Skip to content
ATO Pathways
  Log In

ANSSI-BP-028 (high)

Rules and Groups employed by this XCCDF Profile

  • Enable Yama support

    This enables support for LSM module Yama, which extends DAC support with additional system-wide security settings beyond regular Linux discretionar...
    Rule Medium Severity
    Show

  • Harden slab freelist metadata

    This feature protects integrity of the allocator's metadata. This configuration is available from kernel 4.14. The configuration that was used to ...
    Rule Medium Severity
    Show

  • Randomize slab freelist

    Randomizes the freelist order used on creating new pages. This configuration is available from kernel 5.9, but may be available if backported by di...
    Rule Medium Severity
    Show

  • Disallow merge of slab caches

    For reduced kernel memory fragmentation, slab caches can be merged when they share the same size and other characteristics. This carries a risk of ...
    Rule Medium Severity
    Show

  • Enable SLUB debugging support

    SLUB has extensive debug support features and this allows the allocator validation checking to be enabled. The configuration that was used to buil...
    Rule Medium Severity
    Show

  • Stack Protector buffer overlow detection

    This feature puts, at the beginning of functions, a canary value on the stack just before the return address, and validates the value just before a...
    Rule Medium Severity
    Show

  • Strong Stack Protector

    This features adds canary logic protection to more kinds of vulnerable functions than CONFIG_STACKPROTECTOR, but not to all functions so that perfo...
    Rule Medium Severity
    Show

  • Make the kernel text and rodata read-only

    When set, kernel text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available fr...
    Rule Medium Severity
    Show

  • Make the module text and rodata read-only

    When set, module text and rodata memory will be made read-only, and non-text memory will be made non-executable. This configuration is available fr...
    Rule Medium Severity
    Show

  • Enable TCP/IP syncookie support

    Normal TCP/IP networking is open to an attack known as SYN flooding. It is denial-of-service attack that prevents legitimate remote users from bein...
    Rule Medium Severity
    Show

  • Unmap kernel when running in userspace (aka KAISER)

    Speculation attacks against some high-performance processors can be used to bypass MMU permission checks and leak kernel data to userspace. This ca...
    Rule Medium Severity
    Show

  • User a virtually-mapped stack

    Enable this to use virtually-mapped kernel stacks with guard pages. This configuration is available from kernel 4.9. The configuration that was us...
    Rule Medium Severity
    Show

  • Disable x86 vsyscall emulation

    Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also disable the helpful warning if a program tries to use a ...
    Rule Low Severity
    Show

  • Kernel GCC plugin configuration

    Contains rules that check the configuration of GCC plugins used by the compiler
    Group
    Show

  • Generate some entropy during boot and runtime

    Instrument some kernel code to extract some entropy from both original and artificially created program state. This will help especially embedded s...
    Rule Medium Severity
    Show

  • Randomize layout of sensitive kernel structures

    Randomize at compile-time the layouts of structures that are entirely function pointers (and have not been manually annotated with __no_randomize_l...
    Rule Medium Severity
    Show

  • Poison kernel stack before returning from syscalls

    This option makes the kernel erase the kernel stack before returning from system calls. This has the effect of leaving the stack initialized to the...
    Rule Medium Severity
    Show

  • Force initialization of variables containing userspace addresses

    While the kernel is built with warnings enabled for any missed stack variable initializations, this warning is silenced for anything passed by refe...
    Rule Medium Severity
    Show

  • zero-init everything passed by reference

    Zero-initialize any stack variables that may be passed by reference and had not already been explicitly initialized. This configuration is availabl...
    Rule Medium Severity
    Show

  • Configure Syslog

    The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...
    Group
    Show

  • Ensure rsyslog-gnutls is installed

    TLS protocol support for rsyslog is installed. The <code>rsyslog-gnutls</code> package can be installed with the following command: <pre> $ sudo d...
    Rule Medium Severity
    Show

  • Ensure Proper Configuration of Log Files

    The file <code>/etc/rsyslog.conf</code> controls where log message are written. These are controlled by lines called <i>rules</i>, which consist of...
    Group
    Show

  • Ensure Log Files Are Owned By Appropriate Group

    The group-owner of all log files written by <code>rsyslog</code> should be <code>root</code>. These log files are determined by the second part of ...
    Rule Medium Severity
    Show

  • Ensure Log Files Are Owned By Appropriate User

    The owner of all log files written by <code>rsyslog</code> should be <code>root</code>. These log files are determined by the second part of each...
    Rule Medium Severity
    Show

  • Ensure System Log Files Have Correct Permissions

    The file permissions for all log files written by <code>rsyslog</code> should be set to 640, or more restrictive. These log files are determined by...
    Rule Medium Severity
    Show

  • Ensure All Logs are Rotated by logrotate

    Edit the file <code>/etc/logrotate.d/syslog</code>. Find the first line, which should look like this (wrapped for clarity): <pre>/var/log/message...
    Group
    Show

  • Ensure logrotate is Installed

    logrotate is installed by default. The <code>logrotate</code> package can be installed with the following command: <pre> $ sudo dnf install logrota...
    Rule Medium Severity
    Show

  • Ensure Logrotate Runs Periodically

    The <code>logrotate</code> utility allows for the automatic rotation of log files. The frequency of rotation is specified in <code>/etc/logrotate....
    Rule Medium Severity
    Show

  • Enable logrotate Timer

    The logrotate timer can be enabled with the following command: 
    $ sudo systemctl enable logrotate.timer
    Rule Medium Severity
    Show

  • Rsyslog Logs Sent To Remote Host

    If system logs are to be useful in detecting malicious activities, it is necessary to send logs to a remote server. An intruder who has compromised...
    Group
    Show

  • Ensure Logs Sent To Remote Host

    To configure rsyslog to send logs to a remote log server, open <code>/etc/rsyslog.conf</code> and read and understand the last section of the file,...
    Rule Medium Severity
    Show

  • Configure TLS for rsyslog remote logging

    Configure <code>rsyslog</code> to use Transport Layer Security (TLS) support for logging to remote server for the Forwarding Output Module in <code...
    Rule Medium Severity
    Show

  • Configure CA certificate for rsyslog remote logging

    Configure CA certificate for <code>rsyslog</code> logging to remote server using Transport Layer Security (TLS) using correct path for the <code>De...
    Rule Medium Severity
    Show

  • Network Configuration and Firewalls

    Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses th...
    Group
    Show

  • IPv6

    The system includes support for Internet Protocol version 6. A major and often-mentioned improvement over IPv4 is its enormous increase in the numb...
    Group
    Show

  • Configure IPv6 Settings if Necessary

    A major feature of IPv6 is the extent to which systems implementing it can automatically configure their networking devices using information from ...
    Group
    Show

  • Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_ra_defrtr</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Unknown Severity
    Show

  • Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_ra_pinfo</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ...
    Rule Unknown Severity
    Show

  • Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_ra_rtr_pref</code> kernel parameter, run the following command: <pre>$ sudo sysctl ...
    Rule Unknown Severity
    Show

  • Disable Accepting ICMP Redirects for All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl...
    Rule Medium Severity
    Show

  • Configure Auto Configuration on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.autoconf</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv...
    Rule Unknown Severity
    Show

  • Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.max_addresses</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ne...
    Rule Unknown Severity
    Show

  • Configure Denying Router Solicitations on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.router_solicitations</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Unknown Severity
    Show

  • Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_ra_defrtr</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Unknown Severity
    Show

  • Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_ra_pinfo</code> kernel parameter, run the following command: <pre>$ sudo sysctl...
    Rule Unknown Severity
    Show

  • Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_ra_rtr_pref</code> kernel parameter, run the following command: <pre>$ sudo sys...
    Rule Unknown Severity
    Show

  • Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.default.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sy...
    Rule Medium Severity
    Show

  • Configure Auto Configuration on All IPv6 Interfaces By Default

    To set the runtime status of the <code>net.ipv6.conf.default.autoconf</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...
    Rule Unknown Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules