Skip to content
ATO Pathways
  Log In

Solaris 11 SPARC Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • The audit system must be configured to audit file deletions.

    <VulnDiscussion>Without auditing, malicious activity cannot be detected.</VulnDiscussion><FalsePositives></FalsePositives>&...
    Rule Medium Severity
    Show

  • SRG-OS-000004

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must protect audit tools from unauthorized access.

    &lt;VulnDiscussion&gt;Failure to maintain system configurations may result in privilege escalation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt...
    Rule Medium Severity
    Show

  • SRG-OS-000257

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server.

    &lt;VulnDiscussion&gt;Keeping audit records on a remote system reduces the likelihood of audit records being changed or corrupted. Duplicating and ...
    Rule Low Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • The auditing system must not define a different auditing level for specific users.

    &lt;VulnDiscussion&gt;Without auditing, individual system accesses cannot be tracked, and malicious activity cannot be detected and traced back to ...
    Rule Low Severity
    Show

  • SRG-OS-000046

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must alert designated organizational officials in the event of an audit processing failure.

    &lt;VulnDiscussion&gt;Proper alerts to system administrators and IA officials of audit failures ensure a timely response to critical system issues....
    Rule High Severity
    Show

  • SRG-OS-000047

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must shut down by default upon audit failure (unless availability is an overriding concern).

    &lt;VulnDiscussion&gt;Continuing to operate a system without auditing working properly can result in undocumented access or system changes.&lt;/Vul...
    Rule Medium Severity
    Show

  • SRG-OS-000057

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must protect audit information from unauthorized access.

    &lt;VulnDiscussion&gt;If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially ma...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • The System packages must be up to date with the most recent vendor updates and security fixes.

    &lt;VulnDiscussion&gt;Failure to install security updates can provide openings for attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePo...
    Rule Medium Severity
    Show

  • SRG-OS-000256

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must protect audit tools from unauthorized modification.

    &lt;VulnDiscussion&gt;Failure to maintain system configurations may result in privilege escalation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt...
    Rule Medium Severity
    Show

  • SRG-OS-000258

    <GroupDescription></GroupDescription>
    Group
    Show

  • The .Xauthority files must not have extended ACLs.

    &lt;VulnDiscussion&gt;.Xauthority files ensure the user is authorized to access the specific X Windows host. Extended ACLs may permit unauthorized ...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • All .Xauthority files must have mode 0600 or less permissive.

    &lt;VulnDiscussion&gt;.Xauthority files ensure the user is authorized to access the specific X Windows host. Excessive permissions may permit unaut...
    Rule Medium Severity
    Show

  • The rpcbind service must be configured for local only services unless organizationally defined.

    &lt;VulnDiscussion&gt;The portmap and rpcbind services increase the attack surface of the system and should only be used when needed. The portmap o...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • The VNC server package must not be installed unless required.

    &lt;VulnDiscussion&gt;The VNC service uses weak authentication capabilities and provides the user complete graphical system access.&lt;/VulnDiscuss...
    Rule Medium Severity
    Show

  • SRG-OS-000095

    <GroupDescription></GroupDescription>
    Group
    Show

  • The operating system must be configured to provide essential capabilities.

    &lt;VulnDiscussion&gt;Operating systems are capable of providing a wide variety of functions and services. Execution must be disabled based on orga...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • All run control scripts must have mode 0755 or less permissive.

    &lt;VulnDiscussion&gt;If the startup files are writable by other users, these users could modify the startup files to insert malicious commands int...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • All run control scripts must have no extended ACLs.

    &lt;VulnDiscussion&gt;If the startup files are writable by other users, these users could modify the startup files to insert malicious commands int...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • Run control scripts executable search paths must contain only authorized paths.

    &lt;VulnDiscussion&gt;The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search t...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • Run control scripts library search paths must contain only authorized paths.

    &lt;VulnDiscussion&gt;The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find librar...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • Run control scripts lists of preloaded libraries must contain only authorized paths.

    &lt;VulnDiscussion&gt;The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the ...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • Run control scripts must not execute world writable programs or scripts.

    &lt;VulnDiscussion&gt;World writable files could be modified accidentally or maliciously to compromise system integrity.&lt;/VulnDiscussion&gt;&lt;...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • All system start-up files must be owned by root.

    &lt;VulnDiscussion&gt;System start-up files not owned by root could lead to system compromise by allowing malicious users or applications to modify...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • All system start-up files must be group-owned by root, sys, or bin.

    &lt;VulnDiscussion&gt;If system start-up files do not have a group owner of root or a system group, the files may be modified by malicious users or...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • System start-up files must only execute programs owned by a privileged UID or an application.

    &lt;VulnDiscussion&gt;System start-up files executing programs owned by other than root (or another privileged user) or an application indicates th...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • Any X Windows host must write .Xauthority files.

    &lt;VulnDiscussion&gt;.Xauthority files ensure the user is authorized to access the specific X Windows host. If .Xauthority files are not used, it ...
    Rule Medium Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • The system must require passwords to contain no more than three consecutive repeating characters.

    &lt;VulnDiscussion&gt;Complex passwords can reduce the likelihood of success of automated password-guessing attacks.&lt;/VulnDiscussion&gt;&lt;Fals...
    Rule Low Severity
    Show

  • SRG-OS-000480

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules