Guide to the Secure Configuration of Oracle Linux 8
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Configure basic parameters of Audit system
Perform basic configuration of Audit system. Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, m...Rule Medium Severity -
Configure auditing of successful file creations
Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: <pre>## Successful file creation (open with O_CREAT) -a always,exit -F arch=b3...Rule Medium Severity -
Configure auditing of unsuccessful file deletions
Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlink...Rule Medium Severity -
Configure auditing of successful file deletions
Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,r...Rule Medium Severity -
Configure auditing of unsuccessful file modifications
Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file modifications (open for write or truncate) -a alwa...Rule Medium Severity -
Configure auditing of successful file modifications
Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Successful file modifications (open for write or truncate) -a always,e...Rule Medium Severity -
Configure auditing of unsuccessful ownership changes
Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Unsuccessful ownership change -a alway...Rule Medium Severity -
Configure auditing of unsuccessful permission changes
Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...Rule Medium Severity -
Configure auditing of successful permission changes
Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...Rule Medium Severity -
Configure audit according to OSPP requirements
Configure audit to meet requirements for Operating System Protection Profile (OSPP) v4.2.1. Audit defines groups of rules in <code>/usr/share/doc/audit/rules</code> to satisfy specific policies. ...Rule Medium Severity -
Enable auditd Service
The <code>auditd</code> service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The <code>auditd</code> service can be ena...Rule Medium Severity -
Extend Audit Backlog Limit for the Audit Daemon
To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument <code>audit_backlog_limit=8192</code> to the default GRUB 2 command lin...Rule Low Severity -
Configure auditd Rules for Comprehensive Auditing
The <code>auditd</code> program can perform comprehensive monitoring of system activity. This section describes recommended configuration settings for comprehensive auditing, but a full description...Group -
Record Events that Modify User/Group Information via openat syscall - /etc/group
The audit system should collect write events to /etc/group file for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rule...Rule Medium Severity -
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
The audit system should collect write events to /etc/gshadow file for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit ru...Rule Medium Severity -
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
The audit system should collect write events to /etc/passwd file for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rul...Rule Medium Severity -
Configure immutable Audit login UIDs
Configure kernel to prevent modification of login UIDs once they are set. Changing login UIDs while this configuration is enforced requires special capabilities which are not available to unprivile...Rule Medium Severity -
Record Events that Modify the System's Mandatory Access Controls
If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following line to a file with suffix <cod...Rule Medium Severity -
Ensure auditd Collects Information on Exporting to Media (successful)
At a minimum, the audit system should collect media exportation events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read aud...Rule Medium Severity -
Record Attempts to Alter Process and Session Initiation Information
The audit system already collects process information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during d...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.