Guide to the Secure Configuration of Debian 12
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Detect stack corruption on calls to schedule()
This option checks for a stack overrun on calls to schedule(). If the stack end location is found to be overwritten always panic as the content of ...Rule Medium Severity -
Harden slab freelist metadata
This feature protects integrity of the allocator's metadata. This configuration is available from kernel 4.14. The configuration that was used to ...Rule Medium Severity -
Randomize slab freelist
Randomizes the freelist order used on creating new pages. This configuration is available from kernel 5.9, but may be available if backported by di...Rule Medium Severity -
Disallow merge of slab caches
For reduced kernel memory fragmentation, slab caches can be merged when they share the same size and other characteristics. This carries a risk of ...Rule Medium Severity -
Stack Protector buffer overlow detection
This feature puts, at the beginning of functions, a canary value on the stack just before the return address, and validates the value just before a...Rule Medium Severity -
Strong Stack Protector
This features adds canary logic protection to more kinds of vulnerable functions than CONFIG_STACKPROTECTOR, but not to all functions so that perfo...Rule Medium Severity -
Make the kernel text and rodata read-only
When set, kernel text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available fr...Rule Medium Severity -
Make the module text and rodata read-only
When set, module text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available fr...Rule Medium Severity -
User a virtually-mapped stack
Enable this to use virtually-mapped kernel stacks with guard pages. This configuration is available from kernel 4.9. The configuration that was us...Rule Medium Severity -
Generate some entropy during boot and runtime
Instrument some kernel code to extract some entropy from both original and artificially created program state. This will help especially embedded s...Rule Medium Severity -
Randomize layout of sensitive kernel structures
Randomize at compile-time the layouts of structures that are entirely function pointers (and have not been manually annotated with __no_randomize_l...Rule Medium Severity -
Poison kernel stack before returning from syscalls
This option makes the kernel erase the kernel stack before returning from system calls. This has the effect of leaving the stack initialized to the...Rule Medium Severity -
Force initialization of variables containing userspace addresses
While the kernel is built with warnings enabled for any missed stack variable initializations, this warning is silenced for anything passed by refe...Rule Medium Severity -
zero-init everything passed by reference
Zero-initialize any stack variables that may be passed by reference and had not already been explicitly initialized. This configuration is availabl...Rule Medium Severity -
Configure Syslog
The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...Group -
Ensure rsyslog-gnutls is installed
TLS protocol support for rsyslog is installed. The <code>rsyslog-gnutls</code> package can be installed with the following command: <pre> $ apt-ge...Rule Medium Severity -
Ensure rsyslog is Installed
Rsyslog is installed by default. The <code>rsyslog</code> package can be installed with the following command: <pre> $ apt-get install rsyslog</pre...Rule Medium Severity -
Enable rsyslog Service
The <code>rsyslog</code> service provides syslog-style logging by default on Debian 12. The <code>rsyslog</code> service can be enabled with the f...Rule Medium Severity -
Ensure Proper Configuration of Log Files
The file <code>/etc/rsyslog.conf</code> controls where log message are written. These are controlled by lines called <i>rules</i>, which consist of...Group -
Ensure Rsyslog Authenticates Off-Loaded Audit Records
Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to suppo...Rule Medium Severity -
Ensure Rsyslog Encrypts Off-Loaded Audit Records
Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to suppo...Rule Medium Severity -
Ensure Rsyslog Encrypts Off-Loaded Audit Records
Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to suppo...Rule Medium Severity -
Ensure Log Files Are Owned By Appropriate Group
The group-owner of all log files written by <code>rsyslog</code> should be <code>adm</code>. These log files are determined by the second part of e...Rule Medium Severity -
Ensure Log Files Are Owned By Appropriate User
The owner of all log files written by <code>rsyslog</code> should be <code>adm</code>. These log files are determined by the second part of each ...Rule Medium Severity -
Ensure System Log Files Have Correct Permissions
The file permissions for all log files written by <code>rsyslog</code> should be set to 640, or more restrictive. These log files are determined by...Rule Medium Severity -
Enable systemd-journald Service
The <code>systemd-journald</code> service is an essential component of systemd. The <code>systemd-journald</code> service can be enabled with the ...Rule Medium Severity -
Ensure All Logs are Rotated by logrotate
Edit the file <code>/etc/logrotate.d/syslog</code>. Find the first line, which should look like this (wrapped for clarity): <pre>/var/log/message...Group -
Enable logrotate Timer
Thelogrotatetimer can be enabled with the following command:$ sudo systemctl enable logrotate.timer
Rule Medium Severity -
Rsyslog Logs Sent To Remote Host
If system logs are to be useful in detecting malicious activities, it is necessary to send logs to a remote server. An intruder who has compromised...Group -
Ensure Logs Sent To Remote Host
To configure rsyslog to send logs to a remote log server, open <code>/etc/rsyslog.conf</code> and read and understand the last section of the file,...Rule Medium Severity -
Configure TLS for rsyslog remote logging
Configure <code>rsyslog</code> to use Transport Layer Security (TLS) support for logging to remote server for the Forwarding Output Module in <code...Rule Medium Severity -
Configure CA certificate for rsyslog remote logging
Configure CA certificate for <code>rsyslog</code> logging to remote server using Transport Layer Security (TLS) using correct path for the <code>De...Rule Medium Severity -
Verify Group Who Owns /etc/ipsec.d Directory
To properly set the group owner of/etc/ipsec.d, run the command:$ sudo chgrp root /etc/ipsec.d
Rule Medium Severity -
Verify User Who Owns /etc/ipsec.d Directory
To properly set the owner of/etc/ipsec.d, run the command:$ sudo chown root /etc/ipsec.d
Rule Medium Severity -
Inspect and Activate Default Rules
View the currently-enforced <code>iptables</code> rules by running the command: <pre>$ sudo iptables -nL --line-numbers</pre> The command is analog...Group -
Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.accept_ra_defrtr</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...Rule Unknown Severity -
Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.accept_ra_pinfo</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ...Rule Unknown Severity -
Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.accept_ra_rtr_pref</code> kernel parameter, run the following command: <pre>$ sudo sysctl ...Rule Unknown Severity -
Disable Accepting ICMP Redirects for All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...Rule Medium Severity -
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl...Rule Medium Severity -
Configure Auto Configuration on All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.autoconf</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv...Rule Unknown Severity -
Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.max_addresses</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ne...Rule Unknown Severity -
Configure Denying Router Solicitations on All IPv6 Interfaces
To set the runtime status of the <code>net.ipv6.conf.all.router_solicitations</code> kernel parameter, run the following command: <pre>$ sudo sysct...Rule Unknown Severity -
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
To set the runtime status of the <code>net.ipv6.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sy...Rule Medium Severity -
Configure Auto Configuration on All IPv6 Interfaces By Default
To set the runtime status of the <code>net.ipv6.conf.default.autoconf</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...Rule Unknown Severity -
Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default
To set the runtime status of the <code>net.ipv6.conf.default.max_addresses</code> kernel parameter, run the following command: <pre>$ sudo sysctl -...Rule Unknown Severity -
Configure Denying Router Solicitations on All IPv6 Interfaces By Default
To set the runtime status of the <code>net.ipv6.conf.default.router_solicitations</code> kernel parameter, run the following command: <pre>$ sudo s...Rule Unknown Severity -
Disable Accepting Packets Routed Between Local Interfaces
To set the runtime status of the <code>net.ipv4.conf.all.accept_local</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...Rule Medium Severity -
Disable Accepting ICMP Redirects for All IPv4 Interfaces
To set the runtime status of the <code>net.ipv4.conf.all.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...Rule Medium Severity -
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
To set the runtime status of the <code>net.ipv4.conf.all.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.