Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 8

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/

    At a minimum, the audit system should collect administrator actions for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit ...
    Rule Medium Severity
    Show

  • Record Events that Modify User/Group Information - /etc/gshadow

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following lines to a file with suffix <co...
    Rule Medium Severity
    Show

  • Record Events When Privileged Executables Are Run

    Verify the system generates an audit record when privileged functions are executed. If audit is using the "auditctl" tool to load the rules, run the following command: <pre>$ sudo grep execve /et...
    Rule Medium Severity
    Show

  • Shutdown System When Auditing Failures Occur

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following line to to the bottom of a file...
    Rule Medium Severity
    Show

  • Record Events that Modify User/Group Information

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following lines to a file with suffix <co...
    Rule Medium Severity
    Show

  • Record Events that Modify User/Group Information - /etc/passwd

    If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following lines to a file with suffix <co...
    Rule Medium Severity
    Show

  • Record Attempts to perform maintenance activities

    The Red Hat Enterprise Linux 8 operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. Verify the operating...
    Rule Medium Severity
    Show

  • Record Access Events to Audit Log Directory

    The audit system should collect access events to read audit log directory. The following audit rule will assure that access to audit log directory are collected. <pre>-a always,exit -F dir=/var/log...
    Rule Medium Severity
    Show

  • System Audit Directories Must Be Group Owned By Root

    All audit directories must be group owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>. To properly set the group owner of <code>/var/log/audit</code>, run the co...
    Rule Medium Severity
    Show

  • System Audit Directories Must Be Owned By Root

    All audit directories must be owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>. To properly set the owner of <code>/var/log/audit</code>, run the command: <pre>...
    Rule Medium Severity
    Show

  • System Audit Logs Must Be Group Owned By Root

    All audit logs must be group owned by root user. The path for audit log can be configured via <code>log_file</code> parameter in <pre>/etc/audit/auditd.conf</pre> or, by default, the path for audit...
    Rule Medium Severity
    Show

  • Audit Configuration Files Must Be Owned By Group root

    All audit configuration files must be owned by group root. 
    chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
    Rule Medium Severity
    Show

  • Audit Configuration Files Must Be Owned By Root

    All audit configuration files must be owned by root user. To properly set the owner of <code>/etc/audit/</code>, run the command: <pre>$ sudo chown root /etc/audit/ </pre> To properly set the own...
    Rule Medium Severity
    Show

  • System Audit Logs Must Be Owned By Root

    All audit logs must be owned by root user and group. By default, the path for audit log is <pre>/var/log/audit/</pre>. To properly set the owner of <code>/var/log/audit</code>, run the command: <p...
    Rule Medium Severity
    Show

  • System Audit Logs Must Be Owned By Root

    All audit logs must be owned by root user. The path for audit log can be configured via <code>log_file</code> parameter in <pre>/etc/audit/auditd.conf</pre> or by default, the path for audit log is...
    Rule Medium Severity
    Show

  • Audit Configuration Files Permissions are 640 or More Restrictive

    All audit configuration files permissions must be 640 or more restrictive. 
    chmod 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
    Rule Medium Severity
    Show

  • System Audit Logs Must Have Mode 0640 or Less Permissive

    Determine where the audit logs are stored with the following command: <pre>$ sudo grep -iw log_file /etc/audit/auditd.conf log_file = /var/log/audit/audit.log</pre> Configure the audit log to be p...
    Rule Medium Severity
    Show

  • Record Execution Attempts to Run ACL Privileged Commands

    At a minimum, the audit system should collect the execution of ACL privileged commands for all users and root.
    Group
    Show

  • Record Execution Attempts to Run SELinux Privileged Commands

    At a minimum, the audit system should collect the execution of SELinux privileged commands for all users and root.
    Group
    Show

  • Record File Deletion Events by User

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit r...
    Group
    Show

  • Record Information on Kernel Modules Loading and Unloading

    To capture kernel module loading and unloading events, use following lines, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: <pr...
    Group
    Show

  • Record Attempts to Alter Logon and Logout Events

    The audit system already collects login information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during dae...
    Group
    Show

  • Record Events that Modify the System's Discretionary Access Controls - chown

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - fchmod

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - fchmodat

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - fchown

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - fremovexattr

    At a minimum, the audit system should collect file permission changes for all users and root. <br> <br> If the <code>auditd</code> daemon is configured to use the <code>augenrules</...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - fsetxattr

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - lchown

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - lsetxattr

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Record Events that Modify the System's Discretionary Access Controls - removexattr

    At a minimum, the audit system should collect file permission changes for all users and root. <br> <br> If the <code>auditd</code> daemon is configured to use the <code>augenrules</...
    Rule Medium Severity
    Show

  • Record Any Attempts to Run chacl

    At a minimum, the audit system should collect any execution attempt of the <code>chacl</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenr...
    Rule Medium Severity
    Show

  • Record Any Attempts to Run setfacl

    At a minimum, the audit system should collect any execution attempt of the <code>setfacl</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>auge...
    Rule Medium Severity
    Show

  • Record Any Attempts to Run chcon

    At a minimum, the audit system should collect any execution attempt of the <code>chcon</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenr...
    Rule Medium Severity
    Show

  • Record Any Attempts to Run restorecon

    At a minimum, the audit system should collect any execution attempt of the <code>restorecon</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>a...
    Rule Medium Severity
    Show

  • Record Any Attempts to Run setfiles

    At a minimum, the audit system should collect any execution attempt of the <code>setfiles</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>aug...
    Rule Medium Severity
    Show

  • Record Any Attempts to Run seunshare

    At a minimum, the audit system should collect any execution attempt of the <code>seunshare</code> command for all users and root. If the <code>auditd</code> daemon is configured to use the <code>au...
    Rule Medium Severity
    Show

  • Configure a Sufficiently Large Partition for Audit Logs

    The Red Hat Enterprise Linux 8 operating system must allocate audit record storage capacity to store at least one weeks worth of audit records when audit records are not immediately sent to a centr...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - rmdir

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit r...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - rename

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit r...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - renameat

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit r...
    Rule Medium Severity
    Show

  • Ensure auditd Collects File Deletion Events by User - unlink

    At a minimum, the audit system should collect file deletion events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit r...
    Rule Medium Severity
    Show

  • Action for audispd to take when disk is full

    The setting for disk_full_action in /etc/audisp/audisp-remote.conf
    Value
    Show

  • Action for audispd to take when network fails

    The setting for network_failure_action in /etc/audisp/audisp-remote.conf
    Value
    Show

  • Remote server for audispd to send audit records

    The setting for remote_server in /etc/audit/audisp-remote.conf
    Value
    Show

  • Account for auditd to send email when actions occurs

    The setting for action_mail_acct in /etc/audit/auditd.conf
    Value
    Show

  • Record Successful Ownership Changes to Files - chown

    At a minimum, the audit system should collect file ownership changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit...
    Rule Medium Severity
    Show

  • Record Successful Permission Changes to Files - fchmod

    At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...
    Rule Medium Severity
    Show

  • Action for auditd to take when disk space is low

    The setting for admin_space_left_action in /etc/audit/auditd.conf
    Value
    Show

  • Record Successful Ownership Changes to Files - fchown

    At a minimum, the audit system should collect file ownership changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules