Skip to content
Log In

Guide to the Secure Configuration of Oracle Linux 8

Rules, Groups, and Values defined within the XCCDF Benchmark

  • User Initialization Files Must Be Group-Owned By The Primary Group

    Change the group owner of interactive users files to the group found in <pre>/etc/passwd</pre> for the user. To change the group owner of a local interactive user home directory, use the following ...
    Rule Medium Severity
    Show

  • Ensure that Users Path Contains Only Local Directories

    Ensure that all interactive user initialization files executable search path statements do not contain statements that will reference a working directory other than the users home directory.
    Rule Medium Severity
    Show

  • All Interactive Users Must Have A Home Directory Defined

    Assign home directories to all interactive users that currently do not have a home directory assigned. This rule checks if the home directory is properly defined in a folder which has at least one...
    Rule Medium Severity
    Show

  • All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group

    Change the group of a local interactive users files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive users files and directories...
    Rule Medium Severity
    Show

  • All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive

    Set the mode on files and directories in the local interactive user home directory with the following command: <pre>$ sudo chmod 0750 /home/<i>USER</i>/<i>FILE_DIR</i> </pre> Files that beg...
    Rule Medium Severity
    Show

  • All Interactive User Home Directories Must Be Group-Owned By The Primary Group

    Change the group owner of interactive users home directory to the group found in <code>/etc/passwd</code>. To change the group owner of interactive users home directory, use the following command: ...
    Rule Medium Severity
    Show

  • Verify Group Who Owns lastlog Command

    To properly set the group owner of /var/log/lastlog, run the command: 
    $ sudo chgrp root /var/log/lastlog
    Rule Medium Severity
    Show

  • All Interactive User Home Directories Must Be Owned By The Primary User

    Change the owner of interactive users home directories to that correct owner. To change the owner of a interactive users home directory, use the following command: <pre>$ sudo chown <i>USER</i> /ho...
    Rule Medium Severity
    Show

  • Verify Owner on lastlog Command

    To properly set the owner of /usr/bin/lastlog, run the command: 
    $ sudo chown root /usr/bin/lastlog
    Rule Medium Severity
    Show

  • Ensure that User Home Directories are not Group-Writable or World-Readable

    For each human user of the system, view the permissions of the user's home directory: <pre># ls -ld /home/<i>USER</i> </pre> Ensure that the directory is not group-writable and that it is n...
    Rule Medium Severity
    Show

  • Verify Permissions on lastlog Command

    To properly set the permissions of /usr/bin/lastlog, run the command: 
    $ sudo chmod 0750 /usr/bin/lastlog
    Rule Medium Severity
    Show

  • Ensure that No Dangerous Directories Exist in Root's Path

    The active path of the root account can be obtained by starting a new root shell and running: <pre># echo $PATH</pre> This will produce a colon-separated list of directories in the path. <br> ...
    Group
    Show

  • Ensure that Root's Path Does Not Include World or Group-Writable Directories

    For each element in root's path, run: 
    # ls -ld DIR
    and ensure that write permissions are disabled for group and other.
    Rule Medium Severity
    Show

  • Ensure that Root's Path Does Not Include Relative Paths or Null Directories

    Ensure that none of the directories in root's path is equal to a single <code>.</code> character, or that it contains any instances that lead to relative path traversal, such as <code>..</code> or ...
    Rule Unknown Severity
    Show

  • Ensure that Users Have Sensible Umask Values

    The umask setting controls the default permissions for the creation of new files. With a default <code>umask</code> setting of 077, files and directories created by users will not be readable by an...
    Group
    Show

  • Sensible umask

    Enter default user umask
    Value
    Show

  • Ensure the Default Bash Umask is Set Correctly

    To ensure the default umask for users of the Bash shell is set properly, add or correct the <code>umask</code> setting in <code>/etc/bashrc</code> to read as follows: <pre>umask <xccdf-1.2:sub idre...
    Rule Medium Severity
    Show

  • Ensure the Default C Shell Umask is Set Correctly

    To ensure the default umask for users of the C shell is set properly, add or correct the <code>umask</code> setting in <code>/etc/csh.cshrc</code> to read as follows: <pre>umask <xccdf-1.2:sub idre...
    Rule Medium Severity
    Show

  • Ensure the Default Umask is Set Correctly in /etc/profile

    To ensure the default umask controlled by <code>/etc/profile</code> is set properly, add or correct the <code>umask</code> setting in <code>/etc/profile</code> to read as follows: <pre>umask <xccdf...
    Rule Medium Severity
    Show

  • Ensure the Default Umask is Set Correctly For Interactive Users

    Remove the UMASK environment variable from all interactive users initialization files.
    Rule Medium Severity
    Show

  • System Accounting with auditd

    The audit service provides substantial capabilities for recording system activities. By default, the service audits about SELinux AVC denials and certain types of security-relevant events such as s...
    Group
    Show

  • Install audispd-plugins Package

    The audispd-plugins package can be installed with the following command: 
    $ sudo yum install audispd-plugins
    Rule Medium Severity
    Show

  • Ensure the audit Subsystem is Installed

    The audit package should be installed.
    Rule Medium Severity
    Show

  • Network Related Kernel Runtime Parameters for Hosts and Routers

    Certain kernel parameters should be set for systems which are acting as either hosts or routers to improve the system's ability defend against certain types of IPv4 protocol attacks.
    Group
    Show

  • net.ipv4.conf.all.accept_redirects

    Disable ICMP Redirect Acceptance
    Value
    Show

  • net.ipv4.conf.all.accept_source_route

    Trackers could be using source-routed packets to generate traffic that seems to be intra-net, but actually was created outside and has been redirected.
    Value
    Show

  • Record Execution Attempts to Run ACL Privileged Commands

    At a minimum, the audit system should collect the execution of ACL privileged commands for all users and root.
    Group
    Show

  • Record Execution Attempts to Run SELinux Privileged Commands

    At a minimum, the audit system should collect the execution of SELinux privileged commands for all users and root.
    Group
    Show

  • Verify /boot/grub2/grub.cfg Permissions

    File permissions for <code>/boot/grub2/grub.cfg</code> should be set to 600. To properly set the permissions of <code>/boot/grub2/grub.cfg</code>, run the command: <pre>$ sudo chmod 600 /boot/grub...
    Rule Medium Severity
    Show

  • Verify Permissions on /var/log/messages File

    To properly set the permissions of /var/log/messages, run the command: 
    $ sudo chmod 0640 /var/log/messages
    Rule Medium Severity
    Show

  • Verify Permissions on /var/log/syslog File

    To properly set the permissions of /var/log/syslog, run the command: 
    $ sudo chmod 0640 /var/log/syslog
    Rule Medium Severity
    Show

  • System Accounting with auditd

    The <code>auditd</code> program can perform comprehensive monitoring of system activity. This section makes use of recommended configuration settings for specific policies or use cases. The rules i...
    Group
    Show

  • Record Any Attempts to Run ssh-agent

    At a minimum, the audit system should collect any execution attempt of the <code>ssh-agent</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>au...
    Rule Medium Severity
    Show

  • Size remaining in disk space before prompting space_left_action

    The setting for space_left (MB) in /etc/audit/auditd.conf
    Value
    Show

  • Action for auditd to take when disk space just starts to run low

    The setting for space_left_action in /etc/audit/auditd.conf
    Value
    Show

  • The percentage remaining in disk space before prompting space_left_action

    The setting for space_left as a percentage in /etc/audit/auditd.conf
    Value
    Show

  • Auditd priority for flushing data to disk

    The setting for flush in /etc/audit/auditd.conf
    Value
    Show

  • Number of Record to Retain Before Flushing to Disk

    The setting for freq in /etc/audit/auditd.conf
    Value
    Show

  • Maximum audit log file size for auditd

    The setting for max_log_file in /etc/audit/auditd.conf
    Value
    Show

  • Resolve information before writing to audit logs

    To configure Audit daemon to resolve all uid, gid, syscall, architecture, and socket address information before writing the events to disk, set <code>log_format</code> to <code>ENRICHED</code> in <...
    Rule Low Severity
    Show

  • Confidence level on Hardware Random Number Generator

    Defines the level of trust on the hardware random number generators available in the system and the percentage of entropy to credit.
    Value
    Show

  • Spec Store Bypass Mitigation

    This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated.
    Value
    Show

  • Disable Recovery Booting

    Oracle Linux 8 systems support an "recovery boot" option that can be used to prevent services from being started. The <code>GRUB_DISABLE_RECOVERY</code> configuration option in <code>/etc/default/g...
    Rule Medium Severity
    Show

  • IOMMU configuration directive

    On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some of the system critical units such as the memory. To ensure that <code>iomm...
    Rule Unknown Severity
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows for the selection of different kernels - possibly ...
    Group
    Show

  • L1TF vulnerability mitigation

    Defines the L1TF vulneratility mitigations to employ.
    Value
    Show

  • MDS vulnerability mitigation

    Defines the MDS vulneratility mitigation to employ.
    Value
    Show

  • Configure auditing of successful ownership changes

    Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Successful ownership change -a always,ex...
    Rule Medium Severity
    Show

  • Force kernel panic on uncorrected MCEs

    A Machine Check Exception is an error generated by the CPU itdetects an error in itself, memory or I/O devices. These errors may be corrected and generate a check log entry, if an error cannot be c...
    Rule Medium Severity
    Show

  • Ensure SMAP is not disabled during boot

    The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into memory pages in the user space, it is enabled by default since Linux kernel 3.7. But it could be disabled t...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules