Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of openEuler 2203

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Restrict Programs from Dangerous Execution Patterns

    The recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution ar...
    Group
    Show

  • Enable ExecShield

    ExecShield describes kernel features that provide protection against exploitation of memory corruption errors such as buffer overflows. These featu...
    Group
    Show

  • kernel.kptr_restrict

    Configure exposition of kernel pointer addresses
    Value
    Show

  • Disable Apache if Possible

    If Apache was installed and activated, but the system does not need to act as a web server, then it should be disabled and removed from the system.
    Group
    Show

  • Configure auditd admin_space_left Action on Low Disk Space

    The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...
    Rule Medium Severity
    Show

  • Non-UEFI GRUB2 bootloader configuration

    Non-UEFI GRUB2 bootloader configuration
    Group
    Show

  • UEFI GRUB2 bootloader configuration

    UEFI GRUB2 bootloader configuration
    Group
    Show

  • Kernel Configuration

    Contains rules that check the kernel configuration that was used to build it.
    Group
    Show

  • Enable seccomp to safely compute untrusted bytecode

    This kernel feature is useful for number crunching applications that may need to compute untrusted bytecode during their execution. By using pipes ...
    Rule Medium Severity
    Show

  • Ensure rsyslog Default File Permissions Configured

    rsyslog will create logfiles that do not already exist on the system. This settings controls what permissions will be applied to these newly create...
    Rule Medium Severity
    Show

  • System Settings

    Contains rules that check correct system settings.
    Group
    Show

  • Installing and Maintaining Software

    The following sections contain information on security-relevant choices during the initial operating system installation process and the setup of s...
    Group
    Show

  • System and Software Integrity

    System and software integrity can be gained by installing antivirus, increasing system encryption strength with FIPS, verifying installed software,...
    Group
    Show

  • Install AIDE

    The aide package can be installed with the following command: 
    $ sudo dnf install aide
    Rule Medium Severity
    Show

  • Build and Test AIDE Database

    Run the following command to generate a new database: <pre>$ sudo /usr/sbin/aide --init</pre> By default, the database will be written to the fil...
    Rule Medium Severity
    Show

  • System Cryptographic Policies

    Linux has the capability to centrally configure cryptographic polices. The command <code>update-crypto-policies</code> is used to set the policy ap...
    Group
    Show

  • The system-provided crypto policies

    Specify the crypto policy for the system.
    Value
    Show

  • net.ipv4.conf.default.rp_filter

    Enables source route verification
    Value
    Show

  • net.ipv4.conf.default.secure_redirects

    Enable to prevent hijacking of routing path by only allowing redirects from gateways known in routing table. Disable to refuse acceptance of secure...
    Value
    Show

  • net.ipv4.icmp_echo_ignore_broadcasts

    Ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
    Value
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules