Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Oracle Linux 7

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Uninstall squid Package

    The squid package can be removed with the following command: 
     $ sudo yum erase squid
    Rule Unknown Severity
    Show

  • Install the OpenSSH Server Package

    The <code>openssh-server</code> package should be installed. The <code>openssh-server</code> package can be installed with the following command: <...
    Rule Medium Severity
    Show

  • Remove the FreeRadius Server Package

    The <code>freeradius</code> package should be removed if not in use. Is this system a RADIUS server? If not, remove the package. The <code>freeradi...
    Rule Low Severity
    Show

  • Hardware RNG Entropy Gatherer Daemon

    The rngd feeds random data from hardware device to kernel random device.
    Group
    Show

  • Network Routing

    A router is a very desirable target for a potential adversary because they fulfill a variety of infrastructure networking roles such as access to ...
    Group
    Show

  • Disable Quagga if Possible

    If Quagga was installed and activated, but the system does not need to act as a router, then it should be disabled and removed.
    Group
    Show

  • Uninstall quagga Package

    The quagga package can be removed with the following command: 
     $ sudo yum erase quagga
    Rule Low Severity
    Show

  • Disable Quagga Service

    The zebra service can be disabled with the following command: 
    $ sudo systemctl mask --now zebra.service
    Rule Medium Severity
    Show

  • Samba(SMB) Microsoft Windows File Sharing Server

    When properly configured, the Samba service allows Linux systems to provide file and print sharing to Microsoft Windows systems. There are two soft...
    Group
    Show

  • Configure Samba if Necessary

    All settings for the Samba daemon can be found in <code>/etc/samba/smb.conf</code>. Settings are divided between a <code>[global]</code> configurat...
    Group
    Show

  • Restrict Printer Sharing

    By default, Samba utilizes the CUPS printing service to enable printer sharing with Microsoft Windows workstations. If there are no printers on the...
    Group
    Show

  • Restrict SMB File Sharing to Configured Networks

    Only users with local user accounts will be able to log in to Samba shares by default. Shares can be limited to particular users or network address...
    Group
    Show

  • Disable Samba if Possible

    Even after the Samba server package has been installed, it will remain disabled. Do not enable this service unless it is absolutely necessary to pr...
    Group
    Show

  • SNMP Server

    The Simple Network Management Protocol allows administrators to monitor the state of network devices, including computers. Older versions of SNMP w...
    Group
    Show

  • Disable SNMP Server if Possible

    The system includes an SNMP daemon that allows for its remote monitoring, though it not installed by default. If it was installed and activated but...
    Group
    Show

  • Uninstall net-snmp Package

    The <code>net-snmp</code> package provides the snmpd service. The <code>net-snmp</code> package can be removed with the following command: <pre> $...
    Rule Unknown Severity
    Show

  • Configure SNMP Server if Necessary

    If it is necessary to run the snmpd agent on the system, some best practices should be followed to minimize the security risk from the installation...
    Group
    Show

  • SNMP read-only community string

    Specify the SNMP community string used for read-only access.
    Value
    Show

  • SNMP read-write community string

    Specify the SNMP community string used for read-write access.
    Value
    Show

  • Ensure Default SNMP Password Is Not Used

    Edit <code>/etc/snmp/snmpd.conf</code>, remove or change the default community strings of <code>public</code> and <code>private</code>. This profil...
    Rule High Severity
    Show

  • SSH Server

    The SSH protocol is recommended for remote login and remote file transfer. SSH provides confidentiality and integrity for data exchanged between tw...
    Group
    Show

  • SSH enabled firewalld zone

    Specify firewalld zone to enable SSH service. This value is used only for remediation purposes.
    Value
    Show

  • SSH Approved ciphers by FIPS

    Specify the FIPS approved ciphers that are used for data integrity protection by the SSH server.
    Value
    Show

  • SSH Approved MACs by FIPS

    Specify the FIPS approved MACs (message authentication code) algorithms that are used for data integrity protection by the SSH server.
    Value
    Show

  • SSH session Idle time

    Specify duration of allowed idle time.
    Value
    Show

  • SSH Server Listening Port

    Specify port the SSH server is listening.
    Value
    Show

  • SSH Max authentication attempts

    Specify the maximum number of authentication attempts per connection.
    Value
    Show

  • SSH is required to be installed

    Specify if the Policy requires SSH to be installed. Used by SSH Rules to determine if SSH should be uninstalled or configured.<br> A value of 0 mea...
    Value
    Show

  • SSH Strong KEX by FIPS

    Specify the FIPS approved KEXs (Key Exchange Algorithms) algorithms that are used for methods in cryptography by which cryptographic keys are exch...
    Value
    Show

  • SSH Max Sessions Count

    Specify the maximum number of open sessions permitted.
    Value
    Show

  • Remove the OpenSSH Server Package

    The <code>openssh-server</code> package should be removed. The <code>openssh-server</code> package can be removed with the following command: <pre>...
    Rule Medium Severity
    Show

  • Enable the OpenSSH Service

    The SSH server service, sshd, is commonly needed. The <code>sshd</code> service can be enabled with the following command: <pre>$ sudo systemctl e...
    Rule Medium Severity
    Show

  • Disable SSH Server If Possible

    The SSH server service, sshd, is commonly needed. However, if it can be disabled, do so. This is unusual, as SSH is a common method for encrypted ...
    Rule High Severity
    Show

  • Verify Group Ownership on SSH Server Private *_key Key Files

    SSH server private keys, files that match the /etc/ssh/*_key glob, must be group-owned by ssh_keys group.
    Rule Medium Severity
    Show

  • Verify Group Ownership on SSH Server Public *.pub Key Files

    SSH server public keys, files that match the /etc/ssh/*.pub glob, must be group-owned by root group.
    Rule Medium Severity
    Show

  • Verify Ownership on SSH Server Private *_key Key Files

    SSH server private keys, files that match the /etc/ssh/*_key glob, must be owned by root user.
    Rule Medium Severity
    Show

  • Verify Ownership on SSH Server Public *.pub Key Files

    SSH server public keys, files that match the /etc/ssh/*.pub glob, must be owned by root user.
    Rule Medium Severity
    Show

  • Verify Permissions on SSH Server Private *_key Key Files

    SSH server private keys - files that match the <code>/etc/ssh/*_key</code> glob, have to have restricted permissions. If those files are owned by t...
    Rule Medium Severity
    Show

  • Verify Permissions on SSH Server Public *.pub Key Files

    To properly set the permissions of /etc/ssh/*.pub, run the command: 
    $ sudo chmod 0644 /etc/ssh/*.pub
    Rule Medium Severity
    Show

  • Remove SSH Server iptables Firewall exception (Unusual)

    By default, inbound connections to SSH's port are allowed. If the SSH server is not being used, this exception should be removed from the firewall ...
    Rule Unknown Severity
    Show

  • Configure OpenSSH Client if Necessary

    The following configuration changes apply to the SSH client. They can improve security parameters relwevant to the client user, e.g. increasing ent...
    Group
    Show

  • Configure OpenSSH Server if Necessary

    If the system needs to act as an SSH server, then certain changes should be made to the OpenSSH daemon configuration file <code>/etc/ssh/sshd_confi...
    Group
    Show

  • SSH RekeyLimit - size

    Specify the size component of the rekey limit.
    Value
    Show

  • SSH RekeyLimit - size

    Specify the size component of the rekey limit.
    Value
    Show

  • SSH Compression Setting

    Specify the compression setting for SSH connections.
    Value
    Show

  • SSH Privilege Separation Setting

    Specify whether and how sshd separates privileges when handling incoming network connections.
    Value
    Show

  • Set SSH Client Alive Count Max to zero

    The SSH server sends at most <code>ClientAliveCountMax</code> messages during a SSH session and waits for a response from the SSH client. The optio...
    Rule Medium Severity
    Show

  • Set SSH Client Alive Count Max

    The SSH server sends at most <code>ClientAliveCountMax</code> messages during a SSH session and waits for a response from the SSH client. The optio...
    Rule Medium Severity
    Show

  • Set SSH Client Alive Interval

    SSH allows administrators to set a network responsiveness timeout interval. After this interval has passed, the unresponsive client will be automat...
    Rule Medium Severity
    Show

  • Disable Host-Based Authentication

    SSH's cryptographic host-based authentication is more secure than <code>.rhosts</code> authentication. However, it is not recommended that hosts un...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules