Red Hat Enterprise Linux 8 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for RHEL 8 operational support.
If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only au...Rule High Severity -
RHEL 8 must prevent IPv6 Internet Control Message Protocol (ICMP) redirect messages from being accepted.
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An ill...Rule Medium Severity -
RHEL 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
Responding to broadcast ICMP echoes facilitates network mapping and provides a vector for amplification attacks. There are notable differences between Internet Protocol version 4 (IPv4) and Intern...Rule Medium Severity -
RHEL 8 must not accept router advertisements on all IPv6 interfaces.
Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unn...Rule Medium Severity -
RHEL 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly r...Rule Medium Severity -
RHEL 8 must disable access to network bpf syscall from unprivileged processes.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
RHEL 8 must use reverse path filtering on all IPv4 interfaces.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
RHEL 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements.
The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack when the SSH client requests forwarding. A system administrator may have a stance in whic...Rule Medium Severity -
The iprutils package must not be installed unless mission essential on RHEL 8.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
RHEL 8 must use the invoking user's password for privilege escalation when using "sudo".
The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, ...Rule Medium Severity -
RHEL 8 must require re-authentication when using the "sudo" command.
Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability,...Rule Medium Severity -
The RHEL 8 pam_unix.so module must be configured in the system-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be ...Rule Medium Severity -
RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or con...Rule Medium Severity -
RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service.
The most important characteristic of a random number generator is its randomness, namely its ability to deliver random numbers that are impossible to predict. Entropy in computer security is assoc...Rule Low Severity -
RHEL 8 must use a separate file system for /var/tmp.
The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.Rule Medium Severity -
RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking...Rule Medium Severity -
RHEL 8 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking...Rule Medium Severity -
RHEL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporar...Rule Medium Severity -
RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporar...Rule Medium Severity -
A firewall must be active on RHEL 8.
"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to netwo...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.