Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Uncommon Network Protocols
The system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code are not frequently discovered, the consequences ca...Group -
Disable ATM Support
The Asynchronous Transfer Mode (ATM) is a protocol operating on network, data link, and physical layers, based on virtual circuits and virtual paths. To configure the system to prevent the <code>a...Rule Medium Severity -
Disable CAN Support
The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configur...Rule Medium Severity -
Disable IEEE 1394 (FireWire) Support
The IEEE 1394 (FireWire) is a serial bus standard for high-speed real-time communication. To configure the system to prevent the <code>firewire-core</code> kernel module from being loaded, add the...Rule Low Severity -
Disable RDS Support
The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications between nodes in a cluster. To configure the syst...Rule Low Severity -
Disable SCTP Support
The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection...Rule Medium Severity -
Disable TIPC Support
The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the <code>tipc</code> kernel module...Rule Low Severity -
Wireless Networking
Wireless networking, such as 802.11 (WiFi) and Bluetooth, can present a security risk to sensitive or classified systems and networks. Wireless networking hardware is much more likely to be include...Group -
Verify Permissions on Files with Local Account Information and Credentials
The default restrictive permissions for files which act as important security databases such as <code>passwd</code>, <code>shadow</code>, <code>group</code>, and <code>gshadow</code> files must be ...Group -
Disable Bluetooth Kernel Module
The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate <code>/etc/modprobe.d</code> configuration file to prevent the ...Rule Medium Severity -
Disable Kernel cfg80211 Module
To configure the system to prevent the <code>cfg80211</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/cfg80211.conf</code>: <pre>install cfg80211 /...Rule Medium Severity -
Disable Kernel iwlmvm Module
To configure the system to prevent the <code>iwlmvm</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/iwlmvm.conf</code>: <pre>install iwlmvm /bin/fa...Rule Medium Severity -
Disable Kernel iwlwifi Module
To configure the system to prevent the <code>iwlwifi</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/iwlwifi.conf</code>: <pre>install iwlwifi /bin...Rule Medium Severity -
Disable Kernel mac80211 Module
To configure the system to prevent the <code>mac80211</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/mac80211.conf</code>: <pre>install mac80211 /...Rule Medium Severity -
Disable WiFi or Bluetooth in BIOS
Some machines that include built-in wireless support offer the ability to disable the device through the BIOS. This is hardware-specific; consult your hardware manual or explore the BIOS setup duri...Rule Unknown Severity -
Deactivate Wireless Network Interfaces
Deactivating wireless network interfaces should prevent normal usage of the wireless capability. <br> <br> Configure the system to disable all wireless network interfaces with the followi...Rule Medium Severity -
Verify Group Who Owns Backup gshadow File
To properly set the group owner of/etc/gshadow-, run the command:$ sudo chgrp root /etc/gshadow-
Rule Medium Severity -
Verify Permissions on Important Files and Directories
Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses important permission restrictions which can be verifie...Group -
Verify Permissions on System.map Files
The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. In general,...Rule Low Severity -
Ensure No World-Writable Files Exist
It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor f...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Capacity
Modules