Skip to content
Log In

Guide to the Secure Configuration of SUSE Linux Enterprise 15

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Verify that System Executables Have Root Ownership

    System executables are stored in the following directories by default: <pre>/bin /sbin /usr/bin /usr/libexec /usr/local/bin /usr/local/sbin /usr/sbin</pre> All files in these directories should be ...
    Rule Medium Severity
    Show

  • net.ipv4.conf.default.log_martians

    Disable so you don't Log Spoofed Packets, Source Routed Packets, Redirect Packets
    Value
    Show

  • net.ipv4.conf.default.rp_filter

    Enables source route verification
    Value
    Show

  • Disable the selinuxuser_execheap SELinux Boolean

    By default, the SELinux boolean <code>selinuxuser_execheap</code> is disabled. When enabled this boolean is enabled it allows selinuxusers to execute code from the heap. If this setting is enabled,...
    Rule Medium Severity
    Show

  • Disable the ssh_sysadm_login SELinux Boolean

    By default, the SELinux boolean <code>ssh_sysadm_login</code> is disabled. If this setting is enabled, it should be disabled. To disable the <code>ssh_sysadm_login</code> SELinux boolean, run the ...
    Rule Medium Severity
    Show

  • Disable Avahi Server Software

    The avahi-daemon service can be disabled with the following command: 
    $ sudo systemctl mask --now avahi-daemon.service
    Rule Medium Severity
    Show

  • Disable KDump Kernel Crash Analyzer (kdump)

    The <code>kdump</code> service provides a kernel crash dump analyzer. It uses the <code>kexec</code> system call to boot a secondary kernel ("capture" kernel) following a system crash, which can lo...
    Rule Medium Severity
    Show

  • net.ipv6.conf.all.accept_source_route

    Trackers could be using source-routed packets to generate traffic that seems to be intra-net, but actually was created outside and has been redirected.
    Value
    Show

  • Verify Owner on cron.d

    To properly set the owner of /etc/cron.d, run the command: 
    $ sudo chown root /etc/cron.d
    Rule Medium Severity
    Show

  • Verify Owner on cron.daily

    To properly set the owner of /etc/cron.daily, run the command: 
    $ sudo chown root /etc/cron.daily
    Rule Medium Severity
    Show

  • net.ipv6.conf.all.forwarding

    Toggle IPv6 Forwarding
    Value
    Show

  • Enforce all AppArmor Profiles

    AppArmor profiles define what resources applications are able to access. To set all profiles to enforce mode run the following command: <pre>$ sudo aa-enforce /etc/apparmor.d/*</pre> To list unconf...
    Rule Medium Severity
    Show

  • All AppArmor Profiles are in enforce or complain mode

    AppArmor profiles define what resources applications are able to access. To set all profiles to either <code>enforce</code> or <code>complain</code> mode run the following command to set all profi...
    Rule Medium Severity
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows for the selection of different kernels - possibly ...
    Group
    Show

  • L1TF vulnerability mitigation

    Defines the L1TF vulneratility mitigations to employ.
    Value
    Show

  • MDS vulnerability mitigation

    Defines the MDS vulneratility mitigation to employ.
    Value
    Show

  • Confidence level on Hardware Random Number Generator

    Defines the level of trust on the hardware random number generators available in the system and the percentage of entropy to credit.
    Value
    Show

  • Spec Store Bypass Mitigation

    This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated.
    Value
    Show

  • Disable Recovery Booting

    SUSE Linux Enterprise 15 systems support an "recovery boot" option that can be used to prevent services from being started. The <code>GRUB_DISABLE_RECOVERY</code> configuration option in <code>/etc...
    Rule Medium Severity
    Show

  • IOMMU configuration directive

    On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some of the system critical units such as the memory. Configure the default Gru...
    Rule Unknown Severity
    Show

  • Force kernel panic on uncorrected MCEs

    A Machine Check Exception is an error generated by the CPU itdetects an error in itself, memory or I/O devices. These errors may be corrected and generate a check log entry, if an error cannot be c...
    Rule Medium Severity
    Show

  • Ensure SMAP is not disabled during boot

    The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into memory pages in the user space, it is enabled by default since Linux kernel 3.7. But it could be disabled t...
    Rule Medium Severity
    Show

  • Ensure SMEP is not disabled during boot

    The SMEP is used to prevent the supervisor mode from executing user space code, it is enabled by default since Linux kernel 3.0. But it could be disabled through kernel boot parameters. Ensure tha...
    Rule Medium Severity
    Show

  • Disable merging of slabs with similar size

    The kernel may merge similar slabs together to reduce overhead and increase cache hotness of objects. Disabling merging of slabs keeps the slabs separate and reduces the risk of kernel heap overflo...
    Rule Medium Severity
    Show

  • net.ipv6.conf.all.max_addresses

    Maximum number of autoconfigured IPv6 addresses
    Value
    Show

  • Enforce Spectre v2 mitigation

    Spectre V2 is an indirect branch poisoning attack that can lead to data leakage. An exploit for Spectre V2 tricks the indirect branch predictor into executing code from a future indirect branch cho...
    Rule High Severity
    Show

  • Ensure debug-shell service is not enabled during boot

    systemd's <code>debug-shell</code> service is intended to diagnose systemd related boot issues with various <code>systemctl</code> commands. Once enabled and following a system reboot, the root she...
    Rule Medium Severity
    Show

  • Non-UEFI GRUB2 bootloader configuration

    Non-UEFI GRUB2 bootloader configuration
    Group
    Show

  • Verify /boot/grub2/grub.cfg Group Ownership

    The file <code>/boot/grub2/grub.cfg</code> should be group-owned by the <code>root</code> group to prevent destruction or modification of the file. To properly set the group owner of <code>/boot/g...
    Rule Medium Severity
    Show

  • Verify /boot/grub2/grub.cfg User Ownership

    The file <code>/boot/grub2/grub.cfg</code> should be owned by the <code>root</code> user to prevent destruction or modification of the file. To properly set the owner of <code>/boot/grub2/grub.cfg...
    Rule Medium Severity
    Show

  • Verify /boot/grub2/grub.cfg Permissions

    File permissions for <code>/boot/grub2/grub.cfg</code> should be set to 600. To properly set the permissions of <code>/boot/grub2/grub.cfg</code>, run the command: <pre>$ sudo chmod 600 /boot/grub...
    Rule Medium Severity
    Show

  • Set Boot Loader Password in grub2

    The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br> <br> Since plaintext passwords are a security risk, generate a hash...
    Rule High Severity
    Show

  • UEFI GRUB2 bootloader configuration

    UEFI GRUB2 bootloader configuration
    Group
    Show

  • Protect Random-Number Entropy Pool

    The I/O operations of the Linux kernel block layer due to their inherently unpredictable execution times have been traditionally considered as a reliable source to contribute to random-number entro...
    Group
    Show

  • Kernel Configuration

    Contains rules that check the kernel configuration that was used to build it.
    Group
    Show

  • Hash function for kernel module signing

    The hash function to use when signing modules during kernel build process.
    Value
    Show

  • Key and certificate for kernel module signing

    The private key and certificate to use when signing modules during kernel build process. On systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by RFC7512 In the latter...
    Value
    Show

  • Kernel panic timeout

    The time, in seconds, to wait until a reboot occurs. If the value is 0 the system never reboots. If the value is less than 0 the system reboots immediately.
    Value
    Show

  • Do not allow ACPI methods to be inserted/replaced at run time

    This debug facility allows ACPI AML methods to be inserted and/or replaced without rebooting the system. This configuration is available from kernel 3.0. The configuration that was used to build k...
    Rule Low Severity
    Show

  • Disable kernel support for MISC binaries

    Enabling <code>CONFIG_BINFMT_MISC</code> makes it possible to plug wrapper-driven binary formats into the kernel. This is specially useful for programs that need an interpreter to run like Java, Py...
    Rule Medium Severity
    Show

  • Enable support for BUG()

    Disabling this option eliminates support for BUG and WARN, reducing the size of your kernel image and potentially quietly ignoring numerous fatal conditions. You should only consider disabling this...
    Rule Medium Severity
    Show

  • Disable compatibility with brk()

    Enabling compatiliby with <code>brk()</code> allows legacy binaries to run (i.e. those linked against libc5). But this compatibility comes at the cost of not being able to randomize the heap placem...
    Rule Medium Severity
    Show

  • Disable the 32-bit vDSO

    Certain buggy versions of glibc (2.3.3) will crash if they are presented with a 32-bit vDSO that is not mapped at the address indicated in its segment table. Setting <code>CONFIG_COMPAT_VDSO</code>...
    Rule Low Severity
    Show

  • Enable checks on credential management

    Enable this to turn on some debug checking for credential management. The additional code keeps track of the number of pointers from task_structs to any given cred struct, and checks to see that th...
    Rule Low Severity
    Show

  • net.ipv6.conf.all.router_solicitations

    Accept all router solicitations?
    Value
    Show

  • Disable kernel debugfs

    <code>debugfs</code> is a virtual file system that kernel developers use to put debugging files into. Enable this option to be able to read and write to these files. The configuration that was use...
    Rule Low Severity
    Show

  • Enable checks on linked list manipulation

    Enable this to turn on extended checks in the linked-list walking routines. The configuration that was used to build kernel is available at <code>/boot/config-*</code>. To check the configurat...
    Rule Low Severity
    Show

  • Enable checks on notifier call chains

    Enable this to turn on sanity checking for notifier call chains. This is most useful for kernel developers to make sure that modules properly unregister themselves from notifier chains. The config...
    Rule Low Severity
    Show

  • Enable checks on scatter-gather (SG) table operations

    Scatter-gather tables are mechanism used for high performance I/O on DMA devices. Enable this to turn on checks on scatter-gather tables. The configuration that was used to build kernel is availab...
    Rule Low Severity
    Show

  • Disable /dev/kmem virtual device support

    Disable support for the /dev/kmem device. The configuration that was used to build kernel is available at <code>/boot/config-*</code>. To check the configuration value for <code>CONFIG_DEVKMEM...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules