An XCCDF Group - A logical subset of the XCCDF Benchmark
/etc/pam.d
/etc/pam.d/login
/etc/pam.d/system-auth
/etc/security/opasswd
$ sudo grep pam_succeed_if /etc/pam.d/sudo
pam_lastlog
/etc/pam.d/postlogin
showfailed
session [default=1] pam_lastlog.so showfailed
silent
pam_faillock
/usr/share/doc/pam-VERSION/txts/README.pam_faillock
remember
pam_unix
pam_pwhistory
pam_faillock.so
/etc/security/faillock.conf
deny = <count>
fail_interval
fail_interval = <interval-in-seconds>
interval-in-seconds
unlock_time=<interval-in-seconds>
authselect
authconfig
unlock_time
0
faillock
pam_pwquality
pam_pwquality(8)
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
/etc/security/pwquality.conf
difok = 4 minlen = 14 dcredit = -1 ucredit = -1 lcredit = -1 ocredit = -1 maxrepeat = 3
dcredit
lcredit
minclass
* Upper-case characters * Lower-case characters * Digits * Special characters (for example, punctuation)
minlen
minlen=
ocredit=
ocredit
pam_pwquality.so
/etc/pam.d/common-password
retry=
ucredit=
ucredit
/etc/shadow
/etc/login.defs
ENCRYPT_METHOD
libpam-pwquality
$ apt-get install libpam-pwquality
logind
/etc/systemd/logind.conf
[Login]
StopIdleSessionSec=
/etc/passwd
NUM_DAYS
USER
$ sudo chage -I NUM_DAYS USER
-E
/etc/default/useradd
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
passwd
su
login
login.defs(5)
PASS_MAX_DAYS
-M
PASS_MIN_DAYS
-m
PASS_WARN_AGE
-W
$ sudo chage -M 180 -m 7 -W 7 USER
PASS_MIN_LEN
15
12
$ sudo chage -M root
/etc/pam.d/password-auth
x
*
nullok
$ sudo awk -F: '!$2 {print $1}' /etc/shadow
$ sudo passwd [username]
$ sudo passwd -l [username]
.netrc
rounds
rounds=
pam_unix.so
password [success=1 default=ignore] pam_unix.so ...existing_options... rounds=
sudo
/etc/securetty
/dev/console
/dev/tty*
/dev/vc/*
root
$ sudo echo > /etc/securetty
ttyS0 ttyS1
vc/1 vc/2 vc/3 vc/4
FAIL_DELAY
/etc/security/limits.conf
/etc/security/limits.d/
* hard maxlogins
$ sudo mkdir --mode 000 /tmp/tmp-inst
/etc/security/namespace.conf
/tmp /tmp/tmp-inst/ level root,adm
$ sudo mkdir --mode 000 /var/tmp/tmp-inst
/var/tmp /var/tmp/tmp-inst/ level root,adm
# ls -ld /home/USER
# chmod g-w /home/USER # chmod o-rwx /home/USER
# echo $PATH
.
# ls -ld DIR
..
/
PATH=:/bin PATH=/bin: PATH=/bin::/sbin
umask
UMASK
/etc/profile
/etc/profile.d
/etc/bashrc
TMOUT
/etc/profile.d/tmout.sh
typeset -xr TMOUT=
declare -xr TMOUT=
typeset
$ sudo chgrp USER_GROUP /home/USER/.INIT_FILE
$ sudo chown USER /home/USER/.*
$ sudo chgrp USER_GROUP /home/USER/FILE_DIR
$ sudo chown -R USER /home/USER
$ sudo chmod 0750 /home/USER/FILE_DIR
0740
$ sudo chmod 0740 /home/USER/.INIT_FILE