Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of openEuler 2203

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Record Information on the Use of Privileged Commands

    At a minimum, the audit system should collect the execution of privileged commands for all users and root.
    Group
    Show

  • Verify Permissions on Files with Local Account Information and Credentials

    The default restrictive permissions for files which act as important security databases such as <code>passwd</code>, <code>shadow</code>, <code>gro...
    Group
    Show

  • Verify Group Who Owns Backup gshadow File

    To properly set the group owner of /etc/gshadow-, run the command: 
    $ sudo chgrp root /etc/gshadow-
    Rule Medium Severity
    Show

  • Verify Group Who Owns shadow File

    To properly set the group owner of /etc/shadow, run the command: 
    $ sudo chgrp root /etc/shadow
    Rule Medium Severity
    Show

  • Ensure PAM Enforces Password Requirements - Enforce for root User

    The pam_pwquality module's <code>enforce_for_root</code> parameter controls requirements for enforcing password complexity for the root user. Enabl...
    Rule Medium Severity
    Show

  • Set Password Hashing Algorithm

    The system's default algorithm for storing password hashes in /etc/shadow is SHA-512. This can be configured in several locations.
    Group
    Show

  • Protect Accounts by Restricting Password-Based Login

    Conventionally, Unix shell accounts are accessed by providing a username and password to a login program, which tests these values for correctness ...
    Group
    Show

  • Ensure All Accounts on the System Have Unique User IDs

    Change user IDs (UIDs), or delete accounts, so each has a unique name.
    Rule Medium Severity
    Show

  • Ensure All Groups on the System Have Unique Group ID

    Change the group name or delete groups, so each has a unique id.
    Rule Medium Severity
    Show

  • Ensure All Groups on the System Have Unique Group Names

    Change the group name or delete groups, so each has a unique name.
    Rule Medium Severity
    Show

  • Verify Permissions on gshadow File

    To properly set the permissions of /etc/gshadow, run the command: 
    $ sudo chmod 0000 /etc/gshadow
    Rule Medium Severity
    Show

  • Ensure All Accounts on the System Have Unique Names

    Ensure accounts on the system have unique names. To ensure all accounts have unique names, run the following command: <pre>$ sudo getent passwd | ...
    Rule Medium Severity
    Show

  • Verify No .forward Files Exist

    The .forward file specifies an email address to forward the user's mail to.
    Rule Medium Severity
    Show

  • Verify No netrc Files Exist

    The <code>.netrc</code> files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files ma...
    Rule Medium Severity
    Show

  • Restrict Partition Mount Options

    System partitions can be mounted with certain options that limit what files on those partitions can do. These options are set in the <code>/etc/fst...
    Group
    Show

  • Sensible umask

    Enter default user umask
    Value
    Show

  • System Accounting with auditd

    The audit service provides substantial capabilities for recording system activities. By default, the service audits about SELinux AVC denials and c...
    Group
    Show

  • Removable Partition

    This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions, and mount_option_nodev_removable...
    Value
    Show

  • Add nodev Option to Removable Media Partitions

    The <code>nodev</code> mount option prevents files from being interpreted as character or block devices. Legitimate character and block devices sho...
    Rule Medium Severity
    Show

  • Add noexec Option to Removable Media Partitions

    The <code>noexec</code> mount option prevents the direct execution of binaries on the mounted filesystem. Preventing the direct execution of binari...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules