Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 9

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Screensaver Lock Delay

    Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt
    Value
    Show

  • Enable GNOME3 Screensaver Idle Activation

    To activate the screensaver in the GNOME3 desktop after a period of inactivity, add or set <code>idle-activation-enabled</code> to <code>true</code...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Idle Activation

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <pre>/org/gnome/desktop/screensaver/idle-acti...
    Rule Medium Severity
    Show

  • Set GNOME3 Screensaver Inactivity Timeout

    The idle time-out value for inactivity in the GNOME3 desktop is configured via the <code>idle-delay</code> setting must be set under an appropriate...
    Rule Medium Severity
    Show

  • Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC

    The sudo <code>NOEXEC</code> tag, when specified, prevents user executed commands from executing other commands, like a shell for example. This sho...
    Rule High Severity
    Show

  • Set GNOME3 Screensaver Lock Delay After Activation Period

    To activate the locking delay of the screensaver in the GNOME3 desktop when the screensaver is activated, add or set <code>lock-delay</code> to <co...
    Rule Medium Severity
    Show

  • Enable GNOME3 Screensaver Lock After Idle Period

    To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set <code>lock-enabled</code> to <code>true</code> in <c...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <pre>/org/gnome/desktop/screensaver/lock-enab...
    Rule Medium Severity
    Show

  • Implement Blank Screensaver

    To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set <code>picture-uri</code> to <code>string ''</code> in <code>/etc...
    Rule Medium Severity
    Show

  • Disable Full User Name on Splash Shield

    By default when the screen is locked, the splash shield will show the user's full name. This should be disabled to prevent casual observers from se...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Screensaver Settings

    If not already configured, ensure that users cannot change GNOME3 screensaver lock settings by adding <code>/org/gnome/desktop/screensaver/lock-del...
    Rule Medium Severity
    Show

  • Ensure Users Cannot Change GNOME3 Session Idle Settings

    If not already configured, ensure that users cannot change GNOME3 session idle settings by adding <code>/org/gnome/desktop/session/idle-delay</code...
    Rule Medium Severity
    Show

  • GNOME System Settings

    GNOME provides configuration and functionality to a graphical desktop environment that changes grahical configurations or allow a user to perform a...
    Group
    Show

  • collectd_tcp_network_connect SELinux Boolean

    default - Default SELinux boolean setting.
    on - SELinux boolean is enabled.
    off - SELinux boolean is disabled.
    Value
    Show

  • Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3

    By default, <code>GNOME</code> will reboot the system if the <code>Ctrl-Alt-Del</code> key sequence is pressed. <br><br> To configure the system to...
    Rule High Severity
    Show

  • Disable Geolocation in GNOME3

    <code>GNOME</code> allows the clock and applications to track and access location information. This setting should be disabled as applications shou...
    Rule Medium Severity
    Show

  • Disable Power Settings in GNOME3

    By default, <code>GNOME</code> enables a power profile designed for mobile devices with battery usage. While useful for mobile devices, this settin...
    Rule Medium Severity
    Show

  • Disable User Administration in GNOME3

    By default, <code>GNOME</code> will allow all users to have some administratrion capability. This should be disabled so that non-administrative use...
    Rule High Severity
    Show

  • SAP Specific Requirement

    SAP (Systems, Applications and Products in Data Processing) is enterprise software to manage business operations and customer relations. The follow...
    Group
    Show

  • Sudo

    <code>Sudo</code>, which stands for "su 'do'", provides the ability to delegate authority to certain users, groups of users, or system administrato...
    Group
    Show

  • Group name dedicated to the use of sudo

    Specify the name of the group that should own /usr/bin/sudo.
    Value
    Show

  • Sudo - logfile value

    Specify the sudo logfile to use. The default value used here matches the example location from CIS, which uses /var/log/sudo.log.
    Value
    Show

  • Sudo - passwd_timeout value

    Defines the number of minutes before the <code>sudo</code> password prompt times out. Defining 0 means no timeout. The default timeout value is 5 m...
    Value
    Show

  • Sudo - timestamp_timeout value

    Defines the number of minutes that can elapse before <code>sudo</code> will ask for a passwd again. If set to a value less than 0 the user's time s...
    Value
    Show

  • Sudo - umask value

    Specify the sudo umask to use. The actual umask value that is used is the union of the user's umask and the sudo umask. The default sudo umask is 0...
    Value
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

    The sudo <code>use_pty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by ma...
    Rule Medium Severity
    Show

  • Ensure Sudo Logfile Exists - sudo logfile

    A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CI...
    Rule Low Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

    The sudo <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having to authenticate. This shoul...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be dis...
    Rule Medium Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo

    The sudo <code>NOPASSWD</code> and <code>!authenticate</code> option, when specified, allows a user to execute commands using sudo without having t...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is...
    Rule Medium Severity
    Show

  • The operating system must restrict privilege elevation to authorized personnel

    The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms yo...
    Rule Medium Severity
    Show

  • Only the VDSM User Can Use sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <code>vds...
    Rule Medium Severity
    Show

  • Ensure sudo only includes the default configuration directory

    Administrators can configure authorized <code>sudo</code> users via drop-in files, and it is possible to include other directories and configuratio...
    Rule Medium Severity
    Show

  • Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.

    The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.
    Rule Medium Severity
    Show

  • Explicit arguments in sudo specifications

    All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user. If the command is supposed to be executed...
    Rule Medium Severity
    Show

  • Don't define allowed commands in sudoers by means of exclusion

    Policies applied by sudo through the sudoers file should not involve negation. Each user specification in the <code>sudoers</code> file contains a...
    Rule Medium Severity
    Show

  • Don't target root user in the sudoers file

    The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to expl...
    Rule Medium Severity
    Show

  • Ensure invoking users password for privilege escalation when using sudo

    The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validate...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Ensure gnutls-utils is installed

    The gnutls-utils package can be installed with the following command: 
    $ sudo dnf install gnutls-utils
    Rule Medium Severity
    Show

  • Ensure nss-tools is installed

    The nss-tools package can be installed with the following command: 
    $ sudo dnf install nss-tools
    Rule Medium Severity
    Show

  • Install openscap-scanner Package

    The openscap-scanner package can be installed with the following command: 
    $ sudo dnf install openscap-scanner
    Rule Medium Severity
    Show

  • Install rear Package

    The rear package can be installed with the following command: 
    $ sudo dnf install rear
    Rule Medium Severity
    Show

  • Install rng-tools Package

    The rng-tools package can be installed with the following command: 
    $ sudo dnf install rng-tools
    Rule Low Severity
    Show

  • Configure dnf-automatic to Install Only Security Updates

    To configure <code>dnf-automatic</code> to install only security updates automatically, set <code>upgrade_type</code> to <code>security</code> unde...
    Rule Low Severity
    Show

  • Install scap-security-guide Package

    The scap-security-guide package can be installed with the following command: 
    $ sudo dnf install scap-security-guide
    Rule Medium Severity
    Show

  • Install subscription-manager Package

    The subscription-manager package can be installed with the following command: 
    $ sudo dnf install subscription-manager
    Rule Medium Severity
    Show

  • Uninstall geolite2-city Package

    The geolite2-city package can be removed with the following command: 
    $ sudo dnf erase geolite2-city
    Rule Low Severity
    Show

  • Uninstall geolite2-country Package

    The geolite2-country package can be removed with the following command: 
    $ sudo dnf erase geolite2-country
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules