Skip to content
Log In

Guide to the Secure Configuration of Oracle Linux 8

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Do Not Show System Messages When Unsuccessful Logon Attempts Occur

    This rule ensures the system prevents informative messages from being presented to the user pertaining to logon information after a number of incorrect login attempts using <code>pam_faillock.so</c...
    Rule Medium Severity
    Show

  • Set Password Quality Requirements

    The default <code>pam_pwquality</code> PAM module provides strength checking for passwords. It performs a number of checks, such as making sure passwords are not similar to dictionary words, are of...
    Group
    Show

  • Configure PAMs passwd Module To Implement system-auth Substack When Changing Passwords

    Verify that pam is configured to use <code>/etc/pam.d/system-auth</code> when changing passwords. Look for the following line in <code>/etc/pam.d/passwd</code>: <pre>password substack system-auth</...
    Rule Medium Severity
    Show

  • Group Name Used by pam_wheel Group Parameter

    pam_wheel module has a parameter called group, which controls which groups can access the su command. This variable holds the valid value for the parameter.
    Value
    Show

  • dcredit

    Minimum number of digits in password
    Value
    Show

  • dictcheck

    Prevent the use of dictionary words for passwords.
    Value
    Show

  • difok

    Minimum number of characters not present in old password
    Value
    Show

  • lcredit

    Minimum number of lower case in password
    Value
    Show

  • maxclassrepeat

    Maximum Number of Consecutive Repeating Characters in a Password From the Same Character Class
    Value
    Show

  • maxrepeat

    Maximum Number of Consecutive Repeating Characters in a Password
    Value
    Show

  • minclass

    Minimum number of categories of characters that must exist in a password
    Value
    Show

  • minlen

    Minimum number of characters in password
    Value
    Show

  • ocredit

    Minimum number of other (special characters) in password
    Value
    Show

  • retry

    Number of retry attempts before erroring out
    Value
    Show

  • ucredit

    Minimum number of upper case in password
    Value
    Show

  • Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words

    The pam_pwquality module's dictcheck check if passwords contains dictionary words. When dictcheck is set to 1 passwords will be checked for dictionary words.
    Rule Medium Severity
    Show

  • Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters

    The pam_pwquality module's <code>lcredit</code> parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain...
    Rule Medium Severity
    Show

  • Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class

    The pam_pwquality module's <code>maxclassrepeat</code> parameter controls requirements for consecutive repeating characters from the same character class. When set to a positive number, it will rej...
    Rule Medium Severity
    Show

  • Ensure PAM Enforces Password Requirements - Minimum Length

    The pam_pwquality module's <code>minlen</code> parameter controls requirements for minimum characters required in a password. Add <code>minlen=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_val...
    Rule Medium Severity
    Show

  • Ensure PAM password complexity module is enabled in password-auth

    To enable PAM password complexity in password-auth file: Edit the <code>password</code> section in <code>/etc/pam.d/password-auth</code> to show <code>password requisite ...
    Rule Medium Severity
    Show

  • Ensure PAM password complexity module is enabled in system-auth

    To enable PAM password complexity in system-auth file: Edit the <code>password</code> section in <code>/etc/pam.d/system-auth</code> to show <code>password requisite ...
    Rule Medium Severity
    Show

  • Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session

    To configure the number of retry prompts that are permitted per-session: Edit the <code>/etc/security/pwquality.conf</code> to include <code>retry=<xccdf-1.2:sub idref="xccdf_org.ssgproject.conte...
    Rule Medium Severity
    Show

  • Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters

    The pam_pwquality module's <code>ucredit=</code> parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contai...
    Rule Medium Severity
    Show

  • Set Password Hashing Algorithm

    The system's default algorithm for storing password hashes in /etc/shadow is SHA-512. This can be configured in several locations.
    Group
    Show

  • Set Password Hashing Algorithm in /etc/libuser.conf

    In <code>/etc/libuser.conf</code>, add or correct the following line in its <code>[defaults]</code> section to ensure the system will use the <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_valu...
    Rule Medium Severity
    Show

  • Set Password Hashing Algorithm in /etc/login.defs

    In <code>/etc/login.defs</code>, add or update the following line to ensure the system will use <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"...
    Rule Medium Severity
    Show

  • Set Password Hashing Rounds in /etc/login.defs

    In <code>/etc/login.defs</code>, ensure <code>SHA_CRYPT_MIN_ROUNDS</code> and <code>SHA_CRYPT_MAX_ROUNDS</code> has the minimum value of <code>5000</code>. For example: <pre>SHA_CRYPT_MIN_ROUNDS 50...
    Rule Medium Severity
    Show

  • Protect Physical Console Access

    It is impossible to fully protect a system from an attacker with physical access, so securing the space in which the system is located should be considered a necessary step. However, there are some...
    Group
    Show

  • Login timeout for idle sessions

    Specify duration of allowed idle time.
    Value
    Show

  • Disable debug-shell SystemD Service

    SystemD's <code>debug-shell</code> service is intended to diagnose SystemD related boot issues with various <code>systemctl</code> commands. Once enabled and following a system reboot, the root she...
    Rule Medium Severity
    Show

  • Disable Ctrl-Alt-Del Burst Action

    By default, <code>SystemD</code> will reboot the system if the <code>Ctrl-Alt-Del</code> key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds. <br> <br> To configure the s...
    Rule High Severity
    Show

  • Disable Ctrl-Alt-Del Reboot Activation

    By default, <code>SystemD</code> will reboot the system if the <code>Ctrl-Alt-Del</code> key sequence is pressed. <br> <br> To configure the system to ignore the <code>Ctrl-Alt-Del</code> k...
    Rule High Severity
    Show

  • Require Authentication for Emergency Systemd Target

    Emergency mode is intended as a system recovery method, providing a single user root access to the system during a failed boot sequence. <br> <br> By default, Emergency mode is protected by...
    Rule Medium Severity
    Show

  • Require Authentication for Single User Mode

    Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. <br> <br> By default, single-user mode is ...
    Rule Medium Severity
    Show

  • Configure Screen Locking

    When a user must temporarily leave an account logged-in, screen locking should be employed to prevent passersby from abusing the account. User education and training is particularly important for s...
    Group
    Show

  • Configure Console Screen Locking

    A console screen locking mechanism is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of th...
    Group
    Show

  • Support session locking with tmux

    The tmux terminal multiplexer is used to implement automatic session locking. It should be started from /etc/bashrc or drop-in files within /etc/profile.d/.
    Rule Medium Severity
    Show

  • Support session locking with tmux (not enforcing)

    The tmux terminal multiplexer is used to implement automatic session locking. It should be started from /etc/bashrc or drop-in files within /etc/profile.d/.
    Rule Medium Severity
    Show

  • Configure tmux to lock session after inactivity

    To enable console screen locking in <code>tmux</code> terminal multiplexer after a period of inactivity, the <code>lock-after-time</code> option has to be set to a value greater than 0 and less tha...
    Rule Medium Severity
    Show

  • Configure the tmux lock session key binding

    To set a key binding for the screen locking in <code>tmux</code> terminal multiplexer, the <code>session-lock</code> command must be bound to a key. Add the following line to <code>/etc/tmux.conf</...
    Rule Low Severity
    Show

  • Prevent user from disabling the screen lock

    The tmux terminal multiplexer is used to implement automatic session locking. It should not be listed in /etc/shells.
    Rule Low Severity
    Show

  • Check that vlock is installed to allow session locking

    The Oracle Linux 8 operating system must have vlock installed to allow for session locking. The <code>kbd</code> package can be installed with the following command: <pre> $ sudo yum install kbd<...
    Rule Medium Severity
    Show

  • Hardware Tokens for Authentication

    The use of hardware tokens such as smart cards for system login provides stronger, two-factor authentication than using a username and password. In Oracle Linux 8 servers, hardware token login is...
    Group
    Show

  • OpenSC Smart Card Drivers

    Choose the Smart Card Driver in use by your organization. <br>For DoD, choose the <code>cac</code> driver. <br>If your driver is not listed and you don't want to use the <code>default</code> driver...
    Value
    Show

  • Install the opensc Package For Multifactor Authentication

    The opensc package can be installed with the following command: 
    $ sudo yum install opensc
    Rule Medium Severity
    Show

  • Install the pcsc-lite package

    The pcsc-lite package can be installed with the following command: 
    $ sudo yum install pcsc-lite
    Rule Medium Severity
    Show

  • Enable the pcscd Service

    The pcscd service can be enabled with the following command: 
    $ sudo systemctl enable pcscd.service
    Rule Medium Severity
    Show

  • Configure Smart Card Certificate Status Checking

    Configure the operating system to do certificate status checking for PKI authentication. Modify all of the <code>cert_policy</code> lines in <code>/etc/pam_pkcs11/pam_pkcs11.conf</code> to include ...
    Rule Medium Severity
    Show

  • Protect Accounts by Restricting Password-Based Login

    Conventionally, Unix shell accounts are accessed by providing a username and password to a login program, which tests these values for correctness using the <code>/etc/passwd</code> and <code>/etc/...
    Group
    Show

  • Accounts Authorized Local Users on the Operating System

    List the user accounts that are authorized locally on the operating system. This list includes both users requried by the operating system and by the installed applications. Depending on the Operat...
    Value
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules