Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 7

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Configure ntpd To Run As ntp User

    ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information ...
    Rule Medium Severity
    Show

  • Specify Additional Remote NTP Servers

    Additional NTP servers can be specified for time synchronization in the file <code>/etc/ntp.conf</code>. To do so, add additional lines of the following form, substituting the IP address or hostna...
    Rule Unknown Severity
    Show

  • Specify a Remote NTP Server

    To specify a remote NTP server for time synchronization, edit the file <code>/etc/ntp.conf</code>. Add or correct the following lines, substituting the IP or hostname of a remote NTP server for <em...
    Rule Medium Severity
    Show

  • Obsolete Services

    This section discusses a number of network-visible services which have historically caused problems for system security, and for which disabling or severely limiting the service has been the best a...
    Group
    Show

  • Uninstall rsync Package

    The rsyncd service can be used to synchronize files between systems over network links. The rsync package can be removed with the following command: 
    $ sudo yum erase rsync
    Rule Medium Severity
    Show

  • Ensure rsyncd service is disabled

    The rsyncd service can be disabled with the following command: 
    $ sudo systemctl mask --now rsyncd.service
    Rule Medium Severity
    Show

  • Xinetd

    The <code>xinetd</code> service acts as a dedicated listener for some network services (mostly, obsolete ones) and can be used to provide access controls and perform some logging. It has been large...
    Group
    Show

  • Install tcp_wrappers Package

    When network services are using the <code>xinetd</code> service, the <code>tcp_wrappers</code> package should be installed. The <code>tcp_wrappers</code> package can be installed with the following...
    Rule Medium Severity
    Show

  • Uninstall xinetd Package

    The xinetd package can be removed with the following command: 
    $ sudo yum erase xinetd
    Rule Low Severity
    Show

  • Ensure /etc/hosts.deny is configured

    The file <code>/etc/hosts.deny</code> together with <code>/etc/hosts.allow</code> provides a simple access control mechanism for network services supporting TCP wrappers. The following line in the ...
    Rule Medium Severity
    Show

  • Verify Group Ownership of /etc/hosts.allow

    To properly set the group owner of /etc/hosts.allow, run the command: 
    $ sudo chgrp root /etc/hosts.allow
    Rule Medium Severity
    Show

  • Verify Group Ownership of /etc/hosts.deny

    To properly set the group owner of /etc/hosts.deny, run the command: 
    $ sudo chgrp root /etc/hosts.deny
    Rule Medium Severity
    Show

  • Verify Ownership of /etc/hosts.allow

    To properly set the owner of /etc/hosts.allow, run the command: 
    $ sudo chown root /etc/hosts.allow
    Rule Medium Severity
    Show

  • Verify Ownership of /etc/hosts.deny

    To properly set the owner of /etc/hosts.deny, run the command: 
    $ sudo chown root /etc/hosts.deny
    Rule Medium Severity
    Show

  • Verify Permissions on /etc/hosts.allow

    To properly set the permissions of /etc/hosts.allow, run the command: 
    $ sudo chmod 0644 /etc/hosts.allow
    Rule Medium Severity
    Show

  • Verify Permissions on /etc/hosts.deny

    To properly set the permissions of /etc/hosts.deny, run the command: 
    $ sudo chmod 0644 /etc/hosts.deny
    Rule Medium Severity
    Show

  • NIS

    The Network Information Service (NIS), also known as 'Yellow Pages' (YP), and its successor NIS+ have been made obsolete by Kerberos, LDAP, and other modern centralized authentication services. NIS...
    Group
    Show

  • Remove NIS Client

    The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client (<code>ypbind</cod...
    Rule Unknown Severity
    Show

  • Uninstall ypserv Package

    The ypserv package can be removed with the following command: 
    $ sudo yum erase ypserv
    Rule High Severity
    Show

  • Disable ypbind Service

    The <code>ypbind</code> service, which allows the system to act as a client in a NIS or NIS+ domain, should be disabled. The <code>ypbind</code> service can be disabled with the following command:...
    Rule Medium Severity
    Show

  • Rlogin, Rsh, and Rexec

    The Berkeley r-commands are legacy services which allow cleartext remote access and have an insecure trust model.
    Group
    Show

  • Telnet

    The telnet protocol does not provide confidentiality or integrity for information transmitted on the network. This includes authentication information such as passwords. Organizations which use tel...
    Group
    Show

  • Uninstall rsh-server Package

    The rsh-server package can be removed with the following command: 
    $ sudo yum erase rsh-server
    Rule High Severity
    Show

  • Uninstall rsh Package

    The rsh package contains the client commands for the rsh services
    Rule Unknown Severity
    Show

  • Disable rexec Service

    The <code>rexec</code> service, which is available with the <code>rsh-server</code> package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xine...
    Rule High Severity
    Show

  • Disable rlogin Service

    The <code>rlogin</code> service, which is available with the <code>rsh-server</code> package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xin...
    Rule High Severity
    Show

  • Disable rsh Service

    The <code>rsh</code> service, which is available with the <code>rsh-server</code> package and runs as a service through xinetd or separately as a systemd socket, should be disabled. If using xinetd...
    Rule High Severity
    Show

  • Remove Host-Based Authentication Files

    The <code>shosts.equiv</code> file lists remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them from any location: <pre>$ sudo ...
    Rule High Severity
    Show

  • Remove Rsh Trust Files

    The files <code>/etc/hosts.equiv</code> and <code>~/.rhosts</code> (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To re...
    Rule High Severity
    Show

  • Remove User Host-Based Authentication Files

    The <code>~/.shosts</code> (in each user's home directory) files list remote hosts and users that are trusted by the local system. To remove these files, run the following command to delete them fr...
    Rule High Severity
    Show

  • Chat/Messaging Services

    The talk software makes it possible for users to send and receive messages across systems through a terminal session.
    Group
    Show

  • Uninstall talk-server Package

    The talk-server package can be removed with the following command: 
     $ sudo yum erase talk-server
    Rule Medium Severity
    Show

  • Uninstall talk Package

    The <code>talk</code> package contains the client program for the Internet talk protocol, which allows the user to chat with other users on different systems. Talk is a communication program which ...
    Rule Medium Severity
    Show

  • Configure the CUPS Service if Necessary

    CUPS provides the ability to easily share local printers with other systems over the network. It does this by allowing systems to share lists of available printers. Additionally, each system that r...
    Group
    Show

  • Disable Printer Browsing Entirely if Possible

    By default, CUPS listens on the network for printer list broadcasts on UDP port 631. This functionality is called printer browsing. To disable printer browsing entirely, edit the CUPS configuration...
    Rule Unknown Severity
    Show

  • Uninstall telnet-server Package

    The telnet-server package can be removed with the following command: 
    $ sudo yum erase telnet-server
    Rule High Severity
    Show

  • Remove telnet Clients

    The telnet client allows users to start connections to other systems via the telnet protocol.
    Rule Low Severity
    Show

  • Disable telnet Service

    Make sure that the activation of the <code>telnet</code> service on system boot is disabled. The <code>telnet</code> socket can be disabled with the following command: <pre>$ sudo systemctl mask -...
    Rule High Severity
    Show

  • TFTP Server

    TFTP is a lightweight version of the FTP protocol which has traditionally been used to configure networking equipment. However, TFTP provides little security, and modern versions of networking oper...
    Group
    Show

  • TFTP server secure directory

    Specify the directory which is used by TFTP server as a root directory when running in secure mode.
    Value
    Show

  • Uninstall tftp-server Package

    The tftp-server package can be removed with the following command: 
     $ sudo yum erase tftp-server
    Rule High Severity
    Show

  • Remove tftp Daemon

    Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between systems. TFTP does not support authentication ...
    Rule Low Severity
    Show

  • Disable tftp Service

    The tftp service should be disabled. The tftp service can be disabled with the following command: 
    $ sudo systemctl mask --now tftp.service
    Rule High Severity
    Show

  • Ensure tftp Daemon Uses Secure Mode

    If running the Trivial File Transfer Protocol (TFTP) service is necessary, it should be configured to change its root directory at startup. To do so, ensure <code>/etc/xinetd.d/tftp</code> includes...
    Rule Medium Severity
    Show

  • Print Support

    The Common Unix Printing System (CUPS) service provides both local and network printing support. A system running the CUPS service can accept print jobs from other systems, process them, and send t...
    Group
    Show

  • Uninstall CUPS Package

    The cups package can be removed with the following command: 
    $ sudo yum erase cups
    Rule Unknown Severity
    Show

  • Disable the CUPS Service

    The cups service can be disabled with the following command: 
    $ sudo systemctl mask --now cups.service
    Rule Unknown Severity
    Show

  • Install the Samba Common Package

    The samba-common package should be installed. The samba-common package can be installed with the following command: 
    $ sudo yum install samba-common
    Rule Medium Severity
    Show

  • Disable Print Server Capabilities

    To prevent remote users from potentially connecting to and using locally configured printers, disable the CUPS print server sharing capabilities. To do so, limit how the server will listen for prin...
    Rule Unknown Severity
    Show

  • Proxy Server

    A proxy server is a very desirable target for a potential adversary because much (or all) sensitive data for a given infrastructure may flow through it. Therefore, if one is required, the system ac...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules