Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Enable Kernel Parameter to Enforce DAC on Symlinks

    To set the runtime status of the <code>fs.protected_symlinks</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w fs.protected_symlinks=1</pre> To make sure that the setting is...
    Rule Medium Severity
    Show

  • Verify Group Who Owns Backup group File

    To properly set the group owner of /etc/group-, run the command: 
    $ sudo chgrp root /etc/group-
    Rule Medium Severity
    Show

  • Verify Group Who Owns Backup passwd File

    To properly set the group owner of /etc/passwd-, run the command: 
    $ sudo chgrp root /etc/passwd-
    Rule Medium Severity
    Show

  • Verify Group Who Owns /etc/shells File

    To properly set the group owner of /etc/shells, run the command: 
    $ sudo chgrp root /etc/shells
    Rule Medium Severity
    Show

  • Verify User Who Owns shadow File

    To properly set the owner of /etc/shadow, run the command: 
    $ sudo chown root /etc/shadow
    Rule Medium Severity
    Show

  • Verify Who Owns /etc/shells File

    To properly set the owner of /etc/shells, run the command: 
    $ sudo chown root /etc/shells
    Rule Medium Severity
    Show

  • Verify Permissions on passwd File

    To properly set the permissions of /etc/passwd, run the command: 
    $ sudo chmod 0644 /etc/passwd
    Rule Medium Severity
    Show

  • Verify Permissions on /etc/shells File

    To properly set the permissions of /etc/shells, run the command: 
    $ sudo chmod 0644 /etc/shells
    Rule Medium Severity
    Show

  • Verify that Shared Library Directories Have Root Ownership

    System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: <pre>/lib /lib64 /usr/lib /usr/lib64 </pr...
    Rule Medium Severity
    Show

  • Verify that Shared Library Directories Have Restrictive Permissions

    System-wide shared library directories, which contain are linked to executables during process load time or run time, are stored in the following directories by default: <pre>/lib /lib64 /usr/lib /...
    Rule Medium Severity
    Show

  • Verify Group Who Owns /etc/sysctl.d Directory

    To properly set the group owner of /etc/sysctl.d, run the command: 
    $ sudo chgrp root /etc/sysctl.d
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/sysctl.d Directory

    To properly set the owner of /etc/sysctl.d, run the command: 
    $ sudo chown root /etc/sysctl.d
    Rule Medium Severity
    Show

  • Verify Permissions On /etc/sysctl.d Directory

    To properly set the permissions of /etc/sysctl.d, run the command: 
    $ sudo chmod 0755 /etc/sysctl.d
    Rule Medium Severity
    Show

  • Verify that system commands files are group owned by root or a system account

    System commands files are stored in the following directories by default: <pre>/bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin </pre> All files in these directories should be owned by ...
    Rule Medium Severity
    Show

  • Verify that Shared Library Files Have Restrictive Permissions

    System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: <pre>/lib /lib64 /usr/lib /usr/lib64 </pr...
    Rule Medium Severity
    Show

  • Set LogLevel to INFO

    The INFO parameter specifices that record login and logout activity will be logged. <br> The default SSH configuration sets the log level to INFO. The appropriate configuration is used if no value ...
    Rule Low Severity
    Show

  • Disable the Automounter

    The <code>autofs</code> daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default c...
    Rule Medium Severity
    Show

  • Disable Mounting of jffs2

    To configure the system to prevent the <code>jffs2</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/jffs2.conf</code>: <pre>install jffs2 /bin/false...
    Rule Low Severity
    Show

  • Disable Mounting of squashfs

    To configure the system to prevent the <code>squashfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/squashfs.conf</code>: <pre>install squashfs /...
    Rule Low Severity
    Show

  • Disable storing core dumps

    To set the runtime status of the <code>kernel.core_pattern</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.core_pattern=|/bin/false</pre> To make sure that the sett...
    Rule Medium Severity
    Show

  • Configure file name of core dumps

    To set the runtime status of the <code>kernel.core_uses_pid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.core_uses_pid=0</pre> To make sure that the setting is p...
    Rule Medium Severity
    Show

  • Disable Access to Network bpf() Syscall From Unprivileged Processes

    To set the runtime status of the <code>kernel.unprivileged_bpf_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1</pre> To make su...
    Rule Medium Severity
    Show

  • Restrict usage of ptrace to descendant processes

    To set the runtime status of the <code>kernel.yama.ptrace_scope</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.yama.ptrace_scope=1</pre> To make sure that the sett...
    Rule Medium Severity
    Show

  • Disable Core Dumps

    A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases, only software developers legitimately need to acc...
    Group
    Show

  • Restrict Exposed Kernel Pointer Addresses Access

    To set the runtime status of the <code>kernel.kptr_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kptr_restrict=<xccdf-1.2:sub idref="xccdf_org.ssgproject...
    Rule Medium Severity
    Show

  • SELinux

    SELinux is a feature of the Linux kernel which can be used to guard against misconfigured or compromised programs. SELinux enforces the idea that programs should be limited in what files they can a...
    Group
    Show

  • Verify Group Who Owns /etc/selinux Directory

    To properly set the group owner of /etc/selinux, run the command: 
    $ sudo chgrp root /etc/selinux
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/selinux Directory

    To properly set the owner of /etc/selinux, run the command: 
    $ sudo chown root /etc/selinux
    Rule Medium Severity
    Show

  • Verify Permissions On /etc/selinux Directory

    To properly set the permissions of /etc/selinux, run the command: 
    $ sudo chmod 0755 /etc/selinux
    Rule Medium Severity
    Show

  • Verify Group Who Owns /etc/sestatus.conf File

    To properly set the group owner of /etc/sestatus.conf, run the command: 
    $ sudo chgrp root /etc/sestatus.conf
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/sestatus.conf File

    To properly set the owner of /etc/sestatus.conf, run the command: 
    $ sudo chown root /etc/sestatus.conf
    Rule Medium Severity
    Show

  • Verify Permissions On /etc/sestatus.conf File

    To properly set the permissions of /etc/sestatus.conf, run the command: 
    $ sudo chmod 0644 /etc/sestatus.conf
    Rule Medium Severity
    Show

  • Ensure SELinux State is Enforcing

    The SELinux state should be set to <code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"></xccdf-1.2:sub></code> at system boot time. In the file <code>/et...
    Rule High Severity
    Show

  • Services

    The best protection against vulnerable software is running less software. This section describes how to review the software which Red Hat Enterprise Linux CoreOS 4 installs on a system and disable ...
    Group
    Show

  • Enable cron Service

    The <code>crond</code> service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system acti...
    Rule Medium Severity
    Show

  • Minimize the DHCP-Configured Options

    Create the file <code>/etc/dhcp/dhclient.conf</code>, and add an appropriate setting for each of the ten configuration settings which can be obtained via DHCP. For each setting, do one of the follo...
    Rule Unknown Severity
    Show

  • Uninstall kea Package

    If the system does not need to act as a DHCP server, the kea package can be uninstalled.
    Rule Medium Severity
    Show

  • Enable the File Access Policy Service

    The File Access Policy service should be enabled. The <code>fapolicyd</code> service can be enabled with the following manifest: <pre> --- apiVersion: machineconfiguration.openshift.io/v1 kind: Ma...
    Rule Medium Severity
    Show

  • Ensure LDAP client is not installed

    The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The <code>openldap-clients</code> package can be removed wit...
    Rule Low Severity
    Show

  • Mail Server Software

    Mail servers are used to send and receive email over the network. Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious targets of network attack. Ensure that systems are not r...
    Group
    Show

  • The Postfix package is installed

    A mail server is required for sending emails. The postfix package can be installed with the following command: 
    $ sudo dnf install postfix
    Rule Medium Severity
    Show

  • Uninstall Sendmail Package

    Sendmail is not the default mail transfer agent and is not installed by default. The <code>sendmail</code> package can be removed with the following command: <pre> $ sudo dnf remove sendmail</pre> ...
    Rule Medium Severity
    Show

  • Disable Network File Systems (netfs)

    The netfs script manages the boot-time mounting of several types of networked filesystems, of which NFS and Samba are the most common. If these filesystem types are not in use, the script can be di...
    Rule Unknown Severity
    Show

  • The Chrony package is installed

    System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize th...
    Rule Medium Severity
    Show

  • The Chronyd service is enabled

    chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information o...
    Rule Medium Severity
    Show

  • Enable the NTP Daemon

    As a user with administrator privileges, log into a node in the relevant pool: <pre> $ oc debug node/$NODE_NAME </pre> At the <pre>sh-4.4#</pre> prompt, run: <pre> # chroot /host </pre> Run the ...
    Rule Medium Severity
    Show

  • Enable the NTP Daemon

    The <code>ntpd</code> service can be enabled with the following manifest: <pre> --- apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguratio...
    Rule Medium Severity
    Show

  • A remote time server for Chrony is configured

    <code>Chrony</code> is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. M...
    Rule Medium Severity
    Show

  • Specify Additional Remote NTP Servers

    Depending on specific functional requirements of a concrete production environment, the Red Hat Enterprise Linux CoreOS 4 system can be configured to utilize the services of the <code>chronyd</code...
    Rule Medium Severity
    Show

  • Verify Group Who Owns /etc/chrony.keys File

    To properly set the group owner of /etc/chrony.keys, run the command: 
    $ sudo chgrp chrony /etc/chrony.keys
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules