SUSE Linux Enterprise Server 15 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000480-GPOS-00227
Group -
A separate file system must be used for SUSE operating system user home directories (such as /home or an equivalent).
The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.Rule Low Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system must use a separate file system for /var.
The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.Rule Low Severity -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication.
Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system SSH daemon public host key files must have mode 0644 or less permissive.
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system SSH daemon private host key files must have mode 0640 or less permissive.
If an unauthorized user obtains the private SSH host key file, the host could be impersonated.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system SSH daemon must perform strict mode checking of home directory configuration files.
If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system SSH daemon must disable forwarded remote X connections for interactive users, unless to fulfill documented and validated mission requirements.
The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack when the SSH client requests forwarding. A system administrator may have a stance in which...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system must not allow interfaces to accept Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages by default.
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An ill...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system must not allow interfaces to send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default.
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly r...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly r...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00228
Group -
The SUSE operating system default permissions must be defined in such a way that all authenticated users can only read and modify their own files.
Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.Rule Medium Severity -
SRG-OS-000480-GPOS-00229
Group -
The SUSE operating system must not allow unattended or automatic logon via the graphical user interface (GUI).
Failure to restrict system access to authenticated users negatively impacts SUSE operating system security.Rule High Severity -
SRG-OS-000480-GPOS-00229
Group -
The SUSE operating system must not allow unattended or automatic logon via SSH.
Failure to restrict system access via SSH to authenticated users negatively impacts SUSE operating system security.Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
The SUSE operating system must enforce passwords that contain at least one lowercase character.
Use of a complex password helps increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting a...Rule Medium Severity -
SRG-OS-000071-GPOS-00039
Group -
The SUSE operating system must enforce passwords that contain at least one numeric character.
Use of a complex password helps increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting a...Rule Medium Severity -
SRG-OS-000072-GPOS-00040
Group -
The SUSE operating system must require the change of at least eight of the total number of characters when passwords are changed.
If the SUSE operating system allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for at...Rule Medium Severity -
SRG-OS-000073-GPOS-00041
Group -
The SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to only store encrypted representations of passwords.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily c...Rule Medium Severity -
SRG-OS-000073-GPOS-00041
Group -
SRG-OS-000073-GPOS-00041
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.