Standard System Security Profile for Oracle Linux 7
Rules and Groups employed by this XCCDF Profile
-
File Permissions and Masks
Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which t...Group -
Verify Permissions on Important Files and Directories
Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses impo...Group -
Verify that All World-Writable Directories Have Sticky Bits Set
When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky b...Rule Medium Severity -
Ensure All SGID Executables Are Authorized
The SGID (set group id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthoriz...Rule Medium Severity -
Ensure All SUID Executables Are Authorized
The SUID (set user id) bit should be set only on files that were installed via authorized means. A straightforward means of identifying unauthorize...Rule Medium Severity -
Ensure No World-Writable Files Exist
It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific a...Rule Medium Severity -
Restrict Dynamic Mounting and Unmounting of Filesystems
Linux includes a number of facilities for the automated addition and removal of filesystems on a running system. These facilities may be necessary...Group -
Disable the Automounter
The <code>autofs</code> daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be...Rule Medium Severity -
Restrict Partition Mount Options
System partitions can be mounted with certain options that limit what files on those partitions can do. These options are set in the <code>/etc/fst...Group -
Add nodev Option to /dev/shm
The <code>nodev</code> mount option can be used to prevent creation of device files in <code>/dev/shm</code>. Legitimate character and block device...Rule Medium Severity -
Add nosuid Option to /dev/shm
The <code>nosuid</code> mount option can be used to prevent execution of setuid programs in <code>/dev/shm</code>. The SUID and SGID permissions s...Rule Medium Severity -
Services
The best protection against vulnerable software is running less software. This section describes how to review the software which Oracle Linux 7 in...Group -
Base Services
This section addresses the base services that are installed on a Oracle Linux 7 default installation which are not covered in other sections. Some ...Group -
Disable Automatic Bug Reporting Tool (abrtd)
The Automatic Bug Reporting Tool (<code>abrtd</code>) daemon collects and reports crash data when an application crash is detected. Using a variety...Rule Medium Severity -
Disable ntpdate Service (ntpdate)
The <code>ntpdate</code> service sets the local hardware clock by polling NTP servers when the system boots. It synchronizes to the NTP servers lis...Rule Low Severity -
Disable Odd Job Daemon (oddjobd)
The <code>oddjobd</code> service exists to provide an interface and access control mechanism through which specified privileged tasks can run tasks...Rule Medium Severity -
Disable Apache Qpid (qpidd)
The <code>qpidd</code> service provides high speed, secure, guaranteed delivery services. It is an implementation of the Advanced Message Queuing ...Rule Low Severity -
Disable Network Router Discovery Daemon (rdisc)
The <code>rdisc</code> service implements the client side of the ICMP Internet Router Discovery Protocol (IRDP), which allows discovery of routers ...Rule Medium Severity -
Cron and At Daemons
The cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform n...Group -
Disable At Service (atd)
The <code>at</code> and <code>batch</code> commands can be used to schedule tasks that are meant to be executed only once. This allows delayed exec...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.