CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000095-GPOS-00049
Group -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must be configured to disable Bluetooth.
This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with AlmaLinux OS 9 systems. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keybo...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must disable the Controller Area Network (CAN) kernel module.
The CAN protocol is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other's applications without a host computer. Disabling CAN protects the ...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must disable mounting of cramfs.
Removing support for unneeded filesystem types reduces the local attack surface of the server. Compressed ROM/RAM file system (or cramfs) is a read-only file system designed for simplicity and spa...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
The SCTP is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. Disabling SCTP protects the system ...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must disable mounting of squashfs.
Removing support for unneeded filesystem types reduces the local attack surface of the server. A squashfs compressed filesystem image can be mounted without first decompressing the image. Note th...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must disable mounting of udf.
Removing support for unneeded filesystem types reduces the local attack surface of the server. The UDF filesystem is used to write DVDs and so could assist in data exfiltration, the so-called "sne...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
Cameras must be disabled or covered when not in use.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must not have the nfs-utils package installed.
"nfs-utils" provides a daemon for the kernel Network File System (NFS) server and related tools. This package also contains the "showmount" program. "showmount" queries the mount daemon on a remote...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
AlmaLinux OS 9 must not have the rsh package installed.
The "rsh" package provides a client for several obsolete and insecure network services. Removing it decreases the risk of accidental (or intentional) use of those services.Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.