Guide to the Secure Configuration of Red Hat Enterprise Linux 7
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Application Whitelisting Daemon
Fapolicyd (File Access Policy Daemon) implements application whitelisting to decide file access rights. Applications that are known via a reputatio...Group -
fapolicyd Must be Configured to Limit Access to Users Home Folders
fapolicyd needs be configured so that users cannot give access to their home folders to other users.Rule Medium Severity -
FTP Server
FTP is a common method for allowing remote access to files. Like telnet, the FTP protocol is unencrypted, which means that passwords and other data...Group -
Disable vsftpd if Possible
To minimize attack surface, disable vsftpd if at all possible.Group -
Uninstall vsftpd Package
Thevsftpdpackage can be removed with the following command:$ sudo yum erase vsftpd
Rule High Severity -
Disable FTP Uploads if Possible
Is there a mission-critical reason for users to upload files via FTP? If not, edit the vsftpd configuration file to add or correct the following co...Rule Unknown Severity -
Place the FTP Home Directory on its Own Partition
By default, the anonymous FTP root is the home directory of the FTP user account. The df command can be used to verify that this directory is on it...Rule Unknown Severity -
Enable Logging of All FTP Transactions
Add or correct the following configuration options within the <code>vsftpd</code> configuration file, located at <code>/etc/vsftpd/vsftpd.conf</cod...Rule Unknown Severity -
Create Warning Banners for All FTP Users
Edit the vsftpd configuration file, which resides at <code>/etc/vsftpd/vsftpd.conf</code> by default. Add or correct the following configuration ...Rule Medium Severity -
Restrict the Set of Users Allowed to Access FTP
This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to do this entirely due to legacy applic...Group -
Limit Users Allowed FTP Access if Necessary
If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this...Rule Unknown Severity -
Restrict Access to Anonymous Users if Possible
Is there a mission-critical reason for users to transfer files to/from their own accounts using FTP, rather than using a secure protocol like SCP/S...Rule Medium Severity -
Use vsftpd to Provide FTP Service if Necessary
If your use-case requires FTP service, install and set-up vsftpd to provide it.Group -
Install vsftpd Package
If this system must operate as an FTP server, install the <code>vsftpd</code> package via the standard channels. The <code>vsftpd</code> package ca...Rule Low Severity -
Web Server
The web server is responsible for providing access to content via the HTTP protocol. Web servers represent a significant security risk because: <br...Group -
Disable Apache if Possible
If Apache was installed and activated, but the system does not need to act as a web server, then it should be disabled and removed from the system.Group -
Uninstall httpd Package
Thehttpdpackage can be removed with the following command:$ sudo yum erase httpd
Rule Unknown Severity -
Disable httpd Service
Thehttpdservice can be disabled with the following command:$ sudo systemctl mask --now httpd.service
Rule Unknown Severity -
Disable NGINX if Possible
If NGINX was installed and activated, but the system does not need to act as a web server, then it should be removed from the system.Group -
Install Apache if Necessary
If <code>httpd</code> was not installed and activated, but the system needs to act as a web server, then it should be installed on the system. Foll...Group -
Confirm Minimal Built-in Modules Installed
The default <code>httpd</code> installation minimizes the number of modules that are compiled directly into the binary (<code>core prefork http_cor...Group -
Secure Apache Configuration
The <code>httpd</code> configuration file is <code>/etc/httpd/conf/httpd.conf</code>. Apply the recommendations in the remainder of this section to...Group -
HTTPD Log Level
The setting for LogLevel in /etc/httpd/conf/httpd.confValue -
Maximum KeepAlive Requests for HTTPD
The setting for MaxKeepAliveRequests in httpd.confValue -
Configure Error Log Format
<code>LogFormat</code> should be enabled and set to the following in <code>/etc/httpd/conf/httpd.conf</code>: <pre>LogFormat "a %A %h %H %l %m %s %...Rule Medium Severity -
Configure The Number of Allowed Simultaneous Requests
The <code>MaxKeepAliveRequests</code> directive should be set and configured to <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_max_ke...Rule Medium Severity -
MIME types for csh or sh shell programs must be disabled
Users must not be allowed to access the shell programs.Rule Medium Severity -
Enable HTTPD Error Logging
ErrorLogshould be enabled and set to the following in/etc/httpd/conf/httpd.conf:ErrorLog "logs/error_log"
Rule Medium Severity -
Enable HTTPD LogLevel
<code>LogLevel</code> should be enabled and set to <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_httpd_loglevel" use="legacy"></xccd...Rule Medium Severity -
Enable HTTPD System Logging
<code>CustomLog</code> should be enabled and set to the following in <code>/etc/httpd/conf/httpd.conf</code>: <pre>CustomLog "logs/access_log" comb...Rule Medium Severity -
The web server password(s) must be entrusted to the SA or Web Manager
Normally, a service account is established for the web server. This is because a privileged account is not desirable and the server is designed to ...Rule Medium Severity -
A public web server, if hosted on the NIPRNet, must be isolated in an accredited DoD DMZ extension
To minimize exposure of private assets to unnecesarry risk by attackers, public web servers must be isolated from internal systems. Logically relo...Rule Medium Severity -
Installation of a compiler on production web server is prohibited
The presence of a compiler on a production server facilitates the malicious user's task of creating custom versions of programs and installing Troj...Rule Medium Severity -
A private web server must be located on a separate controlled access subnet
Private web servers, which host sites that serve controlled access data, must be protected from outside threats in addition to insider threats. Is...Rule Medium Severity -
Public web server resources must not be shared with private assets
It is important to segregate public web server resources from private resources located behind the DoD DMZ in order to protect private assets.Rule Medium Severity -
Backup interactive scripts on the production web server are prohibited
Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken.Rule Medium Severity -
Configure Operating System to Protect Web Server
The following configuration steps should be taken on the system which hosts the web server, in order to provide as safe an environment as possible ...Group -
Scan All Uploaded Content for Malicious Software
Install anti-virus software on the system and set it to automatically scan new files that are introduced to the web server.Rule Medium Severity -
Ensure Remote Administrative Access Is Encrypted
Ensure that the SSH server service is enabled. The <code>sshd</code> service can be enabled with the following command: <pre>$ sudo systemctl enab...Rule High Severity -
Run httpd in a chroot Jail if Practical
Running <code>httpd</code> inside a <code>chroot</code> jail is designed to isolate the web server process to a small section of the filesystem, li...Group -
Restrict File and Directory Access
Minimize access to criticalhttpdfiles and directories.Group -
Set Permissions on the /etc/httpd/conf/ Directory
To properly set the permissions of/etc/http/conf, run the command:$ sudo chmod 0750 /etc/http/conf
Rule Unknown Severity -
Set Permissions on the /var/log/httpd/ Directory
Ensure that the permissions on the web server log directory is set to 700:$ sudo chmod 700 /var/log/httpd/
This is its default setting.Rule Medium Severity -
Set Permissions on All Configuration Files Inside /etc/httpd/conf.d/
To properly set the permissions of/etc/http/conf.d/*, run the command:$ sudo chmod 0640 /etc/http/conf.d/*
Rule Unknown Severity -
Set Permissions on All Configuration Files Inside /etc/httpd/conf/
To properly set the permissions of/etc/http/conf/*, run the command:$ sudo chmod 0640 /etc/http/conf/*
Rule Unknown Severity -
Set Permissions on All Configuration Files Inside /etc/httpd/conf.modules.d/
To properly set the permissions of/etc/http/conf.modules.d/*, run the command:$ sudo chmod 0640 /etc/http/conf.modules.d/*
Rule Unknown Severity -
HTTPD Log Files Must Be Owned By Root
All <code>httpd</code> logs must be owned by root user and group. By default, the path for httpd logs is <code>/var/log/httpd/</code> To properly ...Rule Medium Severity -
Configure PERL Securely
PERL (Practical Extraction and Report Language) is an interpreted language optimized for scanning arbitrary text files, extracting information from...Group -
Configure HTTP PERL Scripts To Use TAINT Option
If the <code>mod_perl</code> module is installed, enable Perl Taint checking in <code>/etc/httpd/conf/httpd.conf</code>. To enable Perl Taint check...Rule Medium Severity -
Configure PHP Securely
PHP is a widely-used and often misconfigured server-side scripting language. It should be used with caution, but configured appropriately when need...Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.