ sudo chgrp root tls_cert

Remediation script

                    grep -i '^tls_cert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chown -R :root
                  

Security identifiers

  • GEN008240

3.2.3.ew. Verify Permissions on LDAP Certificates

To properly set the permissions of tls_cert, run the command:

$ sudo chmod 0640 tls_cert

Remediation script

                    grep -i '^tls_cert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chmod -R 644
                  

Security identifiers

  • GEN008260

3.2.3.ex. Verify Extended ACLs on LDAP Certificates

No extended ACLs should be applied.

Remediation script

                    grep -i '^tls_cert' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs setfacl --remove-all
                  

Security identifiers

  • GEN008280

3.2.3.ey. Verify User Who Owns LDAP Keys

To properly set the owner of tls_key, run the command:

$ sudo chown root tls_key

Remediation script

                    grep -i '^tls_key' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chown -R root
                  

Security identifiers

  • GEN008300

3.2.3.ez. Verify Group Who Owns LDAP Keys

To properly set the group owner of tls_key, run the command:

$ sudo chgrp root tls_key

Remediation script

                    grep -i '^tls_key' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chown -R :root
                  

Security identifiers

  • GEN008320

3.2.3.fa. Verify Permissions on LDAP Keys

To properly set the permissions of tls_key, run the command:

$ sudo chmod 0600 tls_key

Remediation script

                    grep -i '^tls_key' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs chmod -R 600	
                  

Security identifiers

  • GEN008340

3.2.3.fb. Verify Extended ACLs on LDAP Keys

No extended ACLs should be applied.

Remediation script

                    grep -i '^tls_key' /etc/ldap.conf | grep -v "#" | awk '{ print $2 }' | xargs setfacl --remove-all
                  

Security identifiers

  • GEN008360

3.2.3.fc. Verify User Who Owns Local Initialization Files

To properly set the owner of ~/.bashrc, run the command:

$ sudo chown root ~/.bashrc

Security identifiers

  • GEN001860

3.2.3.fd. Verify Group Who Owns Local Initialization Files

To properly set the group owner of ~/.bashrc, run the command:

$ sudo chgrp root ~/.bashrc

Security identifiers

  • GEN001870

3.2.3.fe. Verify Permissions on Local Initialization Files

To properly set the permissions of ~/.bashrc, run the command:

$ sudo chmod 0740 ~/.bashrc

Remediation script

                    find /root /home -maxdepth 2 -type f \( -perm -o+r -o -perm -o+w  -o -perm -o+x -o -perm -g+w -o -perm -g+x \) -a \( -name \.bashrc -o -name \.bash_login -o -name \.bash_logout -o -name \.bash_profile -o -name \.cshrc -o -name \.kshrc -o -name \.login -o -name \.logout -o -name \.profile -o -name \.env -o -name \.dtprofile -o -name \.dispatch -o -name \.emacs -o -name \.exrc \) 2>/dev/null | xargs chmod o-rwx,g-wx

                  

Security identifiers

  • GEN001880

3.2.3.ff. Verify Extended ACLs on Local Initialization Files

No extended ACLs should be applied.

Remediation script

                    cut -d: -f6 /etc/passwd | sort -u | xargs -n1 -IDIR find DIR -maxdepth 1 -name .bashrc -o -name .bash_login -o -name .bash_logout -o -name .bash_profile -o -name .cshrc -o -name .kshrc -o -name .login -o -name .logout -o -name .profile -o -name .env -o -name .dtprofile -o -name .dispatch -o -name .emacs -o -name .exrc 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN001890

3.2.3.fg. Verify Permissions on Man Pages

To properly set the permissions of /usr/share/man, run the command:

$ sudo chmod 0644 /usr/share/man

Security identifiers

  • GEN001280

3.2.3.fh. Verify Extended ACLs on Man Pages

No extended ACLs should be applied.

Remediation script

                    setfacl -RLb /usr/share/man/* /usr/share/info/* /usr/share/infopage/*

                  

Security identifiers

  • GEN001290

3.2.3.fi. Verify Permissions on .Mib Files

To properly set the permissions of *.mib, run the command:

$ sudo chmod 0640 *.mib

Security identifiers

  • GEN005340

3.2.3.fj. Verify Extended ACLs on .Mib Files

No extended ACLs should be applied.

Remediation script

                    find / -name *.mib 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN005350

3.2.3.fk. Verify Permissions on root Directory

To properly set the permissions of /root, run the command:

$ sudo chmod 0700 /root

Remediation script

                    grep ^root: /etc/passwd | awk -F: ' { print $6 }' | xargs -I entry chmod g-rwx,o-rwx "entry"

                  

Security identifiers

  • GEN000920

3.2.3.fl. Verify Extended ACLs on root Directory

No extended ACLs should be applied.

Remediation script

                    setfacl -RLb /root/*

                  

Security identifiers

  • GEN000930

3.2.3.fm. Verify User Who Owns Run Control Scripts

To properly set the owner of /etc/rc*, run the command:

$ sudo chown root /etc/rc*

Security identifiers

  • GEN001660

3.2.3.fn. Verify Group Who Owns Run Control Scripts

To properly set the group owner of /etc/rc*, run the command:

$ sudo chgrp root /etc/rc*

Security identifiers

  • GEN001680

3.2.3.fo. Verify Permissions on Run Control Scripts

To properly set the permissions of /etc/rc*, run the command:

$ sudo chmod 0755 /etc/rc*

Security identifiers

  • GEN001580

3.2.3.fp. Verify Extended ACLs on Run Control Scripts

No extended ACLs should be applied.

Remediation script

                    find /etc/rc* /etc/init.d -type f 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN001590

3.2.3.fq. Verify User Who Owns Shell Files

To properly set the owner of /etc/shells, run the command:

$ sudo chown root /etc/shells

Security identifiers

  • GEN002200

3.2.3.fr. Verify Group Who Owns Shell Files

To properly set the group owner of /etc/shells, run the command:

$ sudo chgrp root /etc/shells

Security identifiers

  • GEN002210

3.2.3.fs. Verify Permissions on Shell Files

To properly set the permissions of /etc/shells, run the command:

$ sudo chmod 0755 /etc/shells

Security identifiers

  • GEN002220

3.2.3.ft. Verify Extended ACLs on Shell Files

No extended ACLs should be applied.

Remediation script

                    cat /etc/shells | xargs setfacl --remove-all
                  

Security identifiers

  • GEN002230

3.2.3.fu. Verify User Who Owns SMTP Logs

To properly set the owner of /var/log/mail.log, run the command:

$ sudo chown root /var/log/mail.log

Security identifiers

  • GEN004480

3.2.3.fv. Verify Permissions on SMTP Logs

To properly set the permissions of /var/log/mail.log, run the command:

$ sudo chmod 0644 /var/log/mail.log

Security identifiers

  • GEN004500

3.2.3.fw. Verify Extended ACLs on SMTP Logs

No extended ACLs should be applied.

Remediation script

                    egrep "(\*.crit|mail\.[^n][^/]*)" /etc/syslog.conf | sed 's/^[^/]*//' | xargs setfacl --remove-all
                  

Security identifiers

  • GEN004510

3.2.3.fx. Verify User Who Owns snmpd.conf

To properly set the owner of snmpd.conf, run the command:

$ sudo chown root snmpd.conf

Security identifiers

  • GEN005360

3.2.3.fy. Verify Group Who Owns snmpd.conf

To properly set the group owner of snmpd.conf, run the command:

$ sudo chgrp root snmpd.conf

Security identifiers

  • GEN005365

3.2.3.fz. Verify Permissions on snmpd.conf

To properly set the permissions of snmpd.conf, run the command:

$ sudo chmod 0644 snmpd.conf

Remediation script

                    find / -name snmpd.conf 2>/dev/null | xargs chmod ugo-x,go-wr
                  

Security identifiers

  • GEN005320

3.2.3.ga. Verify Extended ACLs on snmpd.conf

No extended ACLs should be applied.

Remediation script

                    find / -name snmpd.conf 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN005375

3.2.3.gb. Verify Permissions on /etc/ssh/*key

To properly set the permissions of /etc/ssh/*key, run the command:

$ sudo chmod 0600 /etc/ssh/*key

Security identifiers

  • GEN005523

3.2.3.gc. Verify Permissions on /etc/ssh/*key.pub

To properly set the permissions of /etc/ssh/*key.pub, run the command:

$ sudo chmod 0644 /etc/ssh/*key.pub

Security identifiers

  • GEN005522

3.2.3.gd. Verify Permissions on TFTP Binary

To properly set the permissions of /etc/xinetd.d/tftp, run the command:

$ sudo chmod 0755 /etc/xinetd.d/tftp

Security identifiers

  • GEN005100

3.2.3.ge. Verify Permissions on /usr/bin/ldd

To properly set the permissions of /usr/bin/ldd, run the command:

$ sudo chmod 0000 /usr/bin/ldd

Remediation script

                    chmod a-x /usr/bin/ldd

                  

Security identifiers

  • GEN007960

3.2.3.gf. Verify Permissions on sbin Directory

To properly set the permissions of /usr/sbin/, run the command:

$ sudo chmod 0755 /usr/sbin/

Security identifiers

  • GEN001180

3.2.3.gg. Verify Extended ACLs on sbin Directory

No extended ACLs should be applied.

Remediation script

                    setfacl -RLb /usr/sbin/*

                  

Security identifiers

  • GEN001190

3.2.3.gh. Verify Permissions on System Logs

To properly set the permissions of /var/log/*, run the command:

$ sudo chmod 0640 /var/log/*

Remediation script

                    find /var/log -follow -type f ! -name wtmp 2>/dev/null | xargs chmod o-rwx,g-wx,u-x

# The following corrects the permission mask set for /var/log/rpmpkgs.
if [ -e /etc/cron.daily/rpm ]; then
	sed -i '/rpmpkgs/s/0644/0640/' /etc/cron.daily/rpm
fi

                  

Security identifiers

  • GEN001260

3.2.3.gi. Verify Extended ACLs on System Logs

No extended ACLs should be applied.

Remediation script

                    setfacl -RLb /var/log/*

                  

Security identifiers

  • GEN001270

3.2.3.gj. Verify User Who Owns At Directory

To properly set the owner of /var/spool/at/, run the command:

$ sudo chown root /var/spool/at/

Security identifiers

  • GEN003420

3.2.3.gk. Verify Group Who Owns At Directory

To properly set the group owner of /var/spool/at/, run the command:

$ sudo chgrp root /var/spool/at/

Security identifiers

  • GEN003430

3.2.3.gl. Verify Permissions on At Directory

To properly set the permissions of /var/spool/at/, run the command:

$ sudo chmod 0755 /var/spool/at/

Security identifiers

  • GEN003400

3.2.3.gm. Verify Extended ACLs on At Directory

No extended ACLs should be applied.

Remediation script

                    setfacl --remove-all /var/spool/at
                  

Security identifiers

  • GEN003410

3.2.3.gn. Verify User Who Owns YP Files

To properly set the owner of /var/yp/*, run the command:

$ sudo chown root /var/yp/*

Security identifiers

  • GEN001320

3.2.3.go. Verify Group Who Owns YP Files

To properly set the group owner of /var/yp/*, run the command:

$ sudo chgrp root /var/yp/*

Security identifiers

  • GEN001340

3.2.3.gp. Verify Permissions on YP Files

To properly set the permissions of /var/yp/*, run the command:

$ sudo chmod 0755 /var/yp/*

Security identifiers

  • GEN001360

3.2.3.gq. Verify Extended ACLs on YP Files

No extended ACLs should be applied.

Remediation script

                    setfacl -RLb /var/yp/*

                  

Security identifiers

  • GEN001361

3.2.3.gr. Verify Permissions on Xauthority Files

To properly set the permissions of .Xauthority, run the command:

$ sudo chmod 0600 .Xauthority

Security identifiers

  • GEN005180

3.2.3.gs. Verify Extended ACLs on Xauthority Files

No extended ACLs should be applied.

Remediation script

                    cut -d: -f6 /etc/passwd | sort -u | xargs -n1 -IDIR find DIR -maxdepth 1 -name .Xauthority -o -name .xauth 2>/dev/null | xargs setfacl --remove-all
                  

Security identifiers

  • GEN005190

3.2.3.gt. Verify that All World-Writable Directories Have Sticky Bits Set

When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes.
To set the sticky bit on a world-writable directory DIR, run the following command:

# chmod +t DIR

Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.

The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as /tmp), and for directories requiring global read/write access.

Remediation script

                    find / /home /var /var/log /var/log/audit -xdev -perm -2 ! -perm -1000 -type d 2>/dev/null | xargs chmod o-w

                  

Security identifiers

  • GEN002500

3.2.3.gu. Ensure No World-Writable Files Exist

It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account.

Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.

Remediation script

                    find / /var /home -xdev -follow -type f -perm -002 2>/dev/null | xargs chmod o-w

                  

Security identifiers

  • GEN002480

3.2.3.gv. Ensure All Files Are Owned by a User

If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user.

Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.

Remediation script

                    find / /home /var /var/log /var/log/audit -xdev -nouser 2>/dev/null | xargs chown root

                  

Security identifiers

  • GEN001160

3.2.3.gw. Ensure All Files Are Owned by a Group

If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group.

Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.

Remediation script

                    find / /home /var /var/log /var/log/audit -xdev -nogroup 2>/dev/null | xargs chown :root

                  

Security identifiers

  • GEN001170

3.2.3.gx. Ensure All World-Writable Directories Are Owned by a System Account

All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.

Allowing a user account to own a world-writable directory is undesirable because it allows the owner of that directory to remove or replace any files that may be placed in the directory by other users.

Security identifiers

  • GEN002520

3.2.3.207. Verify Permissions on Files with Local Account Information and Credentials

The default restrictive permissions for files which act as important security databases such as passwd, shadow, group, and gshadow files must be maintained. Many utilities need read access to the passwd file in order to function properly, but read access to the shadow file allows malicious attacks against system passwords, and should never be enabled.

3.2.3.207.a. Verify User Who Owns shadow File

To properly set the owner of /etc/shadow, run the command:

$ sudo chown root /etc/shadow

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Remediation script

                      chown root /etc/shadow
                    

Security identifiers

  • GEN001400

3.2.3.207.b. Verify Group Who Owns shadow File

To properly set the group owner of /etc/shadow, run the command:

$ sudo chgrp root /etc/shadow

The /etc/shadow file stores password hashes. Protection of this file is critical for system security.

Security identifiers

  • GEN001410

3.2.3.207.c. Verify Permissions on shadow File

To properly set the permissions of /etc/shadow, run the command:

$ sudo chmod 0400 /etc/shadow

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Remediation script

                      chmod 0400 /etc/shadow

                    

Security identifiers

  • GEN001420

3.2.3.207.d. Verify Extended ACLs on shadow File

No extended ACLs should be applied.

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Remediation script

                      setfacl --remove-all /etc/shadow
                    

Security identifiers

  • GEN001430

3.2.3.207.e. Verify User Who Owns group File

To properly set the owner of /etc/group, run the command:

$ sudo chown root /etc/group

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Remediation script

                      chown root /etc/group

                    

Security identifiers

  • GEN001391

3.2.3.207.f. Verify Group Who Owns group File

To properly set the group owner of /etc/group, run the command:

$ sudo chgrp root /etc/group

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Remediation script

                      chgrp root /etc/group

                    

Security identifiers

  • GEN001392

3.2.3.207.g. Verify Permissions on group File

To properly set the permissions of /etc/group, run the command:

$ sudo chmod 644 /etc/group

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Remediation script

                      chmod 0644 /etc/group

                    

Security identifiers

  • GEN001393

3.2.3.207.h. Verify Extended ACLs on group File

No extended ACLs should be applied.

The /etc/group file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Remediation script

                      setfacl --remove-all /etc/group
                    

Security identifiers

  • GEN001394

3.2.3.207.i. Verify User Who Owns gshadow File

To properly set the owner of /etc/gshadow, run the command:

$ sudo chown root /etc/gshadow

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

Remediation script

                      chown root /etc/gshadow

                    

Security identifiers

  • GEN000000-LNX001431

3.2.3.207.j. Verify Group Who Owns gshadow File

To properly set the group owner of /etc/gshadow, run the command:

$ sudo chgrp root /etc/gshadow

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

Remediation script

                      chgrp root /etc/gshadow

                    

Security identifiers

  • GEN000000-LNX001432

3.2.3.207.k. Verify Permissions on gshadow File

To properly set the permissions of /etc/gshadow, run the command:

$ sudo chmod 0400 /etc/gshadow

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

Remediation script

                      chmod 0400 /etc/gshadow

                    

Security identifiers

  • GEN000000-LNX001433

3.2.3.207.l. Verify Extended ACLs on gshadow File

No extended ACLs should be applied.

The /etc/gshadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Remediation script

                      setfacl --remove-all /etc/gshadow
                    

Security identifiers

  • GEN000000-LNX001434

3.2.3.207.m. Verify User Who Owns passwd File

To properly set the owner of /etc/passwd, run the command:

$ sudo chown root /etc/passwd

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Remediation script

                      chown root /etc/passwd

                    

Security identifiers

  • GEN001378

3.2.3.207.n. Verify Group Who Owns passwd File

To properly set the group owner of /etc/passwd, run the command:

$ sudo chgrp root /etc/passwd

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Remediation script

                      chgrp root /etc/passwd

                    

Security identifiers

  • GEN001379

3.2.3.207.o. Verify Permissions on passwd File

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

If the /etc/passwd file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

Remediation script

                      chmod 0644 /etc/passwd

                    

Security identifiers

  • GEN001380

3.2.3.207.p. Verify Extended ACLs on passwd File

No extended ACLs should be applied.

The /etc/passwd file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Remediation script

                      setfacl --remove-all /etc/passwd
                    

Security identifiers

  • GEN001390

3.2.3.208. Verify File Permissions Within Some Important Directories

Some directories contain files whose confidentiality or integrity is notably important and may also be susceptible to misconfiguration over time, particularly if unpackaged software is installed. As such, an argument exists to verify that files' permissions within these directories remain configured correctly and restrictively.

3.2.3.208.a. Verify that Shared Library Files Have Restrictive Permissions

System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default:

/lib
/lib64
/usr/lib
/usr/lib64
Kernel modules, which can be added to the kernel during runtime, are stored in /lib/modules. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:
# chmod go-w FILE

Files from shared library directories are loaded into the address space of processes (including privileged ones) or of the kernel itself at runtime. Restrictive permissions are necessary to protect the integrity of the system.

Remediation script

                      find /lib /usr/lib -follow -perm -20 -o -perm -2 2>/dev/null | xargs chmod go-w

                    

Security identifiers

  • GEN001300

3.2.3.208.b. Verify Extended ACLs on Shared Library Files

No extended ACLs should be applied.

Remediation script

                      setfacl -RLb --remove-all /usr/lib/* /lib/*

                    

Security identifiers

  • GEN001310

3.2.3.208.c. Verify that System Executables Have Restrictive Permissions

System executables are stored in the following directories by default:

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:
# chmod go-w FILE

System binaries are executed by privileged users, as well as system services, and restrictive permissions are necessary to ensure execution of these programs cannot be co-opted.

Remediation script

                      find /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin -follow -perm -20 -o -perm -2 2>/dev/null | xargs chmod go-w

                    

Security identifiers

  • GEN001200

3.2.3.208.d. Verify Extended ACLs on Shared Binary Files

No extended ACLs should be applied.

Remediation script

                      setfacl -RLb /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin 2>/dev/null

                    

Security identifiers

  • GEN001210

3.2.3.208.e. Verify that System Executables Have Root User Ownership

System executables are stored in the following directories by default:

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
All files in these directories should be owned by the root user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:
# chown root FILE

System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted.

Remediation script

                      find /bin/ \
/usr/bin/ \
/usr/local/bin/ \
/sbin/ \
/usr/sbin/ \
/usr/local/sbin/ \
/usr/libexec \
\! -user root -execdir chown root {} \;

                    

Security identifiers

  • GEN001220

3.2.3.208.f. Verify that System Executables Have Root Group Ownership

System executables are stored in the following directories by default:

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
All files in these directories should be owned by the root user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:
# chown root FILE

System binaries are executed by privileged users as well as system services, and restrictive permissions are necessary to ensure that their execution of these programs cannot be co-opted.

Remediation script

                      find /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin -follow -gid +499 2>/dev/null | xargs chown :root

                    

Security identifiers

  • GEN001240

3.2.4. Restrict Programs from Dangerous Execution Patterns

The recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution are activated. These protections are applied at the system initialization or kernel level, and defend against certain types of badly-configured or compromised programs.

3.2.4.1. Disable Core Dumps

A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases, only software developers legitimately need to access these files. The core dump files may also contain sensitive information, or unnecessarily occupy large amounts of disk space.

Once a hard limit is set in /etc/security/limits.conf, a user cannot increase that limit within his or her own session. If access to core dumps is required, consider restricting them to only certain users or groups. See the limits.conf man page for more information.

The core dumps of setuid programs are further protected. The sysctl variable fs.suid_dumpable controls whether the kernel allows core dumps from these programs at all. The default value of 0 is recommended.

3.2.4.1.a. Disable Core Dumps for All Users

To disable core dumps for all users, add the following line to /etc/security/limits.conf:

*     hard   core    0

A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

Remediation script

                      echo "*     hard   core    0" >> /etc/security/limits.conf

                    

Security identifiers

  • GEN003500

3.2.4.2. Enable ExecShield

ExecShield describes kernel features that provide protection against exploitation of memory corruption errors such as buffer overflows. These features include random placement of the stack and other memory regions, prevention of execution in memory that should only hold data, and special handling of text buffers. These protections are enabled by default and controlled through sysctl variables kernel.exec-shield and kernel.randomize_va_space.

3.2.4.2.a. Enable ExecShield and Randomized Layout of Virtual Address Space

To set the runtime status of the kernel.exec-shield kernel parameter, run the following command:

$ sudo sysctl -w kernel.exec-shield=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
kernel.exec-shield = 1
To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command:
$ sudo sysctl -w kernel.randomize_va_space=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
kernel.randomize_va_space = 1

ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range. Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.

Remediation script

                      if [[ "`uname -r`" != "2.6.9"* ]]; then
	/sbin/sysctl -q -n -w kernel.randomize_va_space=1
	if grep --silent ^kernel.randomize_va_space /etc/sysctl.conf ; then
		sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 1/g' /etc/sysctl.conf
	else
		echo "" >> /etc/sysctl.conf
		echo "# Set kernel.randomize_va_space to 1 per security requirements" >> /etc/sysctl.conf
		echo "kernel.randomize_va_space = 1" >> /etc/sysctl.conf
	fi
fi

/sbin/sysctl -q -n -w kernel.exec-shield=1
if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then
	sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf
	echo "kernel.exec-shield = 1" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003540

3.2.4.2.b. Enable ExecShield

To set the runtime status of the kernel.exec-shield kernel parameter, run the following command:

$ sudo sysctl -w kernel.exec-shield=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
kernel.exec-shield = 1

ExecShield uses the segmentation feature on all x86 systems to prevent execution in memory higher than a certain address. It writes an address as a limit in the code segment descriptor, to control where code can be executed, on a per-process basis. When the kernel places a process's memory regions such as the stack and heap higher than this address, the hardware prevents execution in that address range.

Remediation script

                      /sbin/sysctl -q -n -w kernel.exec-shield=1
if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then
	sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf
	echo "kernel.exec-shield = 1" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN008420

3.3. SELinux

SELinux is a feature of the Linux kernel which can be used to guard against misconfigured or compromised programs. SELinux enforces the idea that programs should be limited in what files they can access and what actions they can take.

The default SELinux policy, as configured on Red Hat Enterprise Linux 6, has been sufficiently developed and debugged that it should be usable on almost any Red Hat machine with minimal configuration and a small amount of system administrator training. This policy prevents system services - including most of the common network-visible services such as mail servers, FTP servers, and DNS servers - from accessing files which those services have no valid reason to access. This action alone prevents a huge amount of possible damage from network attacks against services, from trojaned software, and so forth.

This guide recommends that SELinux be enabled using the default (targeted) policy on every Red Hat system, unless that system has requirements which make a stronger policy appropriate.

3.3.1. Enable SELinux

Edit the file /etc/selinux/config. Add or correct the following lines:

SELINUX=enforcing
SELINUXTYPE=targeted
Edit the file /etc/grub.conf. Ensure that the following arguments DO NOT appear on any kernel command line in the file:
selinux=0
enforcing=0
The directive SELINUX=enforcing enables SELinux at boot time. If SELinux is suspected of involvement with boot-time problems (unlikely), it is possible to boot into the warning-only mode SELINUX=permissive for debugging purposes. Make certain to change the mode back to enforcing after debugging, set the filesystems to be relabeled for consistency using the command touch /.autorelabel, and reboot.

However, the Red Hat Enterprise Linux 6 default SELinux configuration should be sufficiently reasonable that most systems will boot without serious problems. Some applications that require deep or unusual system privileges, such as virtual machine software, may not be compatible with SELinux in its default configuration. However, this should be uncommon, and SELinux's application support continues to improve. In other cases, SELinux may reveal unusual or insecure program behavior by design.

The directive SELINUXTYPE=targeted configures SELinux to use the default targeted policy.

The SELinux boot mode specified in /etc/selinux/config can be overridden by command-line arguments passed to the kernel. It is necessary to check grub.conf to ensure that this has not been done and to protect the boot process.

3.3.1.a. Ensure SELinux State is Enforcing and Policy is Targeted

The SELinux state should be set to enforcing and the SELinux policy should be set to targeted at system boot time. In the file /etc/selinux/config, add or correct the following lines to configure the system to boot into enforcing mode with the targeted policy:

SELINUX=enforcing
SELINUXTYPE=targeted

Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to prevent them from causing damage to the system or further elevating their privileges. Setting the SELinux policy to targeted or a more specialized policy ensures the system will confine processes that are likely to be targeted for exploitation, such as network or system services.

Remediation script

                    
var_selinux_policy_name="targeted"

if [ "`grep -c ^SELINUX= /etc/sysconfig/selinux`" = "0" ]; then
	echo SELINUX=enforcing >> /etc/sysconfig/selinux
else
	sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/sysconfig/selinux
fi

if [ "`grep -c ^SELINUX= /etc/selinux/config`" = "0" ]; then
	echo SELINUX=enforcing >> /etc/selinux/config
else
	sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
fi

if [ "`grep -c ^SELINUXTYPE= /etc/sysconfig/selinux`" = "0" ]; then
	echo SELINUXTYPE=${var_selinux_policy_name} >> /etc/sysconfig/selinux
else
	sed -i "s/^SELINUXTYPE=.*/SELINUXTYPE=${var_selinux_policy_name}/" /etc/sysconfig/selinux
fi

if [ "`grep -c ^SELINUXTYPE= /etc/selinux/config`" = "0" ]; then
	echo SELINUXTYPE=${var_selinux_policy_name} >> /etc/selinux/config
else
	sed -i "s/^SELINUXTYPE=.*/SELINUXTYPE=${var_selinux_policy_name}/" /etc/selinux/config
fi

                  

Security identifiers

  • GEN000000-LNX00800

3.4. Account and Access Control

In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. Therefore, making it more difficult for unauthorized people to gain shell access to accounts, particularly to privileged accounts, is a necessary part of securing a system. This section introduces mechanisms for restricting access to accounts under Red Hat Enterprise Linux 5.

3.4.1. Special Privileged Accounts Exist

The system must not have special privilege accounts, such as shutdown, reboot, halt, ftp, games, gopher, and news.

3.4.1.a. Special Privileged Accounts

Remove any special privilege accounts, such as shutdown, reboot, and halt, from the /etc/passwd and /etc/shadow files using the userdel or system-config-users commands.

If special privilege accounts are compromised, the accounts could provide privileges to execute malicious commands on a system.

Remediation script

                    /usr/bin/id shutdown &>/dev/null && /usr/sbin/userdel shutdown
/usr/bin/id halt &>/dev/null && /usr/sbin/userdel halt
/usr/bin/id reboot &>/dev/null && /usr/sbin/userdel reboot

                  

Security identifiers

  • GEN000000-LNX00320

3.4.1.b. Ftp Account

Remove the ftp account from the /etc/passwd and /etc/shadow files using the userdel or system-config-users commands.

Accounts that provide no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.

Remediation script

                    /usr/bin/id ftp &>/dev/null && /usr/sbin/userdel ftp

                  

Security identifiers

  • GEN000290-4

3.4.1.c. Games Account

Remove the games account from the /etc/passwd and /etc/shadow files using the userdel or system-config-users commands.

Accounts that provide no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.

Remediation script

                    /usr/bin/id games &>/dev/null && /usr/sbin/userdel games

                  

Security identifiers

  • GEN000290-1

3.4.1.d. Gopher Account

Remove the gopher account from the /etc/passwd and /etc/shadow files using the userdel or system-config-users commands.

Accounts that provide no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.

Remediation script

                    /usr/bin/id gopher &>/dev/null && /usr/sbin/userdel gopher

                  

Security identifiers

  • GEN000290-3

3.4.1.e. News Account

Remove the news account from the /etc/passwd and /etc/shadow files using the userdel or system-config-users commands.

Accounts that provide no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.

Remediation script

                    /usr/bin/id news &>/dev/null && /usr/sbin/userdel news

                  

Security identifiers

  • GEN000290-2

3.4.2. Protect Accounts by Restricting Password-Based Login

Conventionally, Unix shell accounts are accessed by providing a username and password to a login program, which tests these values for correctness using the /etc/passwd and /etc/shadow files. Password-based login is vulnerable to guessing of weak passwords, and to sniffing and man-in-the-middle attacks against passwords entered over a network or at an insecure console. Therefore, mechanisms for accessing accounts by entering usernames and passwords should be restricted to those which are operationally necessary.

3.4.2.1. Restrict Root Logins

Direct root logins should be allowed only for emergency use. In normal situations, the administrator should access the system via a unique unprivileged account, and then use su or sudo to execute privileged commands. Discouraging administrators from accessing the root account directly ensures an audit trail in organizations with multiple administrators. Locking down the channels through which root can connect directly also reduces opportunities for password-guessing against the root account. The login program uses the file /etc/securetty to determine which interfaces should allow root logins. The virtual devices /dev/console and /dev/tty* represent the system consoles (accessible via the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default installation). The default securetty file also contains /dev/vc/*. These are likely to be deprecated in most environments, but may be retained for compatibility. Root should also be prohibited from connecting via network protocols. Other sections of this document include guidance describing how to prevent root from logging in via SSH.

3.4.2.1.a. Restrict Virtual Console Root Logins

To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in /etc/securetty:

vc/1
vc/2
vc/3
vc/4

Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account.

Remediation script

                      echo tty1 > /etc/securetty

                    

Security identifiers

  • GEN000980

3.4.2.1.b. Restrict Web Browser Use for Administrative Accounts

Enforce policy requiring administrative accounts use web browsers only for local service administration.

If a browser vulnerability is exploited while running with administrative privileges, the entire system could be compromised. Specific exceptions for local service administration should be documented in site-defined policy.

Remediation script

                      rm -rf `grep ^root: /etc/passwd | awk -F: '{ print $6 }'`/.mozilla
                    

Security identifiers

  • GEN004220

3.4.2.1.c. Verify Only Root Has UID 0

If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.

An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

Remediation script

                      for UID0_USER in `cat /etc/passwd | cut -d: -f1,3 | grep :0$ | grep -v ^root: | cut -d: -f1`; do
	userdel -rf ${UID0_USER}
done

                    

Security identifiers

  • GEN000880

3.4.2.1.d. Switching To Root Account Must Require Wheel Membership

Ensure that only members of the wheel group are allowed to switch to the root account.

Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing the root account, even with knowledge of the root credentials.

Remediation script

                      if [ "$(grep -c '#.*auth.*required.*pam_wheel.so' /etc/pam.d/su)" != "0" ]; then
	sed -i '/auth.*required.*pam_wheel.so/s/#//g' /etc/pam.d/su
else
	sed -i '/auth.*include/iauth\t\trequired\tpam_wheel.so use_uid' /etc/pam.d/su
fi

                    

Security identifiers

  • GEN000850

3.4.2.2. Verify Proper Storage and Existence of Password Hashes

By default, password hashes for local accounts are stored in the second field (colon-separated) in /etc/shadow. This file should be readable only by processes running with root credentials, preventing users from casually accessing others' password hashes and attempting to crack them. However, it remains possible to misconfigure the system and store password hashes in world-readable files such as /etc/passwd, or to even store passwords themselves in plaintext on the system. Using system-provided tools for password change/creation should allow administrators to avoid such misconfiguration.

3.4.2.2.a. Prevent Log In to Accounts With Empty Password

If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the nullok option in /etc/pam.d/system-auth to prevent logins with empty passwords.

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Remediation script

                      sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/system-auth

                    

Security identifiers

  • GEN000560

3.4.2.2.b. Verify All Account Password Hashes are Shadowed

If any password hashes are stored in /etc/passwd (in the second field, instead of an x), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.

The hashes for all user account passwords should be stored in the file /etc/shadow and never in /etc/passwd, which is readable by all users.

Security identifiers

  • GEN001470

3.4.2.2.c. All GIDs referenced in /etc/passwd must be defined in /etc/group

Add a group to the system for each GID referenced without a corresponding group.

Inconsistency in GIDs between /etc/passwd and /etc/group could lead to a user having unintended rights.

Security identifiers

  • GEN000380

3.4.2.2.d. Verify No netrc Files Exist

The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any .netrc files should be removed.

Unencrypted passwords for remote FTP servers may be stored in .netrc files. DoD policy requires passwords be encrypted in storage and not used in access scripts.

Security identifiers

  • GEN002000

3.4.2.3. Set Password Expiration Parameters

The file /etc/login.defs controls several password-related settings. Programs such as passwd, su, and login consult /etc/login.defs to determine behavior with regard to password aging, expiration warnings, and length. See the man page login.defs(5) for more information.

Users should be forced to change their passwords, in order to decrease the utility of compromised passwords. However, the need to change passwords often should be balanced against the risk that users will reuse or write down passwords if forced to change them too often. Forcing password changes every 90-360 days, depending on the environment, is recommended. Set the appropriate value as PASS_MAX_DAYS and apply it to existing accounts with the -M flag.

The PASS_MIN_DAYS (-m) setting prevents password changes for 7 days after the first change, to discourage password cycling. If you use this setting, train users to contact an administrator for an emergency password change in case a new password becomes compromised. The PASS_WARN_AGE (-W) setting gives users 7 days of warnings at login time that their passwords are about to expire.

For example, for each existing human user USER, expiration parameters could be adjusted to a 180 day maximum password age, 7 day minimum password age, and 7 day warning period with the following command:

# chage -M 180 -m 7 -W 7 USER

3.4.2.3.a. Set Password Minimum Age

To specify password minimum age for new accounts, edit the file /etc/login.defs and add or correct the following line, replacing DAYS appropriately:

PASS_MIN_DAYS DAYS
A value of 1 day is considered for sufficient for many environments. The DoD requirement is 1.

Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.

Remediation script

                      
var_accounts_minimum_age_login_defs="7"

grep -q ^PASS_MIN_DAYS /etc/login.defs && \
  sed -i "s/PASS_MIN_DAYS.*/PASS_MIN_DAYS     $var_accounts_minimum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MIN_DAYS      $var_accounts_minimum_age_login_defs" >> /etc/login.defs
fi

USERACCT=$(egrep -v "^\+|^#" /etc/passwd | cut -d":" -f1)
for SYS_USER in ${USERACCT}; do
	if [ $(grep -c ${SYS_USER} /etc/shadow) != 0 ]; then
		passwd -n $var_accounts_minimum_age_login_defs ${SYS_USER} &>/dev/null
	fi
done

                    

Security identifiers

  • GEN000540

3.4.2.3.b. Set Password Maximum Age

To specify password maximum age for new accounts, edit the file /etc/login.defs and add or correct the following line, replacing DAYS appropriately:

PASS_MAX_DAYS DAYS
A value of 180 days is sufficient for many environments. The DoD requirement is 60.

Setting the password maximum age ensures users are required to periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

Remediation script

                      
var_accounts_maximum_age_login_defs="60"

grep -q ^PASS_MAX_DAYS /etc/login.defs && \
  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" >> /etc/login.defs
fi

USERACCT=$(egrep -v "^\+|^#" /etc/passwd | cut -d":" -f1)
for SYS_USER in ${USERACCT}; do
	if [ $(grep -c ${SYS_USER} /etc/shadow) != 0 ]; then
		passwd -x $var_accounts_maximum_age_login_defs ${SYS_USER} &>/dev/null
	fi
done

                    

Security identifiers

  • GEN000700

3.4.2.4. Set Account Expiration Parameters

Accounts can be configured to be automatically disabled after a certain time period, meaning that they will require administrator interaction to become usable again. Expiration of accounts after inactivity can be set for all accounts by default and also on a per-account basis, such as for accounts that are known to be temporary. To configure automatic expiration of an account following the expiration of its password (that is, after the password has expired and not been changed), run the following command, substituting NUM_DAYS and USER appropriately:

# chage -I NUM_DAYS USER
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the -E option. The file /etc/default/useradd controls default settings for all newly-created accounts created with the system's normal command line utilities.

3.4.2.4.a. Set Account Expiration Following Inactivity

To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following lines in /etc/default/useradd, substituting NUM_DAYS appropriately:

INACTIVE=NUM_DAYS
A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.

Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.

Remediation script

                      
var_account_disable_post_pw_expiration="35"

if [ $(cat /etc/default/useradd | grep -c "^INACTIVE=") != 0 ]; then
	sed -i "s/^INACTIVE=.*/INACTIVE=${var_account_disable_post_pw_expiration}/" /etc/default/useradd
else
	echo INACTIVE=${var_account_disable_post_pw_expiration} >>/etc/default/useradd
fi

                    

Security identifiers

  • GEN006660

References

  1. AC-2(3). URL: <http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf>.
  2. 17. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.

3.4.2.4.b. Ensure All Accounts on the System Have Unique Names

Change usernames, or delete accounts, so each has a unique name.

Unique usernames allow for accountability on the system.

Security identifiers

  • GEN000300

3.4.2.4.c. Ensure All Accounts on the System Have Unique User IDs

Change user ID, or delete accounts, so each has a unique ID.

Unique IDs allow for accountability on the system.

Security identifiers

  • GEN000320

3.4.3. Protect Accounts by Configuring PAM

PAM, or Pluggable Authentication Modules, is a system which implements modular authentication for Linux programs. PAM provides a flexible and configurable architecture for authentication, and it should be configured to minimize exposure to unnecessary risk. This section contains guidance on how to accomplish that.

PAM is implemented as a set of shared objects which are loaded and invoked whenever an application wishes to authenticate a user. Typically, the application must be running as root in order to take advantage of PAM, because PAM's modules often need to be able to access sensitive stores of account information, such as /etc/shadow. Traditional privileged network listeners (e.g. sshd) or SUID programs (e.g. sudo) already meet this requirement. An SUID root application, userhelper, is provided so that programs which are not SUID or privileged themselves can still take advantage of PAM.

PAM looks in the directory /etc/pam.d for application-specific configuration information. For instance, if the program login attempts to authenticate a user, then PAM's libraries follow the instructions in the file /etc/pam.d/login to determine what actions should be taken.

One very important file in /etc/pam.d is /etc/pam.d/system-auth. This file, which is included by many other PAM configuration files, defines 'default' system authentication measures. Modifying this file is a good way to make far-reaching authentication changes, for instance when implementing a centralized authentication service.

Be careful when making changes to PAM's configuration files. The syntax for these files is complex, and modifications can have unexpected consequences. The default configurations shipped with applications should be sufficient for most users.

Running authconfig or system-config-authentication will re-write the PAM configuration files, destroying any manually made changes and replacing them with a series of system defaults. One reference to the configuration file syntax can be found at http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html.

3.4.3.a. Configure Global Account Settings

The /etc/pam.d/system-auth file must not be a symbolic link to /etc/pam.d/system-auth-ac. The /etc/pam.d/system-auth file must instead link to an alternate file, such as /etc/pam.d/system-auth-local, which incorporates include statements for system-auth-ac. Specifically, the following include statements should be present:

auth include system-auth-ac
account include system-auth-ac
password include system-auth-ac
session include system-auth-ac

Pam global requirements are generally defined in the /etc/pam.d/system-auth or /etc/pam.d/system-auth-ac file. In order for the requirements to be applied the file containing them must be included directly or indirectly in each program's definition file in /etc/pam.d.

Remediation script

                    cat > /etc/pam.d/system-auth-local <<'STOP_HERE'
auth        include      system-auth-ac
account     include      system-auth-ac
password    include      system-auth-ac
session     include      system-auth-ac
STOP_HERE
ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth

                  

Security identifiers

  • GEN000600-2

3.4.3.b. Ensure Account Logins are Logged

Monitoring and recording successful and unsuccessful logins assists in tracking unauthorized access to the system. Without this logging, the ability to track unauthorized activity to specific user accounts may be diminished.

Remediation script

                    if [ ! -e /var/log/btmp ]; then
	>/var/log/btmp
	chmod 600 /var/log/btmp
	chown root:root /var/log/btmp
fi
if [ ! -e /var/log/wtmp ]; then
	>/var/log/wtmp
	chmod 664 /var/log/wtmp
	chown root:root /var/log/wtmp
fi

                  

Security identifiers

  • GEN000440

3.4.3.3. Set Password Quality Requirements

The default pam_cracklib PAM module provides strength checking for passwords. It performs a number of checks, such as making sure passwords are not similar to dictionary words, are of at least a certain length, are not the previous password reversed, and are not simply a change of case from the previous password. It can also require passwords to be in certain character classes.

The man page pam_cracklib(8) provides information on the capabilities and configuration of each.

3.4.3.3.1. Set Password Quality Requirements, if using pam_cracklib

The pam_cracklib PAM module can be configured to meet requirements for a variety of policies.

For example, to configure pam_cracklib to require at least one uppercase character, lowercase character, digit, and other (special) character, locate the following line in /etc/pam.d/system-auth:

password requisite pam_cracklib.so try_first_pass retry=3
and then alter it to read:
password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4
If no such line exists, add one as the first line of the password section in /etc/pam.d/system-auth. The arguments can be modified to ensure compliance with your organization's security policy. Discussion of each parameter follows.

Note that the password quality requirements are not enforced for the root account for some reason.

3.4.3.3.1.a. Include Cracklib Password Module

To ensure the cracklib password module is being enforced and its configuration is not being overwritten by authconfig, the cracklib module must be defined in /etc/pam.d/system-auth. Additionally, the /etc/pam.d/passwd file must ensure the password include statement points to system-auth and not system-auth-ac.

An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script that uses repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate passwords are not dictionary words and meet other criteria during password changes.

Remediation script

                        authconfig --updateall
if [ -e /etc/pam.d/system-auth-ac ]; then
	sed -i '/password.*include.*system-auth-ac/ipassword    required     pam_cracklib.so' /etc/pam.d/system-auth
else
	sed -i '/password.*unix.so/ipassword    required     pam_cracklib.so' /etc/pam.d/system-auth
fi

                      

Security identifiers

  • GEN000790

3.4.3.3.1.b. Set Password Minimum Length

To specify password length requirements for new accounts, edit the file /etc/login.defs and add or correct the following lines:

PASS_MIN_LEN 14


The DoD requirement is 14. The FISMA requirement is 12. If a program consults /etc/login.defs and also another PAM module (such as pam_cracklib) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.

Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result.

Remediation script

                        
var_password_pam_cracklib_minlen="14"

if [ $(grep -c "minlen=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/minlen=[0-9]*/minlen=$var_password_pam_cracklib_minlen/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ minlen=$var_password_pam_cracklib_minlen/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "minlen=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/minlen=[0-9]*/minlen=$var_password_pam_cracklib_minlen/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ minlen=$var_password_pam_cracklib_minlen/" /etc/pam.d/system-auth-ac
	fi
fi

                      

Security identifiers

  • GEN000585

3.4.3.3.1.c. Set Password to Maximum of Three Consecutive Repeating Characters

The pam_cracklib module's maxrepeat parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Add maxrepeat=3 after pam_cracklib.so to prevent a run of four or more identical characters.

Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.

Remediation script

                        
var_password_pam_cracklib_maxrepeat="3"

if [ $(grep -c "maxrepeat=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/maxrepeat=[0-9]*/maxrepeat=$var_password_pam_cracklib_maxrepeat/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ maxrepeat=$var_password_pam_cracklib_maxrepeat/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "maxrepeat=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/maxrepeat=[0-9]*/maxrepeat=$var_password_pam_cracklib_maxrepeat/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ maxrepeat=$var_password_pam_cracklib_maxrepeat/" /etc/pam.d/system-auth-ac
	fi
fi
                      

Security identifiers

  • GEN000680

3.4.3.3.1.d. Set Password Strength Minimum Digit Characters

The pam_cracklib module's dcredit parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_cracklib will grant +1 additional length credit for each digit. Add dcredit=-1 after pam_cracklib.so to require use of a digit in passwords.

Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.

Remediation script

                        
var_password_pam_cracklib_dcredit="-1"

if [ $(grep -c "dcredit=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/dcredit=[0-9]*/dcredit=$var_password_pam_cracklib_dcredit/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ dcredit=$var_password_pam_cracklib_dcredit/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "dcredit=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/dcredit=[0-9]*/dcredit=$var_password_pam_cracklib_dcredit/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ dcredit=$var_password_pam_cracklib_dcredit/" /etc/pam.d/system-auth-ac
	fi
fi

                      

Security identifiers

  • GEN000620

3.4.3.3.1.e. Set Password Strength Minimum Uppercase Characters

The pam_cracklib module's ucredit= parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each uppercase character. Add ucredit=-1 after pam_cracklib.so to require use of an upper case character in passwords.

Requiring a minimum number of uppercase characters makes password guessing attacks more difficult by ensuring a larger search space.

Remediation script

                        
var_password_pam_cracklib_ucredit="-1"

if [ $(grep -c "ucredit=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/ucredit=[0-9]*/ucredit=$var_password_pam_cracklib_ucredit/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ ucredit=$var_password_pam_cracklib_ucredit/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "ucredit=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/ucredit=[0-9]*/ucredit=$var_password_pam_cracklib_ucredit/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ ucredit=$var_password_pam_cracklib_ucredit/" /etc/pam.d/system-auth-ac
	fi
fi

                      

Security identifiers

  • GEN000600

3.4.3.3.1.f. Set Password Strength Minimum Special Characters

The pam_cracklib module's ocredit= parameter controls requirements for usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each special character. Add ocredit=-1 after pam_cracklib.so to require use of a special character in passwords.

Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space.

Remediation script

                        
var_password_pam_cracklib_ocredit="-1"

if [ $(grep -c "ocredit=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/ocredit=[0-9]*/ucredit=$var_password_pam_cracklib_ocredit/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ ocredit=$var_password_pam_cracklib_ocredit/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "ocredit=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/ocredit=[0-9]*/ucredit=$var_password_pam_cracklib_ocredit/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ ocredit=$var_password_pam_cracklib_ocredit/" /etc/pam.d/system-auth-ac
	fi
fi

                      

Security identifiers

  • GEN000640

3.4.3.3.1.g. Set Password Strength Minimum Lowercase Characters

The pam_cracklib module's lcredit= parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each lowercase character. Add lcredit=-1 after pam_cracklib.so to require use of a lowercase character in passwords.

Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.

Remediation script

                        
var_password_pam_cracklib_lcredit="-1"

if [ $(grep -c "lcredit=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/lcredit=[0-9]*/lcredit=$var_password_pam_cracklib_lcredit/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ lcredit=$var_password_pam_cracklib_lcredit/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "lcredit=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/lcredit=[0-9]*/lcredit=$var_password_pam_cracklib_lcredit/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ lcredit=$var_password_pam_cracklib_lcredit/" /etc/pam.d/system-auth-ac
	fi
fi

                      

Security identifiers

  • GEN000610

3.4.3.3.1.h. Set Password Strength Minimum Different Characters

The pam_cracklib module's difok parameter controls requirements for usage of different characters during a password change. Add difok=NUM after pam_cracklib.so to require differing characters when changing passwords, substituting NUM appropriately. The DoD requirement is 4.

Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.

Remediation script

                        
var_password_pam_cracklib_difok="4"

if [ $(grep -c "difok=" /etc/pam.d/system-auth) != 0 ]; then
	sed -i "s/difok=[0-9]*/difok=$var_password_pam_cracklib_difok/" /etc/pam.d/system-auth
else
	sed -i "/password.*pam_cracklib.so/s/$/ difok=$var_password_pam_cracklib_difok/" /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep -c "difok=" /etc/pam.d/system-auth-ac) != 0 ]; then
		sed -i "s/difok=[0-9]*/difok=$var_password_pam_cracklib_difok/" /etc/pam.d/system-auth-ac
	else
		sed -i "/password.*pam_cracklib.so/s/$/ difok=$var_password_pam_cracklib_difok/" /etc/pam.d/system-auth-ac
	fi
fi

                      

Security identifiers

  • GEN000750

3.4.3.3.1.i. Limit Password Reuse

Do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_unix PAM module. In the file /etc/pam.d/system-auth, append remember=24 to the line which refers to the pam_unix.so module, as shown:

password sufficient pam_unix.so existing_options remember=24
The DoD and FISMA requirement is 24 passwords.

Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.

Security identifiers

  • GEN000800

3.4.3.4. Set Authentication Failure Actions

The system should be configured to handle authentication failures so that password cracking attempts are mitigated.

Locking out user accounts presents the risk of a denial-of-service attack. The lockout policy must weigh whether the risk of such a denial-of-service attack outweighs the benefits of thwarting password guessing attacks.

3.4.3.4.a. Set Deny For Failed Password Attempts

To configure the system to lock out accounts after a number of incorrect login attempts using pam_faillock.so:

Add the following lines immediately below the pam_unix.so statement in AUTH section of /etc/pam.d/system-auth:

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks.

Remediation script

                      
var_accounts_password_pam_tally_deny="3"

if [ $(grep auth.*required.*pam_tally2 /etc/pam.d/system-auth | grep -c "deny=") != 0 ]; then
	sed -i "/account.*required.*pam_tally/s/deny=[0-9]*/deny=${var_accounts_password_pam_tally_deny}/" /etc/pam.d/system-auth
elif [ $(grep -c "auth.*required.*pam_tally2" /etc/pam.d/system-auth) = 0 ]; then
	if [ $(grep -c "pam_tally.so" /etc/pam.d/system-auth) != 0 ]; then
		sed -i "s/pam_tally.so/pam_tally2.so/g" /etc/pam.d/system-auth
	elif [ $(grep -c "auth.*include.*system-auth-ac" /etc/pam.d/system-auth) != 0 ]; then
		sed -i 's/\(auth\s*include\s*system-auth-ac\)/auth        required     pam_tally2.so\n\1/' /etc/pam.d/system-auth
	elif [ $(grep -c "auth.*pam_unix.so" /etc/pam.d/system-auth) != 0 ]; then
		sed -i 's/\(auth.*pam_unix.so\)/auth        required     pam_tally2.so\n\1/' /etc/pam.d/system-auth
	elif [ $(grep -c "auth.*pam_deny.so" /etc/pam.d/system-auth) != 0 ]; then
		sed -i 's/\(auth.*pam_deny.so\)/auth        required     pam_tally2.so\n\1/' /etc/pam.d/system-auth
	else
		sed -i ':a;N;$!ba;s/\([\n]*[#]*[\s]*account\)/\nauth        required     pam_tally2.so\n\1/' /etc/pam.d/system-auth
	fi
	sed -i "/auth.*pam_tally/s/$/ deny=${var_accounts_password_pam_tally_deny}/" /etc/pam.d/system-auth
else
	sed -i "/auth.*pam_tally/s/$/ deny=${var_accounts_password_pam_tally_deny}/" /etc/pam.d/system-auth
fi
if [ ! -e /var/log/tallylog ]; then
	>/var/log/tallylog
fi
chmod 640 /var/log/tallylog
chown root:root /var/log/tallylog

                    

Security identifiers

  • GEN000460

3.4.3.4.b. Set Delay Between Failed Password Attempts

Check the value of the FAIL_DELAY variable and the ability to use it.

Enforcing a delay between successive failed login attempts increases protection against automated password guessing attacks.

Remediation script

                      if [ $(grep -c ^FAIL_DELAY /etc/login.defs) != 0 ]; then
	sed -i 's/^FAIL_DELAY.*[0-9]*/FAIL_DELAY 4/' /etc/login.defs
else
	echo "FAIL_DELAY 4" | tee -a /etc/login.defs &>/dev/null
fi

if [ $(grep -c pam_faildelay.so /etc/pam.d/system-auth) != 0 ]; then
	if [ $(grep -c pam_faildelay.so.*delay\= /etc/pam.d/system-auth) != 0 ]; then
		sed -i '/pam_faildelay.so/s/\(delay=\)[0-9]*/\14000000/' /etc/pam.d/system-auth
	else
		sed -i '/pam_faildelay.so/s/$/ delay=4000000/' /etc/pam.d/system-auth
	fi
else
	sed -i '/auth.*include.*system-auth-ac/iauth        optional     pam_faildelay.so delay=4000000' /etc/pam.d/system-auth
fi

                    

Security identifiers

  • GEN000480

3.4.3.5. Set Password Hashing Algorithm

The system's default algorithm for storing password hashes in /etc/shadow is SHA-512. This can be configured in several locations.

3.4.3.5.a. Set Password Hashing Algorithm in /etc/pam.d/system-auth

In /etc/pam.d/system-auth, the password section of the file controls which PAM modules execute during a password change. Set the pam_unix.so module in the password section to include the argument sha512, as shown below:

password    sufficient    pam_unix.so sha512 other arguments...
This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.

Using a stronger hashing algorithm makes password cracking attacks more difficult.

Remediation script

                      if [ $(grep "password.*pam_unix.so" /etc/pam.d/system-auth | egrep -c '(descrypt|bigcrypt|md5|sha256)') != 0 ]; then
	sed -i '/password.*pam_unix.so/s/\(descrypt\|bigcrypt\|md5\|sha256\)/sha512/' /etc/pam.d/system-auth
else
	sed -i '/password.*pam_unix.so/s/$/ sha512/' /etc/pam.d/system-auth
fi
if [ -e /etc/pam.d/system-auth-ac ]; then
	if [ $(grep "password.*pam_unix.so" /etc/pam.d/system-auth-ac | egrep -c '(descrypt|bigcrypt|md5|sha256)') != 0 ]; then
		sed -i '/password.*pam_unix.so/s/\(descrypt\|bigcrypt\|md5\|sha256\)/sha512/' /etc/pam.d/system-auth-ac
	else
		sed -i '/password.*pam_unix.so/s/$/ sha512/' /etc/pam.d/system-auth-ac
	fi
fi
                    

Security identifiers

  • GEN000590

3.4.4. Secure Session Configuration Files for Login Accounts

When a user logs into a Unix account, the system configures the user's session by reading a number of files. Many of these files are located in the user's home directory, and may have weak permissions as a result of user error or misconfiguration. If an attacker can modify or even read certain types of account configuration information, they can often gain full access to the affected user's account. Therefore, it is important to test and correct configuration file permissions for interactive accounts, particularly those of privileged users such as root or system administrators.

3.4.4.a. Limit the Number of Concurrent Login Sessions Allowed Per User

Limiting the number of allowed users and sessions per user can limit risks related to Denial of Service attacks. This addresses concurrent sessions for a single account and does not address concurrent sessions by a single user via multiple accounts. The DoD requirement is 10. To set the number of concurrent sessions per user add the following line in /etc/security/limits.conf:

* hard maxlogins 10

Limiting simultaneous user logins can insulate the system from denial of service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions.

Remediation script

                    
max_concurrent_login_sessions_value="1"

if [ $(grep -v "#" /etc/security/limits.conf | grep -c "maxlogins") = "0" ]; then
	echo "* hard maxlogins ${max_concurrent_login_sessions_value}" >>/etc/security/limits.conf
else
	sed -i 's/.*maxlogins.*/* hard maxlogins ${max_concurrent_login_sessions_value}/' /etc/security/limits.conf
fi

                  

Security identifiers

  • GEN000450

3.4.4.2. Ensure that No Dangerous Directories Exist in Root's Path

The active path of the root account can be obtained by starting a new root shell and running:

# echo $PATH
This will produce a colon-separated list of directories in the path.

Certain path elements could be considered dangerous, as they could lead to root executing unknown or untrusted programs, which could contain malicious code. Since root may sometimes work inside untrusted directories, the . character, which represents the current directory, should never be in the root path, nor should any directory which can be written to by an unprivileged or semi-privileged (system) user.

It is a good practice for administrators to always execute privileged commands by typing the full path to the command.

3.4.4.2.a. Ensure that Root's PATH Variable Only Includes Absolute Paths

Ensure that none of the directories in root's executable path is equal to a single . character, or that it contains any instances that lead to relative path traversal, such as .. or beginning a path without the slash (/) character. Also ensure that there are no "empty" elements in the path, such as in these examples:

PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin
These empty elements have the same effect as a single . character.

Including these entries increases the risk that root could execute code from an untrusted location.

Security identifiers

  • GEN000940

3.4.4.2.b. Ensure that Root's LD_LIBRARY_PATH Variable Only Includes Absolute Paths

Ensure that none of the directories in root's library path is equal to a single . character, or that it contains any instances that lead to relative path traversal, such as .. or beginning a path without the slash (/) character. Also ensure that there are no "empty" elements in the path, such as in these examples:

LD_LIBRARY_PATH=:/lib
LD_LIBRARY_PATH=/lib:
LD_LIBRARY_PATH=/lib::/usr/lib
These empty elements have the same effect as a single . character.

Including these entries increases the risk that root could execute code from an untrusted location.

Security identifiers

  • GEN000945

3.4.4.2.c. Ensure that Root's Path Does Not Include World or Group-Writable Directories

For each element in root's path, run:

# ls -ld DIR
and ensure that write permissions are disabled for group and other.

Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code.

Security identifiers

  • GEN000960

3.4.4.3. Ensure that Users Have Sensible Umask Values

The umask setting controls the default permissions for the creation of new files. With a default umask setting of 077, files and directories created by users will not be readable by any other user on the system. Users who wish to make specific files group- or world-readable can accomplish this by using the chmod command. Additionally, users can make all their files readable to their group by default by setting a umask of 027 in their shell configuration files. If default per-user groups exist (that is, if every user has a default group whose name is the same as that user's username and whose only member is the user), then it may even be safe for users to select a umask of 007, making it very easy to intentionally share files with groups of which the user is a member.

3.4.4.3.a. Ensure the Default Umask is Set Correctly

To ensure the default umask for users is set properly, add or correct the umask setting in /etc/bashrc to read as follows:

umask 077

The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

Remediation script

                      
var_accounts_user_umask="027"

egrep -li ^[[:blank:]]*umask `find /etc /root /home/* -maxdepth 1 -type f 2>/dev/null` | while read FILE; do
	sed -i "s/\([uU][mM][aA][sS][kK]\s*[=]*\s*\)[0-9]*/\1${var_accounts_user_umask}/" "${FILE}"
done


                    

Security identifiers

  • GEN002560

3.4.4.3.b. Ensure All User Login Shells Are In The Shells File

To ensure all login shells are included in /etc/shells, run the following command:

# for USHELL in `cut -d: -f7 /etc/passwd`; do if [ $(grep -c "${USHELL}" /etc/shells) == 0 ]; then echo "${USHELL} not in /etc/shells"; fi; done

The shells file lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized unsecure shell.

Remediation script

                      for USHELL in `cut -d: -f7 /etc/passwd | egrep -v '(/usr/bin/false|/bin/false|/dev/null|/sbin/nologin|/bin/sync|/sbin/halt|/sbin/shutdown)' | uniq`; do
	if [ "$(grep -c "${USHELL}" /etc/shells)" = "0" ]; then
		echo "${USHELL}" >> /etc/shells
	fi
done

                    

Security identifiers

  • GEN002140

3.4.5. Protect Physical Console Access

It is impossible to fully protect a system from an attacker with physical access, so securing the space in which the system is located should be considered a necessary step. However, there are some steps which, if taken, make it more difficult for an attacker to quickly or undetectably modify a system from its console.

3.4.5.a. Require Authentication for Single User Mode

Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected.

To require entry of the root password even if the system is started in single-user mode, add or correct the following line in the file /etc/inittab:

~:S:wait:/sbin/sulogin

This prevents attackers with physical access from trivially bypassing security on the machine and gaining root access. Such accesses are further prevented by configuring the bootloader password.

Remediation script

                    grep -q :S: /etc/inittab && \
  sed -i "s/.*:S:.*/~:S:wait:\/sbin\/sulogin/g" /etc/inittab
if ! [ $? -eq 0 ]; then
    echo "~:S:wait:/sbin/sulogin" >> /etc/inittab
fi

                  

Security identifiers

  • GEN000020

3.4.5.b. Disable Ctrl-Alt-Del Reboot Activation

By default, the system includes the following line in /etc/init/control-alt-delete.conf to reboot the system when the Ctrl-Alt-Del key sequence is pressed:

exec /sbin/shutdown -r now "Control-Alt-Delete pressed"

To configure the system to log a message instead of rebooting the system, alter that line to read as follows:
exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"

A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Del sequence is reduced because the user will be prompted before any action is taken.

Remediation script

                    sed -i 's/^.*:ctrlaltdel:.*\(shutdown\|reboot\).*/ca:nil:ctrlaltdel:\/usr\/bin\/logger -p security.info "Ctrl-Alt-Del was pressed"/' /etc/inittab
	
                  

Security identifiers

  • GEN000000-LNX00580

3.4.5.3. Set Boot Loader Password

During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows for the selection of different kernels - possibly on different partitions or media. The default Red Hat Enterprise Linux boot loader for x86 systems is called GRUB. Options it can pass to the kernel include single-user mode, which provides root access without any authentication, and the ability to disable SELinux. To prevent local users from modifying the boot parameters and endangering security, protect the boot loader configuration with a password and ensure its configuration file's permissions are set properly.

3.4.5.3.a. Verify /boot/grub/grub.conf Exists

The file /boot/grub/grub.conf should exist.

GRUB is a versatile boot loader used by several platforms that can provide authentication for access to the system or boot loader.

Security identifiers

  • GEN008660

3.4.5.3.b. Verify /etc/grub.conf User Ownership

The file /etc/grub.conf should be owned by the root user to prevent destruction or modification of the file. To properly set the owner of /etc/grub.conf, run the command:

$ sudo chown root /etc/grub.conf

Only root should be able to modify important boot parameters.

Remediation script

                      chown root /etc/grub.conf /boot/grub/grub.conf
                    

Security identifiers

  • GEN008760

3.4.5.3.c. Verify /etc/grub.conf Group Ownership

The file /etc/grub.conf should be group-owned by the root group to prevent destruction or modification of the file. To properly set the group owner of /etc/grub.conf, run the command:

$ sudo chgrp root /etc/grub.conf

The root group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.

Remediation script

                      chown :root /etc/grub.conf
                    

Security identifiers

  • GEN008780

3.4.5.3.d. Verify /boot/grub/grub.conf Permissions

File permissions for /boot/grub/grub.conf should be set to 600, which is the default. To properly set the permissions of /boot/grub/grub.conf, run the command:

$ sudo chmod 600 /boot/grub/grub.conf

Proper permissions ensure that only the root user can modify important boot parameters.

Remediation script

                      chmod 0600 /etc/grub.conf /boot/grub/grub.conf
                    

Security identifiers

  • GEN008720

3.4.5.3.e. Verify /boot/grub/grub.conf Extended ACLs

The system's boot loader configuration file(s) must not have extended ACLs.

Proper permissions ensure that only the root user can modify important boot parameters.

Remediation script

                      setfacl --remove-all /etc/grub.conf /boot/grub/grub.conf
                    

Security identifiers

  • GEN008740

3.4.5.3.f. Set Boot Loader Password

The grub boot loader should have password protection enabled to protect boot-time settings. To do so, select a password and then generate a hash from it by running the following command:

# /sbin/grub-md5-crypt
When prompted to enter a password, insert the following line into /etc/grub.conf immediately after the header comments. (Use the output from grub-md5-crypt as the value of password-hash):
password --md5 password-hash
NOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password.

Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.

Remediation script

                      if [ -e /tmp/GRUB.TMP ]; then
	/sbin/grub-md5-crypt < /tmp/GRUB.TMP &> /tmp/GRUB.TMP.out
	md5crypt=`tail -n1 /tmp/GRUB.TMP.out`
	if [ -f /boot/grub/grub.conf ] && [ ! -h /boot/grub/grub.conf ]; then
		if [ "$(grep -c '^password' /boot/grub/grub.conf)" = "0" ]; then
			sed -i "/timeout/apassword --md5 ${md5crypt}" /boot/grub/grub.conf
		else
			sed -i "s/^password .*/password --md5 ${md5crypt}/" /boot/grub/grub.conf
		fi
	fi
	if [ -f /etc/grub.conf ] && [ ! -h /etc/grub.conf ]; then
		if [ "$(grep -c '^password' /etc/grub.conf)" = "0" ]; then
			sed -i "/timeout/apassword --md5 ${md5crypt}" /etc/grub.conf
		else
			sed -i "s/^password .*/password --md5 ${md5crypt}/" /etc/grub.conf
		fi
	fi
	rm -f /tmp/GRUB.TMP /tmp/GRUB.TMP.out
fi

                    

Security identifiers

  • GEN008700

3.4.5.3.g. Set Boot Loader Password Hash

The grub boot loader password should be protected by being hashed with an approved hash algorithm, such as md5. To do so, select a password and then generate a hash from it by running the following command:

# /sbin/grub-md5-crypt
When prompted to enter a password, insert the following line into /etc/grub.conf immediately after the header comments. (Use the output from grub-md5-crypt as the value of password-hash):
password --md5 password-hash
NOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password.

Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.

Remediation script

                      if [ -e /tmp/GRUB.TMP ]; then
	/sbin/grub-md5-crypt < /tmp/GRUB.TMP &> /tmp/GRUB.TMP.out
	md5crypt=`tail -n1 /tmp/GRUB.TMP.out`
	if [ -f /boot/grub/grub.conf ] && [ ! -h /boot/grub/grub.conf ]; then
		if [ "$(grep -c '^password' /boot/grub/grub.conf)" = "0" ]; then
			sed -i "/timeout/apassword --md5 ${md5crypt}" /boot/grub/grub.conf
		else
			sed -i "s/^password .*/password --md5 ${md5crypt}/" /boot/grub/grub.conf
		fi
	fi
	if [ -f /etc/grub.conf ] && [ ! -h /etc/grub.conf ]; then
		if [ "$(grep -c '^password' /etc/grub.conf)" = "0" ]; then
			sed -i "/timeout/apassword --md5 ${md5crypt}" /etc/grub.conf
		else
			sed -i "s/^password .*/password --md5 ${md5crypt}/" /etc/grub.conf
		fi
	fi
	rm -f /tmp/GRUB.TMP /tmp/GRUB.TMP.out
fi

                    

Security identifiers

  • GEN008710

3.4.5.4. Configure Screen Locking

When a user must temporarily leave an account logged-in, screen locking should be employed to prevent passersby from abusing the account. User education and training is particularly important for screen locking to be effective, and policies can be implemented to reinforce this.

Automatic screen locking is only meant as a safeguard for those cases where a user forgot to lock the screen.

3.4.5.4.1. Configure GUI Screen Locking

In the default GNOME desktop, the screen can be locked by choosing Lock Screen from the System menu.

The gconftool-2 program can be used to enforce mandatory screen locking settings for the default GNOME environment. The following sections detail commands to enforce idle activation of the screen saver, screen locking, a blank-screen screensaver, and an idle activation time.

Because users should be trained to lock the screen when they step away from the computer, the automatic locking feature is only meant as a backup. The Lock Screen icon from the System menu can also be dragged to the taskbar in order to facilitate even more convenient screen-locking.

The root account cannot be screen-locked, but this should have no practical effect as the root account should never be used to log into an X Windows environment, and should only be used to for direct login via console in emergency circumstances.

For more information about configuring GNOME screensaver, see http://live.gnome.org/GnomeScreensaver. For more information about enforcing preferences in the GNOME environment using the GConf configuration system, see http://projects.gnome.org/gconf and the man page gconftool-2(1).

3.4.5.4.1.a. Set GNOME Login Inactivity Timeout

Run the following command to set the idle time-out value for inactivity in the GNOME desktop to 15 minutes:

# gconftool-2 \
  --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type int \
  --set /apps/gnome-screensaver/idle_delay 15

Setting the idle delay controls when the screensaver will start, and can be combined with screen locking to prevent access from passersby.

Remediation script

                        gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /apps/gnome-screensaver/idle_delay 15 &>/dev/null

                      

Security identifiers

  • GEN000500-2

3.4.5.4.1.b. GNOME Desktop Screensaver Mandatory Use

Run the following command to activate the screensaver in the GNOME desktop after a period of inactivity:

# gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gnome-screensaver/idle_activation_enabled true

Enabling idle activation of the screen saver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area.

Remediation script

                        gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /apps/gnome-screensaver/idle_activation_enabled true &>/dev/null

                      

Security identifiers

  • GEN000500

3.4.5.4.1.c. Enable Screen Lock Activation After Idle Period

Run the following command to activate locking of the screensaver in the GNOME desktop when it is activated:

# gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gnome-screensaver/lock_enabled true

Enabling the activation of the screen lock after an idle period ensures password entry will be required in order to access the system, preventing access by passersby.

Remediation script

                        gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /apps/gnome-screensaver/lock_enabled true &>/dev/null

                      

Security identifiers

  • GEN000500-3

3.4.5.4.2. Configure Console Screen Locking

A console screen locking mechanism is provided in the screen package, which is not installed by default.

3.4.5.4.2.1. Hardware Tokens for Authentication

The use of hardware tokens such as smart cards for system login provides stronger, two-factor authentication than using a username/password. In Red Hat Enterprise Linux servers and workstations, hardware token login is not enabled by default and must be enabled in the system settings.

3.4.5.4.2.1.a. Enable Smart Card Login

To enable smart card authentication, consult the documentation at:

Smart card login provides two-factor authentication stronger than that provided by a username/password combination. Smart cards leverage a PKI (public key infrastructure) in order to provide and verify credentials.

Security identifiers

  • GEN009120

3.4.6. Warning Banners for System Accesses

Each system should expose as little information about itself as possible.

System banners, which are typically displayed just before a login prompt, give out information about the service or the host's operating system. This might include the distribution name and the system kernel version, and the particular version of a network service. This information can assist intruders in gaining access to the system as it can reveal whether the system is running vulnerable software. Most network services can be configured to limit what information is displayed.

Many organizations implement security policies that require a system banner provide notice of the system's ownership, provide warning to unauthorized users, and remind authorized users of their consent to monitoring.

3.4.6.a. Modify the System Login Banner

To configure the system login banner:

Edit /etc/issue. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either:

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.


OR:

I've read & consent to terms in IS user agreem't.

An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.

Remediation script

                    
system_login_banner_text=""

echo $system_login_banner_text | sed -e 's/\[\\s\\n\][+|*]/ /g' -e 's/\&amp;/\&/g' -e 's/\\//g' -e 's/ - /\n- /g' >/etc/issue

                  

Security identifiers

  • GEN000400

3.4.6.b. Create Warning Banners for All FTP Users

Edit the vsftpd configuration file, which resides at /etc/vsftpd/vsftpd.conf by default. Add or correct the following configuration options:

banner_file=/etc/issue

This setting will cause the system greeting banner to be used for FTP connections as well.

Remediation script

                    
ftp_login_banner_text=""

if [ -e /etc/xinetd.d/gssftp ]; then
	if [ "`egrep -c '^(\s|\t)banner' /etc/xinetd.d/gssftp`" = "0" ]; then
		sed -i "/^}$/i\\\tbanner\t\t= /etc/issue" /etc/xinetd.d/gssftp
	else
		GSSFTP_BANNER_FILE="`egrep '^(\s|\t)banner' /etc/xinetd.d/gssftp | awk '{ print $3 }'`"
		echo $ftp_login_banner_text | sed -e 's/\[\\s\\n\][+|*]/ /g' -e 's/\&amp;/\&/g' -e 's/\\//g' -e 's/ - /\n- /g' >"${GSSFTP_BANNER_FILE}"
	fi
fi

if [ -e /etc/vsftpd/vsftpd.conf ]; then
	if [ "`egrep -c '^banner_file' /etc/vsftpd/vsftpd.conf`" = "0" ]; then
		echo "banner_file=/etc/issue" >> /etc/vsftpd/vsftpd.conf
	else
		VSFTPD_BANNER_FILE="`egrep '^banner_file' /etc/vsftpd/vsftpd.conf | awk -F= '{ print $2 }'`"
		echo $ftp_login_banner_text | sed -e 's/\[\\s\\n\][+|*]/ /g' -e 's/\&amp;/\&/g' -e 's/\\//g' -e 's/ - /\n- /g' >"${VSFTPD_BANNER_FILE}"
	fi
fi

                  

Security identifiers

  • GEN000410

3.4.6.3. Implement a GUI Warning Banner

In the default graphical environment, users logging directly into the system are greeted with a login screen provided by the GNOME Display Manager (GDM). The warning banner should be displayed in this graphical environment for these users. The following sections describe how to configure the GDM login banner.

3.4.6.3.a. Enable GUI Warning Banner With Proper Text

To enable displaying a login warning banner in the GNOME Display Manager's login screen, run the following command:

sudo -u gdm gconftool-2 \
  --type bool \
  --set /apps/gdm/simple-greeter/banner_message_enable true
To set the text shown by the GNOME Display Manager in the login screen, run the following command:
sudo -u gdm gconftool-2 \
  --type string \
  --set /apps/gdm/simple-greeter/banner_message_text \
  "Text of the warning banner here"
When entering a warning banner that spans several lines, remember to begin and end the string with ". This command writes directly to the file /var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml, and this file can later be edited directly if necessary.

An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.

Remediation script

                      
gui_login_banner_text=""

gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /apps/gdm/simple-greeter/banner_message_enable true &>/dev/null
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type string --set /apps/gdm/simple-greeter/banner_message_text "$(echo $gui_login_banner_text | sed -e 's/\[\\s\\n\][+|*]/ /g' -e 's/\&amp;/\&/g' -e 's/\\//g' -e 's/ - /\n- /g')" &>/dev/null

                    

Security identifiers

  • GEN000402

3.5. Network Configuration and Firewalls

Most machines must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses the security impact of decisions about networking which must be made when configuring a system.

This section also discusses firewalls, network access controls, and other network security frameworks, which allow system-level rules to be written that can limit an attackers' ability to connect to your system. These rules can specify that network traffic should be allowed or denied from certain IP addresses, hosts, and networks. The rules can also specify which of the system's network services are available to particular hosts or networks.

3.5.1. Disable Unused Interfaces

Network interfaces expand the attack surface of the system. Unused interfaces are not monitored or controlled, and should be disabled.

If the system does not require network communications but still needs to use the loopback interface, remove all files of the form ifcfg-interface except for ifcfg-lo from /etc/sysconfig/network-scripts:

# rm /etc/sysconfig/network-scripts/ifcfg-interface
If the system is a standalone machine with no need for network access or even communication over the loopback device, then disable this service. The network service can be disabled with the following command:
$ sudo chkconfig network off

3.5.2. Restrict Access to Network Configuration Changes

The network configuration should only be allowed to be modified by authorized users.

3.5.2.a. Network interfaces must not be configured to allow user control.

Configuration of network interfaces should be limited to privileged users. Manipulation of network interfaces may result in a Denial of Service or bypass of network security mechanisms.

Remediation script

                    find /etc/sysconfig/network-scripts/ -name ifcfg-* | while read FILE; do
	sed -i 's/^USERCTL=.*/USERCTL=no/' "${FILE}"
done

                  

Security identifiers

  • GEN003581

3.5.3. Kernel Parameters Which Affect Networking

The sysctl utility is used to set parameters which affect the operation of the Linux kernel. Kernel parameters which affect networking and have security implications are described here.

3.5.3.1. Network Parameters for Hosts Only

If the system is not going to be used as a router, then setting certain kernel parameters ensure that the host will not perform routing of network traffic.

3.5.3.1.a. Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces

To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.send_redirects = 0

Sending ICMP redirects permits the system to instruct other systems to update their routing information. The ability to send ICMP redirects is only appropriate for systems acting as routers.

Remediation script

                      /sbin/sysctl -q -n -w net.ipv4.conf.all.send_redirects=0
/sbin/sysctl -q -n -w net.ipv4.conf.default.send_redirects=0

if grep --silent ^net.ipv4.conf.all.send_redirects /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.all.send_redirects to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf
fi

if grep --silent ^net.ipv4.conf.default.send_redirects /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.default.send_redirects.*/net.ipv4.conf.default.send_redirects = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.default.send_redirects to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003610

3.5.3.1.b. Disable Kernel Parameter for IP Forwarding

To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.ip_forward=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.ip_forward = 0

IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.

Remediation script

                      #
# Set runtime for net.ipv4.ip_forward
#
/sbin/sysctl -q -n -w net.ipv4.ip_forward=0

#
# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
#
if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf
else
	echo -e "\n# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN005600

3.5.3.2. Network Related Kernel Runtime Parameters for Hosts and Routers

Certain kernel parameters should be set for systems which are acting as either hosts or routers to improve the system's ability defend against certain types of IPv4 protocol attacks.

3.5.3.2.a. Disable Kernel Parameter for Accepting Source-Routed Packets for All Interfaces

To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.accept_source_route = 0

Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Remediation script

                      /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_source_route=0
/sbin/sysctl -q -n -w net.ipv4.conf.default.accept_source_route=0

if grep --silent ^net.ipv4.conf.all.accept_source_route /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.all.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf
fi

if grep --silent ^net.ipv4.conf.default.accept_source_route /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.default.accept_source_route.*/net.ipv4.conf.default.accept_source_route = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.default.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003607

3.5.3.2.b. Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces

To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.accept_redirects = 0

Accepting ICMP redirects has few legitimate uses. It should be disabled unless it is absolutely required.

Remediation script

                      /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_redirects=0
/sbin/sysctl -q -n -w net.ipv4.conf.default.accept_redirects=0

if grep --silent ^net.ipv4.conf.all.accept_redirects /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
fi

if grep --silent ^net.ipv4.conf.default.accept_redirects /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.default.accept_redirects.*/net.ipv4.conf.default.accept_redirects = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003609

3.5.3.2.c. Enable Kernel Parameter to Log Martian Packets

To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.log_martians=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.conf.all.log_martians = 1

The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

Remediation script

                      /sbin/sysctl -q -n -w net.ipv4.conf.all.log_martians=1
/sbin/sysctl -q -n -w net.ipv4.conf.default.log_martians=1

if grep --silent ^net.ipv4.conf.all.log_martians /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.all.log_martians.*/net.ipv4.conf.all.log_martians = 1/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.all.log_martians to 1 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf
fi

if grep --silent ^net.ipv4.conf.default.log_martians /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.conf.default.log_martians.*/net.ipv4.conf.default.log_martians = 1/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv4.conf.default.log_martians to 1 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.conf.default.log_martians = 1" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003611

3.5.3.2.d. Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests

To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.icmp_echo_ignore_broadcasts = 1

Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

Remediation script

                      #
# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
#
/sbin/sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts=1

#
# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv4.icmp_echo_ignore_broadcasts = 1" to /etc/sysctl.conf
#
if grep --silent ^net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.icmp_echo_ignore_broadcasts.*/net.ipv4.icmp_echo_ignore_broadcasts = 1/g' /etc/sysctl.conf
else
	echo -e "\n# Set net.ipv4.icmp_echo_ignore_broadcasts to 1 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003603

3.5.3.2.e. Enable Kernel Parameter to Use TCP Syncookies

To set the runtime status of the net.ipv4.tcp_syncookies kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.tcp_syncookies=1
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.tcp_syncookies = 1

A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.

Remediation script

                      #
# Set runtime for net.ipv4.tcp_syncookies
#
/sbin/sysctl -q -n -w net.ipv4.tcp_syncookies=1

#
# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv4.tcp_syncookies = 1" to /etc/sysctl.conf
#
if grep --silent ^net.ipv4.tcp_syncookies /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf
else
	echo -e "\n# Set net.ipv4.tcp_syncookies to 1 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003612

3.5.3.2.f. TCP backlog queue sizes must be set appropriately

To set the runtime status of the net.ipv4.max_syn_backlog kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.max_syn_backlog=1280
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv4.max_syn_backlog = 1280

To provide some mitigation to TCP Denial of Service attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.

Remediation script

                      #
# Set runtime for net.ipv4.tcp_max_syn_backlog
#
/sbin/sysctl -q -n -w net.ipv4.tcp_max_syn_backlog=1280

#
# If net.ipv4.tcp_max_syn_backlog present in /etc/sysctl.conf, change value to "1280"
#	else, add "net.ipv4.tcp_max_syn_backlog = 1280" to /etc/sysctl.conf
#
if grep --silent ^net.ipv4.tcp_max_syn_backlog /etc/sysctl.conf ; then
	sed -i 's/^net.ipv4.tcp_max_syn_backlog.*/net.ipv4.tcp_max_syn_backlog = 1280/g' /etc/sysctl.conf
else
	echo -e "\n# Set net.ipv4.tcp_max_syn_backlog to 1280 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv4.tcp_max_syn_backlog = 1280" >> /etc/sysctl.conf
fi

                    

Security identifiers

  • GEN003601

3.5.4. Wireless Networking

Wireless networking, such as 802.11 (WiFi) and Bluetooth, can present a security risk to sensitive or classified systems and networks. Wireless networking hardware is much more likely to be included in laptop or portable systems than desktops or servers.

Removal of hardware provides the greatest assurance that the wireless capability remains disabled. Acquisition policies often include provisions to prevent the purchase of equipment that will be used in sensitive spaces and includes wireless capabilities. If it is impractical to remove the wireless hardware, and policy permits the device to enter sensitive spaces as long as wireless is disabled, efforts should instead focus on disabling wireless capability via software.

3.5.4.1. Disable Wireless Through Software Configuration

If it is impossible to remove the wireless hardware from the device in question, disable as much of it as possible through software. The following methods can disable software support for wireless networking, but note that these methods do not prevent malicious software or careless users from re-activating the devices.

3.5.4.1.a. Disable Bluetooth Kernel Modules

The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate /etc/modprobe.d configuration file to prevent the loading of the Bluetooth module:

install net-pf-31 /bin/true
install bluetooth /bin/true

If Bluetooth functionality must be disabled, preventing the kernel from loading the kernel module provides an additional safeguard against its activation.

Remediation script

                      if [ -d /etc/modprobe.d/ ]; then
	echo "install bluetooth /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install bluetooth /bin/true" >> /etc/modprobe.conf
fi

                    

Security identifiers

  • GEN007660

3.5.5. IPv6

The system includes support for Internet Protocol version 6. A major and often-mentioned improvement over IPv4 is its enormous increase in the number of available addresses. Another important feature is its support for automatic configuration of many network settings.

3.5.5.1. Disable Support for IPv6 Unless Needed

Despite configuration that suggests support for IPv6 has been disabled, link-local IPv6 address auto-configuration occurs even when only an IPv4 address is assigned. The only way to effectively prevent execution of the IPv6 networking stack is to instruct the system not to activate the IPv6 kernel module.

3.5.5.1.a. Disable IPv6 Networking Support Automatic Loading

To prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack, add the following line to /etc/modprobe.d/disabled.conf (or another file in /etc/modprobe.d):

options ipv6 disable=1
This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol.

Any unnecessary network stacks - including IPv6 - should be disabled, to reduce the vulnerability to exploitation.

Remediation script

                      if [ -d /etc/modprobe.d/ ]; then
	echo "install ipv6 /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install ipv6 /bin/true" >> /etc/modprobe.conf
fi
chkconfig ip6tables off

                    

Security identifiers

  • GEN007720

3.5.5.1.b. Disable Interface Usage of IPv6

To disable interface usage of IPv6, add or correct the following lines in /etc/sysconfig/network:

NETWORKING_IPV6=no

Remediation script

                      if [ $(grep -c "^NETWORKING_IPV6" /etc/sysconfig/network) = 0 ]; then
	echo "NETWORKING_IPV6=no" | tee -a /etc/sysconfig/network &>/dev/null
else
	sed -i 's/NETWORKING_IPV6.*/NETWORKING_IPV6=no/' /etc/sysconfig/network
fi
chkconfig ip6tables off

                    

Security identifiers

  • GEN007700

3.5.5.2. Configure IPv6 Settings if Necessary

A major feature of IPv6 is the extent to which systems implementing it can automatically configure their networking devices using information from the network. From a security perspective, manually configuring important configuration information is preferable to accepting it from the network in an unauthenticated fashion.

3.5.5.2.a. Manually Assign IPv6 Router Address

Edit the file /etc/sysconfig/network-scripts/ifcfg-interface, and add or correct the following line (substituting your gateway IP as appropriate):

IPV6_DEFAULTGW=2001:0DB8::0001
Router addresses should be manually set and not accepted via any auto-configuration or router advertisement.

Security identifiers

  • GEN005570

3.5.5.2.2. Disable Automatic Configuration

Disable the system's acceptance of router advertisements and redirects by adding or correcting the following line in /etc/sysconfig/network (note that this does not disable sending router solicitations):

IPV6_AUTOCONF=no

3.5.5.2.2.a. Disable Accepting IPv6 Redirects

To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv6.conf.all.accept_redirects = 0

An illicit ICMP redirect message could result in a man-in-the-middle attack.

Remediation script

                        #
# Set runtime for net.ipv6.conf.all.accept_redirects
#
if [ -e /proc/sys/net/ipv6/ ]; then
	/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_redirects=0
fi

#
# If net.ipv6.conf.all.accept_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv6.conf.all.accept_redirects = 0" to /etc/sysctl.conf
#
if grep --silent ^net.ipv6.conf.all.accept_redirects /etc/sysctl.conf ; then
	sed -i 's/^net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv6.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv6.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
fi

                      

Security identifiers

  • GEN007860

3.5.5.2.2.b. Disable Accepting IPv6 Forwarding

To set the runtime status of the net.ipv6.conf.all.forwarding kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.forwarding=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv6.conf.all.forwarding = 0
To set the runtime status of the net.ipv6.conf.default.forwarding kernel parameter, run the following command:
$ sudo sysctl -w net.ipv6.conf.default.forwarding=0
If this is not the system's default value, add the following line to /etc/sysctl.conf:
net.ipv6.conf.default.forwarding = 0

Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.

Remediation script

                        #
# Set runtime for net.ipv6.conf.all.forwarding
#
if [ -e /proc/sys/net/ipv6/ ]; then
	/sbin/sysctl -q -n -w net.ipv6.conf.all.forwarding=0
fi

#
# If net.ipv6.conf.all.forwarding present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv6.conf.all.forwarding = 0" to /etc/sysctl.conf
#
if grep --silent ^net.ipv6.conf.all.forwarding /etc/sysctl.conf ; then
	sed -i 's/^net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv6.conf.all.forwarding to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv6.conf.all.forwarding = 0" >> /etc/sysctl.conf
fi

#
# Set runtime for net.ipv6.conf.default.forwarding
#
if [ -e /proc/sys/net/ipv6/ ]; then
	/sbin/sysctl -q -n -w net.ipv6.conf.default.forwarding=0
fi
#
# If net.ipv6.conf.default.forwarding present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv6.conf.default.forwarding = 0" to /etc/sysctl.conf
#
if grep --silent ^net.ipv6.conf.default.forwarding /etc/sysctl.conf ; then
	sed -i 's/^net.ipv6.conf.default.forwarding.*/net.ipv6.conf.default.forwarding = 0/g' /etc/sysctl.conf
else
	echo "" >> /etc/sysctl.conf
	echo "# Set net.ipv6.conf.default.forwarding to 0 per security requirements" >> /etc/sysctl.conf
	echo "net.ipv6.conf.default.forwarding = 0" >> /etc/sysctl.conf
fi

                      

Security identifiers

  • GEN007920

3.5.6. iptables and ip6tables

A host-based firewall called Netfilter is included as part of the Linux kernel distributed with the system. It is activated by default. This firewall is controlled by the program iptables, and the entire capability is frequently referred to by this name. An analogous program called ip6tables handles filtering for IPv6.

Unlike TCP Wrappers, which depends on the network server program to support and respect the rules written, Netfilter filtering occurs at the kernel level, before a program can even process the data from the network packet. As such, any program on the system is affected by the rules written.

This section provides basic information about strengthening the iptables and ip6tables configurations included with the system. For more complete information that may allow the construction of a sophisticated ruleset tailored to your environment, please consult the references at the end of this section.

3.5.6.1. Inspect and Activate Default Rules

View the currently-enforced iptables rules by running the command:

# iptables -nL --line-numbers
The command is analogous for the ip6tables program.

If the firewall does not appear to be active (i.e., no rules appear), activate it and ensure that it starts at boot by issuing the following commands (and analogously for ip6tables):
# service iptables restart
The default iptables rules are:
Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination
The ip6tables default rules are essentially the same.

3.5.6.1.a. Verify iptables Enabled

The iptables service can be enabled with the following command:

$ sudo chkconfig --level 2345 iptables on

The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.

Remediation script

                      #
# Enable iptables for all run levels
#
/sbin/chkconfig --level 0123456 iptables on

#
# Start iptables if not currently running
#
/sbin/service iptables start 1>/dev/null

                    

Security identifiers

  • GEN008520

3.5.6.2. Strengthen the Default Ruleset

The default rules can be strengthened. The system scripts that activate the firewall rules expect them to be defined in the configuration files iptables and ip6tables in the directory /etc/sysconfig. Many of the lines in these files are similar to the command line arguments that would be provided to the programs /sbin/iptables or /sbin/ip6tables - but some are quite different.

The following recommendations describe how to strengthen the default ruleset configuration file. An alternative to editing this configuration file is to create a shell script that makes calls to the iptables program to load in rules, and then invokes service iptables save to write those loaded rules to /etc/sysconfig/iptables.

The following alterations can be made directly to /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Instructions apply to both unless otherwise noted. Language and address conventions for regular iptables are used throughout this section; configuration for ip6tables will be either analogous or explicitly covered.

The program system-config-securitylevel allows additional services to penetrate the default firewall rules and automatically adjusts /etc/sysconfig/iptables. This program is only useful if the default ruleset meets your security requirements. Otherwise, this program should not be used to make changes to the firewall configuration because it re-writes the saved configuration file.

3.5.6.2.a. Reject Incoming Timestamp Requests and Replies

To reject incoming timestamp requests and replies, add or correct the following line in /etc/sysconfig/iptables:

-I INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
-I INPUT -p icmp -m icmp --icmp-type timestamp-reply -j DROP

The processing of (ICMP) timestamp requests increases the attack surface of the system.

Remediation script

                      if [ "$(egrep -c '(--icmp-type 14|timestamp-reply) -j DROP')" = "0" ]; then
	/sbin/iptables -I INPUT -p ICMP --icmp-type timestamp-reply -j DROP
fi
if [ "$(egrep -c '(--icmp-type 13|timestamp-request) -j DROP')" = "0" ]; then
	/sbin/iptables -I INPUT -p ICMP --icmp-type timestamp-request -j DROP
fi
/sbin/iptables-save > /etc/sysconfig/iptables
if [ "$(grep -c 'icmp-type 13' /etc/sysconfig/iptables)" != "0" ]; then
	sed -i 's/icmp-type 13/icmp-type timestamp-request/' /etc/sysconfig/iptables
fi
if [ "$(grep -c 'icmp-type 14' /etc/sysconfig/iptables)" != "0" ]; then
	sed -i 's/icmp-type 14/icmp-type timestamp-reply/' /etc/sysconfig/iptables
fi

                    

Security identifiers

  • GEN003602

3.5.6.2.b. Add Reject Rule for INPUT Chain.

To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in /etc/sysconfig/iptables:

:INPUT DROP [0:0]

In iptables the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to DROP implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.

Remediation script

                      /sbin/iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
/sbin/iptables-save > /etc/sysconfig/iptables
                    

Security identifiers

  • GEN008540

3.5.6.2.c. Ignore ICMPv6 Echo Requests On a Broadcast Address.

To configure the system to ignore ICMPv6 echo requests on a broadcast address, add or correct the following line in /etc/sysconfig/ip6tables:

-A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP

Responding to broadcast ICMP echo requests facilitates network mapping and provides a vector for amplification attacks.

Remediation script

                      if [ ! -e /etc/sysconfig/ip6tables ] || [ "$(grep -c ^ /etc/sysconfig/ip6tables)" -lt "5" ]; then
	echo -e "*filter\n:INPUT DROP [0:0]\n:FORWARD DROP [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT" | tee /etc/sysconfig/ip6tables &>/dev/null
	echo "-A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP" | tee -a /etc/sysconfig/ip6tables &>/dev/null 
else
	echo "-A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP" | tee -a /etc/sysconfig/ip6tables &>/dev/null 
fi

                    

Security identifiers

  • GEN007950

3.5.6.2.d. TCP Wrappers Must Be Configured To Grant/Deny Access To Hosts.

To configure the system to grant/deny access to hosts, ensure the following file exists: /etc/hosts.allow: In addition, make sure the following file is present and includes the following line: /etc/hosts.deny:

ALL: ALL

If the system's access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.

Remediation script

                      if [ ! -e /etc/hosts.allow ]; then
	>/etc/hosts.allow
	chmod 644 /etc/hosts.allow
	chown root:root /etc/hosts.allow
fi
if [ ! -e /etc/hosts.deny ]; then
	>/etc/hosts.deny
	chmod 644 /etc/hosts.deny
	chown root:root /etc/hosts.deny
fi
if [ ! -e /var/log/host.access ]; then
	>/var/log/host.access
	chmod 640 /var/log/host.access
	chown root:root /var/log/host.access
fi
if [ $(grep -c "ALL: ALL" /etc/hosts.deny) = 0 ]; then
	echo 'ALL: ALL: spawn /bin/echo Access denied on $(/bin/date) from %a for access to %d \(pid %p\)>>/var/log/host.access' | tee -a /etc/hosts.deny &>/dev/null
fi

                    

Security identifiers

  • GEN006620

3.5.7. Transport Layer Security Support

Support for Transport Layer Security (TLS), and its predecessor, the Secure Sockets Layer (SSL), is included in Red Hat Enterprise Linux in the OpenSSL software (RPM package openssl). TLS provides encrypted and authenticated network communications, and many network services include support for it. TLS or SSL can be leveraged to avoid any plaintext transmission of sensitive data.
For information on how to use OpenSSL, see http://www.openssl.org/docs/HOWTO/. Information on FIPS validation of OpenSSL is available at http://www.openssl.org/docs/fips/fipsvalidation.html and http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm.

3.5.8. IP Tunnelling Support

Support for creating IP encapsulated tunnels between a system and remote endpoints, to also include tunnelling ipv6 over ipv4, is available in Red Hat.

3.5.8.a. Remove IP Tunnels

To remove IP tunnels, perform the following command for each IP tunnel:

# ip tun del tunnel

Remediation script

                    ip tunnel list | cut -d: -f1 | while read TUNNEL_INTERFACE; do ip tunnel del $TUNNEL_INTERFACE 2>/dev/null; done

                  

Security identifiers

  • GEN007820

3.5.8.b. Remove 6to4 IP Tunnels

To remove 6to4 IP tunnels, perform the following command for each IP tunnel:

# ip tun del tunnel

Remediation script

                    ip tunnel list | cut -d: -f1 | while read TUNNEL_INTERFACE; do ip tunnel del $TUNNEL_INTERFACE 2>/dev/null; done

                  

Security identifiers

  • GEN007780

3.5.8.c. Disable Teredo Services

To disable teredo services, perform the following command:

# ps ax | grep -i miredo | grep -v grep | awk ' { print $1 }' | xargs kill

Remediation script

                    ps ax | grep -i miredo | grep -v grep | awk ' { print $1 }' | xargs kill

                  

Security identifiers

  • GEN007800

3.5.9. Uncommon Network Protocols

The system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code are not frequently discovered, the consequences can be dramatic. Ensuring uncommon network protocols are disabled reduces the system's risk to attacks targeted at its implementation of those protocols.

Although these protocols are not commonly used, avoid disruption in your network environment by ensuring they are not needed prior to disabling them.

3.5.9.a. Disable DCCP Support

The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the dccp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install dccp /bin/true

Disabling DCCP protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install dccp /bin/true" >> /etc/modprobe.d/disabled_modules.conf
	echo "install dccp_ipv4 /bin/true" >> /etc/modprobe.d/disabled_modules.conf
	echo "install dccp_ipv6 /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install dccp /bin/true" >> /etc/modprobe.conf
	echo "install dccp_ipv4 /bin/true" >> /etc/modprobe.conf
	echo "install dccp_ipv6 /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN007080

3.5.9.b. Disable SCTP Support

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the sctp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install sctp /bin/true

Disabling SCTP protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install sctp /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install sctp /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN007020

3.5.9.c. Disable RDS Support

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high- bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the rds kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install rds /bin/true

Disabling RDS protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install rds /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install rds /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN007480

3.5.9.d. Disable TIPC Support

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the tipc kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install tipc /bin/true

Disabling TIPC protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install tipc /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install tipc /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN007540

3.5.9.e. Disable AppleTalk Support

The AppleTalk suite of protocols is no longer in common use. Binding this protocol to the network stack increases the attack surface of the host. Unprivileged local processes may be able to cause the system to dynamically load a protocol handler by opening a socket using the protocol. To configure the system to prevent the appletalk kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install appletalk /bin/true

Disabling AppleTalk protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install appletalk /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install appletalk /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN007260

3.5.9.f. Disable Network Bridging Support

Some systems have the ability to bridge or switch frames (link-layer forwarding) between multiple interfaces. This can be useful in a variety of situations but, if enabled when not needed, has the potential to bypass network partitioning and security. To configure the system to prevent the bridge kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install bridge /bin/true

Disabling network bridging protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install bridge /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install bridge /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN003619

3.5.9.g. Disable IEEE1394 (Firewire) Support

Firewire is a common computer peripheral interface. Firewire devices may include storage devices with the potential to install malicious software on a system or exfiltrate data. To configure the system to prevent the ieee1394 kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install ieee1394 /bin/true

Disabling IEEE1394 (Firewire) protects the system against exploitation of any flaws in its implementation.

Remediation script

                    if [ -d /etc/modprobe.d/ ]; then
	echo "install ieee1394 /bin/true" >> /etc/modprobe.d/disabled_modules.conf
else
	echo "install ieee1394 /bin/true" >> /etc/modprobe.conf
fi

                  

Security identifiers

  • GEN008500

3.6. Configure Syslog

The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lack of authentication for received messages, and lack of authentication, encryption, or reliable transport for messages sent over a network. However, due to its long history, syslog is a de facto standard which is supported by almost all Unix applications.

3.6.1. Syslog Logs Sent To Remote Host

If system logs are to be useful in detecting malicious activities, it is necessary to send logs to a remote server. An intruder who has compromised the root account on a machine may delete the log entries which indicate that the system was attacked before they are seen by an administrator.

However, it is recommended that logs be stored on the local host in addition to being sent to the loghost, especially if syslog has been configured to use the UDP protocol to send messages over a network. UDP does not guarantee reliable delivery, and moderately busy sites will lose log messages occasionally, especially in periods of high traffic which may be the result of an attack. In addition, remote syslog messages are not authenticated in any way by default, so it is easy for an attacker to introduce spurious messages to the central log server. Also, some problems cause loss of network connectivity, which will prevent the sending of messages to the central server. For all of these reasons, it is better to store log messages both centrally and on each host, so that they can be correlated if necessary.

3.6.1.a. Ensure Logs Sent To Remote Host

To configure syslog to send logs to a remote log server, open /etc/syslog.conf and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting loghost.example.com appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:

*.* @loghost.example.com

To use TCP for log message delivery:
*.* @@loghost.example.com

To use RELP for log message delivery:
*.* :omrelp:loghost.example.com

A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise.

Security identifiers

  • GEN005460

3.6.2. Configure syslogd to Accept Remote Messages If Acting as a Log Server

By default, syslog does not listen over the network for log messages. If needed, modules can be enabled to allow the syslog daemon to receive messages from other systems and for the system thus to act as a log server. If the machine is not a log server, then lines concerning these modules should remain commented out.

3.6.2.a. Ensure syslog Does Not Accept Remote Messages Unless Acting As Log Server

The syslog daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the network, ensure the following lines are not found in /etc/syslog.conf:

$ModLoad imtcp.so
$InputTCPServerRun port
$ModLoad imudp.so
$InputUDPServerRun port
$ModLoad imrelp.so
$InputRELPServerRun port

Any process which receives messages from the network incurs some risk of receiving malicious messages. This risk can be eliminated for syslog by configuring it not to listen on the network.

Security identifiers

  • GEN005480

3.6.3. Ensure All Logs are Rotated by logrotate

Edit the file /etc/logrotate.d/syslog. Find the first line, which should look like this (wrapped for clarity):

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
  /var/log/boot.log /var/log/cron {
Edit this line so that it contains a one-space-separated listing of each log file referenced in /etc/syslog.conf.

All logs in use on a system must be rotated regularly, or the log files will consume disk space over time, eventually interfering with system operation. The file /etc/logrotate.d/syslog is the configuration file used by the logrotate program to maintain all log files written by syslog. By default, it rotates logs weekly and stores four archival copies of each log. These settings can be modified by editing /etc/logrotate.conf, but the defaults are sufficient for purposes of this guide.

Note that logrotate is run nightly by the cron job /etc/cron.daily/logrotate. If particularly active logs need to be rotated more often than once a day, some other mechanism must be used.

3.6.3.a. Ensure Logrotate Runs Periodically

The logrotate utility allows for the automatic rotation of log files. The frequency of rotation is specified in /etc/logrotate.conf, which triggers a cron task. To configure logrotate to run daily, add or correct the following line in /etc/logrotate.conf:

# rotate log files frequency
daily

Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.

Security identifiers

  • GEN002860

3.7. System Accounting with auditd

The audit service provides substantial capabilities for recording system activities. By default, the service audits about SELinux AVC denials and certain types of security-relevant events such as system logins, account modifications, and authentication events performed by programs such as sudo. Under its default configuration, auditd has modest disk space requirements, and should not noticeably impact system performance.

Government networks often have substantial auditing requirements and auditd can be configured to meet these requirements. Examining some example audit records demonstrates how the Linux audit system satisfies common requirements. The following example from Fedora Documentation available at http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages.html shows the substantial amount of information captured in a two typical "raw" audit messages, followed by a breakdown of the most important fields. In this example the message is SELinux-related and reports an AVC denial (and the associated system call) that occurred when the Apache HTTP Server attempted to access the /var/www/html/file1 file (labeled with the samba_share_t type):

type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13 
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

  • msg=audit(1226874073.147:96)

    • The number in parentheses is the unformatted time stamp (Epoch time) for the event, which can be converted to standard time by using the date command.

  • { getattr }

    • The item in braces indicates the permission that was denied. getattr indicates the source process was trying to read the target file's status information. This occurs before reading files. This action is denied due to the file being accessed having the wrong label. Commonly seen permissions include getattr, read, and write.

  • comm="httpd"

    • The executable that launched the process. The full path of the executable is found in the exe= section of the system call (SYSCALL) message, which in this case, is exe="/usr/sbin/httpd".

  • path="/var/www/html/file1"

    • The path to the object (target) the process attempted to access.

  • scontext="unconfined_u:system_r:httpd_t:s0"

    • The SELinux context of the process that attempted the denied action. In this case, it is the SELinux context of the Apache HTTP Server, which is running in the httpd_t domain.

  • tcontext="unconfined_u:object_r:samba_share_t:s0"

    • The SELinux context of the object (target) the process attempted to access. In this case, it is the SELinux context of file1. Note: the samba_share_t type is not accessible to processes running in the httpd_t domain.

  • From the system call (SYSCALL) message, two items are of interest:

    • success=no: indicates whether the denial (AVC) was enforced or not. success=no indicates the system call was not successful (SELinux denied access). success=yes indicates the system call was successful - this can be seen for permissive domains or unconfined domains, such as initrc_t and kernel_t.

    • exe="/usr/sbin/httpd": the full path to the executable that launched the process, which in this case, is exe="/usr/sbin/httpd".

3.7.a. Enable auditd Service

The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:

$ sudo chkconfig --level 2345 auditd on

Ensuring the auditd service is active ensures audit records generated by the kernel can be written to disk, or that appropriate actions will be taken if other obstacles exist.

Remediation script

                  #
# Enable auditd for all run levels
#
/sbin/chkconfig --level 0123456 auditd on

#
# Start auditd if not currently running
#
/sbin/service auditd start 1>/dev/null

                

Security identifiers

  • GEN002660

3.7.b. Enable Auditing for Processes Which Start Prior to the Audit Daemon

To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument audit=1 to the kernel line in /etc/grub.conf, in the manner below:

kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1

Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.

Remediation script

                  if [ $(grep -v '#' /boot/grub/grub.conf | grep kernel | grep -c audit=) = 0 ]; then
	sed -i '/^[ |\t]*kernel/s/$/ audit=1/' /boot/grub/grub.conf
else
	sed -i '/^[ |\t]*kernel/s/audit=./audit=1/' /boot/grub/grub.conf
fi

                

Security identifiers

  • GEN000000-LNX00720

3.7.3. Configure auditd Data Retention

The audit system writes data to /var/log/audit/audit.log. By default, auditd rotates 5 logs by size (6MB), retaining a maximum of 30MB of data in total, and refuses to write entries when the disk is too full. This minimizes the risk of audit data filling its partition and impacting other services. This also minimizes the risk of the audit daemon temporarily disabling the system if it cannot write audit log (which it can be configured to do). For a busy system or a system which is thoroughly auditing system activity, the default settings for data retention may be insufficient. The log file size needed will depend heavily on what types of events are being audited. First configure auditing to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will allow you to keep the required data for the correct time period.

Using a dedicated partition for /var/log/audit prevents the auditd logs from disrupting system functionality if they fill, and, more importantly, prevents other activity in /var from filling the partition and stopping the audit trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.) Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then auditd can be configured to halt the machine if it runs out of space. Note: Since older logs are rotated, configuring auditd this way does not prevent older logs from being rotated away before they can be viewed. If your system is configured to halt when logging cannot be performed, make sure this can never happen under normal circumstances! Ensure that /var/log/audit is on its own partition, and that this partition is larger than the maximum amount of data auditd will retain normally.

3.7.3.a. Configure auditd space_left Action on Low Disk Space

The auditd service can be configured to take an action when disk space starts to run low. Edit the file /etc/audit/auditd.conf. Modify the following line, substituting ACTION appropriately:

space_left_action = ACTION
Possible values for ACTION are described in the auditd.conf man page. These include:

  • ignore

  • syslog

  • email

  • exec

  • suspend

  • single

  • halt

Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.

Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

Remediation script

                    if [ -e /etc/audit/auditd.conf ]; then
	AUDITD_CONF_FILE="/etc/audit/auditd.conf"
elif [ -e /etc/auditd.conf ]; then
	AUDITD_CONF_FILE="/etc/auditd.conf"
else
	exit
fi

if [ "$(grep -v "#" ${AUDITD_CONF_FILE} | grep -c space_left_action)" != "0" ]; then
	sed -i 's/space_left_action.*/space_left_action = syslog/' ${AUDITD_CONF_FILE}
else
	echo "space_left_action = syslog">>${AUDITD_CONF_FILE}
fi

                  

Security identifiers

  • GEN002730

3.7.3.b. Configure auditd disk_error_action and disk_full_action on Storage Failures

The auditd service can be configured to take an action when the disk errors or becomes full. Edit the file /etc/audit/auditd.conf. Add or modify the following lines, substituting ACTION appropriately:

disk_error_action = ACTION
disk_full_action = ACTION
Set this value to single to cause the system to switch to single user mode for corrective action. Acceptable values also include syslog, exec, and halt. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the auditd.conf man page.

Administrators should be made aware of an inability to write to disk.

Remediation script

                    
var_auditd_disk_error_action="single"

if [ -e /etc/audit/auditd.conf ]; then
	AUDITD_CONF_FILE="/etc/audit/auditd.conf"
elif [ -e /etc/auditd.conf ]; then
	AUDITD_CONF_FILE="/etc/auditd.conf"
else
	exit
fi

grep -q ^disk_error_action ${AUDITD_CONF_FILE} && \
  sed -i "s/disk_error_action.*/disk_error_action = $var_auditd_disk_error_action/g" ${AUDITD_CONF_FILE}
if ! [ $? -eq 0 ]; then
    echo "disk_error_action = $var_auditd_disk_error_action" >> ${AUDITD_CONF_FILE}
fi
grep -q ^disk_full_action ${AUDITD_CONF_FILE} && \
  sed -i "s/disk_full_action.*/disk_full_action = $var_auditd_disk_error_action/g" ${AUDITD_CONF_FILE}
if ! [ $? -eq 0 ]; then
    echo "disk_full_action = $var_auditd_disk_error_action" >> ${AUDITD_CONF_FILE}
fi

                  

Security identifiers

  • GEN002719

3.7.3.c. Configure auditd to use audispd's syslog plugin

To configure the auditd service to use the syslog plug-in of the audispd audit event multiplexor, set the active line in /etc/audisp/plugins.d/syslog.conf to yes. Restart the auditd service:

# service auditd restart

The auditd service does not include the ability to send audit records to a centralized server for management directly. It does, however, include a plug-in for audit event multiplexor (audispd) to pass audit records to the local syslog server

Remediation script

                    
grep -q ^active /etc/audisp/plugins.d/syslog.conf && \
  sed -i "s/active.*/active = yes/g" /etc/audisp/plugins.d/syslog.conf
if ! [ $? -eq 0 ]; then
    echo "active = yes" >> /etc/audisp/plugins.d/syslog.conf
fi

                  

Security identifiers

  • GEN002870

3.7.4. Configure auditd Rules for Comprehensive Auditing

The auditd program can perform comprehensive monitoring of system activity. This section describes recommended configuration settings for comprehensive auditing, but a full description of the auditing system's capabilities is beyond the scope of this guide. The mailing list linux-audit@redhat.com exists to facilitate community discussion of the auditing system.

The audit subsystem supports extensive collection of events, including:

  • Tracing of arbitrary system calls (identified by name or number) on entry or exit.

  • Filtering by PID, UID, call success, system call argument (with some limitations), etc.

  • Monitoring of specific files for modifications to the file's contents or metadata.


Auditing rules at startup are controlled by the file /etc/audit/audit.rules. Add rules to it to meet the auditing requirements for your organization. Each line in /etc/audit/audit.rules represents a series of arguments that can be passed to auditctl and can be individually tested during runtime. See documentation in /usr/share/doc/audit-VERSION and in the related man pages for more details.

If copying any example audit rulesets from /usr/share/doc/audit-VERSION, be sure to comment out the lines containing arch= which are not appropriate for your system's architecture. Then review and understand the following rules, ensuring rules are activated as needed for the appropriate architecture.

After reviewing all the rules, reading the following sections, and editing as needed, the new rules can be activated as follows:

# service auditd restart

3.7.4.a. Record Events that Create User/Group Information

Add the following to /etc/audit/audit.rules, in order to capture events that create accounts:

# audit_account_creation
-w /usr/sbin/groupadd -p x -k audit_account_changes
-w /usr/sbin/useradd -p x -k audit_account_changes
-w /etc/group -p a -k audit_account_changes
-w /etc/passwd -p a -k audit_account_changes
-w /etc/gshadow -p a -k audit_account_changes
-w /etc/shadow -p a -k audit_account_changes

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
else
	exit
fi

for FILE in /usr/sbin/useradd /usr/sbin/groupadd; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p x -k audit_account_creation" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [wa]*x"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p x/" ${AUDIT_RULES_FILE}
		else
			sed -i "s/\(-w ${SED_FILE} -p \)/\1x/" ${AUDIT_RULES_FILE}
		fi
	fi
done
for FILE in /etc/group /etc/passwd /etc/gshadow /etc/shadow; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p a -k audit_account_creation" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [wx]*a"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p a/" ${AUDIT_RULES_FILE}
		else
			sed -i "s/\(-w ${SED_FILE} -p \)/\1a/" ${AUDIT_RULES_FILE}
		fi
	fi
done
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002750

3.7.4.b. Record Events that Disable User Accounts

Add the following to /etc/audit/audit.rules, in order to capture events that disable accounts:

# audit_account_disabling
-w /usr/bin/passwd -p x -k audit_account_disabling

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w /usr/bin/passwd"`" = "0" ]; then
	echo "-w /usr/bin/passwd -p x -k audit_account_changes" >>${AUDIT_RULES_FILE}
elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w /usr/bin/passwd -p [wa]*x"`" = "0" ]; then
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w /usr/bin/passwd -p "`" = "0" ]; then
		sed -i "s/\(-w \/usr\/bin\/passwd\)/\1 -p x/" ${AUDIT_RULES_FILE}
	else
		sed -i "s/\(-w \/usr\/bin\/passwd -p \)/\1x/" ${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002752

3.7.4.c. Record Events that Modify User/Group Information

Add the following to /etc/audit/audit.rules, in order to capture events that modify account changes:

# audit_account_changes
-w /usr/sbin/groupmod -p x -k audit_account_changes
-w /usr/sbin/usermod -p x -k audit_account_changes
-w /etc/group -p w -k audit_account_changes
-w /etc/passwd -p w -k audit_account_changes
-w /etc/gshadow -p w -k audit_account_changes
-w /etc/shadow -p w -k audit_account_changes

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
else
	exit
fi

for FILE in /usr/sbin/usermod /usr/sbin/groupmod; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p x -k audit_account_changes" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [wa]*x"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p x/" ${AUDIT_RULES_FILE}
		else
			sed -i "s/\(-w ${SED_FILE} -p \)/\1x/" ${AUDIT_RULES_FILE}
		fi
	fi
done
for FILE in /etc/group /etc/passwd /etc/gshadow /etc/shadow; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p w -k audit_account_changes" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [xa]*w"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p w/" ${AUDIT_RULES_FILE}
		else
			sed -i "s/\(-w ${SED_FILE} -p \)/\1w/" ${AUDIT_RULES_FILE}
		fi
	fi
done
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002751

3.7.4.d. Record Events that Terminate Users/Groups

Add the following to /etc/audit/audit.rules, in order to capture events that terminate accounts:

# audit_account_termination
-w /usr/sbin/groupdel -p x -k audit_account_termination
-w /usr/sbin/userdel -p x -k audit_account_termination

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
else
	exit
fi

for FILE in /usr/sbin/userdel /usr/sbin/groupdel; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p x -k audit_account_changes" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [wa]*x"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p x/" ${AUDIT_RULES_FILE}
		else
			sed -i "s/\(-w ${SED_FILE} -p \)/\1x/" ${AUDIT_RULES_FILE}
		fi
	fi
done
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002753

3.7.4.e. Record Events that Modify the System's Host Name

Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:

# audit_network_sethostname
-a exit,always -F arch=ARCH -S sethostname -k audit_network_modifications

The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k set_hostname"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`uname -p`" != "x86_64" ]; then
	echo "-a exit,always -F arch=b32 -S sethostname ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
else
	echo "-a exit,always -F arch=b64 -S sethostname ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002760-7

3.7.4.f. Record Events that Modify the System's Domain Name

Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:

# audit_network_setdomainname
-a exit,always -F arch=ARCH -S setdomainname -k audit_network_modifications

The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k set_domainname"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`uname -p`" != "x86_64" ]; then
	echo "-a exit,always -F arch=b32 -S setdomainname ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
else
	echo "-a exit,always -F arch=b64 -S setdomainname ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002760-8

3.7.4.g. Record Events that Modify the System's Scheduler Parameters

Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:

# audit_network_sethostname
-a exit,always -F arch=ARCH -S sched_setparam -k scheduler

The scheduler parameters should not be modified by anything other than administrator action. Any change to network parameters should be audited.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k set_scheduler_parameters"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

# check for realtime capabilities
if [ `lsmod | grep -ic jiffies` = 0 ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S sched_setparam ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S sched_setparam ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002760-9

3.7.4.h. Record Events that Modify the System's Scheduler Priorities

Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:

# audit_network_sethostname
-a exit,always -F arch=ARCH -S sched_setscheduler -k scheduler

The scheduler priorities should not be modified by anything other than administrator action. Any change to network parameters should be audited.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k set_scheduler_setting"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

# check for realtime capabilities
if [ `lsmod | grep -ic jiffies` = 0 ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S sched_setscheduler ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S sched_setscheduler ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002760-10

3.7.4.i. Record Attempts to Alter Logon and Logout Events

The audit system already collects login info for all users and root. To watch for attempted manual edits of files involved in storing logon events, add the following to /etc/audit/audit.rules:

-w /var/log/faillog -p wa -k logins 
-w /var/log/lastlog -p wa -k logins

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
else
	exit
fi
for FILE in /var/log/faillog /var/log/lastlog; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p wa -k audit_login_events" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [x]*\(wa\|aw\)"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p wa/" ${AUDIT_RULES_FILE}
		else
			if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [xa]*w"`" = "0" ]; then
				sed -i "s/\(-w ${SED_FILE} -p \)/\1w/" ${AUDIT_RULES_FILE}
			fi
			if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [xw]*a"`" = "0" ]; then
				sed -i "s/\(-w ${SED_FILE} -p \)/\1a/" ${AUDIT_RULES_FILE}
			fi
		fi
	fi
done
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002800

3.7.4.j. Record Attempts to Alter Audit Rules

To watch for attempted manual edits of audit rules, add the following to /etc/audit/audit.rules:

-w /etc/audit/audit.rules -p w -k audit_rules

Manual editing of audit rules may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${AUDIT_RULES_FILE}"`" = "0" ]; then
	echo "-w ${AUDIT_RULES_FILE} -p wa -k audit_rules_changes" >>${AUDIT_RULES_FILE}
elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${AUDIT_RULES_FILE} -p [x]*\(wa\|aw\)"`" = "0" ]; then
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${AUDIT_RULES_FILE} -p "`" = "0" ]; then
		sed -i "s/\(-w ${AUDIT_RULES_FILE}\)/\1 -p wa/" ${AUDIT_RULES_FILE}
	else
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${AUDIT_RULES_FILE} -p [xa]*w"`" = "0" ]; then
			sed -i "s/\(-w ${AUDIT_RULES_FILE} -p \)/\1w/" ${AUDIT_RULES_FILE}
		fi
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${AUDIT_RULES_FILE} -p [xw]*a"`" = "0" ]; then
			sed -i "s/\(-w ${AUDIT_RULES_FILE} -p \)/\1a/" ${AUDIT_RULES_FILE}
		fi
	fi
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002760-2

3.7.4.k. Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Via creat

At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system with either:

-a exit,always -F arch=ARCH -S creat -F success=0 -k access
or
-a exit,always -F arch=ARCH -S creat -F exit=-EPERM -k access
-a exit,always -F arch=ARCH -S creat -F exit=-EACCES -k access

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	if [ "`grep " -S creat " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EACCES'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S creat -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S creat -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		fi
	fi
	if [ "`grep " -S creat " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EPERM'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S creat -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S creat -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		fi
	fi
elif [ -e /etc/audit.rules ]; then
	if [ "`grep " -S creat " /etc/audit.rules | grep -v '#' | grep -c '\success=0'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S creat -F success=0" >>/etc/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S creat -F success=0" >>/etc/audit.rules
		fi
	fi
else
	exit
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002720

3.7.4.l. Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Via ftruncate

At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system with either:

-a exit,always -F arch=ARCH -S ftruncate -F success=0 -k access
or
-a exit,always -F arch=ARCH -S ftruncate -F exit=-EPERM -k access
-a exit,always -F arch=ARCH -S ftruncate -F exit=-EACCES -k access

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	if [ "`grep " -S ftruncate " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EACCES'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S ftruncate -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S ftruncate -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		fi
	fi
	if [ "`grep " -S ftruncate " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EPERM'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S ftruncate -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S ftruncate -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		fi
	fi
elif [ -e /etc/audit.rules ]; then
	if [ "`grep " -S ftruncate " /etc/audit.rules | grep -v '#' | grep -c '\success=0'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S ftruncate -F success=0" >>/etc/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S ftruncate -F success=0" >>/etc/audit.rules
		fi
	fi
else
	exit
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002720-5

3.7.4.m. Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Via open

At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system with either:

-a exit,always -F arch=ARCH -S open -F success=0 -k access
or
-a exit,always -F arch=ARCH -S open -F exit=-EPERM -k access
-a exit,always -F arch=ARCH -S open -F exit=-EACCES -k access

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	if [ "`grep " -S open " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EACCES'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S open -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S open -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		fi
	fi
	if [ "`grep " -S open " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EPERM'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S open -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S open -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		fi
	fi
elif [ -e /etc/audit.rules ]; then
	if [ "`grep " -S open " /etc/audit.rules | grep -v '#' | grep -c '\success=0'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S open -F success=0" >>/etc/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S open -F success=0" >>/etc/audit.rules
		fi
	fi
else
	exit
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002720-2

3.7.4.n. Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Via openat

At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system with either:

-a exit,always -F arch=ARCH -S openat -F success=0 -k access
or
-a exit,always -F arch=ARCH -S openat -F exit=-EPERM -k access
-a exit,always -F arch=ARCH -S openat -F exit=-EACCES -k access

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	if [ "`grep " -S openat " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EACCES'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S openat -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S openat -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		fi
	fi
	if [ "`grep " -S openat " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EPERM'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S openat -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S openat -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		fi
	fi
elif [ -e /etc/audit.rules ]; then
	if [ "`grep " -S openat " /etc/audit.rules | grep -v '#' | grep -c '\success=0'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S openat -F success=0" >>/etc/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S openat -F success=0" >>/etc/audit.rules
		fi
	fi
else
	exit
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002720-3

3.7.4.o. Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Via truncate

At a minimum the audit system should collect unauthorized file accesses for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system with either:

-a exit,always -F arch=ARCH -S truncate -F success=0 -k access
or
-a exit,always -F arch=ARCH -S truncate -F exit=-EPERM -k access
-a exit,always -F arch=ARCH -S truncate -F exit=-EACCES -k access

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	if [ "`grep " -S truncate " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EACCES'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S truncate -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S truncate -F exit=-EACCES -k access" >>/etc/audit/audit.rules
		fi
	fi
	if [ "`grep " -S truncate " /etc/audit/audit.rules | grep -v '#' | grep -c '\-F exit=-EPERM'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S truncate -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S truncate -F exit=-EPERM -k access" >>/etc/audit/audit.rules
		fi
	fi
elif [ -e /etc/audit.rules ]; then
	if [ "`grep " -S truncate " /etc/audit.rules | grep -v '#' | grep -c '\success=0'`" = "0" ]; then
		if [ "`uname -p`" != "x86_64" ]; then
			echo "-a exit,always -F arch=b32 -S truncate -F success=0" >>/etc/audit.rules
		else
			echo "-a exit,always -F arch=b64 -S truncate -F success=0" >>/etc/audit.rules
		fi
	fi
else
	exit
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002720-4

3.7.4.p. Ensure auditd Collects File Deletion Events by User

At a minimum the audit system should collect file deletion events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:

-a exit,always -F arch=ARCH -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k delete"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S unlink '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S unlink ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S unlink ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002740

3.7.4.q. Ensure auditd Collects Directory Deletion Events by User

At a minimum the audit system should collect directory deletion events for all users and root. Add the following to /etc/audit/audit.rules, setting ARCH to either b32 or b64 as appropriate for your system:

-a exit,always -F arch=ARCH -S rmdir -k delete

Auditing directory deletions will create an audit trail for directories that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log directories to conceal their presence.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k delete"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S rmdir '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S rmdir ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S rmdir ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002740-2

3.7.4.r. Ensure auditd Collects Information on Kernel Module Loading and Unloading

Add the following to /etc/audit/audit.rules in order to capture kernel module loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a exit,always -F arch=ARCH -S init_module -S delete_module -k modules

The addition/removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.

Remediation script

                    if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k modules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S init_module '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S init_module ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S init_module ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S delete_module '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S delete_module ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S delete_module ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi

for FILE in /sbin/insmod /sbin/rmmod /sbin/modprobe; do
	if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE}"`" = "0" ]; then
		echo "-w ${FILE} -p x -k modules" >>${AUDIT_RULES_FILE}
	elif [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p [wa]*x"`" = "0" ]; then
		SED_FILE="$(echo ${FILE} | sed 's/\//\\\//g')"
		if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c "\-w ${FILE} -p "`" = "0" ]; then
			sed -i "s/\(-w ${SED_FILE}\)/\1 -p x/" ${AUDIT_RULES_FILE}
		else
			sed -i "s/\(-w ${SED_FILE} -p \)/\1x/" ${AUDIT_RULES_FILE}
		fi
	fi
done
service auditd restart 1>/dev/null

                  

Security identifiers

  • GEN002825-2

3.7.4.19. Records Events that Modify Date and Time Information

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time. All changes to the system time should be audited.

3.7.4.19.a. Record attempts to alter time through adjtimex

On a 32-bit system, add the following to /etc/audit/audit.rules:

# audit_time_rules
-a exit,always -F arch=b32 -S adjtimex -k audit_time_rules
On a 64-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules
-a exit,always -F arch=b64 -S adjtimex -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a exit,always -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k audit_time_rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S adjtimex '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S adjtimex ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S adjtimex ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002760-3

3.7.4.19.b. Record attempts to alter time through settimeofday

On a 32-bit system, add the following to /etc/audit/audit.rules:

# audit_time_rules
-a exit,always -F arch=b32 -S settimeofday -k audit_time_rules
On a 64-bit system, add the following to /etc/audit/audit.rules:
# audit_time_rules
-a exit,always -F arch=b64 -S settimeofday -k audit_time_rules
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a exit,always -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k audit_time_rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S settimeofday '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S settimeofday ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b64 -S settimeofday ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002760-4

3.7.4.19.c. Record Attempts to Alter Time Through stime

Add the following line to /etc/audit/audit.rules for both 32-bit and 64-bit systems:

# audit_time_rules
-a always,exit -F arch=b32 -S stime -k audit_time_rules
Since the 64-bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64-bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32-bit and 64-bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k audit_time_rules"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S stime '`" = "0" ]; then
	if [ "`uname -p`" != "x86_64" ]; then
		echo "-a exit,always -F arch=b32 -S stime ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
		# stime is not supported on 64-bit.
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002760-5

3.7.4.19.d. Record Attempts to Alter Time Through clock_settime

On a 32-bit system, add the following to /etc/audit/audit.rules:

# time-change
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
On a 64-bit system, add the following to /etc/audit/audit.rules:
# time-change
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:
-a exit,always -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

Security identifiers

  • GEN002760-6

3.7.4.20. Record Events that Modify the System's Discretionary Access Controls

At a minimum the audit system should collect file permission changes for all users and root. Note that the "-F arch=b32" lines should be present even on a 64 bit system. These commands identify system calls for auditing. Even if the system is 64 bit it can still execute 32 bit system calls. Additionally, these rules can be configured in a number of ways while still achieving the desired effect. An example of this is that the "-S" calls could be split up and placed on separate lines, however, this is less efficient. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
    -a exit,always -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
    -a exit,always -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If your system is 64 bit then these lines should be duplicated and the arch=b32 replaced with arch=b64 as follows:
-a exit,always -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
    -a exit,always -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
    -a exit,always -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

3.7.4.20.a. Record Events that Modify the System's Discretionary Access Controls - chmod

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S chmod  -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S chmod '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S chmod ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S chmod ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820

3.7.4.20.b. Record Events that Modify the System's Discretionary Access Controls - chown

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S chown '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S chown ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S chown ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S chown32 '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S chown32 ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S chown32 ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-4

3.7.4.20.c. Record Events that Modify the System's Discretionary Access Controls - fchmod

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fchmod '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fchmod ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fchmod ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-2

3.7.4.20.d. Record Events that Modify the System's Discretionary Access Controls - fchmodat

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fchmodat '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fchmodat ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fchmodat ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-3

3.7.4.20.e. Record Events that Modify the System's Discretionary Access Controls - fchown

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fchown '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fchown ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fchown ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fchown32 '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fchown32 ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fchown32 ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-5

3.7.4.20.f. Record Events that Modify the System's Discretionary Access Controls - fchownat

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fchownat '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fchownat ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fchownat ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-6

3.7.4.20.g. Record Events that Modify the System's Discretionary Access Controls - fremovexattr

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fremovexattr '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fremovexattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fremovexattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-13

3.7.4.20.h. Record Events that Modify the System's Discretionary Access Controls - fsetxattr

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S fsetxattr '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S fsetxattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S fsetxattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-10

3.7.4.20.i. Record Events that Modify the System's Discretionary Access Controls - lchown

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S lchown '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S lchown ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S lchown ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S lchown32 '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S lchown32 ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S lchown32 ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-7

3.7.4.20.j. Record Events that Modify the System's Discretionary Access Controls - lremovexattr

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S lremovexattr '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S lremovexattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S lremovexattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-12

3.7.4.20.k. Record Events that Modify the System's Discretionary Access Controls - lsetxattr

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S lsetxattr '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S lsetxattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S lsetxattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-9

3.7.4.20.l. Record Events that Modify the System's Discretionary Access Controls - removexattr

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S removexattr '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S removexattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S removexattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-11

3.7.4.20.m. Record Events that Modify the System's Discretionary Access Controls - setxattr

At a minimum the audit system should collect file permission changes for all users and root. Add the following to /etc/audit/audit.rules:

-a exit,always -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
If the system is 64 bit then also add the following:
-a exit,always -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Remediation script

                      if [ -e /etc/audit/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit/audit.rules"
	AUDIT_TAG="-k perm_mod"
elif [ -e /etc/audit.rules ]; then
	AUDIT_RULES_FILE="/etc/audit.rules"
	AUDIT_TAG=""
else
	exit
fi

if [ "`grep -v '#' ${AUDIT_RULES_FILE} | grep -c ' -S setxattr '`" = "0" ]; then
	if [ "`uname -p`" = "x86_64" ]; then
		echo "-a exit,always -F arch=b64 -S setxattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	else
		echo "-a exit,always -F arch=b32 -S setxattr ${AUDIT_TAG}" >>${AUDIT_RULES_FILE}
	fi
fi
service auditd restart 1>/dev/null

                    

Security identifiers

  • GEN002820-8

4. Services

The best protection against vulnerable software is running less software. This section describes how to review the software which Red Hat Enterprise Linux 5 installs on a system and disable software which is not needed. It then enumerates the software packages installed on a default Red Hat Enterprise Linux 5 system and provides guidance about which ones can be safely disabled.

Red Hat Enterprise Linux 5 provides a convenient minimal install option that essentially installs the bare necessities for a functional system. When building Red Hat Enterprise Linux 5 systems, it is highly recommended to select the minimal packages and then build up the system from there.

Table of Contents

4.1. Obsolete Services

This section discusses a number of network-visible services which have historically caused problems for system security, and for which disabling or severely limiting the service has been the best available guidance for some time. As a result of this, many of these services are not installed as part of Red Hat Enterprise Linux 6 by default.

Organizations which are running these services should switch to more secure equivalents as soon as possible. If it remains absolutely necessary to run one of these services for legacy reasons, care should be taken to restrict the service as much as possible, for instance by configuring host firewall software such as iptables to restrict access to the vulnerable service to only those remote hosts which have a known need to use it.

4.1.1. Xinetd

The xinetd service acts as a dedicated listener for some network services (mostly, obsolete ones) and can be used to provide access controls and perform some logging. It has been largely obsoleted by other features, and it is not installed by default. The older Inetd service is not even available as part of Red Hat Enterprise Linux 6.

4.1.1.a. Disable xinetd Service

The xinetd service can be disabled with the following command:

$ sudo chkconfig xinetd off

The xinetd service provides a dedicated listener service for some programs, which is no longer necessary for commonly-used network services. Disabling it ensures that these uncommon services are not running, and also prevents attacks against xinetd itself.

Remediation script

                    #
# Disable xinetd for all run levels
#
/sbin/chkconfig --level 0123456 xinetd off

#
# Stop xinetd if currently running
#
/sbin/service xinetd stop 1>/dev/null

                  

Security identifiers

  • GEN003700

4.1.2. Telnet

The telnet protocol does not provide confidentiality or integrity for information transmitted on the network. This includes authentication information such as passwords. Organizations which use telnet should be actively working to migrate to a more secure protocol.

4.1.2.a. Disable telnet Service

The telnet service can be disabled with the following command:

$ sudo chkconfig telnet off

The telnet protocol uses unencrypted network communication, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network. The telnet protocol is also subject to man-in-the-middle attacks.

Remediation script

                    #
# Disable telnetd for all run levels
#
/sbin/chkconfig --level 0123456 telnetd off

#
# Stop telnetd if currently running
#
/sbin/service telnetd stop 1>/dev/null

                  

Security identifiers

  • GEN003850

4.1.3. Rlogin, Rsh, and Rexec

The Berkeley r-commands are legacy services which allow cleartext remote access and have an insecure trust model.

4.1.3.a. Uninstall rsh-server Package

The rsh-server package can be uninstalled with the following command:

# yum erase rsh-server

The rsh-server package provides several obsolete and insecure network services. Removing it decreases the risk of those services' accidental (or intentional) activation.

Remediation script

                    yum -y remove rsh-server --disablerepo=* 1>/dev/null

                  

Remediation script

                    include remove_rsh-server

class remove_rsh-server {
  package { 'rsh-server':
    ensure => 'purged',
  }
}

                  

Remediation script

                    
package -remove=rsh-server

                  

Security identifiers

  • GEN003845

4.1.3.b. Disable rexec Service

The rexec service, which is available with the rsh-server package and runs as a service through xinetd, should be disabled. The rexec service can be disabled with the following command:

$ sudo chkconfig rexec off

The rexec service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.

Remediation script

                    #
# Disable rexec for all run levels
#
/sbin/chkconfig --level 0123456 rexec off

#
# Stop rexec if currently running
#
/sbin/service rexec stop 1>/dev/null

                  

Security identifiers

  • GEN003840

4.1.3.c. Disable rsh Service

The rsh service, which is available with the rsh-server package and runs as a service through xinetd, should be disabled. The rsh service can be disabled with the following command:

$ sudo chkconfig rsh off

The rsh service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.

Remediation script

                    #
# Disable rsh for all run levels
#
/sbin/chkconfig --level 0123456 rsh off

#
# Stop rsh if currently running
#
/sbin/service rsh stop 1>/dev/null

                  

Security identifiers

  • GEN003820

4.1.3.d. Disable rlogin Service

The rlogin service, which is available with the rsh-server package and runs as a service through xinetd, should be disabled. The rlogin service can be disabled with the following command:

$ sudo chkconfig rlogin off

The rlogin service uses unencrypted network communications, which means that data from the login session, including passwords and all other information transmitted during the session, can be stolen by eavesdroppers on the network.

Remediation script

                    #
# Disable rlogin for all run levels
#
/sbin/chkconfig --level 0123456 rlogin off

#
# Stop rlogin if currently running
#
/sbin/service rlogin stop 1>/dev/null

                  

Security identifiers

  • GEN003830

4.1.3.e. Remove Rsh Trust Files

The files /etc/hosts.equiv and ~/.rhosts (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location:

# rm /etc/hosts.equiv
$ rm ~/.rhosts

Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.

Remediation script

                    find -type f -name .rhosts -exec rm -f '{}' \;
rm /etc/hosts.equiv

                  

Security identifiers

  • GEN002040

4.1.3.f. Remove rhosts_auth Entries

All pam files located within /etc/pam.d/ must not include rhosts_auth. To remove these entries, run the following command:

# sed -i '/.*rhosts_auth.*/d' /etc/pam.d/*

.rhosts files are used to specify a list of hosts permitted remote access to a particular account without authenticating. The use of such a mechanism defeats strong identification and authentication requirements.

Remediation script

                    sed -i '/.*rhosts_auth.*/d' /etc/pam.d/*

                  

Security identifiers

  • GEN002100

4.1.4. NIS

The Network Information Service (NIS), also known as 'Yellow Pages' (YP), and its successor NIS+ have been made obsolete by Kerberos, LDAP, and other modern centralized authentication services. NIS should not be used because it suffers from security problems inherent in its design, such as inadequate protection of important authentication information.

4.1.4.a. Disable ypbind Service

The ypbind service, which allows the system to act as a client in a NIS or NIS+ domain, should be disabled. The ypbind service can be disabled with the following command:

$ sudo chkconfig ypbind off

Disabling the ypbind service ensures the system is not acting as a client in a NIS or NIS+ domain.

Remediation script

                    #
# Disable ypbind for all run levels
#
/sbin/chkconfig --level 0123456 ypbind off

#
# Stop ypbind if currently running
#
/sbin/service ypbind stop 1>/dev/null

                  

Security identifiers

  • GEN006400

4.1.5. TFTP Server

TFTP is a lightweight version of the FTP protocol which has traditionally been used to configure networking equipment. However, TFTP provides little security, and modern versions of networking operating systems frequently support configuration via SSH or other more secure protocols. A TFTP server should be run only if no more secure method of supporting existing equipment can be found.

4.1.5.a. Disable tftp Service

The tftp service should be disabled. The tftp service can be disabled with the following command:

$ sudo chkconfig tftp off

Disabling the tftp service ensures the system is not acting as a TFTP server, which does not provide encryption or authentication.

Remediation script

                    #
# Disable tftp for all run levels
#
/sbin/chkconfig --level 0123456 tftp off

#
# Stop tftp if currently running
#
/sbin/service tftp stop 1>/dev/null

                  

Security identifiers

  • GEN005140

4.1.5.b. Ensure tftp Daemon Uses Secure Mode

If running the tftp service is necessary, it should be configured to change its root directory at startup. To do so, ensure /etc/xinetd.d/tftp includes -s as a command line argument, as shown in the following example (which is also the default):

server_args = -s /var/lib/tftpboot

Using the -s option causes the TFTP service to only serve files from the given directory. Serving files from an intentionally-specified directory reduces the risk of sharing files which should remain private.

Security identifiers

  • GEN005080

4.2. Base Services

This section addresses the base services that are installed on a Red Hat Enterprise Linux 6 default installation which are not covered in other sections. Some of these services listen on the network and should be treated with particular discretion. Other services are local system utilities that may or may not be extraneous. In general, system services should be disabled if not required.

4.2.a. Disable KDump Kernel Crash Analyzer (kdump)

The kdump service provides a kernel crash dump analyzer. It uses the kexec system call to boot a secondary kernel ("capture" kernel) following a system crash, which can load information from the crashed kernel for analysis. The kdump service can be disabled with the following command:

$ sudo chkconfig kdump off

Unless the system is used for kernel development or testing, there is little need to run the kdump service.

Security identifiers

  • GEN003510

4.2.b. Disable Automatic Updates

The yum-updatesd service can be disabled with the following command:

$ sudo chkconfig yum-updatesd off

System package management tools can obtain a list of updates and patches from a package repository and make this information available to the SA for review and action. Using a package repository outside of the organization's control presents a risk of malicious packages being introduced.

Remediation script

                  #
# Disable yum-updatesd for all run levels
#
/sbin/chkconfig --level 0123456 yum-updatesd off

#
# Stop yum-updatesd if currently running
#
/sbin/service yum-updatesd stop 1>/dev/null

                

Security identifiers

  • GEN008820

4.3. Cron and At Daemons

The cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform necessary maintenance tasks, while at may or may not be required on a given system. Both daemons should be configured defensively.

4.3.1. Restrict cron to Authorized Users if Necessary

The /etc/cron.allow file contain lists of users who are allowed to use cron to delay execution of processes. If this file exists and if the corresponding file /etc/cron.deny does not exist, then only users listed in the relevant allow files can run the crontab commands to submit jobs to be run at scheduled intervals. On many systems, only the system administrator needs the ability to schedule jobs. Note that even if a given user is not listed in cron.allow, cron jobs can still be run as that user.

To restrict cron to only authorized users:

  • Remove the cron.deny file:

    # rm /etc/cron.deny

  • Edit /etc/cron.allow, adding one line for each user allowed to use the crontab command to create cron jobs.

4.3.1.a. Cron Must Control Access

The cron service must control access to the execution of cron jobs. This is accomplished defining the users allowed/denied in the cron.allow and cron.deny files. To confirm if these files exist, run the following commands:

# ls -1l /etc/cron.allow
# ls -1l /etc/cron.deny
The cron facility allows users to execute recurring jobs on a regular and unattended basis. The cron.allow file designates accounts allowed to enter and execute jobs using the cron facility. If neither cron.allow nor cron.deny exists, then any account may use the cron facility. This may open the facility up for abuse by system intruders and malicious users.

Remediation script

                    if [ ! -e [/etc/cron.allow ]; then
	> /etc/cron.allow
	chown root:root /etc/cron.allow
	chmod 0600 /etc/cron.allow
fi
if [ ! -e [/etc/cron.deny ]; then
	SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
	for USER in `echo $SYS_USER`; do
		if [ $(grep -c "^${USER}$" /etc/cron.deny) = 0 ]; then
			echo ${USER} | tee -a /etc/cron.deny &>/dev/null
		fi
	done
	chown root:root /etc/cron.deny
	chmod 0600 /etc/cron.deny
fi

                  

Security identifiers

  • GEN002960

4.3.1.b. Cron Must Deny System Accounts

The cron service must deny system accounts (except for root) access to the execution of cron jobs. This includes all accounts with a UID less than 500, except for 0. This is accomplished by listing all system users within the cron.deny file and ensuring that they are not listed in the cron.allow file. To confirm these conditions are met, run the following commands:

# cat /etc/passwd | awk -F: '{ print $1"|"$3 }' | grep -v "^root|" | while read ENTRY; do 
if [ $(echo $ENTRY | cut -d"|" -f2) -lt 500 ];then 
if [ $(grep -c "$(echo $ENTRY | cut -d"|" -f1)" /etc/cron.deny) = 0 ] || 
[ $(grep -c "$(echo $ENTRY | cut -d"|" -f1)" /etc/cron.allow) != 0 ]; then 
echo $ENTRY | cut -d"|" -f1; fi; fi; done
If any users are listed from the above command, then the listed user(s) does not meet the above requirements. To centralize the management of privileged account crontabs, of the default system accounts, only root may have a crontab.

Remediation script

                    SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
for USER in `echo $SYS_USER`; do
	if [ $(grep -c "^${USER}$" /etc/cron.deny) = 0 ]; then
		echo ${USER} | tee -a /etc/cron.deny &>/dev/null
	fi
done

                  

Security identifiers

  • GEN003060

4.3.2. Restrict at to Authorized Users if Necessary

The /etc/at.allow file contain lists of users who are allowed to use at to delay execution of processes. If this file exists and if the corresponding file /etc/at.deny does not exist, then only users listed in the relevant allow files can run the at commands to submit jobs to be run at scheduled intervals. On many systems, only the system administrator needs the ability to schedule jobs. Note that even if a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file controls only administrative access to the crontab command for scheduling and modifying cron jobs.

To restrict at to only authorized users:

  • Remove the at.deny file:

    # rm /etc/at.deny

  • Edit /etc/at.allow, adding one line for each user allowed to use the at command to create at jobs.

4.3.2.a. At Must Control Access

The at service must control access to the execution of at jobs. This is accomplished defining the users allowed/denied in the at.allow and at.deny files. To confirm if these files exist, run the following commands:

# ls -1l /etc/at.allow
# ls -1l /etc/at.deny
The at facility allows users to execute recurring jobs on a regular and unattended basis. The at.allow file designates accounts allowed to enter and execute jobs using the at facility. If neither at.allow nor at.deny exists, then any account may use the at facility. This may open the facility up for abuse by system intruders and malicious users.

Remediation script

                    if [ ! -e [/etc/at.allow ]; then
	> /etc/at.allow
	chown root:root /etc/at.allow
	chmod 0600 /etc/at.allow
fi
if [ ! -e [/etc/at.deny ]; then
	SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
	for USER in `echo $SYS_USER`; do
		if [ $(grep -c "^${USER}$" /etc/at.deny) = 0 ]; then
			echo ${USER} | tee -a /etc/at.deny &>/dev/null
		fi
	done
	chown root:root /etc/at.deny
	chmod 0600 /etc/at.deny
fi

                  

Security identifiers

  • GEN003280

4.3.2.b. At Must Deny System Accounts

The at service must deny system accounts (except for root) access to the execution of at jobs. This includes all accounts with a UID less than 500, except for 0. This is accomplished by listing all system users within the at.deny file and ensuring that they are not listed in the at.allow file. To confirm these conditions are met, run the following commands:

# cat /etc/passwd | awk -F: '{ print $1"|"$3 }' | grep -v "^root|" | while read ENTRY; do 
if [ $(echo $ENTRY | cut -d"|" -f2) -lt 500 ];then 
if [ $(grep -c "$(echo $ENTRY | cut -d"|" -f1)" /etc/at.deny) = 0 ] || 
[ $(grep -c "$(echo $ENTRY | cut -d"|" -f1)" /etc/at.allow) != 0 ]; then 
echo $ENTRY | cut -d"|" -f1; fi; fi; done
If any users are listed from the above command, then the listed user(s) does not meet the above requirements. To centralize the management of privileged account at jobs, of the default system accounts, only root may have the ability to schedule at jobs.

Remediation script

                    SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
for USER in `echo $SYS_USER`; do
	if [ $(grep -c "^${USER}$" /etc/at.deny) = 0 ]; then
		echo ${USER} | tee -a /etc/at.deny &>/dev/null
	fi
done

                  

Security identifiers

  • GEN003320

4.3.2.c. At.deny Must Either Not Exist Or Not Be Empty

On some systems, if there is no at.allow file and there is an empty at.deny file, then the system assumes everyone has permission to use the "at" facility. This could create an insecure setting in the case of malicious users or system intruders. To confirm these conditions are met, run the following command:

# ls -1l /etc/at.deny
If the above command returns with details about /etc/at.deny, then it exists. If it exists, then run the following command:
# cat /etc/at.deny
If no entries are returned, then configure the at.deny file with the default system accounts, excluding root.

Remediation script

                    SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
for USER in `echo $SYS_USER`; do
	if [ $(grep -c "^${USER}$" /etc/at.deny) = 0 ]; then
		echo ${USER} | tee -a /etc/at.deny &>/dev/null
	fi
done
sed -i '/^$/d' /etc/at.deny

                  

Security identifiers

  • GEN003300

4.4. SSH Server

The SSH protocol is recommended for remote login and remote file transfer. SSH provides confidentiality and integrity for data exchanged between two systems, as well as server authentication, through the use of public key cryptography. The implementation included with the system is called OpenSSH, and more detailed documentation is available from its website, http://www.openssh.org. Its server program is called sshd and provided by the RPM package openssh-server.

4.4.1. Configure OpenSSH Server if Necessary

If the system needs to act as an SSH server, then certain changes should be made to the OpenSSH daemon configuration file /etc/ssh/sshd_config. The following recommendations can be applied to this file. See the sshd_config(5) man page for more detailed information.

4.4.1.a. Allow Only SSH Protocol 2

Only SSH protocol version 2 connections should be permitted. The default setting in /etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:

Protocol 2

SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -c "^Protocol") != "0" ]; then
	sed -i 's/^Protocol.*/Protocol 2/' /etc/ssh/sshd_config
else
	echo "Protocol 2">>/etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005500

4.4.1.b. Disable SSH Root Login

The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config:

PermitRootLogin no

Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.

Remediation script

                    grep -q ^PermitRootLogin /etc/ssh/sshd_config && \
  sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
    echo "PermitRootLogin no" >> /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN001120

4.4.1.c. Enable SSH Warning Banner

To enable the warning banner and ensure it is consistent across the system, add or correct the following line in /etc/ssh/sshd_config:

Banner /etc/issue
Another section contains information on how to create an appropriate system-wide warning banner.

The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.

Remediation script

                    grep -q ^Banner /etc/ssh/sshd_config && \
  sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
    echo "Banner /etc/issue" >> /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005550

4.4.1.d. Use Only Approved Ciphers

Limit the ciphers to those algorithms which are FIPS-approved. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page sshd_config(5) contains a list of supported ciphers.

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Remediation script

                    grep -q ^Ciphers /etc/ssh/sshd_config && \
  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
    echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr" >> /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null

                  

Security identifiers

  • GEN005505

4.4.1.e. Do Not Use CBC Mode

The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plain text attacks. Counter (CTR) mode is preferred over CBC mode. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page sshd_config(5) contains a list of supported ciphers.

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Remediation script

                    grep -q ^Ciphers /etc/ssh/sshd_config && \
  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
    echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr" >> /etc/ssh/sshd_config
fi
/sbin/service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005506

4.4.1.f. Use Only Approved Macs

Limit the MACs to those hash algorithms which are FIPS-approved. The following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved MACs:

Macs hmac-sha1
The man page sshd_config(5) contains a list of supported macs.

DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -c "^MACs") = "0" ]; then
	echo "MACs hmac-sha1" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^MACs.*/MACs hmac-sha1/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005507

4.4.1.g. Disable GSSAPIAuthentication

GSSAPIAuthentication should not be permitted. The default setting in /etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:

GSSAPIAuthentication no

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -c "^GSSAPIAuthentication") = "0" ]; then
	echo "GSSAPIAuthentication no" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005524

4.4.1.h. Display Login Details

A user should be presented with details on the last attempted access to their account, upon logging in. The default setting in /etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:

PrintLastLog yes

Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.

Remediation script

                    if [ "$(grep -c '^session.*required.*pam_lastlog.so$' /etc/pam.d/sshd)" = "0" ]; then
	echo -e "session    required\tpam_lastlog.so" | tee -a /etc/pam.d/sshd &>/dev/null
elif [ "$(grep pam_lastlog /etc/pam.d/sshd | grep -c silent)" != "0" ]; then
	sed -i '/pam_lastlog/s/silent//' /etc/pam.d/sshd
fi
if [ $(cat /etc/ssh/sshd_config | grep -ic "^PrintLastLog") = "0" ]; then
	echo "PrintLastLog yes" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^PrintLastLog.*/PrintLastLog yes/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN000452

4.4.1.i. Restrict Users/Groups

Login access to the SSH server should be restricted to a list of allowed users or groups. The default setting in /etc/ssh/sshd_config is to allow all users and groups access to login. The user/group restriction can be verified by ensuring that the following line appears:

AllowedUsers
or
AllowedGroups

Restricting SSH logins to a limited group of users, such as system administrators, prevents password-guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access.

Remediation script

                    echo "AllowGroups wheel" | tee -a /etc/ssh/sshd_config &>/dev/null
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005521

4.4.1.j. Disable KerberosAuthentication

KerberosAuthentication should not be permitted. The default setting in /etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:

KerberosAuthentication no

Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -ic "^KerberosAuthentication") = "0" ]; then
	echo "KerberosAuthentication no" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^KerberosAuthentication.*/KerberosAuthentication no/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005526

4.4.1.k. Enable StrictModes

StrictModes must be enabled. The default setting in /etc/ssh/sshd_config is not correct, and can be verified by ensuring that the following line appears:

StrictModes yes

If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -c "^StrictModes") = "0" ]; then
	echo "StrictModes yes" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^StrictModes.*/StrictModes yes/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005536

4.4.1.l. Enable Privilege Separation

UsePrivilegeSeparation must be enabled. The default setting in /etc/ssh/sshd_config is not correct, and can be verified by ensuring that the following line appears:

UsePrivilegeSeparation yes

SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -ic "^UsePrivilegeSeparation") = "0" ]; then
	echo "UsePrivilegeSeparation yes" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^UsePrivilegeSeparation.*/UsePrivilegeSeparation yes/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005537

4.4.1.m. Disable RhostsRSAAuthentication

RhostsRSAAuthentication should not be permitted. The default setting in /etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:

RhostsRSAAuthentication no

If SSH permits rhosts RSA authentication, a user may be able to log in based on the keys of the host originating the request and not any user-specific authentication.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -ic "^RhostsRSAAuthentication") = "0" ]; then
	echo "RhostsRSAAuthentication no" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^RhostsRSAAuthentication.*/RhostsRSAAuthentication no/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005538

4.4.1.n. Disable Or Delay Compression

Compression should not be permitted prior to authentication. The default setting in /etc/ssh/sshd_config is not correct, and can be verified by ensuring that either of the following lines appear:

Compression no
or
Compression delayed

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Remediation script

                    if [ $(cat /etc/ssh/sshd_config | grep -ic "^Compression") = "0" ]; then
	echo "Compression delayed" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i 's/^Compression.*/Compression delayed/' /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                  

Security identifiers

  • GEN005539

4.4.1.15. Strengthen Firewall Configuration if Possible

If the SSH server is expected to only receive connections from the local network, then strengthen the default firewall rule for the SSH service to only accept connections from the appropriate network segment(s).

Determine an appropriate network block, netwk, and network mask, mask, representing the machines on your network which will be allowed to access this SSH server.

Edit the files etc/sysconfig/iptables and /etc/sysconfig/ip6tables (if IPv6 is in use). In each file, locate the line:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
and replace it with:
-A INPUT -s netwk/mask -m state --state NEW -p tcp --dport 22 -j ACCEPT

Restricting SSH access to only trusted network segments reduces exposure of the SSH server to attacks from unauthorized networks.

4.4.1.15.a. Assign Designated IP

The SSH daemon must only listen on management network addresses unless authorized for uses other than management. By default, all addresses are allowed. The default setting in /etc/ssh/sshd_config must be modified to include the specific IP address that the SSH server should be managed from, for example:

ListenAddress 10.10.2.1

The SSH daemon should only listen on network addresses designated for management traffic. If the system has multiple network interfaces and SSH listens on addresses not designated for management traffic, the SSH service could be subject to unauthorized access. If SSH is used for purposes other than management, such as providing an SFTP service, the list of approved listening addresses may be documented.

Remediation script

                      MANAGEMENT_IP=$(/sbin/ifconfig | grep inet | grep -v 127.0.0.1 | cut -d: -f2 | awk '{ print $1}' | head -1)
if [ $(cat /etc/ssh/sshd_config | grep -ic "^ListenAddress") = "0" ]; then
	echo "ListenAddress ${MANAGEMENT_IP}" | tee -a /etc/ssh/sshd_config &>/dev/null
else
	sed -i "s/^ListenAddress.*/ListenAddress ${MANAGEMENT_IP}/" /etc/ssh/sshd_config
fi
service sshd restart 1>/dev/null
                    

Security identifiers

  • GEN005504

4.4.1.15.b. Enable SSH IP Filtering

IP filtering should be enabled for SSH in either /etc/hosts.allow or /etc/hosts.deny. By default, no IP filtering is configured. IP filtering for SSH can be verified by ensuring that a line similar to the following appears:

sshd:10.10.:spawn /bin/echo SSHD accessed on $(/bin/date) from %h>>/var/log/host.access

The SSH daemon must be configured for IP filtering to provide a layered defence against connection attempts from unauthorized addresses.

Remediation script

                      MANAGEMENT_IP=$(/sbin/ifconfig | grep inet | grep -v 127.0.0.1 | cut -d: -f2 | awk '{ print $1}' | head -1 | cut -d. -f1-2)
sed -i '/sshd/d' /etc/hosts.allow
echo "sshd: ${MANAGEMENT_IP}.: spawn /bin/echo SSHD accessed on \$(/bin/date) from %h>>/var/log/host.access" | tee -a /etc/hosts.allow &>/dev/null

                    

Security identifiers

  • GEN005540

4.4.2. Configure OpenSSH Client if Necessary

If the system needs to utilize the SSH client, then certain changes should be made to the OpenSSH client configuration file /etc/ssh/ssh_config. The following recommendations can be applied to this file. See the ssh_config(5) man page for more detailed information.

4.4.2.a. Allow Only SSH Protocol 2

Only SSH protocol version 2 connections should be permitted. The default setting in /etc/ssh/ssh_config is correct, and can be verified by ensuring that the following line appears:

Protocol 2

SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used.

Remediation script

                    if [ $(cat /etc/ssh/ssh_config | grep -c "^Protocol") != "0" ]; then
	sed -i 's/^Protocol.*/Protocol 2/' /etc/ssh/ssh_config
else
	echo "Protocol 2">>/etc/ssh/ssh_config
fi


                  

Security identifiers

  • GEN005501

4.4.2.b. Use Only Approved Ciphers

Limit the ciphers to those algorithms which are FIPS-approved. The following line in /etc/ssh/ssh_config demonstrates use of FIPS-approved ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page ssh_config(5) contains a list of supported ciphers.

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Remediation script

                    grep -q ^Ciphers /etc/ssh/ssh_config && \
  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr/g" /etc/ssh/ssh_config
if ! [ $? -eq 0 ]; then
    echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr" >> /etc/ssh/ssh_config
fi


                  

Security identifiers

  • GEN005510

4.4.2.c. Do Not Use CBC Mode

The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plain text attacks. Counter (CTR) mode is preferred over CBC mode. The following line in /etc/ssh/ssh_config demonstrates use of FIPS-approved ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr
The man page ssh_config(5) contains a list of supported ciphers.

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Remediation script

                    grep -q ^Ciphers /etc/ssh/ssh_config && \
  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr/g" /etc/ssh/ssh_config
if ! [ $? -eq 0 ]; then
    echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr" >> /etc/ssh/ssh_config
fi

                  

Security identifiers

  • GEN005511

4.4.2.d. Use Only Approved Macs

Limit the MACs to those hash algorithms which are FIPS-approved. The following line in /etc/ssh/ssh_config demonstrates use of FIPS-approved MACs:

Macs hmac-sha1
The man page ssh_config(5) contains a list of supported macs.

DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.

Remediation script

                    if [ $(cat /etc/ssh/ssh_config | grep -c "^MACs") = "0" ]; then
	echo "MACs hmac-sha1" | tee -a /etc/ssh/ssh_config &>/dev/null
else
	sed -i 's/^MACs.*/MACs hmac-sha1/' /etc/ssh/ssh_config
fi

                  

Security identifiers

  • GEN005512

4.4.2.e. Disable GSSAPIAuthentication

GSSAPIAuthentication should not be permitted. The default setting in /etc/ssh/ssh_config is correct, and can be verified by ensuring that the following line appears:

GSSAPIAuthentication no

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.

Remediation script

                    if [ $(cat /etc/ssh/ssh_config | grep -c "^GSSAPIAuthentication") = "0" ]; then
	echo "GSSAPIAuthentication no" | tee -a /etc/ssh/ssh_config &>/dev/null
else
	sed -i 's/^GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/ssh_config
fi

                  

Security identifiers

  • GEN005525

4.5. X Window System

The X Window System implementation included with the system is called X.org.

4.5.1. Disable X Windows

Unless there is a mission-critical reason for the system to run a graphical user interface, ensure X is not set to start automatically at boot and remove the X Windows software packages. There is usually no reason to run X Windows on a dedicated server machine, as it increases the system's attack surface and consumes system resources. Administrators of server systems should instead login via SSH or on the text console.

4.5.1.a. Disable X Windows Startup By Setting Runlevel

Setting the system's runlevel to 3 will prevent automatic startup of the X server. To do so, ensure the following line in /etc/inittab features a 3 as shown:

id:3:initdefault:

Unnecessary services should be disabled to decrease the attack surface of the system.

Remediation script

                    sed -i 's/.*:initdefault:.*/id:3:initdefault:/' /etc/inittab
                  

Security identifiers

  • GEN005260

4.6. DHCP

The Dynamic Host Configuration Protocol (DHCP) allows systems to request and obtain an IP address and other configuration parameters from a server.

This guide recommends configuring networking on clients by manually editing the appropriate files under /etc/sysconfig. Use of DHCP can make client systems vulnerable to compromise by rogue DHCP servers, and should be avoided unless necessary. If using DHCP is necessary, however, there are best practices that should be followed to minimize security risk.

4.6.1. Disable DHCP Client

DHCP is the default network configuration method provided by the system installer, and common on many networks. Nevertheless, manual management of IP addresses for systems implies a greater degree of management and accountability for network activity.

4.6.1.a. Disable DHCP Client

For each interface on the system (e.g. eth0), edit /etc/sysconfig/network-scripts/ifcfg-interface and make the following changes:

  • Correct the BOOTPROTO line to read:

    BOOTPROTO=static

  • Add or correct the following lines, substituting the appropriate values based on your site's addressing scheme:

    NETMASK=255.255.255.0
    IPADDR=192.168.1.2
    GATEWAY=192.168.1.1

DHCP relies on trusting the local network. If the local network is not trusted, then it should not be used. However, the automatic configuration provided by DHCP is commonly used and the alternative, manual configuration, presents an unacceptable burden in many circumstances.

Remediation script

                    sed -i 's/^BOOTPROTO=.*/BOOTPROTO="static"/' /etc/sysconfig/network-scripts/ifcfg-*
                  

Security identifiers

  • GEN007840

4.6.2. Configure DHCP Client if Necessary

If DHCP must be used, then certain configuration changes can minimize the amount of information it receives and applies from the network, and thus the amount of incorrect information a rogue DHCP server could successfully distribute. For more information on configuring dhclient, see the dhclient(8) and dhclient.conf(5) man pages.

4.6.2.a. Do Not Use Dynamic DNS

To prevent the DHCP client from transmitting system information, edit /etc/dhclient.conf, and add or correct the following global option:

do-forward-updates false;

Dynamic DNS updates transmit unencrypted information about a system including its name and address and should not be used unless needed.

Remediation script

                    if [ -e /etc/dhclient.conf ]; then
	if [ $(grep -c "do-forward-updates false;" /etc/dhclient.conf) = 0 ]; then
		echo "do-forward-updates false;" | tee -a /etc/dhclient.conf &>/dev/null
	fi
else
	echo "do-forward-updates false;" | tee /etc/dhclient.conf &>/dev/null
fi

                  

Security identifiers

  • GEN007850

4.7. Network Time Protocol

The Network Time Protocol is used to manage the system clock over a network. Computer clocks are not very accurate, so time will drift unpredictably on unmanaged systems. Central time protocols can be used both to ensure that time is consistent among a network of machines, and that their time is consistent with the outside world.

If every system on a network reliably reports the same time, then it is much easier to correlate log messages in case of an attack. In addition, a number of cryptographic protocols (such as Kerberos) use timestamps to prevent certain types of attacks. If your network does not have synchronized time, these protocols may be unreliable or even unusable.

Depending on the specifics of the network, global time accuracy may be just as important as local synchronization, or not very important at all. If your network is connected to the Internet, using a public timeserver (or one provided by your enterprise) provides globally accurate timestamps which may be essential in investigating or responding to an attack which originated outside of your network.

A typical network setup involves a small number of internal systems operating as NTP servers, and the remainder obtaining time information from those internal servers.

More information on how to configure the NTP server software, including configuration of cryptographic authentication for time data, is available at http://www.ntp.org.

4.7.a. Enable the NTP Daemon

The ntpd service can be enabled with the following command:

$ sudo chkconfig --level 2345 ntpd on

Enabling the ntpd service ensures that the ntpd service will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches.

The NTP daemon offers all of the functionality of ntpdate, which is now deprecated. Additional information on this is available at http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate

Remediation script

                  #
# Enable ntpd for all run levels
#
/sbin/chkconfig --level 0123456 ntpd on

#
# Start ntpd if not currently running
#
/sbin/service ntpd start 1>/dev/null

                

Security identifiers

  • GEN000241

4.7.b. Specify a Remote NTP Server

To specify a remote NTP server for time synchronization, edit the file /etc/ntp.conf. Add or correct the following lines, substituting the IP or hostname of a remote NTP server for ntpserver:

server ntpserver
This instructs the NTP software to contact that remote server to obtain time data.

Synchronizing with an NTP server makes it possible to collate system logs from multiple sources or correlate computer events with real time events.

Security identifiers

  • GEN000240

4.7.c. Specify Additional Remote NTP Servers

Additional NTP servers can be specified for time synchronization in the file /etc/ntp.conf. To do so, add additional lines of the following form, substituting the IP address or hostname of a remote NTP server for ntpserver:

server ntpserver

Specifying additional NTP servers increases the availability of accurate time data, in the event that one of the specified servers becomes unavailable. This is typical for a system acting as an NTP server for other systems.

Security identifiers

  • GEN000242

4.8. Mail Server Software

Mail servers are used to send and receive email over the network. Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious targets of network attack. Ensure that machines are not running MTAs unnecessarily, and configure needed MTAs as defensively as possible.

Very few systems at any site should be configured to directly receive email over the network. Users should instead use mail client programs to retrieve email from a central server that supports protocols such as IMAP or POP3. However, it is normal for most systems to be independently capable of sending email, for instance so that cron jobs can report output to an administrator. Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from the local system to a central site MTA (or directly delivered to a local account), but the system still cannot receive mail directly over a network.

The alternatives program in Red Hat Enterprise Linux permits selection of other mail server software (such as Sendmail), but Postfix is the default and is preferred. Postfix was coded with security in mind and can also be more effectively contained by SELinux as its modular design has resulted in separate processes performing specific actions. More information is available on its website, http://www.postfix.org.

4.8.a. Mail Server Software Updates

If sendmail is installed, perform the following command:

# rpm -q sendmail
The version indicated should be equal to or greater than the following:
8.13.8-8
If postfix is installed, perform the following command:
# rpm -q postfix
The version indicated should be equal to or greater than the following:
2.3.3-6

The SMTP service version on the system must be current to avoid exposing vulnerabilities present in unpatched versions.

Security identifiers

  • GEN004600

4.8.2. Mail Server Logging

It is important to ensure adequate logging of mail server connections so as to support detecting any unauthorized activity.

4.8.2.a. Enable Mail Server Logging

To ensure logging is enabled, perform the following command:

grep "mail\." /etc/syslog.conf
The output received should indicate either mail.crit or mail.*.

If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.

Security identifiers

  • GEN004460

4.8.2.b. Configure Mail Server Logging Level

If sendmail is installed, perform the following checks: Edit the file /etc/mail/sendmail.cf and confirm that the following line appears:

O LogLevel=9
If postfix is installed, this check is not applicable.

If Sendmail is not configured to log at level 9, system logs may not contain the information necessary for tracking unauthorized use of the sendmail service.

Security identifiers

  • GEN004440

4.8.3. Mail Server Features

Mail servers are used to send and receive email over the network. Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious targets of network attack. Ensure that machines are not running MTAs unnecessarily, and configure needed MTAs as defensively as possible.

Very few systems at any site should be configured to directly receive email over the network. Users should instead use mail client programs to retrieve email from a central server that supports protocols such as IMAP or POP3. However, it is normal for most systems to be independently capable of sending email, for instance so that cron jobs can report output to an administrator. Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from the local system to a central site MTA (or directly delivered to a local account), but the system still cannot receive mail directly over a network.

The alternatives program in Red Hat Enterprise Linux permits selection of other mail server software (such as Sendmail), but Postfix is the default and is preferred. Postfix was coded with security in mind and can also be more effectively contained by SELinux as its modular design has resulted in separate processes performing specific actions. More information is available on its website, http://www.postfix.org.

4.8.3.a. Disable Debug Command

From a terminal, type the following commands:

# telnet localhost 25
# debug
If debug is disabled, one of the following errors should be returned:
500 error code of "command unrecognised"
550 error code of "access denied"

Debug mode is a feature present in older versions of sendmail which, if not disabled, may allow an attacker to gain access to a system through the sendmail service.

Security identifiers

  • GEN004620

4.8.3.b. Disable Decode Command

Edit the file(s) /etc/aliases and /usr/lib/aliases, if either exist, to ensure that the decode: and uudecode: entries do NOT include the file path to uudecode, such as the following:

decode: |/usr/bin/uudecode
uudecode: |/usr/bin/uuencode -d

A common configuration for older Mail Transfer Agents (MTAs) is to include an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to the decode or the uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

Security identifiers

  • GEN004640

4.8.3.c. Disable EXPN Command

If sendmail is installed, perform the following checks: Edit the file /etc/mail/sendmail.cf to ensure that the following PrivacyOptions line appears and includes noexpn:

O PrivacyOptions=authwarnings,novrfy,noexpn,restrictqrun
If postfix is installed, this check is not applicable.

The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners.

Security identifiers

  • GEN004660

4.8.3.d. Disable Help Command

If sendmail is installed, perform the following checks: Edit the file /etc/mail/helpfile to ensure that the file is empty. If postfix is installed, this check is not applicable.

The HELP command should be disabled to mask version information. The version of the SMTP service software could be used by attackers to target vulnerabilities present in specific software versions.

Remediation script

                    >/etc/mail/helpfile

                  

Security identifiers

  • GEN004540

4.8.3.e. Disable VRFY Command

If sendmail is installed, perform the following checks: Edit the file /etc/mail/sendmail.cf to ensure that the following PrivacyOptions line appears and includes novrfy:

O PrivacyOptions=authwarnings,novrfy,noexpn,restrictqrun
If postfix is installed, this check is not applicable.

The VRFY command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY may provide additional information about users on the system, such as the full names of account owners.

Security identifiers

  • GEN004680

4.8.3.f. Disable WIZ Command

From a terminal, type the following commands:

# telnet localhost 25
# wiz
If wiz is disabled, the following error should be returned:
500 error code of "command unrecognised"

Very old installations of the Sendmail mailing system contained a feature whereby a remote user connecting to the SMTP port can enter the WIZ command and be given an interactive shell with root privileges.

Security identifiers

  • GEN004700

4.8.3.g. Don't Display Version

If sendmail is installed, perform the following checks: Edit the file /etc/mail/sendmail.cf to ensure that the following SmtpGreetingMessage line does not appear as:

O SmtpGreetingMessage=$j Sendmail $v/$Z; $b
If the above line appears, it should be changed to:
O SmtpGreetingMessage= Mail Server Ready ; $b
If postfix is installed, perform the following checks: Edit the file /etc/postfix/main.cf to ensure that the following smtpd_banner line does not appear with $mail_version. If so, remove the $mail_version entry or comment out the entire line to use the default value.

The version of the SMTP service can be used by attackers to plan an attack based on vulnerabilities present in the specific version.

Remediation script

                    SENDMAIL_CONFIG=$(rpm -ql sendmail | grep sendmail.cf)
SENDMAIL_MAINCONF=$(rpm -ql sendmail | grep sendmail.mc)
if [ "$(rpm -q sendmail-cf &>/dev/null; echo $?)" = "0" ]; then
	if [ -e "${SENDMAIL_MAINCONF}" ]; then
		if [ "$(grep -c "^define(\`confSMTP_LOGIN_MSG" "${SENDMAIL_MAINCONF}")" = "0" ]; then
			sed -i "0,/^define/s/\(^define\)/define(\`confSMTP_LOGIN_MSG', \` Mail Server Ready ; $b')dnl\n\1/" "${SENDMAIL_MAINCONF}"
		elif [ "$(grep -c "^define(\`confSMTP_LOGIN_MSG', \` Mail Server Ready ; \$b')dnl" "${SENDMAIL_MAINCONF}")" = "0" ]; then
			sed -i "s/^define(\`confSMTP_LOGIN_MSG.*/define(\`confSMTP_LOGIN_MSG', \`Mail Server Ready ; \$b')dnl/" "${SENDMAIL_MAINCONF}"
		fi
		m4 "${SENDMAIL_MAINCONF}" > "${SENDMAIL_CONFIG}"
	fi
else
	sed -i 's/O SmtpGreetingMessage=.*/O SmtpGreetingMessage= Mail Server Ready ; $b/' "${SENDMAIL_CONFIG}"
fi
service sendmail restart 1>/dev/null

                  

Security identifiers

  • GEN004560

4.8.3.h. Restrict Mail Forwarding

If sendmail is installed, perform the following checks: Edit the file /etc/mail/sendmail.cf to ensure that the following ForwardPath line appears without any file path specified:

0 ForwardPath
Perform a search on the system for any .forward files by issuing the following command:
# find / -name .forward
The above command should not return any results. If so, delete each file returned.

The .forward file allows users to automatically forward mail to another system. Use of .forward files could allow the unauthorized forwarding of mail and could potentially create mail loops which could degrade system performance.

Remediation script

                    SENDMAIL_CONFIG=$(rpm -ql sendmail | grep sendmail.cf)
SENDMAIL_MAINCONF=$(rpm -ql sendmail | grep sendmail.mc)
if [ "$(rpm -q sendmail-cf &>/dev/null; echo $?)" = "0" ]; then
	if [ -e "${SENDMAIL_MAINCONF}" ]; then
		if [ "$(grep -c 'confFORWARD_PATH' "${SENDMAIL_MAINCONF}")" = "0" ]; then
			sed -i "0,/^define/s/\(^define\)/define(\`confFORWARD_PATH',\`')dnl\n\1/" "${SENDMAIL_MAINCONF}"
		elif [ "$(grep -c "define(\`confFORWARD_PATH',\`')dnl" "${SENDMAIL_MAINCONF}")" = "0" ]; then
			sed -i "s/define(\`confFORWARD.*/define(\`confFORWARD_PATH',\`')dnl/" "${SENDMAIL_MAINCONF}"
		fi
		m4 "${SENDMAIL_MAINCONF}" > "${SENDMAIL_CONFIG}"
	fi
else
	sed -i 's/O ForwardPath.*/O ForwardPath/' "${SENDMAIL_CONFIG}"
fi
service sendmail restart 1>/dev/null
for FILE in $(find /etc -name .forward -type f 2>/dev/null); do
	rm -f ${FILE}
done

                  

Security identifiers

  • GEN004580

4.8.3.i. Restrict Mail Relaying

If sendmail is installed, perform the following checks: Edit the file /etc/mail/sendmail.cf to ensure that only the following DaemonPortOptions line appears:

O DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA
Edit the file /etc/mail/sendmail.mc to ensure that the following promiscuous_relay line does NOT appear:
promiscuous_relay
If postfix is installed, perform the following checks: Edit the file /etc/postfix/main.cf to ensure that only the following inet_interfaces line appears:
inet_interfaces = localhost
Edit the file /etc/postfix/main.cf to ensure that only the following smtpd_client_restrictions line appears:
smtpd_client_restrictions = reject

If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending SPAM or other unauthorized activity.

Security identifiers

  • GEN004710

4.9. LDAP

LDAP is a popular directory service, that is, a standardized way of looking up information from a central database. Red Hat Enterprise Linux 5 includes software that enables a system to act as both an LDAP client and server.

4.9.1. Configure OpenLDAP Clients

This section provides information on which security settings are important to configure in OpenLDAP clients by manually editing the appropriate configuration files. Red Hat Enterprise Linux 5 provides an automated configuration tool called authconfig and a graphical wrapper for authconfig called system-config-authentication. However, these tools do not provide as much control over configuration as manual editing of configuration files. The authconfig tools do not allow you to specify locations of SSL certificate files, which is useful when trying to use SSL cleanly across several protocols. Installation and configuration of OpenLDAP on Red Hat Enterprise Linux 5 is available at

.

Before configuring any system to be an LDAP client, ensure that a working LDAP server is present on the network.

4.9.1.a. Configure LDAP Client to Use TLS For All Transactions

Configure LDAP to enforce TLS use. First, edit the file /etc/ldap.conf, and add or correct the following lines:

ssl start_tls
Then review the LDAP server and ensure TLS has been configured.

The ssl directive specifies whether to use ssl or not. If not specified it will default to no. It should be set to start_tls rather than doing LDAP over SSL.

Remediation script

                    if [ "$(cat /etc/ldap.conf | grep -c '^ssl ')" = "0" ]; then
	echo "ssl start_tls" | tee -a /etc/ldap.conf &>/dev/null
else
	sed -i 's/^ssl .*/ssl start_tls/' /etc/ldap.conf
fi
if [ "$(cat /etc/ldap.conf | grep -c '^tls_ciphers ')" = "0" ]; then
	echo "tls_ciphers TLSv1" | tee -a /etc/ldap.conf &>/dev/null
else
	sed -i 's/^tls_ciphers .*/tls_ciphers TLSv1/' /etc/ldap.conf
fi

                  

Security identifiers

  • GEN007980

4.9.1.b. Configure Certificate Directives for LDAP Use of TLS

Ensure a copy of a trusted CA certificate has been placed in the file /etc/pki/tls/CA/cacert.pem. Configure LDAP to enforce TLS use and to trust certificates signed by that CA. First, edit the file /etc/ldap.conf, and add or correct either of the following lines:

tls_cert /etc/pki/tls/CA
or
tls_cert /etc/pki/tls/CA/cacert.pem

LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.

Remediation script

                    sed -i 's/ ldap//g' /etc/nsswitch.conf
                  

Security identifiers

  • GEN008000

4.9.1.c. Configure Certificate Trust Validation

Ensure LDAP server connections have a valid trust path. Configure LDAP to enforce validation of LDAP server certificates for trust. First, edit the file /etc/ldap.conf, and add or correct the following line:

tls_checkpeer yes

The NSS LDAP service provides user mappings which are a vital component of system security. Communication between an LDAP server and a host using LDAP for NSS require authentication.

Remediation script

                    if [ $(cat /etc/ldap.conf | grep -c "^tls_checkpeer") = "0" ]; then
	echo "tls_checkpeer yes" | tee -a /etc/ldap.conf &>/dev/null
else
	sed -i 's/^tls_checkpeer.*/tls_checkpeer yes/' /etc/ldap.conf
fi

                  

Security identifiers

  • GEN008020

4.9.1.d. Configure Certificate Revocation Validation

Ensure LDAP server connections have a valid certificate that is not revoked. Configure LDAP to enforce validation of LDAP server certificates for revocation. First, edit the file /etc/ldap.conf, and add or correct the following line:

tls_crlcheck all

LDAP can be used to provide user authentication and account information, which are vital to system security. Communication between an LDAP server and a host using LDAP requires authentication.

Remediation script

                    if [ $(cat /etc/ldap.conf | grep -c "^tls_crlcheck") = "0" ]; then
	echo "tls_crlcheck all" | tee -a /etc/ldap.conf &>/dev/null
else
	sed -i 's/^tls_crlcheck.*/tls_crlcheck all/' /etc/ldap.conf
fi

                  

Security identifiers

  • GEN008040

4.9.1.e. LDAP Passwords Are Stored In Clear Text

Ensure the LDAP configuration does not include any passwords stored in clear text. Edit the file /etc/ldap.conf, and remove any lines that include the bindpw directive.

The authentication of automated LDAP connections between systems must not use passwords since more secure methods are available, such as PKI and Kerberos. Additionally, the storage of unencrypted passwords on the system is not permitted.

Remediation script

                    sed -i '/bindpw/d' /etc/ldap.conf
                  

Security identifiers

  • GEN008050

4.10. NFS and RPC

The Network File System is a popular distributed filesystem for the Unix environment, and is very widely deployed. This section discusses the circumstances under which it is possible to disable NFS and its dependencies, and then details steps which should be taken to secure NFS's configuration. This section is relevant to machines operating as NFS clients, as well as to those operating as NFS servers.

4.10.1. Disable All NFS Services if Possible

If there is not a reason for the system to operate as either an NFS client or an NFS server, follow all instructions in this section to disable subsystems required by NFS.

The steps in this section will prevent a machine from operating as either an NFS client or an NFS server. Only perform these steps on machines which do not need NFS at all.

4.10.1.1. Remove Services Used Only by NFS

If NFS is not needed, remove the NFS client daemons portmap and rpcbind.

All of these daemons run with elevated privileges, and many listen for network connections. If they are not needed, they should be disabled to improve system security posture.

4.10.1.1.a. Remove portmap and rpcbind Packages

The portmap and rpcbind packages can be uninstalled with the following command:

# yum erase portmap rpcbind

Remediation script

                      yum -y remove portmap rpcbind --disablerepo=* 1>/dev/null

                    

Security identifiers

  • GEN003815

4.10.1.2. Disable Services Used Only by NFS

If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd.

All of these daemons run with elevated privileges, and many listen for network connections. If they are not needed, they should be disabled to improve system security posture.

4.10.1.2.a. Disable portmap and rpcbind Services

The rpcbind service increase the attack surface of the system and should only be used when needed. The rpcbind service are used by a variety of services using Remote Procedure Calls (RPCs). The rpcbind service can be disabled with the following command:

$ sudo chkconfig rpcbind off

Security identifiers

  • GEN003810

4.10.2. Configure All Machines which Use NFS

The steps in this section are appropriate for all machines which run NFS, whether they operate as clients or as servers.

4.10.2.1. Configure NFS Clients

The steps in this section are appropriate for machines which operate as NFS clients.

4.10.2.1.a. Mount Remote Filesystems with nosuid

Add the nosuid option to the fourth column of /etc/fstab for the line which controls mounting of any NFS mounts.

NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables should be installed to their default location on the local filesystem.

Security identifiers

  • GEN005900

4.10.2.2. Configure NFS Servers

The steps in this section are appropriate for machines which operate as NFS servers.

4.10.2.2.a. Specify UID and GID for Anonymous NFS Connections

To specify the UID and GID for remote root users, edit the /etc/exports file and add the following for each export:


anonuid=-1
anongid=-1

Specifying the anonymous UID and GID as -1 ensures that the remote root user is mapped to a local account which has no permissions on the system.

Security identifiers

  • GEN005820

4.10.2.2.b. All Exports Must Define Allowed Targets

When configuring NFS exports, ensure that each export line in /etc/exports contains a list of hosts which are allowed to access that export. If no hosts are specified on an export line, then that export is available to any remote host which requests it. All lines of the exports file should specify the hosts (or subnets, if needed) which are allowed to access the exported directory, so that unknown or remote hosts will be denied.

Authorized hosts can be specified in several different formats:

  • Name or alias that is recognized by the resolver

  • Fully qualified domain name

  • IP address

  • IP subnets in the format address/netmask or address/CIDR

The NFS access option limits user access to the specified level. This assists in protecting exported file systems. If access is not restricted, unauthorized hosts may be able to access the system's NFS exports.

Security identifiers

  • GEN005840

4.10.2.2.c. Use Root-Squashing on All Exports

If a filesystem is exported using root squashing, requests from root on the client are considered to be unprivileged (mapped to a user such as nobody). This provides some mild protection against remote abuse of an NFS server. Root squashing is enabled by default, and should not be disabled.

Ensure that no line in /etc/exports contains the option no_root_squash.

If the NFS server allows root access to local file systems from remote hosts, this access could be used to compromise the system.

Security identifiers

  • GEN005880

4.10.2.2.d. Ensure Insecure File Locking is Not Allowed

By default the NFS server requires secure file-lock requests, which require credentials from the client in order to lock a file. Most NFS clients send credentials with file lock requests, however, there are a few clients that do not send credentials when requesting a file-lock, allowing the client to only be able to lock world-readable files. To get around this, the insecure_locks option can be used so these clients can access the desired export. This poses a security risk by potentially allowing the client access to data for which it does not have authorization. Remove any instances of the insecure_locks option from the file /etc/exports.

Allowing insecure file locking could allow for sensitive data to be viewed or edited by an unauthorized user.

Security identifiers

  • GEN000000-LNX00560

4.11. FTP Server

FTP is a common method for allowing remote access to files. Like telnet, the FTP protocol is unencrypted, which means that passwords and other data transmitted during the session can be captured and that the session is vulnerable to hijacking. Therefore, running the FTP server software is not recommended.

However, there are some FTP server configurations which may be appropriate for some environments, particularly those which allow only read-only anonymous access as a means of downloading data available to the public.

4.11.a. Disable Unencrypted FTP Services

The vsftpd service can be disabled with the following command:

$ sudo chkconfig vsftpd off

Running unencrypted FTP server software provides a network-based avenue of attack, and should be disabled if not needed. Furthermore, the FTP protocol is unencrypted and creates a risk of compromising sensitive information.

Security identifiers

  • GEN004800

4.11.b. Enable Logging of All FTP Transactions

Add or correct the following configuration options within the vsftpd configuration file, located at /etc/vsftpd/vsftpd.conf:

xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES

If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log

To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to the FTP server are logged using the verbose vsftpd log format. The default vsftpd log file is /var/log/vsftpd.log.

Remediation script

                  if [ -e /etc/xinetd.d/gssftp ]; then
	if [ "$(grep server_args /etc/xinetd.d/gssftp | grep -c " -l")" = "0" ]; then
		sed -i "/server_args/s/$/ -l/" /etc/xinetd.d/gssftp
	fi
fi
if [ -e /etc/vsftpd/vsftpd.conf ]; then
	if [ "$(grep -ic "^xferlog_enable=yes" /etc/vsftpd/vsftpd.conf)" = "0" ]; then
		sed -i "s/xferlog_enable.*/xferlog_enable=yes/" /etc/xinetd.d/gssftp
	fi
fi

                

Security identifiers

  • GEN004980

4.11.c. FTP Umask Must Be 077.

All FTP users must have a default umask of 077.

The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask is stored as a 4-digit number, the first digit representing special access modes is typically ignored or required to be zero (0).

Remediation script

                  if [ "$(rpm -q krb5-workstation &>/dev/null; echo $?)" = "0" ]; then
	if [ "$(grep server_args /etc/xinetd.d/gssftp | grep -v "#" | grep -c "\-u 077")" = "0" ]; then
		sed -i '/server_args/s/$/ -u 077/' /etc/xinetd.d/gssftp
	fi
fi
if [ "$(rpm -q vsftpd &>/dev/null; echo $?)" = "0" ]; then
	if [ "$(grep -c local_umask /etc/vsftpd/vsftpd.conf)" = "0" ]; then
		echo "local_umask=077" >> /etc/vsftpd/vsftpd.conf
	else
		sed -i '/local_umask/s/=.*/=077/' /etc/vsftpd/vsftpd.conf
	fi
	if [ "$(grep -c anon_umask /etc/vsftpd/vsftpd.conf)" = "0" ]; then
		echo "anon_umask=077" >> /etc/vsftpd/vsftpd.conf
	else
		sed -i '/anon_umask/s/=.*/=077/' /etc/vsftpd/vsftpd.conf
	fi
fi

                

Security identifiers

  • GEN005040

4.11.d. Ftpusers File Contains Users

The ftpusers file must contain account names not allowed to use FTP.

The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If the file does not contain the names of all accounts not authorized to use FTP, then unauthorized use of FTP may take place.

Remediation script

                  SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
if [ "$(rpm -q krb5-workstation &>/dev/null; echo $?)" = "0" ]; then
	if [ ! -e /etc/ftpusers ]; then
		>/etc/ftpusers
		chmod 0640 /etc/ftpusers
		chown root:root /etc/ftpusers
	fi
	for USER in `echo $SYS_USER`; do
		if [ $(grep -c "^${USER}$" /etc/ftpusers) = 0 ]; then
			echo ${USER} | tee -a /etc/ftpusers &>/dev/null
		fi
	done
fi
if [ "$(rpm -q vsftpd &>/dev/null; echo $?)" = "0" ]; then
	if [ ! -e /etc/vsftpd/ftpusers ]; then
		>/etc/vsftpd/ftpusers
		chmod 0640 /etc/vsftpd/ftpusers
		chown root:root /etc/vsftpd/ftpusers
	fi
	for USER in `echo $SYS_USER`; do
		if [ $(grep -c "^${USER}$" /etc/vsftpd/ftpusers) = 0 ]; then
			echo ${USER} | tee -a /etc/vsftpd/ftpusers &>/dev/null
		fi
	done
fi

                

Security identifiers

  • GEN004900

4.11.e. Ftpusers File Exists

The ftpusers file must exist.

The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If this file does not exist, then unauthorized accounts can utilize FTP.

Remediation script

                  SYS_USER=$(cat /etc/passwd | while read entry; do if [ "$(echo ${entry} | cut -d: -f3)" -lt "500" ]; then echo ${entry} | cut -d: -f1 ; fi; done)
if [ "$(rpm -q krb5-workstation &>/dev/null; echo $?)" = "0" ]; then
	if [ ! -e /etc/ftpusers ]; then
		>/etc/ftpusers
		chmod 0640 /etc/ftpusers
		chown root:root /etc/ftpusers
	fi
	for USER in `echo $SYS_USER`; do
		if [ $(grep -c "^${USER}$" /etc/ftpusers) = 0 ]; then
			echo ${USER} | tee -a /etc/ftpusers &>/dev/null
		fi
	done
fi
if [ "$(rpm -q vsftpd &>/dev/null; echo $?)" = "0" ]; then
	if [ ! -e /etc/vsftpd/ftpusers ]; then
		>/etc/vsftpd/ftpusers
		chmod 0640 /etc/vsftpd/ftpusers
		chown root:root /etc/vsftpd/ftpusers
	fi
	for USER in `echo $SYS_USER`; do
		if [ $(grep -c "^${USER}$" /etc/vsftpd/ftpusers) = 0 ]; then
			echo ${USER} | tee -a /etc/vsftpd/ftpusers &>/dev/null
		fi
	done
fi

                

Security identifiers

  • GEN004880

4.11.f. FTP User Has Shell

Anonymous FTP accounts must not have a functional shell.

If an anonymous FTP account has been configured to use a functional shell, attackers could gain access to the shell if the account is compromised.

Security identifiers

  • GEN005000

4.11.g. TFTP User Has Shell

The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user.

If TFTP has a valid shell, it increases the likelihood someone could log on to the TFTP account and compromise the system.

Security identifiers

  • GEN005120

4.12. Samba(SMB) Microsoft Windows File Sharing Server

When properly configured, the Samba service allows Linux machines to provide file and print sharing to Microsoft Windows machines. There are two software packages that provide Samba support. The first, samba-client, provides a series of command line tools that enable a client machine to access Samba shares. The second, simply labeled samba, provides the Samba service. It is this second package that allows a Linux machine to act as an Active Directory server, a domain controller, or as a domain member. Only the samba-client package is installed by default.

4.12.1. Remove Samba if Possible

The Samba server must not be installed unless it provides an operational need.

4.12.1.a. Remove samba and samba3x Packages

The samba and samba3x packages can be uninstalled with the following command:

# yum erase samba samba3x

Remediation script

                    yum -y remove samba-common --disablerepo=* 1>/dev/null

                  

Security identifiers

  • GEN006060

4.12.2. Configure Samba if Necessary

All settings for the Samba daemon can be found in /etc/samba/smb.conf. Settings are divided between a [global] configuration section and a series of user created share definition sections meant to describe file or print shares on the system. By default, Samba will operate in user mode and allow client machines to access local home directories and printers. It is recommended that these settings be changed or that additional limitations be set in place.

4.12.2.a. Samba Web Administration Tool Must Be Restricted

The Samba Web Administration Tool (SWAT) must be restricted to the local host or require SSL.

SWAT is a tool used to configure Samba. It modifies Samba configuration, which can impact system security, and must be protected from unauthorized access. SWAT authentication may involve the root password, which must be protected by encryption when traversing the network. Restricting access to the local host allows for the use of SSH TCP forwarding, if configured, or administration by a web browser on the local system.

Security identifiers

  • GEN006080

4.12.2.b. Configure hosts Option

Samba increases the attack surface of the system and must be restricted to communicate only with systems requiring access.

Specifying the anonymous UID and GID as -1 ensures that the remote root user is mapped to a local account which has no permissions on the system.

Remediation script

                    sed -i 's/\(^\[global\]$\)/\1\n\n\thosts allow = 127./' /etc/samba/smb.conf
                  

Security identifiers

  • GEN006220

4.12.2.c. Configure security Option

Samba share authentication does not provide for individual user identification and must not be used.

Specifying the anonymous UID and GID as -1 ensures that the remote root user is mapped to a local account which has no permissions on the system.

Remediation script

                    sed -i '/^[#|;]/!s/\([ |\t]*security =\).*/\1 user/' /etc/samba/smb.conf
                  

Security identifiers

  • GEN006225

4.12.2.d. Configure encrypt passwords Option

Samba must be configured to use encrypted passwords.

Remediation script

                    if [ "$(grep -c '^[ |\t]*encrypt passwords' /etc/samba/smb.conf)" = "0" ]; then
	sed -i 's/\(^\[global\]$\)/\1\n\n\tencrypt passwords = yes/' /etc/samba/smb.conf
else
	sed -i '/^[#|;]/!s/\(encrypt passwords =\).*/\1 yes/g' /etc/samba/smb.conf
fi

                  

Security identifiers

  • GEN006230

4.12.2.e. Configure guest ok Option

Guest access to shares permits anonymous access and is not permitted.

Remediation script

                    sed -i '/^[#|;]/!s/\(guest ok =\).*/\1 no/g' /etc/samba/smb.conf
                  

Security identifiers

  • GEN006235

4.13. SNMP Server

The Simple Network Management Protocol allows administrators to monitor the state of network devices, including computers. Older versions of SNMP were well-known for weak security, such as plaintext transmission of the community string (used for authentication) and usage of easily-guessable choices for the community string.

4.13.1. Configure SNMP Server

If it is necessary to run the snmpd agent on the system, some best practices should be followed to minimize the security risk from the installation. The multiple security models implemented by SNMP cannot be fully covered here so only the following general configuration advice can be offered:

  • use only SNMP version 3 security models and enable the use of authentication and encryption

  • write access to the MIB (Management Information Base) should be allowed only if necessary

  • all access to the MIB should be restricted following a principle of least privilege

  • network access should be limited to the maximum extent possible including restricting to expected network addresses both in the configuration files and in the system firewall rules

  • ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management stations

  • ensure that permissions on the snmpd.conf configuration file (by default, in /etc/snmp) are 640 or more restrictive

  • ensure that any MIB files' permissions are also 640 or more restrictive

4.13.1.a. Configure SNMP Service to Use Only SNMPv3 or Newer

Edit /etc/snmp/snmpd.conf, removing any references to v1, v2c, or com2sec. Upon doing that, restart the SNMP service:

# service snmpd restart

Earlier versions of SNMP are considered insecure, as they potentially allow unauthorized access to detailed system management information.

Remediation script

                    find / -xdev -name snmpd.conf 2>/dev/null | xargs sed -i '/.*\(v1\|v2c\|community\|com2sec\).*/s/^/#/'

                  

Security identifiers

  • GEN005305

4.13.1.b. Ensure Default Password Is Not Used

Edit /etc/snmp/snmpd.conf, remove default community strings public, private, snmp-trap, password. Upon doing that, restart the SNMP service:

# service snmpd restart

Presence of the default SNMP password enables querying of different system aspects and could result in unauthorized knowledge of the system.

Security identifiers

  • GEN005300

4.13.1.c. Ensure Approved Hash Is Used

Edit /etc/snmp/snmpd.conf, ensure every line beginning with createUser includes SHA, similar to the following:

# createUser myuser SHA -l 0x0001020304050607080900010203040506070809 AES -l 0x00010203040506070809000102030405
Upon doing that, restart the SNMP service:
# service snmpd restart

The SNMP service must use SHA-1 or a FIPS 140-2 approved successor for authentication and integrity.

Security identifiers

  • GEN005306

4.13.1.d. Ensure Approved Encryption Is Used

Edit /etc/snmp/snmpd.conf, ensure every line beginning with createUser includes AES, similar to the following:

# createUser myuser SHA -l 0x0001020304050607080900010203040506070809 AES -l 0x00010203040506070809000102030405
Upon doing that, restart the SNMP service:
# service snmpd restart

The SNMP service must use AES or a FIPS 140-2 approved successor algorithm for protecting the privacy of communications.

Security identifiers

  • GEN005307

5. Documentation to Support DISA OS SRG Mapping

These groups exist to document how the Red Hat Enterprise Linux product meets (or does not meet) requirements listed in the DISA OS SRG, for those cases where Groups or Rules elsewhere in scap-security-guide do not clearly relate.

5.a. Product Meets this Requirement

This requirement is a permanent not a finding. No fix is required.

Red Hat Enterprise Linux meets this requirement through design and implementation.

References

  1. 42. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  2. 56. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  3. 206. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  4. 1084. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  5. 66. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  6. 85. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  7. 86. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  8. 185. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  9. 223. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  10. 171. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  11. 172. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  12. 1694. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  13. 770. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  14. 804. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  15. 162. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  16. 163. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  17. 164. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  18. 345. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  19. 346. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  20. 1096. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  21. 1111. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  22. 1291. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  23. 386. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  24. 156. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  25. 186. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  26. 1083. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  27. 1082. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  28. 1090. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  29. 804. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  30. 1127. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  31. 1128. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  32. 1129. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  33. 1248. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  34. 1265. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  35. 1314. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  36. 1362. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  37. 1368. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  38. 1310. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  39. 1311. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  40. 1328. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  41. 1399. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  42. 1400. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  43. 1427. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  44. 1499. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  45. 1632. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  46. 1693. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  47. 1665. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  48. 1674. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.

5.b. Product Meets this Requirement

This requirement is a permanent not a finding. No fix is required.

The Red Hat Enterprise Linux audit system meets this requirement through design and implementation.

5.c. Product Meets this Requirement

This requirement is a permanent not a finding. No fix is required.

Red Hat Enterprise Linux meets this requirement through design and implementation.

5.d. Guidance Does Not Meet this Requirement Due to Impracticality or Scope

This requirement is NA. No fix is required.

The guidance does not meet this requirement. The requirement is impractical or out of scope.

References

  1. 21. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  2. 25. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  3. 28. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  4. 29. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  5. 30. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  6. 165. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  7. 221. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  8. 354. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  9. 553. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  10. 779. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  11. 780. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  12. 781. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  13. 1009. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  14. 1094. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  15. 1123. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  16. 1124. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  17. 1125. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  18. 1132. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  19. 1135. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  20. 1140. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  21. 1141. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  22. 1142. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  23. 1143. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  24. 1145. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  25. 1147. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  26. 1148. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  27. 1166. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  28. 1339. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  29. 1340. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  30. 1341. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  31. 1350. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  32. 1356. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  33. 1373. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  34. 1374. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  35. 1383. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  36. 1391. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  37. 1392. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  38. 1395. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  39. 1662. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.

5.e. Implementation of the Requirement is Not Supported

This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.

RHEL6 does not support this requirement.

5.f. Guidance Does Not Meet this Requirement Due to Impracticality or Scope

This requirement is NA. No fix is required.

The guidance does not meet this requirement. The requirement is impractical or out of scope.

References

  1. 15. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  2. 27. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  3. 218. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  4. 219. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  5. 371. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  6. 372. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  7. 535. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  8. 537. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  9. 539. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  10. 1682. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  11. 370. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  12. 37. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  13. 24. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  14. 1112. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  15. 1126. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  16. 1143. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  17. 1149. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  18. 1157. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  19. 1159. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  20. 1210. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  21. 1211. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  22. 1274. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  23. 1372. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  24. 1376. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  25. 1377. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  26. 1352. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  27. 1401. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  28. 1555. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  29. 1556. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.
  30. 1150. URL: <http://iase.disa.mil/stigs/cci/Pages/index.aspx>.

5.g. A process for prompt installation of OS updates must exist.

Procedures to promptly apply software updates must be established and executed. The Red Hat operating system provides support for automating such a process, by running the yum program through a cron job or by managing the system and its packages through the Red Hat Network or a Satellite Server.

This is a manual inquiry about update procedure.

Colophon

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.