Guide to the Secure Configuration of SUSE Linux Enterprise 12
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Verify Group Who Owns /etc/sysctl.d Directory
To properly set the group owner of/etc/sysctl.d, run the command:$ sudo chgrp root /etc/sysctl.d
Rule Medium Severity -
Verify that Shared Library Files Have Root Ownership
System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by default: <pre>/lib /lib64 /usr/lib /usr/lib64 </pr...Rule Medium Severity -
Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.
System-wide library files are stored in the following directories by default: <pre>/lib /lib64 /usr/lib /usr/lib64 </pre> All system-wide shared library files should be protected from unauthorised ...Rule Medium Severity -
Disable Mounting of squashfs
To configure the system to prevent the <code>squashfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/squashfs.conf</code>: <pre>install squashfs /...Rule Low Severity -
Verify that local /var/log/messages is not world-readable
Files containing sensitive informations should be protected by restrictive permissions. Most of the time, there is no need that these files need to be read by any non-root user To properly set the...Rule Medium Severity -
Disable loading and unloading of kernel modules
To set the runtime status of the <code>kernel.modules_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.modules_disabled=1</pre> To make sure that the settin...Rule Medium Severity -
Disable Core Dumps
A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases, only software developers legitimately need to acc...Group -
Restrict Exposed Kernel Pointer Addresses Access
To set the runtime status of the <code>kernel.kptr_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kptr_restrict=<xccdf-1.2:sub idref="xccdf_org.ssgproject...Rule Medium Severity -
Configure SELinux Policy
The SELinux <code>targeted</code> policy is appropriate for general-purpose desktops and servers, as well as systems in many other roles. To configure the system to use this policy, add or correct ...Rule Medium Severity -
Configure the deny_execmem SELinux Boolean
By default, the SELinux boolean <code>deny_execmem</code> is disabled. This setting should be configured to <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_deny_execmem" use="legacy"><...Rule Medium Severity -
Disable the ssh_sysadm_login SELinux Boolean
By default, the SELinux boolean <code>ssh_sysadm_login</code> is disabled. If this setting is enabled, it should be disabled. To disable the <code>ssh_sysadm_login</code> SELinux boolean, run the ...Rule Medium Severity -
Disable Avahi Publishing
To prevent Avahi from publishing its records, edit <code>/etc/avahi/avahi-daemon.conf</code> and ensure the following line appears in the <code>[publish]</code> section: <pre>disable-publishing=yes...Rule Low Severity -
Disable KDump Kernel Crash Analyzer (kdump)
The <code>kdump</code> service provides a kernel crash dump analyzer. It uses the <code>kexec</code> system call to boot a secondary kernel ("capture" kernel) following a system crash, which can lo...Rule Medium Severity -
Verify Group Who Owns cron.hourly
To properly set the group owner of/etc/cron.hourly, run the command:$ sudo chgrp root /etc/cron.hourly
Rule Medium Severity -
Verify Group Who Owns cron.monthly
To properly set the group owner of/etc/cron.monthly, run the command:$ sudo chgrp root /etc/cron.monthly
Rule Medium Severity -
Verify Group Who Owns cron.weekly
To properly set the group owner of/etc/cron.weekly, run the command:$ sudo chgrp root /etc/cron.weekly
Rule Medium Severity -
Verify Permissions on cron.monthly
To properly set the permissions of/etc/cron.monthly, run the command:$ sudo chmod 0700 /etc/cron.monthly
Rule Medium Severity -
Allow Only SSH Protocol 2
Only SSH protocol version 2 connections should be permitted. The default setting in <code>/etc/ssh/sshd_config</code> is correct, and can be verified by ensuring that the following line appears: <p...Rule High Severity -
Restrict at and cron to Authorized Users if Necessary
The <code>/etc/cron.allow</code> and <code>/etc/at.allow</code> files contain lists of users who are allowed to use <code>cron</code> and at to delay execution of processes. If these files exist an...Group -
DHCP
The Dynamic Host Configuration Protocol (DHCP) allows systems to request and obtain an IP address and other configuration parameters from a server. <br> <br> This guide recommends configuring...Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.