Guide to the Secure Configuration of Red Hat Enterprise Linux 7
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Configure A Banner Page For Each Website
Configure a login banner for each website when authentication is required for user access.Rule Low Severity -
Each Web Content Directory Must Contain An index.html File
Every <code>DocumentRoot</code> that is configured should have an <code>index.html</code> file that exists. Add an <code>index.html</code> file to ...Rule Low Severity -
The Postfix package is installed
A mail server is required for sending emails. The <code>postfix</code> package can be installed with the following command: <pre> $ sudo yum instal...Rule Medium Severity -
Disable Web Content Symbolic Links
For each <code><Directory></code> instance, remove the following: <pre>FollowSymLinks</pre> If symbolic links are allowed, the following can ...Rule High Severity -
Encrypt All File Uploads
Use only secure encrypted logons and connections for uploading files to the web site.Rule High Severity -
Remove .java And .jpp Files
.javaand.jppfiles should not exist and should be removed from the web server.Rule Low Severity -
The robots.txt Files Must Not Exist
Remove any <code>robots.txt</code> files that may exist with any web content. Other methods must be employed if there is information on the web sit...Rule Medium Severity -
Ensure Web Content Located on Separate partition
The <code>DocumentRoot</code> directory is used for storing web content and data. Ensure that the <code>DocumentRoot</code> directory exists on a s...Rule Medium Severity -
Use Denial-of-Service Protection Modules
Denial-of-service attacks are difficult to detect and prevent while maintaining acceptable access to authorized users. However, some traffic-shapin...Group -
IMAP and POP3 Server
Dovecot provides IMAP and POP3 services. It is not installed by default. The project page at <a href="http://www.dovecot.org">http://www.dovec...Group -
Configure Dovecot if Necessary
If the system will operate as an IMAP or POP3 server, the dovecot software should be configured securely by following the recommendations below.Group -
Enable SSL Support
SSL should be used to encrypt network traffic between the Dovecot server and its clients. Users must authenticate to the Dovecot server in order ...Group -
Uninstall Sendmail Package
Sendmail is not the default mail transfer agent and is not installed by default. The <code>sendmail</code> package can be removed with the followin...Rule Medium Severity -
Configure Dovecot to Use the SSL Certificate file
This option tells Dovecot where to find the mail server's SSL Certificate. <br><br> Edit <code>/etc/dovecot/conf.d/10-ssl.conf</code> and add or co...Rule Unknown Severity -
Configure Dovecot to Use the SSL Key file
This option tells Dovecot where to find the mail server's SSL Key. <br><br> Edit <code>/etc/dovecot/conf.d/10-ssl.conf</code> and add or correct th...Rule Unknown Severity -
Disable Plaintext Authentication
To prevent Dovecot from attempting plaintext authentication of clients, edit <code>/etc/dovecot/conf.d/10-auth.conf</code> and add\or correct the f...Rule Unknown Severity -
Enable the SSL flag in /etc/dovecot.conf
To allow clients to make encrypted connections the <code>ssl</code> flag in Dovecot's configuration file needs to be set to <code>yes</code>. <br><...Rule Unknown Severity -
Support Only the Necessary Protocols
Dovecot supports the IMAP and POP3 protocols, as well as SSL-protected versions of those protocols. Configure the Dovecot server to support only ...Group -
Disable Cyrus IMAP
If the system does not need to operate as an IMAP or POP3 server, the Cyrus IMAP software should be removed.Group -
Disable Dovecot
If the system does not need to operate as an IMAP or POP3 server, the dovecot software should be disabled and removed.Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.