Skip to content
Log In

Guide to the Secure Configuration of Anolis OS 23

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Disable DNS Server

    DNS software should be disabled on any systems which does not need to be a nameserver. Note that the BIND DNS server software is not installed on Anolis OS 23 by default. The remainder of this sect...
    Group
    Show

  • Uninstall bind Package

    The named service is provided by the bind package. The bind package can be removed with the following command: 
    $ sudo yum erase bind
    Rule Low Severity
    Show

  • Disable named Service

    The named service can be disabled with the following command: 
    $ sudo systemctl mask --now named.service
    Rule Medium Severity
    Show

  • Application Whitelisting Daemon

    Fapolicyd (File Access Policy Daemon) implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applicat...
    Group
    Show

  • fapolicyd Must be Configured to Limit Access to Users Home Folders

    fapolicyd needs be configured so that users cannot give access to their home folders to other users.
    Rule Medium Severity
    Show

  • FTP Server

    FTP is a common method for allowing remote access to files. Like telnet, the FTP protocol is unencrypted, which means that passwords and other data transmitted during the session can be captured an...
    Group
    Show

  • Disable vsftpd if Possible

    To minimize attack surface, disable vsftpd if at all possible.
    Group
    Show

  • Disable vsftpd Service

    The vsftpd service can be disabled with the following command: 
    $ sudo systemctl mask --now vsftpd.service
    Rule Medium Severity
    Show

  • Configure vsftpd to Provide FTP Service if Necessary

    The primary vsftpd configuration file is /etc/vsftpd.conf, if that file exists, or /etc/vsftpd/vsftpd.conf if it does not.
    Group
    Show

  • Restrict the Set of Users Allowed to Access FTP

    This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to do this entirely due to legacy applications, how to restrict insecure FTP login to only...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules