An XCCDF Group - A logical subset of the XCCDF Benchmark
/etc/sysconfig
dhcpd
dhcp
$ sudo dnf remove dhcp
alternatives
sendmail
$ sudo dnf remove sendmail
$ sudo echo "root: " >> /etc/aliases $ sudo newaliases
/etc/postfix/main.cf
inet_interfaces
inet_interfaces =
ntpd
chronyd
ntp
chrony
Chronyd
Autokey
$ sudo dnf install chrony
Chrony
/etc/chrony.conf
server <remote-server>
/etc/chrony.keys
$ sudo chgrp chrony /etc/chrony.keys
$ sudo chown root /etc/chrony.keys
$ sudo chmod 0640 /etc/chrony.keys
iptables
rsh-server
$ sudo dnf remove rsh-server
rsh
talk-server
$ sudo dnf remove talk-server
talk
$ sudo dnf remove talk
telnet-server
$ sudo dnf remove telnet-server
tftp-server
$ sudo dnf remove tftp-server
tftp
sshd
openssh-server
/etc/ssh/sshd_config
$ sudo chgrp root /etc/ssh/sshd_config
/etc/ssh/*_key
ssh_keys
/etc/ssh/*.pub
root
$ sudo chown root /etc/ssh/sshd_config
$ sudo chmod 0600 /etc/ssh/sshd_config
0600
0640
$ sudo chmod 0644 /etc/ssh/*.pub
sshd_config(5)
PermitRootLogin no
sssd
$ sudo dnf install sssd
$ sudo systemctl enable sssd.service
pam
services
[sssd]
/etc/sssd/sssd.conf
[sssd] services = sudo, autofs, pam
sssd-ldap
ldap_tls_reqcert
demand
id_provider
ldap
ipa
/etc/sssd/sssd.conf.d
ldap_id_use_start_tls
true
$ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf