Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

    The sudo <code>use_pty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the <code>use_pty</code> tag exists...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the <code>NOPASSWD</code...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo

    The sudo <code>NOPASSWD</code> and <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making ...
    Rule Medium Severity
    Show

  • Only the VDSM User Can Use sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <code>vdsm</code> user should have this capability in any s...
    Rule Medium Severity
    Show

  • Don't define allowed commands in sudoers by means of exclusion

    Policies applied by sudo through the sudoers file should not involve negation. Each user specification in the <code>sudoers</code> file contains a comma-delimited list of command specifications. T...
    Rule Medium Severity
    Show

  • Don't target root user in the sudoers file

    The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to explicitly list the runas spec (i.e. the list of targe...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Ensure nss-tools is installed

    The nss-tools package can be installed with the following command: 
    $ sudo dnf install nss-tools
    Rule Medium Severity
    Show

  • Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. Therefore, making it mor...
    Group
    Show

  • Warning Banners for System Accesses

    Each system should expose as little information about itself as possible. <br> <br> System banners, which are typically displayed just before a login prompt, give out information about the s...
    Group
    Show

  • Login Banner Verbiage

    Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters like parentheses and quotation marks must be escap...
    Value
    Show

  • Remote Login Banner Verbiage

    Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters like parentheses and quotation marks must be escap...
    Value
    Show

  • Modify the System Login Banner

    To configure the system login banner create a file under <code>/etc/issue.d</code> The Machine Configuration provided with this rule is generic. You may need to adjust it accordingly to fit your ...
    Rule Medium Severity
    Show

  • Disallow Configuration to Bypass Password Requirements for Privilege Escalation

    Verify the operating system is not configured to bypass password requirements for privilege escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command: <pre>$ sudo...
    Rule Medium Severity
    Show

  • Verify Group Ownership of System Login Banner for Remote Connections

    To properly set the group owner of /etc/issue.net, run the command: 
    $ sudo chgrp root /etc/issue.net
    Rule Medium Severity
    Show

  • Verify ownership of System Login Banner

    To properly set the owner of /etc/issue, run the command: 
    $ sudo chown root /etc/issue
    Rule Medium Severity
    Show

  • Verify ownership of System Login Banner for Remote Connections

    To properly set the owner of /etc/issue.net, run the command: 
    $ sudo chown root /etc/issue.net
    Rule Medium Severity
    Show

  • Verify permissions on System Login Banner

    To properly set the permissions of /etc/issue, run the command: 
    $ sudo chmod 0644 /etc/issue
    Rule Medium Severity
    Show

  • Verify permissions on System Login Banner for Remote Connections

    To properly set the permissions of /etc/issue.net, run the command: 
    $ sudo chmod 0644 /etc/issue.net
    Rule Medium Severity
    Show

  • Password Hashing algorithm

    Specify the system default encryption algorithm for encrypting passwords. Defines the value set as ENCRYPT_METHOD in /etc/login.defs.
    Value
    Show

  • remember

    The last n passwords for each user are saved in <code>/etc/security/opasswd</code> in order to force password change history and keep the user from alternating between the same password too frequen...
    Value
    Show

  • Ensure there are no legacy + NIS entries in /etc/shadow

    The + character in /etc/shadow file marks a place where entries from a network information service (NIS) should be directly inserted.
    Rule Medium Severity
    Show

  • fail_deny

    Number of failed login attempts before account lockout
    Value
    Show

  • faillock directory

    The directory where the user files with the failure records are kept
    Value
    Show

  • fail_interval

    Interval for counting failed login attempts before account lockout
    Value
    Show

  • fail_unlock_time

    Seconds before automatic unlocking or permanently locking after excessive failed logins
    Value
    Show

  • tally2_unlock_time

    Seconds before automatic unlocking or permanently locking after excessive failed logins
    Value
    Show

  • tally2

    Number of failed login attempts
    Value
    Show

  • Account Lockouts Must Be Logged

    PAM faillock locks an account due to excessive password failures, this event must be logged.
    Rule Medium Severity
    Show

  • Account Lockouts Must Persist

    By setting a `dir` in the faillock configuration account lockouts will persist across reboots.
    Rule Medium Severity
    Show

  • Account Lockouts Must Be Logged

    PAM faillock locks an account due to excessive password failures, this event must be logged.
    Rule Medium Severity
    Show

  • Ensure There Are No Accounts With Blank or Null Passwords

    Check the "/etc/shadow" file for blank passwords with the following command: <pre>$ sudo awk -F: '!$2 {print $1}' /etc/shadow</pre> If the command returns any results, this is a finding. Configure ...
    Rule High Severity
    Show

  • dcredit

    Minimum number of digits in password
    Value
    Show

  • lcredit

    Minimum number of lower case in password
    Value
    Show

  • minclass

    Minimum number of categories of characters that must exist in a password
    Value
    Show

  • minlen

    Minimum number of characters in password
    Value
    Show

  • ocredit

    Minimum number of other (special characters) in password
    Value
    Show

  • retry

    Number of retry attempts before erroring out
    Value
    Show

  • ucredit

    Minimum number of upper case in password
    Value
    Show

  • Protect Physical Console Access

    It is impossible to fully protect a system from an attacker with physical access, so securing the space in which the system is located should be considered a necessary step. However, there are some...
    Group
    Show

  • Login timeout for idle sessions

    Specify duration of allowed idle time.
    Value
    Show

  • Verify that Interactive Boot is Disabled

    Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can be used to prevent services from being started. On a Red Hat Enterprise Linux CoreOS 4 system, interactive bo...
    Rule Medium Severity
    Show

  • Ensure there are no legacy + NIS entries in /etc/group

    The + character in /etc/group file marks a place where entries from a network information service (NIS) should be directly inserted.
    Rule Medium Severity
    Show

  • Disable Ctrl-Alt-Del Reboot Activation

    By default, <code>SystemD</code> will reboot the system if the <code>Ctrl-Alt-Del</code> key sequence is pressed. <br> <br> To configure the system to ignore the <code>Ctrl-Alt-Del</code> k...
    Rule High Severity
    Show

  • Verify that Interactive Boot is Disabled

    Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can be used to prevent services from being started. On a Red Hat Enterprise Linux CoreOS 4 system, interactive bo...
    Rule Medium Severity
    Show

  • Require Authentication for Single User Mode

    Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. <br> <br> By default, single-user mode is ...
    Rule Medium Severity
    Show

  • Configure Screen Locking

    When a user must temporarily leave an account logged-in, screen locking should be employed to prevent passersby from abusing the account. User education and training is particularly important for s...
    Group
    Show

  • Configure Console Screen Locking

    A console screen locking mechanism is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of th...
    Group
    Show

  • Support session locking with tmux

    The tmux terminal multiplexer is used to implement automatic session locking. It should be started from /etc/bashrc or drop-in files within /etc/profile.d/.
    Rule Medium Severity
    Show

  • Configure tmux to lock session after inactivity

    To enable console screen locking in <code>tmux</code> terminal multiplexer after a period of inactivity, the <code>lock-after-time</code> option has to be set to a value greater than 0 and less tha...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules