Guide to the Secure Configuration of UnionTech OS Server 20
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Restrict Web Server Information Leakage
The <code>ServerTokens</code> and <code>ServerSignature</code> directives determine how much information the web server discloses about the configu...Group -
Configure HTTPD-Served Web Content Securely
Running <code>httpd</code> inside a <code>chroot</code> jail is designed to isolate the web server process to a small section of the filesystem, li...Group -
Web Login Banner Verbiage
Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters ...Value -
Use Denial-of-Service Protection Modules
Denial-of-service attacks are difficult to detect and prevent while maintaining acceptable access to authorized users. However, some traffic-shapin...Group -
IMAP and POP3 Server
Dovecot provides IMAP and POP3 services. It is not installed by default. The project page at <a href="http://www.dovecot.org">http://www.dovec...Group -
Configure Dovecot if Necessary
If the system will operate as an IMAP or POP3 server, the dovecot software should be configured securely by following the recommendations below.Group -
Allow IMAP Clients to Access the Server
The default iptables configuration does not allow inbound access to any services. This modification will allow remote hosts to initiate connection...Group -
Postfix Root Mail Alias
Specify an email address (string) for a root mail alias.Value -
Support Only the Necessary Protocols
Dovecot supports the IMAP and POP3 protocols, as well as SSL-protected versions of those protocols. Configure the Dovecot server to support only ...Group -
Disable Cyrus IMAP
If the system does not need to operate as an IMAP or POP3 server, the Cyrus IMAP software should be removed.Group -
Disable Dovecot
If the system does not need to operate as an IMAP or POP3 server, the dovecot software should be disabled and removed.Group -
Kerberos
The Kerberos protocol is used for authentication across non-secure network. Authentication can happen between various types of principals -- users,...Group -
LDAP
LDAP is a popular directory service, that is, a standardized way of looking up information from a central database. UnionTech OS Server 20 includes...Group -
Configure OpenLDAP Clients
This section provides information on which security settings are important to configure in OpenLDAP clients by manually editing the appropriate con...Group -
Configure OpenLDAP Server
This section details some security-relevant settings for an OpenLDAP server.Group -
Install and Protect LDAP Certificate Files
Create the PKI directory for LDAP certificates if it does not already exist: <pre>$ sudo mkdir /etc/pki/tls/ldap $ sudo chown root:root /etc/pki/tl...Group -
Mail Server Software
Mail servers are used to send and receive email over the network. Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious target...Group -
The Postfix package is installed
A mail server is required for sending emails. The <code>postfix</code> package can be installed with the following command: <pre> $ sudo yum instal...Rule Medium Severity -
Configure SMTP For Mail Clients
This section discusses settings for Postfix in a submission-only e-mail configuration.Group -
Postfix Network Interfaces
The setting for inet_interfaces in /etc/postfix/main.cfValue -
Postfix relayhost
Specify the host all outbound email should be routed into.Value -
Configure System to Forward All Mail For The Root Account
Make sure that mails delivered to root user are forwarded to a monitored email address. Make sure that the address <xccdf-1.2:sub idref="xccdf_org....Rule Medium Severity -
Configure System to Forward All Mail From Postmaster to The Root Account
Verify the administrators are notified in the event of an audit processing failure. Check that the "/etc/aliases" file has a defined value for "roo...Rule Medium Severity -
Configure System to Forward All Mail through a specific host
Set up a relay host that will act as a gateway for all outbound email. Edit the file <code>/etc/postfix/main.cf</code> to ensure that only the foll...Rule Medium Severity -
Configure Operating System to Protect Mail Server
The guidance in this section is appropriate for any host which is operating as a site MTA, whether the mail server runs using Sendmail, Postfix, or...Group -
Configure SSL Certificates for Use with SMTP AUTH
If SMTP AUTH is to be used, the use of SSL to protect credentials in transit is strongly recommended. There are also configurations for which it ma...Group -
Ensure Security of Postfix SSL Certificate
Create the PKI directory for mail certificates, if it does not already exist: <pre>$ sudo mkdir /etc/pki/tls/mail $ sudo chown root:root /etc/pki/t...Group -
Configure Postfix if Necessary
Postfix stores its configuration files in the directory /etc/postfix by default. The primary configuration file is/etc/postfix/main.cf.Group -
Configure Postfix Resource Usage to Limit Denial of Service Attacks
Edit <code>/etc/postfix/main.cf</code>. Edit the following lines to configure the amount of system resources Postfix can consume: <pre>default_proc...Group -
Control Mail Relaying
Postfix's mail relay controls are implemented with the help of the smtpd recipient restrictions option, which controls the restrictions placed on t...Group -
Enact SMTP Recipient Restrictions
To configure Postfix to restrict addresses to which it will send mail, see: <a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">h...Group -
Install the ntp service
The ntpd service should be installed.Rule High Severity -
Enact SMTP Relay Restrictions
To configure Postfix to restrict addresses to which it will send mail, see: <a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">h...Group -
Use TLS for SMTP AUTH
Postfix provides options to use TLS for certificate-based authentication and encrypted sessions. An encrypted session protects the information that...Group -
Configure Trusted Networks and Hosts
Edit <code>/etc/postfix/main.cf</code>, and configure the contents of the <code>mynetworks</code> variable in one of the following ways: <ul> <li>I...Group -
Require SMTP AUTH Before Relaying from Untrusted Clients
SMTP authentication allows remote clients to relay mail safely by requiring them to authenticate before submitting mail. Postfix's SMTP AUTH uses a...Group -
NFS and RPC
The Network File System is a popular distributed filesystem for the Unix environment, and is very widely deployed. This section discusses the circ...Group -
Disable All NFS Services if Possible
If there is not a reason for the system to operate as either an NFS client or an NFS server, follow all instructions in this section to disable sub...Group -
Disable netfs if Possible
To determine if any network filesystems handled by netfs are currently mounted on the system execute the following command: <pre>$ mount -t nfs,nfs...Group -
Disable Network File Systems (netfs)
The netfs script manages the boot-time mounting of several types of networked filesystems, of which NFS and Samba are the most common. If these fil...Rule Unknown Severity -
Disable Services Used Only by NFS
If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd. <br><br> All of these daemons run with elevated privileges, a...Group -
Configure All Systems which Use NFS
The steps in this section are appropriate for all systems which run NFS, whether they operate as clients or as servers.Group -
Make Each System a Client or a Server, not Both
If NFS must be used, it should be deployed in the simplest configuration possible to avoid maintainability problems which may lead to unnecessary s...Group -
The Chronyd service is enabled
chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a ...Rule Medium Severity -
Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2)
Firewalling should be done at each host and at the border firewalls to protect the NFS daemons from remote access, since NFS servers should never b...Group -
Configure NFS Clients
The steps in this section are appropriate for systems which operate as NFS clients.Group -
Disable NFS Server Daemons
There is no need to run the NFS server daemons <code>nfs</code> and <code>rpcsvcgssd</code> except on a small number of properly secured systems de...Group -
Mount Remote Filesystems with Restrictive Options
Edit the file <code>/etc/fstab</code>. For each filesystem whose type (column 3) is <code>nfs</code> or <code>nfs4</code>, add the text <code>,node...Group -
Configure NFS Servers
The steps in this section are appropriate for systems which operate as NFS servers.Group -
Ensure All-Squashing Disabled On All Exports
The <code>all_squash</code> maps all uids and gids to an anonymous user. This should be disabled by removing any instances of the <code>all_squash<...Rule Low Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.