Guide to the Secure Configuration of Anolis OS 8
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Minimize Various Optional Components
The following modules perform very specific tasks, sometimes providing access to just a few additional directives. If such functionality is not req...Group -
Use Appropriate Modules to Improve httpd's Security
Among the modules available for <code>httpd</code> are several whose use may improve the security of the web server installation. This section reco...Group -
Deploy mod_security
The <code>security</code> module provides an application level firewall for <code>httpd</code>. Following its installation with the base ruleset, s...Group -
Deploy mod_ssl
Because HTTP is a plain text protocol, all traffic is susceptible to passive monitoring. If there is a need for confidentiality, SSL should be conf...Group -
Restrict Web Server Information Leakage
The <code>ServerTokens</code> and <code>ServerSignature</code> directives determine how much information the web server discloses about the configu...Group -
Configure HTTPD-Served Web Content Securely
Running <code>httpd</code> inside a <code>chroot</code> jail is designed to isolate the web server process to a small section of the filesystem, li...Group -
Web Login Banner Verbiage
Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters ...Value -
Use Denial-of-Service Protection Modules
Denial-of-service attacks are difficult to detect and prevent while maintaining acceptable access to authorized users. However, some traffic-shapin...Group -
IMAP and POP3 Server
Dovecot provides IMAP and POP3 services. It is not installed by default. The project page at <a href="http://www.dovecot.org">http://www.dovec...Group -
Configure Dovecot if Necessary
If the system will operate as an IMAP or POP3 server, the dovecot software should be configured securely by following the recommendations below.Group -
Allow IMAP Clients to Access the Server
The default iptables configuration does not allow inbound access to any services. This modification will allow remote hosts to initiate connection...Group -
Enable SSL Support
SSL should be used to encrypt network traffic between the Dovecot server and its clients. Users must authenticate to the Dovecot server in order ...Group -
Support Only the Necessary Protocols
Dovecot supports the IMAP and POP3 protocols, as well as SSL-protected versions of those protocols. Configure the Dovecot server to support only ...Group -
Disable Cyrus IMAP
If the system does not need to operate as an IMAP or POP3 server, the Cyrus IMAP software should be removed.Group -
Disable Dovecot
If the system does not need to operate as an IMAP or POP3 server, the dovecot software should be disabled and removed.Group -
Disable Dovecot Service
Thedovecotservice can be disabled with the following command:$ sudo systemctl mask --now dovecot.service
Rule Unknown Severity -
Kerberos
The Kerberos protocol is used for authentication across non-secure network. Authentication can happen between various types of principals -- users,...Group -
Configure OpenLDAP Clients
This section provides information on which security settings are important to configure in OpenLDAP clients by manually editing the appropriate con...Group -
Configure OpenLDAP Server
This section details some security-relevant settings for an OpenLDAP server.Group -
Disable LDAP Server (slapd)
The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database.Rule Medium Severity -
Install and Protect LDAP Certificate Files
Create the PKI directory for LDAP certificates if it does not already exist: <pre>$ sudo mkdir /etc/pki/tls/ldap $ sudo chown root:root /etc/pki/tl...Group -
Mail Server Software
Mail servers are used to send and receive email over the network. Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious target...Group -
The Postfix package is installed
A mail server is required for sending emails. The <code>postfix</code> package can be installed with the following command: <pre> $ sudo yum instal...Rule Medium Severity -
Configure SMTP For Mail Clients
This section discusses settings for Postfix in a submission-only e-mail configuration.Group -
Postfix Network Interfaces
The setting for inet_interfaces in /etc/postfix/main.cfValue -
Postfix relayhost
Specify the host all outbound email should be routed into.Value -
Postfix Root Mail Alias
Specify an email address (string) for a root mail alias.Value -
Configure System to Forward All Mail For The Root Account
Make sure that mails delivered to root user are forwarded to a monitored email address. Make sure that the address <xccdf-1.2:sub idref="xccdf_org....Rule Medium Severity -
Use TLS for SMTP AUTH
Postfix provides options to use TLS for certificate-based authentication and encrypted sessions. An encrypted session protects the information that...Group -
Configure System to Forward All Mail From Postmaster to The Root Account
Verify the administrators are notified in the event of an audit processing failure. Check that the "/etc/aliases" file has a defined value for "roo...Rule Medium Severity -
Configure System to Forward All Mail through a specific host
Set up a relay host that will act as a gateway for all outbound email. Edit the file <code>/etc/postfix/main.cf</code> to ensure that only the foll...Rule Medium Severity -
Configure Operating System to Protect Mail Server
The guidance in this section is appropriate for any host which is operating as a site MTA, whether the mail server runs using Sendmail, Postfix, or...Group -
Configure SSL Certificates for Use with SMTP AUTH
If SMTP AUTH is to be used, the use of SSL to protect credentials in transit is strongly recommended. There are also configurations for which it ma...Group -
Ensure Security of Postfix SSL Certificate
Create the PKI directory for mail certificates, if it does not already exist: <pre>$ sudo mkdir /etc/pki/tls/mail $ sudo chown root:root /etc/pki/t...Group -
Configure Postfix if Necessary
Postfix stores its configuration files in the directory /etc/postfix by default. The primary configuration file is/etc/postfix/main.cf.Group -
Configure Postfix Resource Usage to Limit Denial of Service Attacks
Edit <code>/etc/postfix/main.cf</code>. Edit the following lines to configure the amount of system resources Postfix can consume: <pre>default_proc...Group -
Control Mail Relaying
Postfix's mail relay controls are implemented with the help of the smtpd recipient restrictions option, which controls the restrictions placed on t...Group -
Enact SMTP Recipient Restrictions
To configure Postfix to restrict addresses to which it will send mail, see: <a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">h...Group -
Enact SMTP Relay Restrictions
To configure Postfix to restrict addresses to which it will send mail, see: <a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">h...Group -
Disable NFS Server Daemons
There is no need to run the NFS server daemons <code>nfs</code> and <code>rpcsvcgssd</code> except on a small number of properly secured systems de...Group -
Configure Trusted Networks and Hosts
Edit <code>/etc/postfix/main.cf</code>, and configure the contents of the <code>mynetworks</code> variable in one of the following ways: <ul> <li>I...Group -
Require SMTP AUTH Before Relaying from Untrusted Clients
SMTP authentication allows remote clients to relay mail safely by requiring them to authenticate before submitting mail. Postfix's SMTP AUTH uses a...Group -
NFS and RPC
The Network File System is a popular distributed filesystem for the Unix environment, and is very widely deployed. This section discusses the circ...Group -
Disable All NFS Services if Possible
If there is not a reason for the system to operate as either an NFS client or an NFS server, follow all instructions in this section to disable sub...Group -
Disable netfs if Possible
To determine if any network filesystems handled by netfs are currently mounted on the system execute the following command: <pre>$ mount -t nfs,nfs...Group -
Disable Network File Systems (netfs)
The netfs script manages the boot-time mounting of several types of networked filesystems, of which NFS and Samba are the most common. If these fil...Rule Unknown Severity -
Disable Services Used Only by NFS
If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd. <br><br> All of these daemons run with elevated privileges, a...Group -
Disable rpcbind Service
The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they a...Rule Low Severity -
Configure All Systems which Use NFS
The steps in this section are appropriate for all systems which run NFS, whether they operate as clients or as servers.Group -
Make Each System a Client or a Server, not Both
If NFS must be used, it should be deployed in the simplest configuration possible to avoid maintainability problems which may lead to unnecessary s...Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.