Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of openSUSE

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Record Events that Modify the System's Discretionary Access Controls - fsetxattr

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to us...
    Rule Medium Severity
    Show

  • cron_system_cronjob_use_shares SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Record Events that Modify the System's Discretionary Access Controls - lchown

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to us...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - lremovexattr

    At a minimum, the audit system should collect file permission changes for all users and root. <br><br> If the <code>auditd</code> daemon is configu...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - lsetxattr

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to us...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - removexattr

    At a minimum, the audit system should collect file permission changes for all users and root. <br><br> If the <code>auditd</code> daemon is configu...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - setxattr

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to us...
    Rule Medium Severity
    Show

  • cron_userdomain_transition SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Record Events that Modify the System's Discretionary Access Controls - umount

    At a minimum, the audit system should collect file system umount changes. If the <code>auditd</code> daemon is configured to use the <code>augenrul...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - umount2

    At a minimum, the audit system should collect file system umount2 changes. If the <code>auditd</code> daemon is configured to use the <code>augenru...
    Rule Medium Severity
    Show

  • Record Execution Attempts to Run ACL Privileged Commands

    At a minimum, the audit system should collect the execution of ACL privileged commands for all users and root.
    Group
    Show

  • Record Execution Attempts to Run SELinux Privileged Commands

    At a minimum, the audit system should collect the execution of SELinux privileged commands for all users and root.
    Group
    Show

  • Record File Deletion Events by User

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use t...
    Group
    Show

  • Ensure auditd Collects File Deletion Events by User - rename

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use t...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - renameat

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use t...
    Rule Medium Severity
    Show

  • Record Information on the Use of Privileged Commands

    At a minimum, the audit system should collect the execution of privileged commands for all users and root.
    Group
    Show

  • Verify ufw Enabled

    The ufw service can be enabled with the following command: 
    $ sudo systemctl enable ufw.service
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - rmdir

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use t...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - unlink

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use t...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - unlinkat

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use t...
    Rule Medium Severity
    Show

  • Record Unauthorized Access Attempts Events to Files (unsuccessful)

    At a minimum, the audit system should collect unauthorized file accesses for all users and root. Note that the "-F arch=b32" lines should be presen...
    Group
    Show

  • Record Information on Kernel Modules Loading and Unloading

    To capture kernel module loading and unloading events, use following lines, setting ARCH to either b32 for 32-bit system, or having two lines for b...
    Group
    Show

  • cups_execmem SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Ensure auditd Collects Information on the Use of Privileged Commands - init

    At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...
    Rule Medium Severity
    Show

  • Ensure auditd Collects Information on the Use of Privileged Commands - poweroff

    At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...
    Rule Medium Severity
    Show

  • Ensure auditd Collects Information on the Use of Privileged Commands - reboot

    At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...
    Rule Medium Severity
    Show

  • Ensure auditd Collects Information on the Use of Privileged Commands - shutdown

    At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...
    Rule Medium Severity
    Show

  • Ensure auditd Collects Information on the Use of Privileged Commands

    The audit system should collect information about usage of privileged commands for all users. These are commands with suid or sgid bits on and they...
    Rule Medium Severity
    Show

  • Records Events that Modify Date and Time Information

    Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are hi...
    Group
    Show

  • cvs_read_shadow SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Record attempts to alter time through adjtimex

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default),...
    Rule Medium Severity
    Show

  • Record Attempts to Alter Time Through clock_settime

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default),...
    Rule Medium Severity
    Show

  • Record attempts to alter time through settimeofday

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default),...
    Rule Medium Severity
    Show

  • Record Attempts to Alter Time Through stime

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default),...
    Rule Medium Severity
    Show

  • Record Attempts to Alter the localtime File

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default),...
    Rule Medium Severity
    Show

  • daemons_dump_core SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Configure auditd Disk Error Action on Disk Error

    The <code>auditd</code> service can be configured to take an action when there is a disk error. Edit the file <code>/etc/audit/auditd.conf</code>. ...
    Rule Medium Severity
    Show

  • net.ipv4.conf.default.secure_redirects

    Enable to prevent hijacking of routing path by only allowing redirects from gateways known in routing table. Disable to refuse acceptance of secure...
    Value
    Show

  • Configure auditd Data Retention

    The audit system writes data to <code>/var/log/audit/audit.log</code>. By default, <code>auditd</code> rotates 5 logs by size (6MB), retaining a ma...
    Group
    Show

  • Action for audispd to take when disk is full

    The setting for disk_full_action in /etc/audisp/audisp-remote.conf
    Value
    Show

  • Action for audispd to take when network fails

    The setting for network_failure_action in /etc/audisp/audisp-remote.conf
    Value
    Show

  • Remote server for audispd to send audit records

    The setting for remote_server in /etc/audisp/audisp-remote.conf
    Value
    Show

  • Account for auditd to send email when actions occurs

    The setting for action_mail_acct in /etc/audit/auditd.conf
    Value
    Show

  • Action for auditd to take when disk space is low

    The setting for admin_space_left_action in /etc/audit/auditd.conf
    Value
    Show

  • The percentage remaining in disk space before prompting admin_space_left_action

    The setting for admin_space_left as a percentage in /etc/audit/auditd.conf
    Value
    Show

  • Action for auditd to take when disk errors

    'The setting for disk_error_action in /etc/audit/auditd.conf, if multiple values are allowed write them separated by pipes as in "syslog|single|hal...
    Value
    Show

  • Action for auditd to take when disk is full

    'The setting for disk_full_action in /etc/audit/auditd.conf, if multiple values are allowed write them separated by pipes as in "syslog|single|halt...
    Value
    Show

  • Auditd priority for flushing data to disk

    The setting for flush in /etc/audit/auditd.conf
    Value
    Show

  • Number of Record to Retain Before Flushing to Disk

    The setting for freq in /etc/audit/auditd.conf
    Value
    Show

  • Maximum audit log file size for auditd

    The setting for max_log_file in /etc/audit/auditd.conf
    Value
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules