Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Oracle Linux 7

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Disable Automatic Bug Reporting Tool (abrtd)

    The Automatic Bug Reporting Tool (<code>abrtd</code>) daemon collects and reports crash data when an application crash is detected. Using a variety...
    Rule Medium Severity
    Show

  • Disable KDump Kernel Crash Analyzer (kdump)

    The <code>kdump</code> service provides a kernel crash dump analyzer. It uses the <code>kexec</code> system call to boot a secondary kernel ("captu...
    Rule Medium Severity
    Show

  • Disable ntpdate Service (ntpdate)

    The <code>ntpdate</code> service sets the local hardware clock by polling NTP servers when the system boots. It synchronizes to the NTP servers lis...
    Rule Low Severity
    Show

  • Disable Odd Job Daemon (oddjobd)

    The <code>oddjobd</code> service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks...
    Rule Medium Severity
    Show

  • Disable Apache Qpid (qpidd)

    The <code>qpidd</code> service provides high speed, secure, guaranteed delivery services. It is an implementation of the Advanced Message Queuing ...
    Rule Low Severity
    Show

  • Disable Network Router Discovery Daemon (rdisc)

    The <code>rdisc</code> service implements the client side of the ICMP Internet Router Discovery Protocol (IRDP), which allows discovery of routers ...
    Rule Medium Severity
    Show

  • Cron and At Daemons

    The cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform n...
    Group
    Show

  • Install the cron service

    The Cron service should be installed.
    Rule Medium Severity
    Show

  • Enable cron Service

    The <code>crond</code> service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary mainte...
    Rule Medium Severity
    Show

  • Enable cron Service

    The <code>crond</code> service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary mainte...
    Rule Medium Severity
    Show

  • Disable At Service (atd)

    The <code>at</code> and <code>batch</code> commands can be used to schedule tasks that are meant to be executed only once. This allows delayed exec...
    Rule Medium Severity
    Show

  • SSH LoginGraceTime setting

    Configure parameters for how long the servers stays connected before the user has successfully logged in
    Value
    Show

  • Restrict at and cron to Authorized Users if Necessary

    The <code>/etc/cron.allow</code> and <code>/etc/at.allow</code> files contain lists of users who are allowed to use <code>cron</code> and at to del...
    Group
    Show

  • Verify Group Who Owns /etc/cron.allow file

    If <code>/etc/cron.allow</code> exists, it must be group-owned by <code>root</code>. To properly set the group owner of <code>/etc/cron.allow</cod...
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/cron.allow file

    If <code>/etc/cron.allow</code> exists, it must be owned by <code>root</code>. To properly set the owner of <code>/etc/cron.allow</code>, run the ...
    Rule Medium Severity
    Show

  • Deprecated services

    Some deprecated software services impact the overall system security due to their behavior (leak of confidentiality in network exchange, usage as u...
    Group
    Show

  • Uninstall the inet-based telnet server

    The inet-based telnet daemon should be uninstalled.
    Rule High Severity
    Show

  • Uninstall the nis package

    The support for Yellowpages should not be installed unless it is required.
    Rule Low Severity
    Show

  • Uninstall the ntpdate package

    ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
    Rule Low Severity
    Show

  • Uninstall the ssl compliant telnet server

    The telnet daemon, even with ssl support, should be uninstalled.
    Rule High Severity
    Show

  • Uninstall the telnet server

    The telnet daemon should be uninstalled.
    Rule High Severity
    Show

  • DHCP

    The Dynamic Host Configuration Protocol (DHCP) allows systems to request and obtain an IP address and other configuration parameters from a server....
    Group
    Show

  • Configure DHCP Client if Necessary

    If DHCP must be used, then certain configuration changes can minimize the amount of information it receives and applies from the network, and thus ...
    Group
    Show

  • Minimize the DHCP-Configured Options

    Create the file <code>/etc/dhcp/dhclient.conf</code>, and add an appropriate setting for each of the ten configuration settings which can be obtain...
    Rule Unknown Severity
    Show

  • Configure DHCP Server

    If the system must act as a DHCP server, the configuration information it serves should be minimized. Also, support for other protocols and DNS-upd...
    Group
    Show

  • Minimize Served Information

    Edit /etc/dhcp/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there i...
    Rule Unknown Severity
    Show

  • Disable DHCP Client

    DHCP is the default network configuration method provided by the system installer, and common on many networks. Nevertheless, manual management of ...
    Group
    Show

  • Disable DHCP Server

    The DHCP server <code>dhcpd</code> is not installed or activated by default. If the software was installed and activated, but the system does not n...
    Group
    Show

  • Uninstall DHCP Server Package

    If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The <code>dhcp</code> package can be removed with the fo...
    Rule Medium Severity
    Show

  • DNS Server

    Most organizations have an operational need to run at least one nameserver. However, there are many common attacks involving DNS server software, a...
    Group
    Show

  • Disable DNS Server

    DNS software should be disabled on any systems which does not need to be a nameserver. Note that the BIND DNS server software is not installed on O...
    Group
    Show

  • Uninstall bind Package

    The <code>named</code> service is provided by the <code>bind</code> package. The <code>bind</code> package can be removed with the following comman...
    Rule Low Severity
    Show

  • Isolate DNS from Other Services

    This section discusses mechanisms for preventing the DNS server from interfering with other services. This is done both to protect the remainder of...
    Group
    Show

  • Run DNS Software in a chroot Jail

    Install the <code>bind-chroot</code> package: <pre>$ sudo yum install bind-chroot</pre> Place a valid named.conf file inside the chroot jail: <pre>...
    Group
    Show

  • Run DNS Software on Dedicated Servers

    Since DNS is a high-risk service which must frequently be made available to the entire Internet, it is strongly recommended that no other services ...
    Group
    Show

  • Use Views to Partition External and Internal Information

    If it is not possible to run external and internal nameservers on separate physical systems, run BIND9 and simulate this feature using views. Edit ...
    Group
    Show

  • Run Separate DNS Servers for External and Internal Queries

    Is it possible to run external and internal nameservers on separate systems? If so, follow the configuration guidance in this section. On the exter...
    Group
    Show

  • Docker Service

    The docker service is necessary to create containers, which are self-sufficient and self-contained applications using the resource isolation fe...
    Group
    Show

  • Application Whitelisting Daemon

    Fapolicyd (File Access Policy Daemon) implements application whitelisting to decide file access rights. Applications that are known via a reputatio...
    Group
    Show

  • fapolicyd Must be Configured to Limit Access to Users Home Folders

    fapolicyd needs be configured so that users cannot give access to their home folders to other users.
    Rule Medium Severity
    Show

  • FTP Server

    FTP is a common method for allowing remote access to files. Like telnet, the FTP protocol is unencrypted, which means that passwords and other data...
    Group
    Show

  • Disable vsftpd if Possible

    To minimize attack surface, disable vsftpd if at all possible.
    Group
    Show

  • Uninstall vsftpd Package

    The vsftpd package can be removed with the following command: 
     $ sudo yum erase vsftpd
    Rule High Severity
    Show

  • Configure vsftpd to Provide FTP Service if Necessary

    The primary vsftpd configuration file is /etc/vsftpd.conf, if that file exists, or /etc/vsftpd/vsftpd.conf if it does not.
    Group
    Show

  • Configure Firewalls to Protect the FTP Server

    By default, <code>iptables</code> blocks access to the ports used by the web server. To configure <code>iptables</code> to allow port 21 traffic,...
    Rule Unknown Severity
    Show

  • Restrict the Set of Users Allowed to Access FTP

    This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to do this entirely due to legacy applic...
    Group
    Show

  • Disable Squid

    The squid service can be disabled with the following command: 
    $ sudo systemctl mask --now squid.service
    Rule Unknown Severity
    Show

  • Limit Users Allowed FTP Access if Necessary

    If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this...
    Rule Unknown Severity
    Show

  • Use vsftpd to Provide FTP Service if Necessary

    If your use-case requires FTP service, install and set-up vsftpd to provide it.
    Group
    Show

  • Web Server

    The web server is responsible for providing access to content via the HTTP protocol. Web servers represent a significant security risk because: <br...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules