Skip to content
Log In

Guide to the Secure Configuration of Fedora

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Configure GNOME Login Screen

    In the default GNOME desktop, the login is displayed after system boot and can display user accounts, allow users to reboot the system, and allow users to login automatically and/or with a guest ac...
    Group
    Show

  • Sudo - logfile value

    Specify the sudo logfile to use. The default value used here matches the example location from CIS, which uses /var/log/sudo.log.
    Value
    Show

  • Disable the GNOME3 Login User List

    In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting <code>di...
    Rule Medium Severity
    Show

  • Enable the GNOME3 Login Smartcard Authentication

    In the default graphical environment, smart card authentication can be enabled on the login screen by setting <code>enable-smartcard-authentication</code> to <code>true</code>. <br> <br> T...
    Rule Medium Severity
    Show

  • Enable the GNOME3 Screen Locking On Smartcard Removal

    In the default graphical environment, screen locking on smartcard removal can be enabled by setting <code>removal-action</code> to <code>'lock-screen'</code>. <br> <br> To enable, add or e...
    Rule Medium Severity
    Show

  • Set the GNOME3 Login Number of Failures

    In the default graphical environment, the GNOME3 login screen and be configured to restart the authentication process after a configured number of attempts. This can be configured by setting <code>...
    Rule Medium Severity
    Show

  • Disable GDM Automatic Login

    The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials. User should always be required to authenticate themselves to the system that they are...
    Rule High Severity
    Show

  • Disable GDM Guest Login

    The GNOME Display Manager (GDM) can allow users to login without credentials which can be useful for public kiosk scenarios. Allowing users to login without credentials or "guest" account access ha...
    Rule High Severity
    Show

  • GNOME Media Settings

    GNOME media settings that apply to the graphical interface.
    Group
    Show

  • Disable GNOME3 Automounting

    The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount wi...
    Rule Medium Severity
    Show

  • Disable GNOME3 Automount Opening

    The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount-op...
    Rule Medium Severity
    Show

  • Disable GNOME3 Automount running

    The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable autorun-neve...
    Rule Low Severity
    Show

  • Disable All GNOME3 Thumbnailers

    The system's default desktop environment, GNOME3, uses a number of different thumbnailer programs to generate thumbnails for any new or modified content in an opened folder. To disable the executio...
    Rule Unknown Severity
    Show

  • GNOME Network Settings

    GNOME network settings that apply to the graphical interface.
    Group
    Show

  • Disable WIFI Network Connection Creation in GNOME3

    <code>GNOME</code> allows users to create ad-hoc wireless connections through the <code>NetworkManager</code> applet. Wireless connections should be disabled by adding or setting <code>disable-wifi...
    Rule Medium Severity
    Show

  • Disable WIFI Network Notification in GNOME3

    By default, <code>GNOME</code> disables WIFI notification. This should be permanently set so that users do not connect to a wireless network when the system finds one. While useful for mobile devic...
    Rule Medium Severity
    Show

  • GNOME Remote Access Settings

    GNOME remote access settings that apply to the graphical interface.
    Group
    Show

  • Require Credential Prompting for Remote Access in GNOME3

    By default, <code>GNOME</code> does not require credentials when using <code>Vino</code> for remote access. To configure the system to require remote credentials, add or set <code>authentication-me...
    Rule Medium Severity
    Show

  • Require Encryption for Remote Access in GNOME3

    By default, <code>GNOME</code> requires encryption when using <code>Vino</code> for remote access. To prevent remote access encryption from being disabled, add or set <code>require-encryption</code...
    Rule Medium Severity
    Show

  • Screensaver Inactivity timeout

    Choose allowed duration (in seconds) of inactive graphical sessions
    Value
    Show

  • Screensaver Lock Delay

    Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt
    Value
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Idle Activation

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <pre>/org/gnome/desktop/screensaver/idle-activation-enabled</pre> to <code>/etc/dconf/db/local....
    Rule Medium Severity
    Show

  • Uninstall gssproxy Package

    The gssproxy package can be removed with the following command: 
    $ sudo dnf remove gssproxy
    Rule Medium Severity
    Show

  • Set GNOME3 Screensaver Lock Delay After Activation Period

    To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set <code>lock-delay</code> to <code>uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproje...
    Rule Medium Severity
    Show

  • Enable GNOME3 Screensaver Lock After Idle Period

    To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set <code>lock-enabled</code> to <code>true</code> in <code>/etc/dconf/db/local.d/00-security-settings</co...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <pre>/org/gnome/desktop/screensaver/lock-enabled</pre> to <code>/etc/dconf/db/local.d/locks/00-...
    Rule Medium Severity
    Show

  • Implement Blank Screensaver

    To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set <code>picture-uri</code> to <code>string ''</code> in <code>/etc/dconf/db/local.d/00-security-settings</code>. For...
    Rule Medium Severity
    Show

  • Disable Full User Name on Splash Shield

    By default when the screen is locked, the splash shield will show the user's full name. This should be disabled to prevent casual observers from seeing who has access to the system. This can be dis...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Settings

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <code>/org/gnome/desktop/screensaver/lock-delay</code> to <code>/etc/dconf/db/local.d/locks/00-...
    Rule Medium Severity
    Show

  • Sudo - timestamp_timeout value

    Defines the number of minutes that can elapse before <code>sudo</code> will ask for a passwd again. If set to a value less than 0 the user's time stamp will never expire. Defining 0 means always pr...
    Value
    Show

  • Ensure Users Cannot Change GNOME3 Session Idle Settings

    If not already configured, ensure that users cannot change GNOME3 session idle settings by adding <code>/org/gnome/desktop/session/idle-delay</code> to <code>/etc/dconf/db/local.d/locks/00-security...
    Rule Medium Severity
    Show

  • GNOME System Settings

    GNOME provides configuration and functionality to a graphical desktop environment that changes grahical configurations or allow a user to perform actions that users normally would not be able to do...
    Group
    Show

  • Disable Geolocation in GNOME3

    <code>GNOME</code> allows the clock and applications to track and access location information. This setting should be disabled as applications should not track system location. To configure the sys...
    Rule Medium Severity
    Show

  • Disable Power Settings in GNOME3

    By default, <code>GNOME</code> enables a power profile designed for mobile devices with battery usage. While useful for mobile devices, this setting should be disabled for all other systems. To con...
    Rule Medium Severity
    Show

  • Disable User Administration in GNOME3

    By default, <code>GNOME</code> will allow all users to have some administratrion capability. This should be disabled so that non-administrative users are not making configuration changes. To config...
    Rule High Severity
    Show

  • Sudo

    <code>Sudo</code>, which stands for "su 'do'", provides the ability to delegate authority to certain users, groups of users, or system administrators. When configured for system users and/or groups...
    Group
    Show

  • Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC

    The sudo <code>NOEXEC</code> tag, when specified, prevents user executed commands from executing other commands, like a shell for example. This should be enabled by making sure that the <code>NOEXE...
    Rule High Severity
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty

    The sudo <code>requiretty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the <code>requiretty</code> tag ...
    Rule Medium Severity
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

    The sudo <code>use_pty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the <code>use_pty</code> tag exists...
    Rule Medium Severity
    Show

  • Ensure Sudo Logfile Exists - sudo logfile

    A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.
    Rule Low Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the <code>NOPASSWD</code...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo

    The sudo <code>NOPASSWD</code> and <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making ...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is 5 minutes. The timestamp_timeout should be config...
    Rule Medium Severity
    Show

  • Only the VDSM User Can Use sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <code>vdsm</code> user should have this capability in any s...
    Rule Medium Severity
    Show

  • Install libcap-ng-utils Package

    The libcap-ng-utils package can be installed with the following command: 
    $ sudo dnf install libcap-ng-utils
    Rule Medium Severity
    Show

  • Ensure sudo only includes the default configuration directory

    Administrators can configure authorized <code>sudo</code> users via drop-in files, and it is possible to include other directories and configuration files from the file currently being parsed. Mak...
    Rule Medium Severity
    Show

  • Don't define allowed commands in sudoers by means of exclusion

    Policies applied by sudo through the sudoers file should not involve negation. Each user specification in the <code>sudoers</code> file contains a comma-delimited list of command specifications. T...
    Rule Medium Severity
    Show

  • Don't target root user in the sudoers file

    The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to explicitly list the runas spec (i.e. the list of targe...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Install binutils Package

    The binutils package can be installed with the following command: 
    $ sudo dnf install binutils
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules