NIST National Checklist Program Security Guide
Rules and Groups employed by this XCCDF Profile
-
Disable the xdm_write_home SELinux Boolean
By default, the SELinux boolean <code>xdm_write_home</code> is disabled. If this setting is enabled, it should be disabled. To disable the <code>x...Rule Medium Severity -
Disable the xguest_connect_network SELinux Boolean
By default, the SELinux boolean <code>xguest_connect_network</code> is enabled. This setting should be disabled as guest users should not be able t...Rule Medium Severity -
Disable the xguest_exec_content SELinux Boolean
By default, the SELinux boolean <code>xguest_exec_content</code> is enabled. This setting should be disabled as guest users should not be able to r...Rule Medium Severity -
Disable the xguest_mount_media SELinux Boolean
By default, the SELinux boolean <code>xguest_mount_media</code> is enabled. This setting should be disabled as guest users should not be able to mo...Rule Medium Severity -
Disable the xguest_use_bluetooth SELinux Boolean
By default, the SELinux boolean <code>xguest_use_bluetooth</code> is enabled. This setting should be disabled as guests users should not be able to...Rule Medium Severity -
Disable the xserver_clients_write_xshm SELinux Boolean
By default, the SELinux boolean <code>xserver_clients_write_xshm</code> is disabled. If this setting is enabled, it should be disabled. To disable...Rule Medium Severity -
Disable the xserver_execmem SELinux Boolean
By default, the SELinux boolean <code>xserver_execmem</code> is disabled. If this setting is enabled, it should be disabled. To disable the <code>...Rule Medium Severity -
Disable the xserver_object_manager SELinux Boolean
By default, the SELinux boolean <code>xserver_object_manager</code> is disabled. If this setting is enabled, it should be disabled. To disable the...Rule Medium Severity -
Services
The best protection against vulnerable software is running less software. This section describes how to review the software which Oracle Linux 7 in...Group -
Base Services
This section addresses the base services that are installed on a Oracle Linux 7 default installation which are not covered in other sections. Some ...Group -
Uninstall Automatic Bug Reporting Tool (abrt)
The Automatic Bug Reporting Tool (<code>abrt</code>) collects and reports crash data when an application crash is detected. Using a variety of plug...Rule Medium Severity -
Disable KDump Kernel Crash Analyzer (kdump)
The <code>kdump</code> service provides a kernel crash dump analyzer. It uses the <code>kexec</code> system call to boot a secondary kernel ("captu...Rule Medium Severity -
Cron and At Daemons
The cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform n...Group -
Enable cron Service
The <code>crond</code> service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary mainte...Rule Medium Severity -
Restrict at and cron to Authorized Users if Necessary
The <code>/etc/cron.allow</code> and <code>/etc/at.allow</code> files contain lists of users who are allowed to use <code>cron</code> and at to del...Group -
Verify Group Who Owns /etc/cron.allow file
If <code>/etc/cron.allow</code> exists, it must be group-owned by <code>root</code>. To properly set the group owner of <code>/etc/cron.allow</cod...Rule Medium Severity -
Verify User Who Owns /etc/cron.allow file
If <code>/etc/cron.allow</code> exists, it must be owned by <code>root</code>. To properly set the owner of <code>/etc/cron.allow</code>, run the ...Rule Medium Severity -
LDAP
LDAP is a popular directory service, that is, a standardized way of looking up information from a central database. Oracle Linux 7 includes softwar...Group -
Configure OpenLDAP Clients
This section provides information on which security settings are important to configure in OpenLDAP clients by manually editing the appropriate con...Group -
Configure LDAP Client to Use TLS For All Transactions
This check verifies cryptography has been implemented to protect the integrity of remote LDAP authentication sessions. <br><br> To determine if LDA...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.