Skip to content
Log In

Guide to the Secure Configuration of Ubuntu 16.04

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SSH LoginGraceTime setting

    Configure parameters for how long the servers stays connected before the user has successfully logged in
    Value
    Show

  • SSH MaxStartups setting

    Configure parameters for maximum concurrent unauthenticated connections to the SSH daemon.
    Value
    Show

  • LDAP

    LDAP is a popular directory service, that is, a standardized way of looking up information from a central database. Ubuntu 16.04 includes software that enables a system to act as both an LDAP clien...
    Group
    Show

  • Configure OpenLDAP Clients

    This section provides information on which security settings are important to configure in OpenLDAP clients by manually editing the appropriate configuration files. Ubuntu 16.04 provides an automa...
    Group
    Show

  • Configure OpenLDAP Server

    This section details some security-relevant settings for an OpenLDAP server.
    Group
    Show

  • Uninstall openldap-servers Package

    The slapd package is not installed by default on a Ubuntu 16.04 system. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended...
    Rule Low Severity
    Show

  • The Postfix package is installed

    A mail server is required for sending emails. The postfix package can be installed with the following command: 
    $ apt-get install postfix
    Rule Medium Severity
    Show

  • Configure SMTP For Mail Clients

    This section discusses settings for Postfix in a submission-only e-mail configuration.
    Group
    Show

  • Postfix relayhost

    Specify the host all outbound email should be routed into.
    Value
    Show

  • Postfix Root Mail Alias

    Specify an email address (string) for a root mail alias.
    Value
    Show

  • Configure System to Forward All Mail For The Root Account

    Make sure that mails delivered to root user are forwarded to a monitored email address. Make sure that the address <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_ali...
    Rule Medium Severity
    Show

  • Configure System to Forward All Mail through a specific host

    Set up a relay host that will act as a gateway for all outbound email. Edit the file <code>/etc/postfix/main.cf</code> to ensure that only the following <code>relayhost</code> line appears: <pre>re...
    Rule Medium Severity
    Show

  • NFS and RPC

    The Network File System is a popular distributed filesystem for the Unix environment, and is very widely deployed. This section discusses the circumstances under which it is possible to disable NF...
    Group
    Show

  • Disable All NFS Services if Possible

    If there is not a reason for the system to operate as either an NFS client or an NFS server, follow all instructions in this section to disable subsystems required by NFS.
    Group
    Show

  • Disable netfs if Possible

    To determine if any network filesystems handled by netfs are currently mounted on the system execute the following command: <pre>$ mount -t nfs,nfs4,smbfs,cifs,ncpfs</pre> If the command did not re...
    Group
    Show

  • Configure NFS Servers

    The steps in this section are appropriate for systems which operate as NFS servers.
    Group
    Show

  • Ensure All-Squashing Disabled On All Exports

    The <code>all_squash</code> maps all uids and gids to an anonymous user. This should be disabled by removing any instances of the <code>all_squash</code> option from the file <code>/etc/exports</co...
    Rule Low Severity
    Show

  • Vendor Approved Time Servers

    The list of vendor-approved time servers
    Value
    Show

  • Install the ntp service

    The ntpd service should be installed.
    Rule High Severity
    Show

  • The Chronyd service is enabled

    chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information o...
    Rule Medium Severity
    Show

  • Enable systemd_timesyncd Service

    The systemd_timesyncd service can be enabled with the following command: 
    $ sudo systemctl enable systemd_timesyncd.service
    Rule High Severity
    Show

  • Ensure Chrony is only configured with the server directive

    Check that Chrony only has time sources configured with the server directive.
    Rule Medium Severity
    Show

  • A remote time server for Chrony is configured

    <code>Chrony</code> is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. M...
    Rule Medium Severity
    Show

  • Rlogin, Rsh, and Rexec

    The Berkeley r-commands are legacy services which allow cleartext remote access and have an insecure trust model.
    Group
    Show

  • SSH RekeyLimit - size

    Specify the size component of the rekey limit.
    Value
    Show

  • SSH RekeyLimit - size

    Specify the size component of the rekey limit.
    Value
    Show

  • SSH Compression Setting

    Specify the compression setting for SSH connections.
    Value
    Show

  • SSH Server

    The SSH protocol is recommended for remote login and remote file transfer. SSH provides confidentiality and integrity for data exchanged between two systems, as well as server authentication, throu...
    Group
    Show

  • SSH session Idle time

    Specify duration of allowed idle time.
    Value
    Show

  • SSH Max authentication attempts

    Specify the maximum number of authentication attempts per connection.
    Value
    Show

  • SSH Max Sessions Count

    Specify the maximum number of open sessions permitted.
    Value
    Show

  • SSH Max Keep Alive Count

    Specify the maximum number of idle message counts before session is terminated.
    Value
    Show

  • Install the OpenSSH Server Package

    The openssh-server package should be installed. The openssh-server package can be installed with the following command: 
    $ apt-get install openssh-server
    Rule Medium Severity
    Show

  • Remove the OpenSSH Server Package

    The openssh-server package should be removed. The openssh-server package can be removed with the following command: 
    $ apt-get remove openssh-server
    Rule Medium Severity
    Show

  • Disable SSH Server If Possible

    The SSH server service, sshd, is commonly needed. However, if it can be disabled, do so. This is unusual, as SSH is a common method for encrypted and authenticated remote access.
    Rule High Severity
    Show

  • Verify Group Ownership on SSH Server Private *_key Key Files

    SSH server private keys, files that match the /etc/ssh/*_key glob, must be group-owned by root group.
    Rule Medium Severity
    Show

  • Verify Group Ownership on SSH Server Public *.pub Key Files

    SSH server public keys, files that match the /etc/ssh/*.pub glob, must be group-owned by root group.
    Rule Medium Severity
    Show

  • Verify Ownership on SSH Server Private *_key Key Files

    SSH server private keys, files that match the /etc/ssh/*_key glob, must be owned by root user.
    Rule Medium Severity
    Show

  • Verify Ownership on SSH Server Public *.pub Key Files

    SSH server public keys, files that match the /etc/ssh/*.pub glob, must be owned by root user.
    Rule Medium Severity
    Show

  • Verify Permissions on SSH Server Private *_key Key Files

    SSH server private keys - files that match the <code>/etc/ssh/*_key</code> glob, have to have restricted permissions. If those files are owned by the <code>root</code> user and the <code>root</code...
    Rule Medium Severity
    Show

  • Verify Permissions on SSH Server Public *.pub Key Files

    To properly set the permissions of /etc/ssh/*.pub, run the command: 
    $ sudo chmod 0644 /etc/ssh/*.pub
    Rule Medium Severity
    Show

  • Configure OpenSSH Server if Necessary

    If the system needs to act as an SSH server, then certain changes should be made to the OpenSSH daemon configuration file <code>/etc/ssh/sshd_config</code>. The following recommendations can be app...
    Group
    Show

  • Set SSH Client Alive Count Max to zero

    The SSH server sends at most <code>ClientAliveCountMax</code> messages during a SSH session and waits for a response from the SSH client. The option <code>ClientAliveInterval</code> configures time...
    Rule Medium Severity
    Show

  • Set SSH Client Alive Count Max

    The SSH server sends at most <code>ClientAliveCountMax</code> messages during a SSH session and waits for a response from the SSH client. The option <code>ClientAliveInterval</code> configures time...
    Rule Medium Severity
    Show

  • Disable Host-Based Authentication

    SSH's cryptographic host-based authentication is more secure than <code>.rhosts</code> authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organ...
    Rule Medium Severity
    Show

  • Allow Only SSH Protocol 2

    Only SSH protocol version 2 connections should be permitted. The default setting in <code>/etc/ssh/sshd_config</code> is correct, and can be verified by ensuring that the following line appears: <p...
    Rule High Severity
    Show

  • Disable Compression Or Set Compression to delayed

    Compression is useful for slow network connections over long distances but can cause performance issues on local LANs. If use of compression is required, it should be enabled only after a user has ...
    Rule Medium Severity
    Show

  • Disable SSH Access via Empty Passwords

    Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for <code>PermitEmptyPasswords<...
    Rule High Severity
    Show

  • Disable GSSAPI Authentication

    Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms like GSSAPI. <br> The default SSH configuration disallows authentications based on GSSAPI. The appropriate c...
    Rule Medium Severity
    Show

  • Disable PubkeyAuthentication Authentication

    Unless needed, SSH should not permit extraneous or unnecessary authentication mechanisms. To disable PubkeyAuthentication authentication, add or correct the following line in <code>/etc/ssh/sshd_...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules