Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 8

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Disable vsyscalls

    To disable use of virtual syscalls, add the argument <code>vsyscall=none</code> to the default GRUB 2 command line for the Linux operating system. To ensure that <code>vsyscall=none</code> is added...
    Rule Medium Severity
    Show

  • net.ipv4.icmp_echo_ignore_broadcasts

    Ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
    Value
    Show

  • Disable Logwatch on Clients if a Logserver Exists

    Does your site have a central logserver which has been configured to report on logs received from all systems? If so: <pre>$ sudo rm /etc/cron.daily/0logwatch</pre> If no logserver exists, it will ...
    Rule Unknown Severity
    Show

  • zIPL bootloader configuration

    During the boot process, the bootloader is responsible for starting the execution of the kernel and passing options to it. The default Red Hat Enterprise Linux 8 boot loader for s390x systems is ca...
    Group
    Show

  • Enable Auditing to Start Prior to the Audit Daemon in zIPL

    To ensure all processes can be audited, even those which start prior to the audit daemon, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>audit=1</code> included ...
    Rule Medium Severity
    Show

  • Extend Audit Backlog Limit for the Audit Daemon in zIPL

    To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>audit_ba...
    Rule Medium Severity
    Show

  • Ensure all zIPL boot entries are BLS compliant

    Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS) by checking that /etc/zipl.conf doesn't contain image = .
    Rule Medium Severity
    Show

  • Ensure zIPL bootmap is up to date

    Make sure that <code>/boot/bootmap</code> is up to date.<br> Every time a boot entry or zIPL configuration is changed <code>/boot/bootmap</code> needs to be updated to reflect the changes.<br> Run ...
    Rule Medium Severity
    Show

  • Ensure SELinux Not Disabled in zIPL

    To ensure SELinux is not disabled at boot time, check that no boot entry in /boot/loader/entries/*.conf has selinux=0 included in its options.
    Rule Medium Severity
    Show

  • Enable page allocator poisoning in zIPL

    To enable poisoning of free pages, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>page_poison=1</code> included in its options.<br> To ensure that new kernels an...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules