Skip to content
Log In

Guide to the Secure Configuration of Ubuntu 16.04

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Verify Root Has A Primary GID 0

    The root user should have a primary group of 0.
    Rule High Severity
    Show

  • Direct root Logins Not Allowed

    To further limit access to the <code>root</code> account, administrators can disable root logins at the console by editing the <code>/etc/securetty</code> file. This file lists all devices the root...
    Rule Medium Severity
    Show

  • Restrict Serial Port Root Logins

    To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty: 
    ttyS0
ttyS1
    Rule Medium Severity
    Show

  • Configure Polyinstantiation of /tmp Directories

    To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command: <pre>$ sudo mkdir --mode 000 ...
    Rule Low Severity
    Show

  • Configure Polyinstantiation of /var/tmp Directories

    To configure polyinstantiated /tmp directories, first create the parent directories which will hold the polyinstantiation child directories. Use the following command: <pre>$ sudo mkdir --mode 000 ...
    Rule Low Severity
    Show

  • Ensure that User Home Directories are not Group-Writable or World-Readable

    For each human user of the system, view the permissions of the user's home directory: <pre># ls -ld /home/<i>USER</i> </pre> Ensure that the directory is not group-writable and that it is n...
    Rule Medium Severity
    Show

  • Ensure that No Dangerous Directories Exist in Root's Path

    The active path of the root account can be obtained by starting a new root shell and running: <pre># echo $PATH</pre> This will produce a colon-separated list of directories in the path. <br> ...
    Group
    Show

  • Ensure that Root's Path Does Not Include World or Group-Writable Directories

    For each element in root's path, run: 
    # ls -ld DIR
    and ensure that write permissions are disabled for group and other.
    Rule Medium Severity
    Show

  • Ensure that Root's Path Does Not Include Relative Paths or Null Directories

    Ensure that none of the directories in root's path is equal to a single <code>.</code> character, or that it contains any instances that lead to relative path traversal, such as <code>..</code> or ...
    Rule Unknown Severity
    Show

  • Ensure that Users Have Sensible Umask Values

    The umask setting controls the default permissions for the creation of new files. With a default <code>umask</code> setting of 077, files and directories created by users will not be readable by an...
    Group
    Show

  • Sensible umask

    Enter default user umask
    Value
    Show

  • Ensure the Default Umask is Set Correctly in /etc/profile

    To ensure the default umask controlled by <code>/etc/profile</code> is set properly, add or correct the <code>umask</code> setting in <code>/etc/profile</code> to read as follows: <pre>umask <xccdf...
    Rule Medium Severity
    Show

  • System Accounting with auditd

    The audit service provides substantial capabilities for recording system activities. By default, the service audits about SELinux AVC denials and certain types of security-relevant events such as s...
    Group
    Show

  • Ensure the audit Subsystem is Installed

    The audit package should be installed.
    Rule Medium Severity
    Show

  • net.ipv4.conf.default.shared_media

    Controls whether the system can send(router) or accept(host) RFC1620 shared media redirects. <code>shared_media</code> for the interface will be enabled if at least one of conf/{all,interface}/shar...
    Value
    Show

  • Disable Support for IPv6 Unless Needed

    Despite configuration that suggests support for IPv6 has been disabled, link-local IPv6 address auto-configuration occurs even when only an IPv4 address is assigned. The only way to effectively pre...
    Group
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows for the selection of different kernels - possibly ...
    Group
    Show

  • L1TF vulnerability mitigation

    Defines the L1TF vulneratility mitigations to employ.
    Value
    Show

  • Confidence level on Hardware Random Number Generator

    Defines the level of trust on the hardware random number generators available in the system and the percentage of entropy to credit.
    Value
    Show

  • Spec Store Bypass Mitigation

    This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated.
    Value
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules