Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 8

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo

    The sudo <code>NOPASSWD</code> and <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having t...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is...
    Rule Medium Severity
    Show

  • Ensure only owner and members of group owner of /usr/bin/sudo can execute it

    Remove the execute permission bit of <code>/etc/bin/sudo</code> for the other users. To properly set the permissions of <code>/usr/bin/sudo</code>...
    Rule Medium Severity
    Show

  • The operating system must restrict privilege elevation to authorized personnel

    The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms yo...
    Rule Medium Severity
    Show

  • Only the VDSM User Can Use sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <code>vds...
    Rule Medium Severity
    Show

  • Ensure sudo only includes the default configuration directory

    Administrators can configure authorized <code>sudo</code> users via drop-in files, and it is possible to include other directories and configuratio...
    Rule Medium Severity
    Show

  • Explicit arguments in sudo specifications

    All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user. If the command is supposed to be executed...
    Rule Medium Severity
    Show

  • Don't target root user in the sudoers file

    The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to expl...
    Rule Medium Severity
    Show

  • Ensure invoking users password for privilege escalation when using sudo

    The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validate...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Install binutils Package

    The binutils package can be installed with the following command: 
    $ sudo yum install binutils
    Rule Medium Severity
    Show

  • Install dnf-plugin-subscription-manager Package

    The <code>dnf-plugin-subscription-manager</code> package can be installed with the following command: <pre> $ sudo yum install dnf-plugin-subscript...
    Rule Medium Severity
    Show

  • Ensure gnutls-utils is installed

    The gnutls-utils package can be installed with the following command: 
    $ sudo yum install gnutls-utils
    Rule Medium Severity
    Show

  • Install libcap-ng-utils Package

    The libcap-ng-utils package can be installed with the following command: 
    $ sudo yum install libcap-ng-utils
    Rule Medium Severity
    Show

  • Ensure nss-tools is installed

    The nss-tools package can be installed with the following command: 
    $ sudo yum install nss-tools
    Rule Medium Severity
    Show

  • Install openscap-scanner Package

    The openscap-scanner package can be installed with the following command: 
    $ sudo yum install openscap-scanner
    Rule Medium Severity
    Show

  • Install rear Package

    The rear package can be installed with the following command: 
    $ sudo yum install rear
    Rule Medium Severity
    Show

  • Install rng-tools Package

    The rng-tools package can be installed with the following command: 
    $ sudo yum install rng-tools
    Rule Low Severity
    Show

  • Install scap-security-guide Package

    The scap-security-guide package can be installed with the following command: 
    $ sudo yum install scap-security-guide
    Rule Medium Severity
    Show

  • Install subscription-manager Package

    The subscription-manager package can be installed with the following command: 
    $ sudo yum install subscription-manager
    Rule Medium Severity
    Show

  • Install tar Package

    The tar package can be installed with the following command: 
    $ sudo yum install tar
    Rule Medium Severity
    Show

  • Install vim Package

    The vim-enhanced package can be installed with the following command: 
    $ sudo yum install vim-enhanced
    Rule Low Severity
    Show

  • Uninstall abrt-addon-ccpp Package

    The abrt-addon-ccpp package can be removed with the following command: 
    $ sudo yum erase abrt-addon-ccpp
    Rule Low Severity
    Show

  • Uninstall abrt-addon-kerneloops Package

    The abrt-addon-kerneloops package can be removed with the following command: 
    $ sudo yum erase abrt-addon-kerneloops
    Rule Low Severity
    Show

  • Uninstall abrt-cli Package

    The abrt-cli package can be removed with the following command: 
    $ sudo yum erase abrt-cli
    Rule Low Severity
    Show

  • Uninstall abrt-plugin-logger Package

    The abrt-plugin-logger package can be removed with the following command: 
    $ sudo yum erase abrt-plugin-logger
    Rule Low Severity
    Show

  • Uninstall abrt-plugin-rhtsupport Package

    The abrt-plugin-rhtsupport package can be removed with the following command: 
    $ sudo yum erase abrt-plugin-rhtsupport
    Rule Low Severity
    Show

  • Uninstall abrt-plugin-sosreport Package

    The abrt-plugin-sosreport package can be removed with the following command: 
    $ sudo yum erase abrt-plugin-sosreport
    Rule Low Severity
    Show

  • Uninstall geolite2-city Package

    The geolite2-city package can be removed with the following command: 
    $ sudo yum erase geolite2-city
    Rule Low Severity
    Show

  • Uninstall geolite2-country Package

    The geolite2-country package can be removed with the following command: 
    $ sudo yum erase geolite2-country
    Rule Low Severity
    Show

  • Uninstall gssproxy Package

    The gssproxy package can be removed with the following command: 
    $ sudo yum erase gssproxy
    Rule Medium Severity
    Show

  • Uninstall iprutils Package

    The iprutils package can be removed with the following command: 
    $ sudo yum erase iprutils
    Rule Medium Severity
    Show

  • Uninstall krb5-workstation Package

    The krb5-workstation package can be removed with the following command: 
    $ sudo yum erase krb5-workstation
    Rule Medium Severity
    Show

  • Uninstall libreport-plugin-logger Package

    The libreport-plugin-logger package can be removed with the following command: 
    $ sudo yum erase libreport-plugin-logger
    Rule Low Severity
    Show

  • Uninstall libreport-plugin-rhtsupport Package

    The <code>libreport-plugin-rhtsupport</code> package can be removed with the following command: <pre> $ sudo yum erase libreport-plugin-rhtsupport<...
    Rule Low Severity
    Show

  • Uninstall pigz Package

    The pigz package can be removed with the following command: 
    $ sudo yum erase pigz
    Rule Low Severity
    Show

  • Uninstall python3-abrt-addon Package

    The python3-abrt-addon package can be removed with the following command: 
    $ sudo yum erase python3-abrt-addon
    Rule Low Severity
    Show

  • Uninstall tuned Package

    The tuned package can be removed with the following command: 
    $ sudo yum erase tuned
    Rule Medium Severity
    Show

  • Updating Software

    The <code>yum</code> command line tool is used to install and update software packages. The system also provides a graphical software update tool i...
    Group
    Show

  • Install dnf-automatic Package

    The dnf-automatic package can be installed with the following command: 
    $ sudo yum install dnf-automatic
    Rule Medium Severity
    Show

  • Ensure yum Removes Previous Package Versions

    <code>yum</code> should be configured to remove previous software components after new versions have been installed. To configure <code>yum</code> ...
    Rule Low Severity
    Show

  • Configure dnf-automatic to Install Available Updates Automatically

    To ensure that the packages comprising the available updates will be automatically installed by <code>dnf-automatic</code>, set <code>apply_updates...
    Rule Medium Severity
    Show

  • Configure dnf-automatic to Install Only Security Updates

    To configure <code>dnf-automatic</code> to install only security updates automatically, set <code>upgrade_type</code> to <code>security</code> unde...
    Rule Low Severity
    Show

  • Ensure gpgcheck Enabled In Main yum Configuration

    The <code>gpgcheck</code> option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check pack...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for Local Packages

    <code>yum</code> should be configured to verify the signature(s) of local packages prior to installation. To configure <code>yum</code> to verify s...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for All yum Package Repositories

    To ensure signature checking is not disabled for any repos, remove any lines from files in <code>/etc/yum.repos.d</code> of the form: <pre>gpgcheck...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for Repository Metadata

    Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages w...
    Rule High Severity
    Show

  • Ensure Red Hat GPG Key Installed

    To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them),...
    Rule High Severity
    Show

  • Ensure Software Patches Installed

    If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates: <pre>$ ...
    Rule Medium Severity
    Show

  • Enable dnf-automatic Timer

    The dnf-automatic timer can be enabled with the following command: 
    $ sudo systemctl enable dnf-automatic.timer
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules