CCI-000225

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.

29 rules found Severity: Medium

24 rules found Severity: Medium

18 rules found Severity: Medium

4 rules found Severity: Medium

28 rules found Severity: Medium

4 rules found Severity: Medium

28 rules found Severity: Medium

27 rules found Severity: Medium

7 rules found Severity: Medium

3 rules found Severity: Medium

1 rule found Severity: Medium

2 rules found Severity: Medium

2 rules found Severity: High

2 rules found Severity: Medium

CCI-000225

Ensure that User Home Directories are not Group-Writable or World-Readable

Verify /boot/grub2/grub.cfg Permissions

Verify the UEFI Boot Loader grub.cfg Group Ownership

Verify the UEFI Boot Loader grub.cfg User Ownership

Verify the UEFI Boot Loader grub.cfg Permissions

Verify /boot/grub2/grub.cfg Group Ownership

Verify /boot/grub2/user.cfg Group Ownership

Verify /boot/grub2/grub.cfg User Ownership

Verify /boot/grub2/user.cfg User Ownership

Verify /boot/grub2/user.cfg Permissions

Verify /boot/efi/EFI/redhat/user.cfg Group Ownership

Verify /boot/efi/EFI/redhat/user.cfg User Ownership

Verify /boot/efi/EFI/redhat/user.cfg Permissions

Verify /boot/grub/grub.cfg Permissions

Access to the Hardware Management Console (HMC) must be restricted by assigning users proper roles and responsibilities.

Verify /boot/grub/grub.cfg Group Ownership

Verify /boot/grub/user.cfg Group Ownership

Verify /boot/grub/grub.cfg User Ownership

Verify /boot/grub/user.cfg User Ownership

Verify /boot/grub/user.cfg Permissions

Verify /boot/efi/EFI/sles/user.cfg Group Ownership

Verify /boot/efi/EFI/sles/user.cfg User Ownership

Verify /boot/efi/EFI/sles/user.cfg Permissions

The CA-ACF2 LOGONID with the REFRESH attribute must have procedures for utilization.

All .Xauthority files must have mode 0600 or less permissive.

The .Xauthority files must not have extended ACLs.

X displays must not be exported to the world.

The .Xauthority utility must only permit access to authorized hosts.