Verify File Hashes with RPM
Verify and Correct File Permissions with RPM
Configure Periodic Execution of AIDE
Verify and Correct Ownership with RPM
Install the Host Intrusion Prevention System (HIPS) Module
Build and Test AIDE Database
Configure Notification of Post-AIDE Scan Details
Ensure gpgcheck Enabled In Main yum Configuration
Install Intrusion Detection Software
Ensure Red Hat GPG Key Installed
Install the Asset Configuration Compliance Module (ACCM)
Install the Policy Auditor (PA) Module
Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
Disable GDM Automatic Login
Disable All GNOME3 Thumbnailers
Require Encryption for Remote Access in GNOME3
Ensure the Logon Failure Delay is Set Correctly in login.defs
Limit the Number of Concurrent Login Sessions Allowed Per User
Ensure gpgcheck Enabled for Local Packages
Ensure that Root's Path Does Not Include World or Group-Writable Directories
Ensure that Root's Path Does Not Include Relative Paths or Null Directories
Ensure the Default Umask is Set Correctly in login.defs
Ensure gpgcheck Enabled for All yum Package Repositories
Ensure gpgcheck Enabled for Repository Metadata
Record Events that Modify the System's Mandatory Access Controls
Ensure auditd Collects Information on Exporting to Media (successful)
Record Events that Modify the System's Network Environment
Record Attempts to Alter Process and Session Initiation Information
Ensure auditd Collects System Administrator Actions
Record Events that Modify User/Group Information
Record Events that Modify the System's Discretionary Access Controls - chmod
Record Events that Modify the System's Discretionary Access Controls - chown
Record Events that Modify the System's Discretionary Access Controls - fchmod
Record Events that Modify the System's Discretionary Access Controls - fchmodat
Record Events that Modify the System's Discretionary Access Controls - fchown
Record Events that Modify the System's Discretionary Access Controls - fchownat
Record Events that Modify the System's Discretionary Access Controls - fremovexattr
Record Events that Modify the System's Discretionary Access Controls - fsetxattr
Record Events that Modify the System's Discretionary Access Controls - lchown
Record Events that Modify the System's Discretionary Access Controls - lremovexattr
Record Events that Modify the System's Discretionary Access Controls - lsetxattr
Record Events that Modify the System's Discretionary Access Controls - removexattr
Record Events that Modify the System's Discretionary Access Controls - setxattr
Ensure auditd Collects File Deletion Events by User
Ensure auditd Collects File Deletion Events by User - rename
Ensure auditd Collects File Deletion Events by User - renameat
Ensure auditd Collects File Deletion Events by User - rmdir
Ensure auditd Collects File Deletion Events by User - unlink
Ensure auditd Collects File Deletion Events by User - unlinkat
Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
Record Unsuccessful Access Attempts to Files - creat
Record Unsuccessful Access Attempts to Files - ftruncate
Record Unsuccessful Access Attempts to Files - open
Record Unsuccessful Access Attempts to Files - open_by_handle_at
Record Unsuccessful Access Attempts to Files - openat
Record Unsuccessful Access Attempts to Files - truncate
Ensure auditd Collects Information on Kernel Module Loading and Unloading
Ensure auditd Collects Information on Kernel Module Unloading - delete_module
Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
Ensure auditd Collects Information on Kernel Module Loading - init_module
Ensure auditd Collects Information on the Use of Privileged Commands
Record attempts to alter time through adjtimex
Record Attempts to Alter Time Through clock_settime
Record attempts to alter time through settimeofday
Record Attempts to Alter Time Through stime
Record Attempts to Alter the localtime File
Record Events that Modify User/Group Information - /etc/group
Record Events that Modify User/Group Information - /etc/gshadow
Record Events that Modify User/Group Information - /etc/security/opasswd
Record Events that Modify User/Group Information - /etc/passwd
Record Events that Modify User/Group Information - /etc/shadow
Verify ip6tables Enabled if Using IPv6
Set Default ip6tables Policy for Incoming Packets
Set Default iptables Policy for Incoming Packets
Set Default iptables Policy for Forwarded Packets
Disable IPv6 Networking Support Automatic Loading
Disable IPv6 Addressing on All IPv6 Interfaces
Disable IPv6 Addressing on IPv6 Interfaces by Default
Configure Accepting Router Advertisements on All IPv6 Interfaces
Disable Accepting ICMP Redirects for All IPv6 Interfaces
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
Disable Kernel Parameter for IPv6 Forwarding
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
Disable Accepting ICMP Redirects for All IPv4 Interfaces
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
Record Any Attempts to Run chcon
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
Record Any Attempts to Run restorecon
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
Record Any Attempts to Run semanage
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
Record Any Attempts to Run setsebool
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
Configure Kernel Parameter for Accepting Secure Redirects By Default
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
Deactivate Wireless Network Interfaces
Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
Record Unsuccessful Creation Attempts to Files - open O_CREAT
Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
Record Unsuccessful Creation Attempts to Files - openat O_CREAT
Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
Record Unsuccessful Delete Attempts to Files - rename
Record Unsuccessful Delete Attempts to Files - renameat
Add nodev Option to /dev/shm
Add nosuid Option to /dev/shm
Record Unsuccessful Delete Attempts to Files - unlink
Record Unsuccessful Delete Attempts to Files - unlinkat
Ensure SELinux State is Enforcing
Record Attempts to Alter Logon and Logout Events
Record Attempts to Alter Logon and Logout Events - faillock
Record Attempts to Alter Logon and Logout Events - lastlog
Record Attempts to Alter Logon and Logout Events - tallylog
Ensure auditd Collects Information on the Use of Privileged Commands - chage
Ensure auditd Collects Information on the Use of Privileged Commands - chsh
Ensure auditd Collects Information on the Use of Privileged Commands - crontab
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
Disable Avahi Server Software
Disable Automatic Bug Reporting Tool (abrtd)
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
Disable Apache Qpid (qpidd)
Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
Disable Network Router Discovery Daemon (rdisc)
Ensure auditd Collects Information on the Use of Privileged Commands - passwd
Ensure auditd Collects Information on the Use of Privileged Commands - postdrop
Ensure auditd Collects Information on the Use of Privileged Commands - postqueue
Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown
Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
Ensure auditd Collects Information on the Use of Privileged Commands - su
Ensure auditd Collects Information on the Use of Privileged Commands - sudo
Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit
Ensure auditd Collects Information on the Use of Privileged Commands - umount
Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
Ensure auditd Collects Information on the Use of Privileged Commands - userhelper
Uninstall the inet-based telnet server
Uninstall the ssl compliant telnet server
Uninstall the telnet server
Minimize Served Information
Configure auditd flush priority
Disable Host-Based Authentication
Disable Compression Or Set Compression to delayed
Disable SSH Access via Empty Passwords
Disable GSSAPI Authentication
Disable Kerberos Authentication
Disable SSH Support for .rhosts Files
Disable SSH Support for Rhosts RSA Authentication
Disable SSH Support for User Known Hosts
Do Not Allow SSH Environment Options
Enable Encrypted X11 Forwarding
Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
Disable Client Dynamic DNS Updates
Disable Zeroconf Networking
Ensure System is Not Acting as a Network Sniffer
Configure the Firewalld Ports
Set Default firewalld Zone for Incoming Packets
Verify Any Configured IPSec Tunnel Connections
Disable Support for RPC IPv6
Disable Bluetooth Service
Disable Bluetooth Kernel Module
Disable WiFi or Bluetooth in BIOS
Ensure All Files Are Owned by a User
Disable Mounting of cramfs
Disable Mounting of freevxfs
Disable Mounting of hfsplus
Disable Mounting of jffs2
Disable Mounting of squashfs
Disable Mounting of vFAT filesystems
Add noexec Option to /dev/shm
Add nosuid Option to /home
Add nodev Option to Non-Root Local Partitions
Add nodev Option to Removable Media Partitions
Add noexec Option to Removable Media Partitions
Add nosuid Option to Removable Media Partitions
Add noexec Option to /tmp
Add nosuid Option to /tmp
Bind Mount /var/tmp To /tmp
Enable NX or XD Support in the BIOS
Install PAE Kernel on Supported 32-bit x86 Systems
Ensure SELinux Not Disabled in the kernel arguments
Ensure SELinux Not Disabled in /etc/default/grub
Ensure No Device Files are Unlabeled by SELinux
Ensure No Daemons are Unconfined by SELinux
Check Avahi Responses' TTL Field
Serve Avahi Only via Required Protocol
Prevent Other Programs from Using Avahi's Port
Restrict Information Published by Avahi
Uninstall avahi-autoipd Server Package
Uninstall avahi Server Package
Install the psacct package
Enable IRQ Balance (irqbalance)
Enable Process Accounting (psacct)
Disable Advanced Configuration and Power Interface (acpid)
Disable Certmonger Service (certmonger)
Disable Control Group Config (cgconfig)
Disable Control Group Rules Engine (cgred)
Disable CPU Speed (cpupower)
Disable KDump Kernel Crash Analyzer (kdump)
Disable Software RAID Monitor (mdmonitor)
Disable D-Bus IPC Service (messagebus)
Disable Network Console (netconsole)
Disable ntpdate Service (ntpdate)
Disable Odd Job Daemon (oddjobd)
Disable Portreserve (portreserve)
Disable Quota Netlink (quota_nld)
Disable Red Hat Network Service (rhnsd)
Disable Red Hat Subscription Manager Daemon (rhsmcertd)
Disable Cyrus SASL Authentication Daemon (saslauthd)
Disable SMART Disk Monitoring Service (smartd)
Disable System Statistics Reset Service (sysstat)
Disable DHCP Client in ifcfg
Uninstall DHCP Server Package
Authenticate Zone Transfers
Restrict Access to Anonymous Users if Possible
Set Permissions on the /var/log/httpd/ Directory
Set Permissions on All Configuration Files Inside /etc/httpd/conf.d/
Set Permissions on All Configuration Files Inside /etc/httpd/conf/
Set Permissions on All Configuration Files Inside /etc/httpd/conf.modules.d/
Set httpd ServerSignature Directive to Off
Set httpd ServerTokens Directive to Prod
Enable the LDAP Client For Use in Authconfig
Configure LDAP Client to Use TLS For All Transactions
Configure Certificate Directives for LDAP Use of TLS
Uninstall openldap-servers Package
Uninstall Sendmail Package
Disable Postfix Network Listening
Mount Remote Filesystems with nodev
Install tcp_wrappers Package
Uninstall rsh-server Package
Uninstall telnet-server Package
Uninstall tftp-server Package
Ensure tftp Daemon Uses Secure Mode
Disable Printer Browsing Entirely if Possible
Disable Print Server Capabilities
Use Only FIPS 140-2 Validated Ciphers
Configure SSSD LDAP Backend to Use TLS For All Transactions
Ensure gpgcheck Enabled In Main dnf Configuration
Ensure gpgcheck Enabled for All dnf Package Repositories
Ensure Fedora GPG Key Installed
Ensure Oracle Linux GPG Key Installed
Ensure gpgcheck Enabled In Main zypper Configuration
Ensure gpgcheck Enabled for All zypper Package Repositories
Ensure SUSE GPG Key Installed
Ensure auditd Collects Information on the Use of Privileged Commands - unix2_chkpwd
Uninstall 389-ds-base Package
Configure Systemd Timer Execution of AIDE