Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Oracle Linux 7

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Configure auditd Disk Error Action on Disk Error

    The <code>auditd</code> service can be configured to take an action when there is a disk error. Edit the file <code>/etc/audit/auditd.conf</code>. ...
    Rule Medium Severity
    Show

  • Configure auditd Disk Error Action on Disk Error

    The <code>auditd</code> service can be configured to take an action when there is a disk error. Edit the file <code>/etc/audit/auditd.conf</code>. ...
    Rule Medium Severity
    Show

  • Configure auditd Disk Full Action when Disk Space Is Full

    The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...
    Rule Medium Severity
    Show

  • Configure auditd Disk Full Action when Disk Space Is Full

    The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...
    Rule Medium Severity
    Show

  • Configure auditd mail_acct Action on Low Disk Space

    The <code>auditd</code> service can be configured to send email to a designated account in certain situations. Add or correct the following line in...
    Rule Medium Severity
    Show

  • Configure auditd admin_space_left Action on Low Disk Space

    The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...
    Rule Medium Severity
    Show

  • Configure auditd flush priority

    The <code>auditd</code> service can be configured to synchronously write audit event data to disk. Add or correct the following line in <code>/etc/...
    Rule Medium Severity
    Show

  • Configure auditd Max Log File Size

    Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file <code>/etc/audit/auditd.conf</code>. Add...
    Rule Medium Severity
    Show

  • Configure auditd max_log_file_action Upon Reaching Maximum Log Size

    The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action ta...
    Rule Medium Severity
    Show

  • Configure auditd max_log_file_action Upon Reaching Maximum Log Size

    The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action ta...
    Rule Medium Severity
    Show

  • Configure auditd Number of Logs Retained

    Determine how many log files <code>auditd</code> should retain when it rotates logs. Edit the file <code>/etc/audit/auditd.conf</code>. Add or modi...
    Rule Medium Severity
    Show

  • Configure auditd space_left on Low Disk Space

    The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...
    Rule Medium Severity
    Show

  • Configure auditd space_left Action on Low Disk Space

    The <code>auditd</code> service can be configured to take an action when disk space <i>starts</i> to run low. Edit the file <code>/etc/audit/auditd...
    Rule Medium Severity
    Show

  • Configure auditd space_left on Low Disk Space

    The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...
    Rule Medium Severity
    Show

  • Set number of records to cause an explicit flush to audit logs

    To configure Audit daemon to issue an explicit flush to disk command after writing <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_aud...
    Rule Medium Severity
    Show

  • Include Local Events in Audit Logs

    To configure Audit daemon to include local events in Audit logs, set <code>local_events</code> to <code>yes</code> in <code>/etc/audit/auditd.conf<...
    Rule Medium Severity
    Show

  • Resolve information before writing to audit logs

    To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set <co...
    Rule Low Severity
    Show

  • Appropriate Action Must be Setup When the Internal Audit Event Queue is Full

    The audit system should have an action setup in the event the internal event queue becomes full. To setup an overflow action edit <code>/etc/audisp...
    Rule Medium Severity
    Show

  • Write Audit Logs to the Disk

    To configure Audit daemon to write Audit logs to the disk, set <code>write_logs</code> to <code>yes</code> in <code>/etc/audit/auditd.conf</code>. ...
    Rule Medium Severity
    Show

  • System Accounting with auditd

    The <code>auditd</code> program can perform comprehensive monitoring of system activity. This section makes use of recommended configuration settin...
    Group
    Show

  • Configure audit according to OSPP requirements

    Configure audit to meet requirements for Operating System Protection Profile (OSPP) v4.2.1. Audit defines groups of rules in <code>/usr/share/doc/...
    Rule Medium Severity
    Show

  • AppArmor

    Many security vulnerabilities result from bugs in trusted programs. A trusted program runs with privileges that attackers want to possess. The prog...
    Group
    Show

  • AppArmor profiles mode

    enforce - Set all AppArmor profiles to enforce mode
    complain - Set all AppArmor profiles to complain mode
    Value
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows ...
    Group
    Show

  • L1TF vulnerability mitigation

    Defines the L1TF vulneratility mitigations to employ.
    Value
    Show

  • MDS vulnerability mitigation

    Defines the MDS vulneratility mitigation to employ.
    Value
    Show

  • Confidence level on Hardware Random Number Generator

    Defines the level of trust on the hardware random number generators available in the system and the percentage of entropy to credit.
    Value
    Show

  • Spec Store Bypass Mitigation

    This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated.
    Value
    Show

  • Disable Recovery Booting

    Oracle Linux 7 systems support an "recovery boot" option that can be used to prevent services from being started. The <code>GRUB_DISABLE_RECOVERY</...
    Rule Medium Severity
    Show

  • IOMMU configuration directive

    On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some of the system critical u...
    Rule Unknown Severity
    Show

  • Configure L1 Terminal Fault mitigations

    L1 Terminal Fault (L1TF) is a hardware vulnerability which allows unprivileged speculative access to data which is available in the Level 1 Data Ca...
    Rule High Severity
    Show

  • Force kernel panic on uncorrected MCEs

    A Machine Check Exception is an error generated by the CPU itdetects an error in itself, memory or I/O devices. These errors may be corrected and g...
    Rule Medium Severity
    Show

  • Ensure SMAP is not disabled during boot

    The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into memory pages in the user space, it is enabled by default ...
    Rule Medium Severity
    Show

  • Ensure SMEP is not disabled during boot

    The SMEP is used to prevent the supervisor mode from executing user space code, it is enabled by default since Linux kernel 3.0. But it could be di...
    Rule Medium Severity
    Show

  • Configure the confidence in TPM for entropy

    The TPM security chip that is available in most modern systems has a hardware RNG. It is also used to feed the entropy pool, but generally not cred...
    Rule Low Severity
    Show

  • Disable merging of slabs with similar size

    The kernel may merge similar slabs together to reduce overhead and increase cache hotness of objects. Disabling merging of slabs keeps the slabs se...
    Rule Medium Severity
    Show

  • Configure Speculative Store Bypass Mitigation

    Certain CPUs are vulnerable to an exploit against a common wide industry wide performance optimization known as Speculative Store Bypass (SSB). In...
    Rule Medium Severity
    Show

  • Enforce Spectre v2 mitigation

    Spectre V2 is an indirect branch poisoning attack that can lead to data leakage. An exploit for Spectre V2 tricks the indirect branch predictor int...
    Rule High Severity
    Show

  • Ensure debug-shell service is not enabled during boot

    systemd's <code>debug-shell</code> service is intended to diagnose systemd related boot issues with various <code>systemctl</code> commands. Once e...
    Rule Medium Severity
    Show

  • Disable vsyscalls

    To disable use of virtual syscalls, add the argument <code>vsyscall=none</code> to the default GRUB 2 command line for the Linux operating system. ...
    Rule Medium Severity
    Show

  • Non-UEFI GRUB2 bootloader configuration

    Non-UEFI GRUB2 bootloader configuration
    Group
    Show

  • Verify /boot/grub2/grub.cfg Group Ownership

    The file <code>/boot/grub2/grub.cfg</code> should be group-owned by the <code>root</code> group to prevent destruction or modification of the file....
    Rule Medium Severity
    Show

  • Verify /boot/grub2/grub.cfg User Ownership

    The file <code>/boot/grub2/grub.cfg</code> should be owned by the <code>root</code> user to prevent destruction or modification of the file. To pr...
    Rule Medium Severity
    Show

  • Verify /boot/grub2/user.cfg User Ownership

    The file <code>/boot/grub2/user.cfg</code> should be owned by the <code>root</code> user to prevent reading or modification of the file. To proper...
    Rule Medium Severity
    Show

  • Verify /boot/grub2/grub.cfg Permissions

    File permissions for <code>/boot/grub2/grub.cfg</code> should be set to 600. To properly set the permissions of <code>/boot/grub2/grub.cfg</code>,...
    Rule Medium Severity
    Show

  • Verify /boot/grub2/user.cfg Permissions

    File permissions for <code>/boot/grub2/user.cfg</code> should be set to 600. To properly set the permissions of <code>/boot/grub2/user.cfg</code>,...
    Rule Medium Severity
    Show

  • Set the Boot Loader Admin Username to a Non-Default Value

    The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br><br> To maximize the prote...
    Rule High Severity
    Show

  • Boot Loader Is Not Installed On Removeable Media

    The system must not allow removable media to be used as the boot loader. Remove alternate methods of booting the system from removable media. <code...
    Rule Medium Severity
    Show

  • Set Boot Loader Password in grub2

    The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br><br> Since plaintext passw...
    Rule High Severity
    Show

  • Set Boot Loader Password in grub2 - systems prior to version 7.2

    The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br><br> Since plaintext passw...
    Rule High Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules