Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Ubuntu 18.04

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Remove the kernel mapping in user mode

    This feature reduces the number of hardware side channels by ensuring that the majority of kernel addresses are not mapped into userspace. This con...
    Rule High Severity
    Show

  • Kernel panic oops

    Enable the kernel to panic when it oopses. This has the same effect as setting oops=panic on the kernel command line. The configuration that was u...
    Rule Medium Severity
    Show

  • Kernel panic timeout

    Set the timeout value (in seconds) until a reboot occurs when the kernel panics. A timeout of 0 configures the system to wait forever. With a timeo...
    Rule Medium Severity
    Show

  • Disable support for /proc/kkcore

    Provides a virtual ELF core file of the live kernel. The configuration that was used to build kernel is available at <code>/boot/config-*</code>. ...
    Rule Low Severity
    Show

  • Randomize the address of the kernel image (KASLR)

    In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the physical address at which the kernel image is decompressed and...
    Rule Medium Severity
    Show

  • Randomize the kernel memory sections

    Randomizes the base virtual address of kernel memory sections (physical memory mapping, vmalloc &amp; vmemmap). This configuration is available fro...
    Rule Medium Severity
    Show

  • Avoid speculative indirect branches in kernel

    Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks by avoiding speculative indirect branches. Requires a...
    Rule Medium Severity
    Show

  • Enable seccomp to safely compute untrusted bytecode

    This kernel feature is useful for number crunching applications that may need to compute untrusted bytecode during their execution. By using pipes ...
    Rule Medium Severity
    Show

  • Enable use of Berkeley Packet Filter with seccomp

    Enable tasks to build secure computing environments defined in terms of Berkeley Packet Filter programs which implement task-defined system call fi...
    Rule Medium Severity
    Show

  • Enable different security models

    This allows you to choose different security modules to be configured into your kernel. The configuration that was used to build kernel is availab...
    Rule Medium Severity
    Show

  • Enable Yama support

    This enables support for LSM module Yama, which extends DAC support with additional system-wide security settings beyond regular Linux discretionar...
    Rule Medium Severity
    Show

  • Enable SLUB debugging support

    SLUB has extensive debug support features and this allows the allocator validation checking to be enabled. The configuration that was used to buil...
    Rule Medium Severity
    Show

  • Enable TCP/IP syncookie support

    Normal TCP/IP networking is open to an attack known as SYN flooding. It is denial-of-service attack that prevents legitimate remote users from bein...
    Rule Medium Severity
    Show

  • Unmap kernel when running in userspace (aka KAISER)

    Speculation attacks against some high-performance processors can be used to bypass MMU permission checks and leak kernel data to userspace. This ca...
    Rule Medium Severity
    Show

  • Disable x86 vsyscall emulation

    Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also disable the helpful warning if a program tries to use a ...
    Rule Low Severity
    Show

  • Kernel GCC plugin configuration

    Contains rules that check the configuration of GCC plugins used by the compiler
    Group
    Show

  • Configure Syslog

    The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...
    Group
    Show

  • Ensure rsyslog is Installed

    Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
     $ apt-get install rsyslog
    Rule Medium Severity
    Show

  • Enable rsyslog Service

    The <code>rsyslog</code> service provides syslog-style logging by default on Ubuntu 18.04. The <code>rsyslog</code> service can be enabled with th...
    Rule Medium Severity
    Show

  • Configure Logwatch on the Central Log Server

    Is this system the central log server? If so, edit the file /etc/logwatch/conf/logwatch.conf as shown below.
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules