III - Administrative Public
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 must display the date and time of the last successful account logon upon an SSH logon.
Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 SSH daemon must be configured to not allow authentication using known hosts authentication.
Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 SSH daemon must perform strict mode checking of home directory configuration files.
If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.Rule Medium Severity -
SRG-OS-000067-GPOS-00035
Group -
SLEM 5, for PKI-based authentication, must enforce authorized access to the corresponding private key.
If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key use...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
There must be no .shosts files on SLEM 5.
The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the s...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
There must be no shosts.equiv files on SLEM 5.
The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it do...Rule High Severity -
SRG-OS-000480-GPOS-00229
Group -
SLEM 5 must not allow unattended or automatic logon via the graphical user interface (GUI).
Failure to restrict system access to authenticated users negatively impacts SLEM 5 security.Rule High Severity -
SRG-OS-000299-GPOS-00117
Group -
SLEM 5 wireless network adapters must be disabled unless approved and documented.
Without protection of communications with wireless peripherals, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read, altered, or u...Rule Medium Severity -
SRG-OS-000378-GPOS-00163
Group -
SLEM 5 must disable the USB mass storage kernel module.
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include but are not limited to such devices as flash drives, ex...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All SLEM 5 local interactive user accounts, upon creation, must be assigned a home directory.
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.Rule Medium Severity -
SRG-OS-000480-GPOS-00228
Group -
SLEM 5 default permissions must be defined in such a way that all authenticated users can only read and modify their own files.
Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.Rule Medium Severity -
SRG-OS-000480-GPOS-00226
Group -
SLEM 5 shadow password suite must be configured to enforce a delay of at least five seconds between logon prompts following a failed logon attempt.
Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain access to an account.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All SLEM 5 local interactive users must have a home directory assigned in the /etc/passwd file.
If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All SLEM 5 local interactive user home directories defined in the /etc/passwd file must exist.
If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a denial...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All SLEM 5 local interactive user initialization files executable search paths must contain only paths that resolve to the users' home directory.
The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory ...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
All SLEM 5 local initialization files must not execute world-writable programs.
If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the use...Rule Medium Severity -
SRG-OS-000123-GPOS-00064
Group -
SLEM 5 must automatically expire temporary accounts within 72 hours.
Temporary accounts are privileged or nonprivileged accounts established during pressing circumstances, such as new software or hardware configuration or an incident response, where the need for pro...Rule Medium Severity -
SRG-OS-000123-GPOS-00064
Group -
SLEM 5 must never automatically remove or disable emergency administrator accounts.
Emergency administrator accounts, also known as "last resort" or "break glass" accounts, are local logon accounts enabled on the system for emergency use by authorized system administrators to mana...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 must not have unnecessary accounts.
Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and a...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 must not have unnecessary account capabilities.
Accounts providing no operational purpose provide additional opportunities for system compromise. Therefore all necessary noninteractive accounts should not have an interactive shell assigned to them.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 root account must be the only account with unrestricted access to the system.
If an account other than root also has a User Identifier (UID) of "0", it has root authority, giving that account unrestricted access to the entire SLEM 5. Multiple accounts with a UID of "0" affor...Rule High Severity -
SRG-OS-000118-GPOS-00060
Group -
SLEM 5 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts...Rule Medium Severity -
SRG-OS-000104-GPOS-00051
Group -
SLEM 5 must not have duplicate User IDs (UIDs) for interactive users.
To ensure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. Interactive users incl...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
SLEM 5 must display the date and time of the last successful account logon upon logon.
Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.Rule Medium Severity -
SRG-OS-000029-GPOS-00010
Group -
SLEM 5 must initiate a session lock after a 15-minute period of inactivity.
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporar...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.