Guide to the Secure Configuration of Red Hat Enterprise Linux 9
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Configure auditing of successful file creations (AArch64)
Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: <pre>## Successful file creation (open with O_CREAT) -a always,exit -F arch=b3...Rule Medium Severity -
Configure auditing of successful file creations (ppc64le)
Ensure that successful attempts to create a file are audited. The following rules configure audit as described above: <pre>## Successful file creation (open with O_CREAT) -a always,exit -F arch=b6...Rule Medium Severity -
Configure auditing of unsuccessful file deletions
Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlink...Rule Medium Severity -
Configure auditing of unsuccessful file deletions (AArch64)
Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file delete -a always,exit -F arch=b32 -S unlink,unlink...Rule Medium Severity -
Configure auditing of unsuccessful file deletions (ppc64le)
Ensure that unsuccessful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file delete -a always,exit -F arch=b64 -S unlink,unlink...Rule Medium Severity -
Configure auditing of successful file deletions
Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,r...Rule Medium Severity -
Configure auditing of successful file deletions (AArch64)
Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,r...Rule Medium Severity -
Configure auditing of successful file deletions (ppc64le)
Ensure that successful attempts to delete a file are audited. The following rules configure audit as described above: <pre>## Successful file delete -a always,exit -F arch=b64 -S unlink,unlinkat,r...Rule Medium Severity -
Configure auditing of unsuccessful file modifications (AARch64)
Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file modifications (open for write or truncate) -a alwa...Rule Medium Severity -
Configure auditing of unsuccessful file modifications (ppc64le)
Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file modifications (open for write or truncate) -a alwa...Rule Medium Severity -
Configure auditing of successful permission changes (ppc64le)
Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...Rule Medium Severity -
Configure auditing of successful file modifications
Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Successful file modifications (open for write or truncate) -a always,e...Rule Medium Severity -
Configure auditing of successful file modifications (AArch64)
Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Successful file modifications (open for write or truncate) -a always,e...Rule Medium Severity -
Configure auditing of successful file modifications (ppc64le)
Ensure that successful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Successful file modifications (open for write or truncate) -a always,e...Rule Medium Severity -
Configure auditing of loading and unloading of kernel modules (ppc64le)
Ensure that loading and unloading of kernel modules is audited. The following rules configure audit as described above: <pre>## These rules watch for kernel module insertion. By monitoring ## the ...Rule Medium Severity -
Perform general configuration of Audit for OSPP (ppc64le)
Configure some basic <code>Audit</code> parameters specific for OSPP profile. In particular, configure <code>Audit</code> to watch for direct modification of files storing system user and group inf...Rule Medium Severity -
Configure auditing of unsuccessful ownership changes
Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Unsuccessful ownership change -a alway...Rule Medium Severity -
Configure auditing of unsuccessful ownership changes (AArch64)
Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Unsuccessful ownership change -a alway...Rule Medium Severity -
Configure auditing of unsuccessful ownership changes (ppc64le)
Ensure that unsuccessful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Unsuccessful ownership change -a alway...Rule Medium Severity -
Configure auditing of successful ownership changes
Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Successful ownership change -a always,ex...Rule Medium Severity -
Configure auditing of successful ownership changes (AArch64)
Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Successful ownership change -a always,ex...Rule Medium Severity -
Configure auditing of successful ownership changes (ppc64le)
Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Successful ownership change -a always,ex...Rule Medium Severity -
Configure auditing of unsuccessful permission changes
Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...Rule Medium Severity -
Ensure auditd Collects Information on Exporting to Media (successful)
At a minimum, the audit system should collect media exportation events for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read aud...Rule Medium Severity -
Configure auditing of unsuccessful permission changes (AArch64)
Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...Rule Medium Severity -
Configure auditing of unsuccessful permission changes (ppc64le)
Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...Rule Medium Severity -
Configure auditing of successful permission changes
Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...Rule Medium Severity -
Configure auditing of successful permission changes (AArch64)
Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...Rule Medium Severity -
Perform general configuration of Audit for OSPP
Configure some basic <code>Audit</code> parameters specific for OSPP profile. In particular, configure <code>Audit</code> to watch for direct modification of files storing system user and group inf...Rule Medium Severity -
Ensure the audit-libs package as a part of audit Subsystem is Installed
The audit-libs package should be installed.Rule Medium Severity -
Enable auditd Service
The <code>auditd</code> service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The <code>auditd</code> service can be ena...Rule Medium Severity -
Configure auditd Rules for Comprehensive Auditing
The <code>auditd</code> program can perform comprehensive monitoring of system activity. This section describes recommended configuration settings for comprehensive auditing, but a full description...Group -
Record Events that Modify User/Group Information via openat syscall - /etc/group
The audit system should collect write events to /etc/group file for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rule...Rule Medium Severity -
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
The audit system should collect write events to /etc/gshadow file for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit ru...Rule Medium Severity -
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
The audit system should collect write events to /etc/passwd file for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rul...Rule Medium Severity -
Record Events that Modify the System's Mandatory Access Controls
If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following line to a file with suffix <cod...Rule Medium Severity -
Record Events that Modify the System's Network Environment
If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following line to a file with suffix <cod...Rule Medium Severity -
Record Attempts to Alter Process and Session Initiation Information
The audit system already collects process information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during d...Rule Medium Severity -
Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/
At a minimum, the audit system should collect administrator actions for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit ...Rule Medium Severity -
Record Events that Modify User/Group Information
If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following lines to a file with suffix <co...Rule Medium Severity -
Record Events that Modify User/Group Information - /etc/group
If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following lines to a file with suffix <co...Rule Medium Severity -
Record Events that Modify User/Group Information - /etc/passwd
If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audit rules during daemon startup (the default), add the following lines to a file with suffix <co...Rule Medium Severity -
Record Events that Modify the System's Discretionary Access Controls - fremovexattr
At a minimum, the audit system should collect file permission changes for all users and root. <br> <br> If the <code>auditd</code> daemon is configured to use the <code>augenrules</...Rule Medium Severity -
Record Attempts to perform maintenance activities
The Red Hat Enterprise Linux 9 operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. Verify the operating...Rule Medium Severity -
System Audit Directories Must Be Owned By Root
All audit directories must be owned by root user. By default, the path for audit log is <pre>/var/log/audit/</pre>. To properly set the owner of <code>/var/log/audit</code>, run the command: <pre>...Rule Medium Severity -
Audit Configuration Files Must Be Owned By Group root
All audit configuration files must be owned by group root.chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*Rule Medium Severity -
Record Events that Modify the System's Discretionary Access Controls
At a minimum, the audit system should collect file permission changes for all users and root. Note that the "-F arch=b32" lines should be present even on a 64 bit system. These commands identify sy...Group -
Record Events that Modify the System's Discretionary Access Controls - chmod
At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...Rule Medium Severity -
Record Events that Modify the System's Discretionary Access Controls - fchmod
At a minimum, the audit system should collect file permission changes for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenrules</code> program to read audi...Rule Medium Severity -
Record Events that Modify the System's Discretionary Access Controls - lremovexattr
At a minimum, the audit system should collect file permission changes for all users and root. <br> <br> If the <code>auditd</code> daemon is configured to use the <code>augenrules</...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.