Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 10

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure tmp.mount Unit Is Enabled

    The <code>/tmp</code> directory is a world-writable directory used for temporary file storage. This directory is managed by <code>systemd-tmpfiles<...
    Rule Low Severity
    Show

  • GNOME Desktop Environment

    GNOME is a graphical desktop environment bundled with many Linux distributions that allow users to easily interact with the operating system graphi...
    Group
    Show

  • Remove the GDM Package Group

    By removing the <code>gdm</code> package, the system no longer has GNOME installed installed. If X Windows is not installed then the system canno...
    Rule Medium Severity
    Show

  • Make sure that the dconf databases are up-to-date with regards to respective keyfiles

    By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by ...
    Rule High Severity
    Show

  • The operating system must restrict privilege elevation to authorized personnel

    The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms yo...
    Rule Medium Severity
    Show

  • Verify Group Who Owns /etc/sudoers File

    To properly set the group owner of /etc/sudoers, run the command: 
    $ sudo chgrp root /etc/sudoers
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/sudoers File

    To properly set the owner of /etc/sudoers, run the command: 
    $ sudo chown root /etc/sudoers
    Rule Medium Severity
    Show

  • Verify Permissions On /etc/sudoers File

    To properly set the permissions of /etc/sudoers, run the command: 
    $ sudo chmod 0440 /etc/sudoers
    Rule Medium Severity
    Show

  • Ensure That the sudo Binary Has the Correct Permissions

    To properly set the permissions of /usr/bin/sudo, run the command: 
    $ sudo chmod 4111 /usr/bin/sudo
    Rule Medium Severity
    Show

  • Ensure sudo Runs In A Minimal Environment - sudo env_reset

    The sudo <code>env_reset</code> tag, when specified, will run the command in a minimal environment, containing the TERM, PATH, HOME, MAIL, SHELL, L...
    Rule Medium Severity
    Show

  • Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot

    The sudo <code>ignore_dot</code> tag, when specified, will ignore the current directory in the PATH environment variable. On Red Hat Enterprise Lin...
    Rule Medium Severity
    Show

  • Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC

    The sudo <code>NOEXEC</code> tag, when specified, prevents user executed commands from executing other commands, like a shell for example. This sho...
    Rule High Severity
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty

    The sudo <code>requiretty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by...
    Rule Medium Severity
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

    The sudo <code>use_pty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by ma...
    Rule Medium Severity
    Show

  • Ensure Sudo Logfile Exists - sudo logfile

    A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CI...
    Rule Low Severity
    Show

  • Ensure a dedicated group owns sudo

    Restrict the execution of privilege escalated commands to a dedicated group of users. Ensure the group owner of /usr/bin/sudo is <xccdf-1.2:sub xml...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

    The sudo <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having to authenticate. This shoul...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be dis...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo

    The sudo <code>NOPASSWD</code> and <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having t...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is...
    Rule Medium Severity
    Show

  • Configure dnf-automatic to Install Only Security Updates

    To configure <code>dnf-automatic</code> to install only security updates automatically, set <code>upgrade_type</code> to <code>security</code> unde...
    Rule Low Severity
    Show

  • Verify Permissions on Backup group File

    To properly set the permissions of /etc/group-, run the command: 
    $ sudo chmod 0644 /etc/group-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup gshadow File

    To properly set the permissions of /etc/gshadow-, run the command: 
    $ sudo chmod 0000 /etc/gshadow-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup passwd File

    To properly set the permissions of /etc/passwd-, run the command: 
    $ sudo chmod 0644 /etc/passwd-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup shadow File

    To properly set the permissions of /etc/shadow-, run the command: 
    $ sudo chmod 0000 /etc/shadow-
    Rule Medium Severity
    Show

  • Verify Permissions on group File

    To properly set the permissions of /etc/group, run the command: 
    $ sudo chmod 0644 /etc/group
    Rule Medium Severity
    Show

  • Verify Permissions on gshadow File

    To properly set the permissions of /etc/gshadow, run the command: 
    $ sudo chmod 0000 /etc/gshadow
    Rule Medium Severity
    Show

  • Verify Permissions on passwd File

    To properly set the permissions of /etc/passwd, run the command: 
    $ sudo chmod 0644 /etc/passwd
    Rule Medium Severity
    Show

  • Verify Permissions on shadow File

    To properly set the permissions of /etc/shadow, run the command: 
    $ sudo chmod 0000 /etc/shadow
    Rule Medium Severity
    Show

  • Verify Permissions on /etc/shells File

    To properly set the permissions of /etc/shells, run the command: 
    $ sudo chmod 0644 /etc/shells
    Rule Medium Severity
    Show

  • Verify Permissions on Files within /var/log Directory

    The /var/log directory contains files with logs of error messages in the system and should only be accessed by authorized personnel.
    Group
    Show

  • Verify Group Who Owns /var/log Directory

    To properly set the group owner of /var/log, run the command: 
    $ sudo chgrp root /var/log
    Rule Medium Severity
    Show

  • Verify Group Who Owns /var/log/messages File

    To properly set the group owner of /var/log/messages, run the command: 
    $ sudo chgrp root /var/log/messages
    Rule Medium Severity
    Show

  • Verify User Who Owns /var/log Directory

    To properly set the owner of /var/log, run the command: 
    $ sudo chown root /var/log
    Rule Medium Severity
    Show

  • Verify User Who Owns /var/log/messages File

    To properly set the owner of /var/log/messages, run the command: 
    $ sudo chown root /var/log/messages
    Rule Medium Severity
    Show

  • Verify Permissions on /var/log Directory

    To properly set the permissions of /var/log, run the command: 
    $ sudo chmod 0755 /var/log
    Rule Medium Severity
    Show

  • Verify Permissions on /var/log/messages File

    To properly set the permissions of /var/log/messages, run the command: 
    $ sudo chmod 0640 /var/log/messages
    Rule Medium Severity
    Show

  • Verify File Permissions Within Some Important Directories

    Some directories contain files whose confidentiality or integrity is notably important and may also be susceptible to misconfiguration over time, p...
    Group
    Show

  • Verify that Shared Library Directories Have Root Group Ownership

    System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by ...
    Rule Medium Severity
    Show

  • Verify that Shared Library Directories Have Root Ownership

    System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by ...
    Rule Medium Severity
    Show

  • Verify that Shared Library Directories Have Restrictive Permissions

    System-wide shared library directories, which contain are linked to executables during process load time or run time, are stored in the following d...
    Rule Medium Severity
    Show

  • Verify Group Who Owns /etc/sysctl.d Directory

    To properly set the group owner of /etc/sysctl.d, run the command: 
    $ sudo chgrp root /etc/sysctl.d
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/sysctl.d Directory

    To properly set the owner of /etc/sysctl.d, run the command: 
    $ sudo chown root /etc/sysctl.d
    Rule Medium Severity
    Show

  • Verify Permissions On /etc/sysctl.d Directory

    To properly set the permissions of /etc/sysctl.d, run the command: 
    $ sudo chmod 0755 /etc/sysctl.d
    Rule Medium Severity
    Show

  • Verify that audit tools are owned by group root

    The Red Hat Enterprise Linux 10 operating system audit tools must have the proper ownership configured to protected against unauthorized access. V...
    Rule Medium Severity
    Show

  • Ensure the Default C Shell Umask is Set Correctly

    To ensure the default umask for users of the C shell is set properly, add or correct the <code>umask</code> setting in <code>/etc/csh.cshrc</code> ...
    Rule Medium Severity
    Show

  • Ensure the Default Umask is Set Correctly in login.defs

    To ensure the default umask controlled by <code>/etc/login.defs</code> is set properly, add or correct the <code>UMASK</code> setting in <code>/etc...
    Rule Medium Severity
    Show

  • Ensure the Default Umask is Set Correctly in /etc/profile

    To ensure the default umask controlled by <code>/etc/profile</code> is set properly, add or correct the <code>umask</code> setting in <code>/etc/pr...
    Rule Medium Severity
    Show

  • Ensure the Default Umask is Set Correctly For Interactive Users

    Remove the UMASK environment variable from all interactive users initialization files.
    Rule Medium Severity
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows ...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules