Skip to content
ATO Pathways
  Log In

Oracle Linux 7 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000163-GPOS-00072

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.

    &lt;VulnDiscussion&gt;Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personn...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.

    &lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, ...
    Rule Medium Severity
    Show

  • SRG-OS-000163-GPOS-00072

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.

    &lt;VulnDiscussion&gt;Terminating an unresponsive SSH session within a short time period reduces the window of opportunity for unauthorized personn...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.

    &lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must display the date and time of the last successful account logon upon an SSH logon.

    &lt;VulnDiscussion&gt;Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of un...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must not permit direct logons to the root account using remote access via SSH.

    &lt;VulnDiscussion&gt;Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.

    &lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, ...
    Rule Medium Severity
    Show

  • SRG-OS-000074-GPOS-00042

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.

    &lt;VulnDiscussion&gt;SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH d...
    Rule High Severity
    Show

  • SRG-OS-000250-GPOS-00093

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

    &lt;VulnDiscussion&gt;DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm m...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.

    &lt;VulnDiscussion&gt;If a public host key file is modified by an unauthorized user, the SSH service may be compromised.&lt;/VulnDiscussion&gt;&lt;...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so the SSH private host key files have mode 0640 or less permissive.

    &lt;VulnDiscussion&gt;If an unauthorized user obtains the private SSH host key file, the host could be impersonated.&lt;/VulnDiscussion&gt;&lt;Fals...
    Rule Medium Severity
    Show

  • SRG-OS-000364-GPOS-00151

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.

    &lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication...
    Rule Medium Severity
    Show

  • SRG-OS-000364-GPOS-00151

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.

    &lt;VulnDiscussion&gt;Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). I...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.

    &lt;VulnDiscussion&gt;If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as anoth...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon uses privilege separation.

    &lt;VulnDiscussion&gt;SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impa...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.

    &lt;VulnDiscussion&gt;If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could res...
    Rule Medium Severity
    Show

  • SRG-OS-000355-GPOS-00143

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

    &lt;VulnDiscussion&gt;Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the cor...
    Rule Medium Severity
    Show

  • SRG-OS-000420-GPOS-00186

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must protect against or limit the effects of Denial of Service (DoS) attacks by validating the operating system is implementing rate-limiting measures on impacted network interfaces.

    &lt;VulnDiscussion&gt;DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot ac...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must enable an application firewall, if available.

    &lt;VulnDiscussion&gt;Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must display the date and time of the last successful account logon upon logon.

    &lt;VulnDiscussion&gt;Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthoriz...
    Rule Low Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must not contain .shosts files.

    &lt;VulnDiscussion&gt;The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based auth...
    Rule High Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must not contain shosts.equiv files.

    &lt;VulnDiscussion&gt;The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is n...
    Rule High Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • For Oracle Linux operating systems using DNS resolution, at least two name servers must be configured.

    &lt;VulnDiscussion&gt;To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolut...
    Rule Low Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.

    &lt;VulnDiscussion&gt;Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than c...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.

    &lt;VulnDiscussion&gt;Enabling reverse path filtering drops packets with invalid source addresses received on the interface. It should not be used...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules