Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 7

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Configure Logging

    Ensure that the following line exists in <code>/etc/rsyslog.conf</code>: <pre>daemon.* /var/log/daemon.log</pre> Configure logwatch or ot...
    Rule Unknown Severity
    Show

  • Deny BOOTP Queries

    Unless your network needs to support older BOOTP clients, disable support for the bootp protocol by adding or correcting the global option: <pre>de...
    Rule Unknown Severity
    Show

  • Deny Decline Messages

    Edit <code>/etc/dhcp/dhcpd.conf</code> and add or correct the following global option to prevent the DHCP server from responding the DHCPDECLINE me...
    Rule Unknown Severity
    Show

  • Do Not Use Dynamic DNS

    To prevent the DHCP server from receiving DNS information from clients, edit <code>/etc/dhcp/dhcpd.conf</code>, and add or correct the following gl...
    Rule Unknown Severity
    Show

  • Minimize Served Information

    Edit /etc/dhcp/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there i...
    Rule Unknown Severity
    Show

  • Disable DHCP Client

    DHCP is the default network configuration method provided by the system installer, and common on many networks. Nevertheless, manual management of ...
    Group
    Show

  • Disable DHCP Client in ifcfg

    For each interface on the system (e.g. eth0), edit <code>/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></code> and make the following change...
    Rule Unknown Severity
    Show

  • Disable DHCP Server

    The DHCP server <code>dhcpd</code> is not installed or activated by default. If the software was installed and activated, but the system does not n...
    Group
    Show

  • Uninstall DHCP Server Package

    If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The <code>dhcp</code> package can be removed with the fo...
    Rule Medium Severity
    Show

  • Disable DHCP Service

    The <code>dhcpd</code> service should be disabled on any system that does not need to act as a DHCP server. The <code>dhcpd</code> service can be ...
    Rule Medium Severity
    Show

  • DNS Server

    Most organizations have an operational need to run at least one nameserver. However, there are many common attacks involving DNS server software, a...
    Group
    Show

  • Disable DNS Server

    DNS software should be disabled on any systems which does not need to be a nameserver. Note that the BIND DNS server software is not installed on R...
    Group
    Show

  • Uninstall bind Package

    The <code>named</code> service is provided by the <code>bind</code> package. The <code>bind</code> package can be removed with the following comman...
    Rule Low Severity
    Show

  • Disable named Service

    The named service can be disabled with the following command: 
    $ sudo systemctl mask --now named.service
    Rule Medium Severity
    Show

  • Isolate DNS from Other Services

    This section discusses mechanisms for preventing the DNS server from interfering with other services. This is done both to protect the remainder of...
    Group
    Show

  • Run DNS Software in a chroot Jail

    Install the <code>bind-chroot</code> package: <pre>$ sudo yum install bind-chroot</pre> Place a valid named.conf file inside the chroot jail: <pre>...
    Group
    Show

  • Run DNS Software on Dedicated Servers

    Since DNS is a high-risk service which must frequently be made available to the entire Internet, it is strongly recommended that no other services ...
    Group
    Show

  • Protect DNS Data from Tampering or Attack

    This section discusses DNS configuration options which make it more difficult for attackers to gain access to private DNS data or to modify DNS data.
    Group
    Show

  • Use direct-lvm with the Device Mapper Storage Driver

    To use Docker in production with the device mapper storage driver, the Docker daemon should be configured to use direct-lvm instead of loopback dev...
    Rule Low Severity
    Show

  • Application Whitelisting Daemon

    Fapolicyd (File Access Policy Daemon) implements application whitelisting to decide file access rights. Applications that are known via a reputatio...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules