...
| chapter | section | index | title | v8.x.x enabled |
| 1 | Initial Setup | |||
| 1.1 | Filesystem Configuration | |||
| 1.1.1.1 | Ensure mounting of cramfs filesystems is disabled | always | ||
| 1.1.1.2 | Ensure mounting of freevxfs filesystems is disabled | always | ||
| 1.1.1.3 | Ensure mounting of jffs2 filesystems is disabled | always | ||
| 1.1.1.4 | Ensure mounting of hfs filesystems is disabled | always | ||
| 1.1.1.5 | Ensure mounting of hfsplus filesystems is disabled | always | ||
| 1.1.1.6 | Ensure mounting of udf filesystems is disabled | always | ||
| 1.1.2 | Ensure separate partition exists for /tmp | always | ||
| 1.1.3 | Ensure nodev option set on /tmp partition | always | ||
| 1.1.4 | Ensure nosuid option set on /tmp partition | always | ||
| 1.1.5 | Ensure separate partition exists for /var | always | ||
| 1.1.6 | Ensure separate partition exists for /var/tmp | always | ||
| 1.1.7 | Ensure nodev option set on /var/tmp partition | always | ||
| 1.1.8 | Ensure nosuid option set on /var/tmp partition | always | ||
| 1.1.9 | Ensure noexec option set on /var/tmp partition | always | ||
| 1.1.10 | Ensure separate partition exists for /var/log | always | ||
| 1.1.11 | Ensure separate partition exists for /var/log/audit | always | ||
| 1.1.12 | Ensure separate partition exists for /home | always | ||
| 1.1.13 | Ensure nodev option set on /home partition | always | ||
| 1.1.14 | Ensure nodev option set on /dev/shm partition (/run) | always | ||
| 1.1.15 | Ensure nosuid option set on /dev/shm partition (/run) | always | ||
| 1.1.16 | Ensure noexec option set on /dev/shm partition (/run) | always | ||
| 1.1.17 | Ensure nodev option set on removable media partitions | always | ||
| 1.1.18 | Ensure nosuid option set on removable media partitions | always | ||
| 1.1.19 | Ensure noexec option set on removable media partitions | always | ||
| 1.1.20 | Ensure sticky bit is set on all world-writable directories | always | ||
| 1.1.21 | Disable Automounting | always | ||
| 1.2 | Configure Software Updates | |||
| 1.2.1 | Ensure package manager repositories are configured | always | ||
| 1.2.2 | Ensure GPG keys are configured | always | ||
| 1.3 | Filesystem Integrity Checking | |||
| 1.3.1 | Ensure AIDE is installed | always | ||
| 1.3.2 | Ensure filesystem integrity is regularly checked | always | ||
| 1.4 | Secure Boot Settings | |||
| 1.4.1 | Ensure permissions on bootloader config are configured | always | ||
| 1.4.2 | Ensure bootloader password is set | Customer to set see below notes | ||
| 1.4.3 | Ensure authentication required for single user mode | always | ||
| 1.5 | Additional Process Hardening | |||
| 1.5.1 | Ensure core dumps are restricted | always | ||
| 1.5.2 | Ensure XD/NX support is enabled | always | ||
| 1.5.3 | Ensure address space layout randomization (ASLR) is enabled | always | ||
| 1.5.4 | Ensure prelink is disabled | always | ||
| 1.6 | Mandatory Access Control | |||
| 1.6.1.1 | Ensure SELinux is not disabled in bootloader configuration | always | ||
| 1.6.1.2 | Ensure the SELinux state is enforcing | always | ||
| 1.6.1.3 | Ensure SELinux policy is configured | always | ||
| 1.6.1.4 | Ensure no unconfined daemons exist | always | ||
| 1.6.2.1 | Ensure AppArmor is not disabled in bootloader configuration | always | ||
| 1.6.2.2 | Ensure all AppArmor Profiles are enforcing | always | ||
| 1.6.3 | Ensure SELinux or AppArmor are installed | always | ||
| 1.7 | Warning Banners | |||
| 1.7.1.1 | Ensure message of the day is configured properly | always | ||
| 1.7.1.2 | Ensure local login warning banner is configured properly | always | ||
| 1.7.1.3 | Ensure remote login warning banner is configured properly | always | ||
| 1.7.1.4 | Ensure permissions on /etc/motd are configured | always | ||
| 1.7.1.5 | Ensure permissions on /etc/issue are configured | always | ||
| 1.7.1.6 | Ensure permissions on /etc/issue.net are configured | always | ||
| 1.7.2 | Ensure GDM login banner is configured | always | ||
| 1.8 | Ensure updates patches and additional security software are installed | Snare Central patches the system with OS and security updates with each new release. | ||
| 2 | Services | |||
| 2.1 | inetd Services | |||
| 2.1.1 | Ensure chargen services are not enabled | always | ||
| 2.1.2 | Ensure daytime services are not enabled | always | ||
| 2.1.3 | Ensure discard services are not enabled | always | ||
| 2.1.4 | Ensure echo services are not enabled | always | ||
| 2.1.5 | Ensure time services are not enabled | always | ||
| 2.1.6 | Ensure rsh server is not enabled | always | ||
| 2.1.7 | Ensure talk server is not enabled | always | ||
| 2.1.8 | Ensure telnet server is not enabled | always | ||
| 2.1.9 | Ensure tftp server is not enabled | always | ||
| 2.1.10 | Ensure xinetd is not enabled | always | ||
| 2.1.11 | Ensure openbsd-inetd is not installed | always | ||
| 2.2 | Special Purpose Services | |||
| 2.2.1.1 | Ensure time synchronization is in use | false positive | ||
| 2.2.1.2 | Ensure ntp is configured | always | ||
| 2.2.1.3 | Ensure chrony is configured | false positive | ||
| 2.2.2 | Ensure X Window System is not installed | always | ||
| 2.2.3 | Ensure Avahi Server is not enabled | always | ||
| 2.2.4 | Ensure CUPS is not enabled | always | ||
| 2.2.5 | Ensure DHCP Server is not enabled | always | ||
| 2.2.6 | Ensure LDAP server is not enabled | always | ||
| 2.2.7 | Ensure NFS and RPC are not enabled | false positive | ||
| 2.2.8 | Ensure DNS Server is not enabled | always | ||
| 2.2.9 | Ensure FTP Server is not enabled | always | ||
| 2.2.10 | Ensure HTTP server is not enabled | The website redirects from HTTP to HTTPS on login page | ||
| 2.2.11 | Ensure IMAP and POP3 server is not enabled | always | ||
| 2.2.12 | Ensure Samba is not enabled | false positive | ||
| 2.2.13 | Ensure HTTP Proxy Server is not enabled | always | ||
| 2.2.14 | Ensure SNMP Server is not enabled | false positive | ||
| 2.2.15 | Ensure mail transfer agent is configured for local-only mode | always | ||
| 2.2.16 | Ensure rsync service is not enabled | false positive | ||
| 2.2.17 | Ensure NIS Server is not enabled | always | ||
| 2.3 | Service Clients | |||
| 2.3.1 | Ensure NIS Client is not installed | always | ||
| 2.3.2 | Ensure rsh client is not installed | always | ||
| 2.3.3 | Ensure talk client is not installed | always | ||
| 2.3.4 | Ensure telnet client is not installed | always | ||
| 2.3.5 | Ensure LDAP client is not installed | false positive | ||
| 3 | Network Configuration | |||
| 3.1 | Network Parameters (Host Only) | |||
| 3.1.1 | Ensure IP forwarding is disabled | always | ||
| 3.1.2 | Ensure packet redirect sending is disabled | always | ||
| 3.2 | Network Parameters (Host and Router) | |||
| 3.2.1 | Ensure source routed packets are not accepted | always | ||
| 3.2.2 | Ensure ICMP redirects are not accepted | always | ||
| 3.2.3 | Ensure secure ICMP redirects are not accepted | always | ||
| 3.2.4 | Ensure suspicious packets are logged | always | ||
| 3.2.5 | Ensure broadcast ICMP requests are ignored | always | ||
| 3.2.6 | Ensure bogus ICMP responses are ignored | always | ||
| 3.2.7 | Ensure Reverse Path Filtering is enabled | always | ||
| 3.2.8 | Ensure TCP SYN Cookies is enabled | always | ||
| 3.3 | Ipv6 | |||
| 3.3.1 | Ensure IPv6 router advertisements are not accepted | always | ||
| 3.3.2 | Ensure IPv6 redirects are not accepted | always | ||
| 3.3.3 | Ensure IPv6 is disabled | always | ||
| 3.4 | TCP Wrappers | |||
| 3.4.1 | Ensure TCP Wrappers is installed | always | ||
| 3.4.2 | Ensure /etc/hosts.allow is configured | false positive | ||
| 3.4.3 | Ensure /etc/hosts.deny is configured | false positive | ||
| 3.4.4 | Ensure permissions on /etc/hosts.allow are configured | always | ||
| 3.4.5 | Ensure permissions on /etc/hosts.deny are configured | always | ||
| 3.5 | Uncommon Network Protocols | |||
| 3.5.1 | Ensure DCCP is disabled | always | ||
| 3.5.2 | Ensure SCTP is disabled | always | ||
| 3.5.3 | Ensure RDS is disabled | always | ||
| 3.5.4 | Ensure TIPC is disabled | always | ||
| 3.6 | Firewall Configuration | |||
| 3.6.1 | Ensure iptables is installed | always | ||
| 3.6.2 | Ensure default deny firewall policy | always | ||
| 3.6.3 | Ensure loopback traffic is configured | always | ||
| 3.6.4 | Ensure outbound and established connections are configured | always | ||
| 3.6.5 | Ensure firewall rules exist for all open ports | always | ||
| 3.7 | Ensure wireless interfaces are disabled | always | ||
| 4 | Logging and Auditing | |||
| 4.1 | Configure System Accounting (auditd) | |||
| 4.1.1.1 | Ensure audit log storage size is configured | always | ||
| 4.1.1.2 | Ensure system is disabled when audit logs are full | false positive | ||
| 4.1.1.3 | Ensure audit logs are not automatically deleted | false positive | ||
| 4.1.2 | Ensure auditd service is enabled | needs STIG | ||
| 4.1.3 | Ensure auditing for processes that start prior to auditd is enabled | needs STIG | ||
| 4.1.4 | Ensure events that modify date and time information are collected | needs STIG | ||
| 4.1.5 | Ensure events that modify user/group information are collected | needs STIG | ||
| 4.1.6 | Ensure events that modify the system's network environment are collected | needs STIG | ||
| 4.1.7 | Ensure events that modify the system's Mandatory Access Controls are collected | needs STIG | ||
| 4.1.8 | Ensure login and logout events are collected | needs STIG | ||
| 4.1.9 | Ensure session initiation information is collected | needs STIG | ||
| 4.1.10 | Ensure discretionary access control permission modification events are collected | needs STIG | ||
| 4.1.11 | Ensure unsuccessful unauthorized file access attempts are collected | needs STIG | ||
| 4.1.12 | Ensure use of privileged commands is collected | needs STIG | ||
| 4.1.13 | Ensure successful file system mounts are collected | needs STIG | ||
| 4.1.14 | Ensure file deletion events by users are collected | needs STIG | ||
| 4.1.15 | Ensure changes to system administration scope (sudoers) is collected | needs STIG | ||
| 4.1.16 | Ensure system administrator actions (sudolog) are collected | needs STIG | ||
| 4.1.17 | Ensure kernel module loading and unloading is collected | needs STIG | ||
| 4.1.18 | Ensure the audit configuration is immutable | needs STIG | ||
| 4.2 | Configure Logging | |||
| 4.2.1.1 | Ensure rsyslog Service is enabled | always | ||
| 4.2.1.2 | Ensure logging is configured | always | ||
| 4.2.1.3 | Ensure rsyslog default file permissions configured | always | ||
| 4.2.1.4 | Ensure rsyslog is configured to send logs to a remote log host | false positive | ||
| 4.2.1.5 | Ensure remote rsyslog messages are only accepted on designated log hosts | false positive | ||
| 4.2.2.1 | Ensure syslog-ng service is enabled | always | ||
| 4.2.2.2 | Ensure logging is configured | always | ||
| 4.2.2.3 | Ensure syslog-ng default file permissions configured | always | ||
| 4.2.2.4 | Ensure syslog-ng is configured to send logs to a remote log host | always | ||
| 4.2.2.5 | Ensure remote syslog-ng messages are only accepted on designated log hosts] | always | ||
| 4.2.3 | Ensure rsyslog or syslog-ng is installed | always | ||
| 4.2.4 | Ensure permissions on all logfiles are configured | always | ||
| 4.3 | Ensure logrotate is configured | always | ||
| 5 | Access, Authentication and Authorization | |||
| 5.1 | Configure cron | |||
| 5.1.1 | Ensure cron daemon is enabled | always | ||
| 5.1.2 | Ensure permissions on /etc/crontab are configured | always | ||
| 5.1.3 | Ensure permissions on /etc/cron.hourly are configured | always | ||
| 5.1.4 | Ensure permissions on /etc/cron.daily are configured | always | ||
| 5.1.5 | Ensure permissions on /etc/cron.weekly are configured | always | ||
| 5.1.6 | Ensure permissions on /etc/cron.monthly are configured | always | ||
| 5.1.7 | Ensure permissions on /etc/cron.d are configured | always | ||
| 5.1.8 | Ensure at/cron is restricted to authorized users | always | ||
| 5.2 | SSH Server Configuration | always | ||
| 5.2.1 | Ensure permissions on /etc/ssh/sshd_config are configured | always | ||
| 5.2.2 | Ensure SSH Protocol is set to 2 | always | ||
| 5.2.3 | Ensure SSH LogLevel is set to INFO | always | ||
| 5.2.4 | Ensure SSH X11 forwarding is disabled | always | ||
| 5.2.5 | Ensure SSH MaxAuthTries is set to 4 or less | always | ||
| 5.2.6 | Ensure SSH IgnoreRhosts is enabled | always | ||
| 5.2.7 | Ensure SSH HostbasedAuthentication is disabled | always | ||
| 5.2.8 | Ensure SSH root login is disabled | always | ||
| 5.2.9 | Ensure SSH PermitEmptyPasswords is disabled | always | ||
| 5.2.10 | Ensure SSH PermitUserEnvironment is disabled | always | ||
| 5.2.11 | Ensure only approved MAC algorithms are used | always | ||
| 5.2.12 | Ensure SSH Idle Timeout Interval is configured | always | ||
| 5.2.13 | Ensure SSH LoginGraceTime is set to one minute or less | always | ||
| 5.2.14 | Ensure SSH access is limited | always | ||
| 5.2.15 | Ensure SSH warning banner is configured | always | ||
| 5.3 | Configure PAM | |||
| 5.3.1 | Ensure password creation requirements are configured | false positive | ||
| 5.3.2 | Ensure lockout for failed password attempts is configured | always | ||
| 5.3.3 | Ensure password reuse is limited | always | ||
| 5.3.4 | Ensure password hashing algorithm is SHA-512 | always | ||
| 5.4 | User Accounts and Environment | |||
| 5.4.1.1 | Ensure password expiration is 365 days or less | always | ||
| 5.4.1.2 | Ensure minimum days between password changes is 7 or more | always | ||
| 5.4.1.3 | Ensure password expiration warning days is 7 or more | always | ||
| 5.4.1.4 | Ensure inactive password lock is 30 days or less | always | ||
| 5.4.1.5 | Ensure all users last password change date is in the past | always | ||
| 5.4.2 | Ensure system accounts are non-login | always | ||
| 5.4.3 | Ensure default group for the root account is GID 0 | always | ||
| 5.4.4 | Ensure default user umask is 027 or more restrictive | always | ||
| 5.4.5 | Ensure default user shell timeout is 900 seconds or less | always | ||
| 5.5 | Ensure root login is restricted to system console | always | ||
| 5.6 | Ensure access to the su command is restricted | always | ||
| 6 | System Maintenance | |||
| 6.1 | System File Permissions | |||
| 6.1.1 | Audit system file permissions | always | ||
| 6.1.2 | Ensure permissions on /etc/passwd are configured | always | ||
| 6.1.3 | Ensure permissions on /etc/shadow are configured | always | ||
| 6.1.4 | Ensure permissions on /etc/group are configured | always | ||
| 6.1.5 | Ensure permissions on /etc/gshadow are configured | always | ||
| 6.1.6 | Ensure permissions on /etc/passwd- are configured | always | ||
| 6.1.7 | Ensure permissions on /etc/shadow- are configured | always | ||
| 6.1.8 | Ensure permissions on /etc/group- are configured | always | ||
| 6.1.9 | Ensure permissions on /etc/gshadow- are configured | always | ||
| 6.1.10 | Ensure no world writable files exist | false positive | ||
| 6.1.11 | Ensure no unowned files or directories exist | always | ||
| 6.1.12 | Ensure no ungrouped files or directories exist | always | ||
| 6.1.13 | Audit SUID executables | always | ||
| 6.1.14 | Audit SGID executables | always | ||
| 6.2 | User and Group Settings | |||
| 6.2.1 | Ensure password fields are not empty | always | ||
| 6.2.2 | Ensure no legacy "+" entries exist in /etc/passwd | always | ||
| 6.2.3 | Ensure no legacy "+" entries exist in /etc/shadow | always | ||
| 6.2.4 | Ensure no legacy "+" entries exist in /etc/group | always | ||
| 6.2.5 | Ensure root is the only UID 0 account | always | ||
| 6.2.6 | Ensure root PATH Integrity | always | ||
| 6.2.7 | Ensure all users' home directories exist | always | ||
| 6.2.8 | Ensure users' home directories permissions are 750 or more restrictive | always | ||
| 6.2.9 | Ensure users own their home directories | always | ||
| 6.2.10 | Ensure users' dot files are not group or world writable | always | ||
| 6.2.11 | Ensure no users have .forward files | always | ||
| 6.2.12 | Ensure no users have .netrc files | always | ||
| 6.2.13 | Ensure users' .netrc Files are not group or world accessible | always | ||
| 6.2.14 | Ensure no users have .rhosts files | always | ||
| 6.2.15 | Ensure all groups in /etc/passwd exist in /etc/group | always | ||
| 6.2.16 | Ensure no duplicate UIDs exist | always | ||
| 6.2.17 | Ensure no duplicate GIDs exist | always | ||
| 6.2.18 | Ensure no duplicate user names exist | always | ||
| 6.2.19 | Ensure no duplicate group names exist | always | ||
| 6.2.20 | Ensure shadow group is empty | always | ||
...