Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 7

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure /opt Located On Separate Partition

    It is recommended that the /opt directory resides on a separate partition.
    Rule Medium Severity
    Show

  • Uninstall geolite2-city Package

    The geolite2-city package can be removed with the following command: 
    $ sudo yum erase geolite2-city
    Rule Low Severity
    Show

  • Configure GNOME Login Screen

    In the default GNOME desktop, the login is displayed after system boot and can display user accounts, allow users to reboot the system, and allow users to login automatically and/or with a guest ac...
    Group
    Show

  • Ensure /srv Located On Separate Partition

    If a file server (FTP, TFTP...) is hosted locally, create a separate partition for <code>/srv</code> at installation time (or migrate it later using LVM). If <code>/srv</code> will be mounted from ...
    Rule Unknown Severity
    Show

  • Ensure /tmp Located On Separate Partition

    The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
    Rule Low Severity
    Show

  • Ensure /usr Located On Separate Partition

    It is recommended that the /usr directory resides on a separate partition.
    Rule Medium Severity
    Show

  • Ensure /var Located On Separate Partition

    The <code>/var</code> directory is used by daemons and other system services to store frequently-changing data. Ensure that <code>/var</code> has its own partition or logical volume at installation...
    Rule Low Severity
    Show

  • Ensure /var/log Located On Separate Partition

    System logs are stored in the /var/log directory. Ensure that /var/log has its own partition or logical volume at installation time, or migrate it using LVM.
    Rule Low Severity
    Show

  • Ensure /var/log/audit Located On Separate Partition

    Audit logs are stored in the <code>/var/log/audit</code> directory. Ensure that <code>/var/log/audit</code> has its own partition or logical volume at installation time, or migrate it using LVM. M...
    Rule Low Severity
    Show

  • Ensure /var/tmp Located On Separate Partition

    The /var/tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
    Rule Medium Severity
    Show

  • GNOME Desktop Environment

    GNOME is a graphical desktop environment bundled with many Linux distributions that allow users to easily interact with the operating system graphically rather than textually. The GNOME Graphical D...
    Group
    Show

  • Remove the GDM Package Group

    By removing the <code>gdm</code> package, the system no longer has GNOME installed installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the...
    Rule Medium Severity
    Show

  • Make sure that the dconf databases are up-to-date with regards to respective keyfiles

    By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the <pre>dconf update</pre> command. More specific...
    Rule High Severity
    Show

  • Configure GNOME3 DConf User Profile

    By default, DConf provides a standard user profile. This profile contains a list of DConf configuration databases. The user profile and database always take the highest priority. As such the DConf ...
    Rule High Severity
    Show

  • Disable GNOME3 Automounting

    The system's default desktop environment, GNOME3, will mount devices and removable media (such as DVDs, CDs and USB flash drives) whenever they are inserted into the system. To disable automount wi...
    Rule Medium Severity
    Show

  • Require Encryption for Remote Access in GNOME3

    By default, <code>GNOME</code> requires encryption when using <code>Vino</code> for remote access. To prevent remote access encryption from being disabled, add or set <code>require-encryption</code...
    Rule Medium Severity
    Show

  • Disable the GNOME3 Login Restart and Shutdown Buttons

    In the default graphical environment, users logging directly into the system are greeted with a login screen that allows any user, known or unknown, the ability the ability to shutdown or restart t...
    Rule High Severity
    Show

  • Disable the GNOME3 Login User List

    In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting <code>di...
    Rule Medium Severity
    Show

  • Enable the GNOME3 Login Smartcard Authentication

    In the default graphical environment, smart card authentication can be enabled on the login screen by setting <code>enable-smartcard-authentication</code> to <code>true</code>. <br><br> To enable, ...
    Rule Medium Severity
    Show

  • Set the GNOME3 Login Number of Failures

    In the default graphical environment, the GNOME3 login screen and be configured to restart the authentication process after a configured number of attempts. This can be configured by setting <code>...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules