Skip to content
ATO Pathways
  Log In

DISA STIG for Red Hat Enterprise Linux CoreOS

Rules and Groups employed by this XCCDF Profile

  • Configure immutable Audit login UIDs

    Configure kernel to prevent modification of login UIDs once they are set. Changing login UIDs while this configuration is enforced requires special...
    Rule Medium Severity
    Show

  • Configure auditing of unsuccessful file modifications

    Ensure that unsuccessful attempts to modify a file are audited. The following rules configure audit as described above: <pre>## Unsuccessful file ...
    Rule Medium Severity
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows ...
    Group
    Show

  • Disable vsyscalls

    To disable use of virtual syscalls, add the argument <code>vsyscall=none</code> to all BLS (Boot Loader Specification) entries ('options' line) for...
    Rule Medium Severity
    Show

  • Configure Syslog

    The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...
    Group
    Show

  • systemd-journald

    systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging ...
    Group
    Show

  • Verify Group Who Owns the system journal

    To properly set the group owner of <code>/var/log/journal/.*/system.journal</code>, run the command: <pre>$ sudo chgrp systemd-journal /var/log/jo...
    Rule Medium Severity
    Show

  • Verify Owner on the system journal

    To properly set the owner of <code>/var/log/journal/.*/system.journal</code>, run the command: <pre>$ sudo chown root /var/log/journal/.*/system.j...
    Rule Medium Severity
    Show

  • Verify Permissions on the system journal

    To properly set the permissions of <code>/var/log/journal/.*/system.journal</code>, run the command: <pre>$ sudo chmod 0640 /var/log/journal/.*/sy...
    Rule Medium Severity
    Show

  • File Permissions and Masks

    Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which t...
    Group
    Show

  • Verify Permissions on Important Files and Directories

    Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses impo...
    Group
    Show

  • Verify Permissions on Files within /var/log Directory

    The /var/log directory contains files with logs of error messages in the system and should only be accessed by authorized personnel.
    Group
    Show

  • Verify Group Who Owns /var/log Directory

    To properly set the group owner of /var/log, run the command: 
    $ sudo chgrp root /var/log
    Rule Medium Severity
    Show

  • Verify User Who Owns /var/log Directory

    To properly set the owner of /var/log, run the command: 
    $ sudo chown root /var/log
    Rule Medium Severity
    Show

  • Verify Permissions on /var/log Directory

    To properly set the permissions of /var/log, run the command: 
    $ sudo chmod 0755 /var/log
    Rule Medium Severity
    Show

  • Restrict Programs from Dangerous Execution Patterns

    The recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution ar...
    Group
    Show

  • Restrict Access to Kernel Message Buffer

    To set the runtime status of the <code>kernel.dmesg_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.dmesg...
    Rule Low Severity
    Show

  • Disallow kernel profiling by unprivileged users

    To set the runtime status of the <code>kernel.perf_event_paranoid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel....
    Rule Low Severity
    Show

  • Enable ExecShield

    ExecShield describes kernel features that provide protection against exploitation of memory corruption errors such as buffer overflows. These featu...
    Group
    Show

  • Enable Randomized Layout of Virtual Address Space

    To set the runtime status of the <code>kernel.randomize_va_space</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.r...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules