Oracle Linux 7 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The Oracle Linux operating system must ensure cryptographic verification of vendor software packages.
<VulnDiscussion>Cryptographic verification of vendor software packages ensures that all software packages are obtained from a valid source an...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must disable the login screen user list for graphical user interfaces.
<VulnDiscussion>Leaving the user list enabled is a security risk as it allows anyone with physical access to the system to enumerate known us...Rule Medium Severity -
SRG-OS-000363-GPOS-00150
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must be configured to allow sending email notifications of unauthorized configuration changes to designated personnel.
<VulnDiscussion>Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized ...Rule Medium Severity -
The Oracle Linux operating system must audit all uses of the init_module and finit_module syscalls.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000471-GPOS-00216
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must audit all uses of the delete_module syscall.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000471-GPOS-00216
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must audit all uses of the kmod command.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000004-GPOS-00004
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000004-GPOS-00004
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000004-GPOS-00004
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
<VulnDiscussion>Without generating audit specific to the security and mission needs of the organization, it would be difficult to establish, ...Rule Medium Severity -
SRG-OS-000004-GPOS-00004
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000004-GPOS-00004
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to est...Rule Medium Severity -
SRG-OS-000466-GPOS-00210
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must audit all uses of the unlink, unlinkat, rename, renameat, and rmdir syscalls.
<VulnDiscussion>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect an...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must send rsyslog output to a log aggregation server.
<VulnDiscussion>Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is ...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
<VulnDiscussion>Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messa...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must use a virus scan program.
<VulnDiscussion>Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread thro...Rule High Severity -
SRG-OS-000027-GPOS-00008
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.
<VulnDiscussion>Operating system management includes the ability to control the number of users and user sessions that utilize an operating s...Rule Low Severity -
SRG-OS-000096-GPOS-00050
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments.
<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....Rule Medium Severity -
SRG-OS-000033-GPOS-00014
<GroupDescription></GroupDescription>Group -
The Oracle Linux 7 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.
<VulnDiscussion>Unapproved mechanisms for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to...Rule Medium Severity -
SRG-OS-000163-GPOS-00072
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 15 minutes of inactivity from the user at a command prompt, except to fulfill documented and validated mission requirements.
<VulnDiscussion>Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take c...Rule Medium Severity -
SRG-OS-000023-GPOS-00006
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.
<VulnDiscussion>Display of a standardized and approved use notification before granting access to the publicly accessible operating system en...Rule Medium Severity -
SRG-OS-000250-GPOS-00093
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.
<VulnDiscussion>Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptograph...Rule Medium Severity -
SRG-OS-000250-GPOS-00093
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
<VulnDiscussion>Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptograph...Rule Medium Severity -
SRG-OS-000250-GPOS-00093
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
<VulnDiscussion>Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptograph...Rule Medium Severity -
SRG-OS-000433-GPOS-00193
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must implement virtual address space randomization.
<VulnDiscussion>Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code intr...Rule Medium Severity -
SRG-OS-000423-GPOS-00187
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must be configured so that all networked systems have SSH installed.
<VulnDiscussion>Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected commu...Rule Medium Severity -
SRG-OS-000423-GPOS-00187
<GroupDescription></GroupDescription>Group -
The Oracle Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.
<VulnDiscussion>Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected commu...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.