Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 8

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Scan All Uploaded Content for Malicious Software

    Install anti-virus software on the system and set it to automatically scan new files that are introduced to the web server.
    Rule Medium Severity
    Show

  • Configure firewall to Allow Access to the Web Server

    By default, <code>iptables</code> blocks access to the ports used by the web server. To configure <code>iptables</code> to allow port 80 traffic, ...
    Rule Low Severity
    Show

  • Ensure Remote Administrative Access Is Encrypted

    Ensure that the SSH server service is enabled. The <code>sshd</code> service can be enabled with the following command: <pre>$ sudo systemctl enab...
    Rule High Severity
    Show

  • Run httpd in a chroot Jail if Practical

    Running <code>httpd</code> inside a <code>chroot</code> jail is designed to isolate the web server process to a small section of the filesystem, li...
    Group
    Show

  • Restrict File and Directory Access

    Minimize access to critical httpd files and directories.
    Group
    Show

  • Set Permissions on the /etc/httpd/conf/ Directory

    To properly set the permissions of /etc/http/conf, run the command: 
    $ sudo chmod 0750 /etc/http/conf
    Rule Unknown Severity
    Show

  • Set Permissions on the /var/log/httpd/ Directory

    Ensure that the permissions on the web server log directory is set to 700: 
    $ sudo chmod 700 /var/log/httpd/
    This is its default setting.
    Rule Medium Severity
    Show

  • Set Permissions on All Configuration Files Inside /etc/httpd/conf.d/

    To properly set the permissions of /etc/http/conf.d/*, run the command: 
    $ sudo chmod 0640 /etc/http/conf.d/*
    Rule Unknown Severity
    Show

  • Set Permissions on All Configuration Files Inside /etc/httpd/conf/

    To properly set the permissions of /etc/http/conf/*, run the command: 
    $ sudo chmod 0640 /etc/http/conf/*
    Rule Unknown Severity
    Show

  • Set Permissions on All Configuration Files Inside /etc/httpd/conf.modules.d/

    To properly set the permissions of /etc/http/conf.modules.d/*, run the command: 
    $ sudo chmod 0640 /etc/http/conf.modules.d/*
    Rule Unknown Severity
    Show

  • HTTPD Log Files Must Be Owned By Root

    All <code>httpd</code> logs must be owned by root user and group. By default, the path for httpd logs is <code>/var/log/httpd/</code> To properly ...
    Rule Medium Severity
    Show

  • Configure PERL Securely

    PERL (Practical Extraction and Report Language) is an interpreted language optimized for scanning arbitrary text files, extracting information from...
    Group
    Show

  • Restrict Other Critical Directories

    All accessible web directories should be configured with similarly restrictive settings. The <code>Options</code> directive should be limited to ne...
    Rule Unknown Severity
    Show

  • Configure HTTP PERL Scripts To Use TAINT Option

    If the <code>mod_perl</code> module is installed, enable Perl Taint checking in <code>/etc/httpd/conf/httpd.conf</code>. To enable Perl Taint check...
    Rule Medium Severity
    Show

  • Configure PHP Securely

    PHP is a widely-used and often misconfigured server-side scripting language. It should be used with caution, but configured appropriately when need...
    Group
    Show

  • Directory Restrictions

    The Directory tags in the web server configuration file allow finer grained access control for a specified directory. All web directories should be...
    Group
    Show

  • Web Content Directories Must Not Be Shared Anonymously

    Web content directories should not be shared anonymously over remote filesystems such as <code>nfs</code> and <code>smb</code>. Remove the shares f...
    Rule Medium Severity
    Show

  • Remove Write Permissions From Filesystem Paths And Server Scripts

    Configure permissions for each instance of <code>Alias</code>, <code>ScriptAlias</code>, and <code>ScriptAliasMatch</code> that exist. <pre>$ sudo ...
    Rule High Severity
    Show

  • Disable Anonymous FTP Access

    If any directories that contain dynamic scripts can be accessed via FTP by any group or user that does not require access, remove permissions to su...
    Rule Medium Severity
    Show

  • Ignore HTTPD .htaccess Files

    Set AllowOverride to none for each instant of <Directory>.
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules