Skip to content
Log In

Guide to the Secure Configuration of Red Hat Enterprise Linux 9

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Install sudo Package

    The sudo package can be installed with the following command: 
    $ sudo dnf install sudo
    Rule Medium Severity
    Show

  • Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC

    The sudo <code>NOEXEC</code> tag, when specified, prevents user executed commands from executing other commands, like a shell for example. This should be enabled by making sure that the <code>NOEXE...
    Rule High Severity
    Show

  • maxrepeat

    Maximum Number of Consecutive Repeating Characters in a Password
    Value
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

    The sudo <code>use_pty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the <code>use_pty</code> tag exists...
    Rule Medium Severity
    Show

  • Ensure Sudo Logfile Exists - sudo logfile

    A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.
    Rule Low Severity
    Show

  • Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the <code>NOPASSWD</code...
    Rule Medium Severity
    Show

  • Require Re-Authentication When Using the sudo Command

    The sudo <code>timestamp_timeout</code> tag sets the amount of time sudo password prompt waits. The default <code>timestamp_timeout</code> value is 5 minutes. The timestamp_timeout should be config...
    Rule Medium Severity
    Show

  • The operating system must restrict privilege elevation to authorized personnel

    The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file...
    Rule Medium Severity
    Show

  • Only the VDSM User Can Use sudo NOPASSWD

    The sudo <code>NOPASSWD</code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <code>vdsm</code> user should have this capability in any s...
    Rule Medium Severity
    Show

  • Ensure sudo only includes the default configuration directory

    Administrators can configure authorized <code>sudo</code> users via drop-in files, and it is possible to include other directories and configuration files from the file currently being parsed. Mak...
    Rule Medium Severity
    Show

  • minclass

    Minimum number of categories of characters that must exist in a password
    Value
    Show

  • minlen

    Minimum number of characters in password
    Value
    Show

  • Configure dnf-automatic to Install Only Security Updates

    To configure <code>dnf-automatic</code> to install only security updates automatically, set <code>upgrade_type</code> to <code>security</code> under <code>[commands]</code> section in <code>/etc/dn...
    Rule Low Severity
    Show

  • ocredit

    Minimum number of other (special characters) in password
    Value
    Show

  • Don't define allowed commands in sudoers by means of exclusion

    Policies applied by sudo through the sudoers file should not involve negation. Each user specification in the <code>sudoers</code> file contains a comma-delimited list of command specifications. T...
    Rule Medium Severity
    Show

  • Don't target root user in the sudoers file

    The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root). User specifications have to explicitly list the runas spec (i.e. the list of targe...
    Rule Medium Severity
    Show

  • Ensure invoking users password for privilege escalation when using sudo

    The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. The expected ou...
    Rule Medium Severity
    Show

  • System Tooling / Utilities

    The following checks evaluate the system for recommended base packages -- both for installation and removal.
    Group
    Show

  • Ensure gnutls-utils is installed

    The gnutls-utils package can be installed with the following command: 
    $ sudo dnf install gnutls-utils
    Rule Medium Severity
    Show

  • Ensure nss-tools is installed

    The nss-tools package can be installed with the following command: 
    $ sudo dnf install nss-tools
    Rule Medium Severity
    Show

  • Install openscap-scanner Package

    The openscap-scanner package can be installed with the following command: 
    $ sudo dnf install openscap-scanner
    Rule Medium Severity
    Show

  • Install rear Package

    The rear package can be installed with the following command: 
    $ sudo dnf install rear
    Rule Medium Severity
    Show

  • Install rng-tools Package

    The rng-tools package can be installed with the following command: 
    $ sudo dnf install rng-tools
    Rule Low Severity
    Show

  • An SELinux Context must be configured for the pam_faillock.so records directory

    The dir configuration option in PAM pam_faillock.so module defines where the lockout records is stored. The configured directory must have the correct SELinux context.
    Rule Medium Severity
    Show

  • Install subscription-manager Package

    The subscription-manager package can be installed with the following command: 
    $ sudo dnf install subscription-manager
    Rule Medium Severity
    Show

  • Uninstall geolite2-city Package

    The geolite2-city package can be removed with the following command: 
    $ sudo dnf erase geolite2-city
    Rule Low Severity
    Show

  • Uninstall geolite2-country Package

    The geolite2-country package can be removed with the following command: 
    $ sudo dnf erase geolite2-country
    Rule Low Severity
    Show

  • Uninstall gssproxy Package

    The gssproxy package can be removed with the following command: 
    $ sudo dnf erase gssproxy
    Rule Medium Severity
    Show

  • Uninstall iprutils Package

    The iprutils package can be removed with the following command: 
    $ sudo dnf erase iprutils
    Rule Medium Severity
    Show

  • Uninstall krb5-workstation Package

    The krb5-workstation package can be removed with the following command: 
    $ sudo dnf erase krb5-workstation
    Rule Medium Severity
    Show

  • Uninstall tuned Package

    The tuned package can be removed with the following command: 
    $ sudo dnf erase tuned
    Rule Medium Severity
    Show

  • Updating Software

    The <code>dnf</code> command line tool is used to install and update software packages. The system also provides a graphical software update tool in the <b>System</b> menu, in the <b>Administration...
    Group
    Show

  • Install dnf-automatic Package

    The dnf-automatic package can be installed with the following command: 
    $ sudo dnf install dnf-automatic
    Rule Medium Severity
    Show

  • Ensure dnf Removes Previous Package Versions

    <code>dnf</code> should be configured to remove previous software components after new versions have been installed. To configure <code>dnf</code> to remove the previous software components after ...
    Rule Low Severity
    Show

  • Configure dnf-automatic to Install Available Updates Automatically

    To ensure that the packages comprising the available updates will be automatically installed by <code>dnf-automatic</code>, set <code>apply_updates</code> to <code>yes</code> under <code>[commands]...
    Rule Medium Severity
    Show

  • retry

    Number of retry attempts before erroring out
    Value
    Show

  • Ensure gpgcheck Enabled for Local Packages

    <code>dnf</code> should be configured to verify the signature(s) of local packages prior to installation. To configure <code>dnf</code> to verify signatures of local packages, set the <code>localpk...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for All dnf Package Repositories

    To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form: 
    gpgcheck=0
    Rule High Severity
    Show

  • Ensure Software Patches Installed

    If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates: <pre>$ sudo yum update</pre> If the system is not configu...
    Rule Medium Severity
    Show

  • Enable dnf-automatic Timer

    The dnf-automatic timer can be enabled with the following command: 
    $ sudo systemctl enable dnf-automatic.timer
    Rule Medium Severity
    Show

  • Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. Therefore, making it mor...
    Group
    Show

  • Authselect profile

    Specify the authselect profile to select
    Value
    Show

  • Enable authselect

    Configure user authentication setup to use the <code>authselect</code> tool. If authselect profile is selected, the rule will enable the <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var...
    Rule Medium Severity
    Show

  • Verify Group Ownership of System Login Banner

    To properly set the group owner of /etc/issue, run the command: 
    $ sudo chgrp root /etc/issue
    Rule Medium Severity
    Show

  • Account Lockouts Must Be Logged

    PAM faillock locks an account due to excessive password failures, this event must be logged.
    Rule Medium Severity
    Show

  • ucredit

    Minimum number of upper case in password
    Value
    Show

  • Login Banner Verbiage

    Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters like parentheses and quotation marks must be escap...
    Value
    Show

  • MotD Banner Verbiage

    Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters like parentheses and quotation marks must be escap...
    Value
    Show

  • Remote Login Banner Verbiage

    Enter an appropriate login banner for your organization. Please note that new lines must be expressed by the '\n' character and special characters like parentheses and quotation marks must be escap...
    Value
    Show

  • Modify the System Login Banner for Remote Connections

    To configure the system login banner edit <code>/etc/issue.net</code>. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is ...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules