ANSSI-BP-028 (enhanced)
Rules and Groups employed by this XCCDF Profile
-
System Security Services Daemon (SSSD) - LDAP
The System Security Services Daemon (SSSD) is a system daemon that provides access to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD, openLDAP, MIT Kerberos, ...Group -
Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server
Configure SSSD to demand a valid certificate from the server to protect the integrity of LDAP remote access sessions by setting the <pre>ldap_tls_reqcert</pre> option in <pre>/etc/sssd/sssd.conf</p...Rule Medium Severity -
Configure SSSD LDAP Backend to Use TLS For All Transactions
The LDAP client should be configured to implement TLS for the integrity of all remote LDAP authentication sessions. If the <code>id_provider</code> is set to <code>ldap</code> or <code>ipa</code> i...Rule High Severity -
Configure Logind to terminate idle sessions after certain time of inactivity
To configure <code>logind</code> service to terminate inactive user sessions after <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_logind_session_timeout" use="legacy"></xccdf-1.2:sub>...Rule Medium Severity -
Record Attempts to perform maintenance activities
The Oracle Linux 8 operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. Verify the operating system audi...Rule Medium Severity -
Ensure tmp.mount Unit Is Enabled
The <code>/tmp</code> directory is a world-writable directory used for temporary file storage. This directory is managed by <code>systemd-tmpfiles</code>. Ensure that the <code>tmp.mount</code> sys...Rule Low Severity -
Verify Group Who Owns /etc/sudoers.d Directory
To properly set the group owner of/etc/sudoers.d, run the command:$ sudo chgrp root /etc/sudoers.d
Rule Medium Severity -
Verify User Who Owns /etc/sudoers.d Directory
To properly set the owner of/etc/sudoers.d, run the command:$ sudo chown root /etc/sudoers.d
Rule Medium Severity -
Verify Permissions On /etc/sudoers.d Directory
To properly set the permissions of/etc/sudoers.d, run the command:$ sudo chmod 0750 /etc/sudoers.d
Rule Medium Severity -
Verify Group Who Owns /etc/sudoers File
To properly set the group owner of/etc/sudoers, run the command:$ sudo chgrp root /etc/sudoers
Rule Medium Severity -
Verify User Who Owns /etc/sudoers File
To properly set the owner of/etc/sudoers, run the command:$ sudo chown root /etc/sudoers
Rule Medium Severity -
Verify Permissions On /etc/sudoers File
To properly set the permissions of/etc/sudoers, run the command:$ sudo chmod 0440 /etc/sudoers
Rule Medium Severity -
Ensure That the sudo Binary Has the Correct Permissions
To properly set the permissions of/usr/bin/sudo, run the command:$ sudo chmod 4111 /usr/bin/sudo
Rule Medium Severity -
Set Root Account Password Maximum Age
Configure the root account to enforce a <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_root" use="legacy"></xccdf-1.2:sub>-day maximum password lifetime restricti...Rule Medium Severity -
Ensure AppArmor is installed
AppArmor provide Mandatory Access Controls.Rule Medium Severity -
Install the pam_apparmor Package
Thepam_apparmorpackage can be installed with the following command:$ sudo yum install pam_apparmor
Rule Medium Severity -
Enforce all AppArmor Profiles
AppArmor profiles define what resources applications are able to access. To set all profiles to enforce mode run the following command: <pre>$ sudo aa-enforce /etc/apparmor.d/*</pre> To list unconf...Rule Medium Severity -
Ensure AppArmor is Active and Configured
Verify that the Apparmor tool is configured to control whitelisted applications and user home directory access control.<br> <br> The <code>apparmor</code> service can be enabled with the fo...Rule Medium Severity -
Ensure AppArmor is enabled in the bootloader configuration
Configure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters. Note: This recommendation is designed around the grub bootloader, if LI...Rule Medium Severity -
Verify Group Who Owns /etc/ipsec.d Directory
To properly set the group owner of/etc/ipsec.d, run the command:$ sudo chgrp root /etc/ipsec.d
Rule Medium Severity -
Verify User Who Owns /etc/ipsec.d Directory
To properly set the owner of/etc/ipsec.d, run the command:$ sudo chown root /etc/ipsec.d
Rule Medium Severity -
Verify Permissions On /etc/ipsec.d Directory
To properly set the permissions of/etc/ipsec.d, run the command:$ sudo chmod 0700 /etc/ipsec.d
Rule Medium Severity -
Verify Group Who Owns /etc/ipsec.conf File
To properly set the group owner of/etc/ipsec.conf, run the command:$ sudo chgrp root /etc/ipsec.conf
Rule Medium Severity -
Verify Group Who Owns /etc/ipsec.secrets File
To properly set the group owner of/etc/ipsec.secrets, run the command:$ sudo chgrp root /etc/ipsec.secrets
Rule Medium Severity -
Verify User Who Owns /etc/ipsec.conf File
To properly set the owner of/etc/ipsec.conf, run the command:$ sudo chown root /etc/ipsec.conf
Rule Medium Severity -
Verify User Who Owns /etc/ipsec.secrets File
To properly set the owner of/etc/ipsec.secrets, run the command:$ sudo chown root /etc/ipsec.secrets
Rule Medium Severity -
Verify Permissions On /etc/ipsec.conf File
To properly set the permissions of/etc/ipsec.conf, run the command:$ sudo chmod 0644 /etc/ipsec.conf
Rule Medium Severity -
Verify Permissions On /etc/ipsec.secrets File
To properly set the permissions of/etc/ipsec.secrets, run the command:$ sudo chmod 0644 /etc/ipsec.secrets
Rule Medium Severity -
Verify Group Who Owns /etc/iptables Directory
To properly set the group owner of/etc/iptables, run the command:$ sudo chgrp root /etc/iptables
Rule Medium Severity -
Verify User Who Owns /etc/iptables Directory
To properly set the owner of/etc/iptables, run the command:$ sudo chown root /etc/iptables
Rule Medium Severity -
Verify Permissions On /etc/iptables Directory
To properly set the permissions of/etc/iptables, run the command:$ sudo chmod 0700 /etc/iptables
Rule Medium Severity -
Verify Group Who Owns /etc/nftables Directory
To properly set the group owner of/etc/nftables, run the command:$ sudo chgrp root /etc/nftables
Rule Medium Severity -
Verify User Who Owns /etc/nftables Directory
To properly set the owner of/etc/nftables, run the command:$ sudo chown root /etc/nftables
Rule Medium Severity -
Verify Permissions On /etc/nftables Directory
To properly set the permissions of/etc/nftables, run the command:$ sudo chmod 0700 /etc/nftables
Rule Medium Severity -
Verify that system commands directories have root as a group owner
System commands are stored in the following directories: by default: <pre>/bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin </pre> All these directories should have <code>root</code...Rule Medium Severity -
Verify that system commands directories have root ownership
System commands are stored in the following directories by default: <pre>/bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin </pre> All these directories should be owned by the <code>...Rule Medium Severity -
Verify Group Who Owns /etc/crypttab File
To properly set the group owner of/etc/crypttab, run the command:$ sudo chgrp root /etc/crypttab
Rule Medium Severity -
Verify Group Who Owns System.map Files
The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. These files...Rule Low Severity -
Verify User Who Owns /etc/crypttab File
To properly set the owner of/etc/crypttab, run the command:$ sudo chown root /etc/crypttab
Rule Medium Severity -
Verify User Who Owns System.map Files
The System.map files are symbol map files generated during the compilation of the Linux kernel. They contain the mapping between kernel symbols and their corresponding memory addresses. These files...Rule Low Severity -
Verify Permissions On /etc/crypttab File
To properly set the permissions of/etc/crypttab, run the command:$ sudo chmod 0600 /etc/crypttab
Rule Medium Severity -
Verify Group Who Owns /etc/shells File
To properly set the group owner of/etc/shells, run the command:$ sudo chgrp root /etc/shells
Rule Medium Severity -
Verify Who Owns /etc/shells File
To properly set the owner of/etc/shells, run the command:$ sudo chown root /etc/shells
Rule Medium Severity -
Verify Permissions on /etc/shells File
To properly set the permissions of/etc/shells, run the command:$ sudo chmod 0644 /etc/shells
Rule Medium Severity -
Verify Group Who Owns /etc/sysctl.d Directory
To properly set the group owner of/etc/sysctl.d, run the command:$ sudo chgrp root /etc/sysctl.d
Rule Medium Severity -
Verify User Who Owns /etc/sysctl.d Directory
To properly set the owner of/etc/sysctl.d, run the command:$ sudo chown root /etc/sysctl.d
Rule Medium Severity -
Verify Permissions On /etc/sysctl.d Directory
To properly set the permissions of/etc/sysctl.d, run the command:$ sudo chmod 0755 /etc/sysctl.d
Rule Medium Severity -
Verify Group Who Owns /etc/selinux Directory
To properly set the group owner of/etc/selinux, run the command:$ sudo chgrp root /etc/selinux
Rule Medium Severity -
Verify User Who Owns /etc/selinux Directory
To properly set the owner of/etc/selinux, run the command:$ sudo chown root /etc/selinux
Rule Medium Severity -
Verify Permissions On /etc/selinux Directory
To properly set the permissions of/etc/selinux, run the command:$ sudo chmod 0755 /etc/selinux
Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.