CIS SUSE Linux Enterprise 12 Benchmark Level 2 - Workstation
Rules and Groups employed by this XCCDF Profile
-
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
To set the runtime status of the <code>net.ipv4.conf.all.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0</pre> To make su...Rule Medium Severity -
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
To set the runtime status of the <code>net.ipv4.conf.default.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0</pre> To...Rule Medium Severity -
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
To set the runtime status of the <code>net.ipv4.ip_forward</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.ip_forward=0</pre> To make sure that the setting is per...Rule Medium Severity -
Uncommon Network Protocols
The system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code are not frequently discovered, the consequences ca...Group -
Disable DCCP Support
The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the <code>dccp</...Rule Medium Severity -
Disable SCTP Support
The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection...Rule Medium Severity -
Wireless Networking
Wireless networking, such as 802.11 (WiFi) and Bluetooth, can present a security risk to sensitive or classified systems and networks. Wireless networking hardware is much more likely to be include...Group -
Disable Wireless Through Software Configuration
If it is impossible to remove the wireless hardware from the device in question, disable as much of it as possible through software. The following methods can disable software support for wireless ...Group -
Deactivate Wireless Network Interfaces
Deactivating wireless network interfaces should prevent normal usage of the wireless capability. <br> <br> Configure the system to disable wireless network interfaces by issuing the follo...Rule Medium Severity -
File Permissions and Masks
Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which they should not have access. <br> <br> Severa...Group -
Verify Permissions on Important Files and Directories
Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses important permission restrictions which can be verifie...Group -
Verify that All World-Writable Directories Have Sticky Bits Set
When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may ...Rule Medium Severity -
Ensure No World-Writable Files Exist
It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor f...Rule Medium Severity -
Ensure All Files Are Owned by a Group
If any file is not group-owned by a group present in /etc/group, the cause of the lack of group-ownership must be investigated. Following this, those files should be deleted or assigned to an appro...Rule Medium Severity -
Ensure All Files Are Owned by a User
If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. Locate the m...Rule Medium Severity -
Verify permissions of log files
Any operating system providing too much information in error messages risks compromising the data and security of the structure, and content of error messages needs to be carefully considered by th...Rule Medium Severity -
Verify Permissions on Files with Local Account Information and Credentials
The default restrictive permissions for files which act as important security databases such as <code>passwd</code>, <code>shadow</code>, <code>group</code>, and <code>gshadow</code> files must be ...Group -
Verify Group Who Owns Backup group File
To properly set the group owner of/etc/group-, run the command:$ sudo chgrp root /etc/group-
Rule Medium Severity -
Verify Group Who Owns Backup gshadow File
To properly set the group owner of/etc/gshadow-, run the command:$ sudo chgrp root /etc/gshadow-
Rule Medium Severity -
Verify Group Who Owns Backup passwd File
To properly set the group owner of/etc/passwd-, run the command:$ sudo chgrp root /etc/passwd-
Rule Medium Severity -
Verify User Who Owns Backup shadow File
To properly set the group owner of/etc/shadow-, run the command:$ sudo chgrp shadow /etc/shadow-
Rule Medium Severity -
Verify Group Who Owns group File
To properly set the group owner of/etc/group, run the command:$ sudo chgrp root /etc/group
Rule Medium Severity -
Verify Group Who Owns gshadow File
To properly set the group owner of/etc/gshadow, run the command:$ sudo chgrp root /etc/gshadow
Rule Medium Severity -
Verify Group Who Owns passwd File
To properly set the group owner of/etc/passwd, run the command:$ sudo chgrp root /etc/passwd
Rule Medium Severity -
Verify Group Who Owns shadow File
To properly set the group owner of/etc/shadow, run the command:$ sudo chgrp shadow /etc/shadow
Rule Medium Severity -
Verify User Who Owns Backup group File
To properly set the owner of/etc/group-, run the command:$ sudo chown root /etc/group-
Rule Medium Severity -
Verify User Who Owns Backup gshadow File
To properly set the owner of/etc/gshadow-, run the command:$ sudo chown root /etc/gshadow-
Rule Medium Severity -
Verify User Who Owns Backup passwd File
To properly set the owner of/etc/passwd-, run the command:$ sudo chown root /etc/passwd-
Rule Medium Severity -
Verify Group Who Owns Backup shadow File
To properly set the owner of/etc/shadow-, run the command:$ sudo chown root /etc/shadow-
Rule Medium Severity -
Verify User Who Owns group File
To properly set the owner of/etc/group, run the command:$ sudo chown root /etc/group
Rule Medium Severity -
Verify User Who Owns gshadow File
To properly set the owner of/etc/gshadow, run the command:$ sudo chown root /etc/gshadow
Rule Medium Severity -
Verify User Who Owns passwd File
To properly set the owner of/etc/passwd, run the command:$ sudo chown root /etc/passwd
Rule Medium Severity -
Verify User Who Owns shadow File
To properly set the owner of/etc/shadow, run the command:$ sudo chown root /etc/shadow
Rule Medium Severity -
Verify Permissions on Backup group File
To properly set the permissions of/etc/group-, run the command:$ sudo chmod 0644 /etc/group-
Rule Medium Severity -
Verify Permissions on Backup gshadow File
To properly set the permissions of/etc/gshadow-, run the command:$ sudo chmod 0000 /etc/gshadow-
Rule Medium Severity -
Verify Permissions on Backup passwd File
To properly set the permissions of/etc/passwd-, run the command:$ sudo chmod 0644 /etc/passwd-
Rule Medium Severity -
Verify Permissions on Backup shadow File
To properly set the permissions of/etc/shadow-, run the command:$ sudo chmod 0640 /etc/shadow-
Rule Medium Severity -
Verify Permissions on group File
To properly set the permissions of/etc/group, run the command:$ sudo chmod 0644 /etc/group
Rule Medium Severity -
Verify Permissions on gshadow File
To properly set the permissions of/etc/gshadow, run the command:$ sudo chmod 0000 /etc/gshadow
Rule Medium Severity -
Verify Permissions on passwd File
To properly set the permissions of/etc/passwd, run the command:$ sudo chmod 0644 /etc/passwd
Rule Medium Severity -
Verify Permissions on shadow File
To properly set the permissions of/etc/shadow, run the command:$ sudo chmod 0640 /etc/shadow
Rule Medium Severity -
Restrict Dynamic Mounting and Unmounting of Filesystems
Linux includes a number of facilities for the automated addition and removal of filesystems on a running system. These facilities may be necessary in many environments, but this capability also ca...Group -
Disable the Automounter
The <code>autofs</code> daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default c...Rule Medium Severity -
Disable Mounting of cramfs
To configure the system to prevent the <code>cramfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/cramfs.conf</code>: <pre>install cramfs /bin/fa...Rule Low Severity -
Disable Mounting of squashfs
To configure the system to prevent the <code>squashfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/squashfs.conf</code>: <pre>install squashfs /...Rule Low Severity -
Disable Mounting of udf
To configure the system to prevent the <code>udf</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/udf.conf</code>: <pre>install udf /bin/false</pre>...Rule Low Severity -
Disable Modprobe Loading of USB Storage Driver
To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the <code>usb-...Rule Medium Severity -
Restrict Partition Mount Options
System partitions can be mounted with certain options that limit what files on those partitions can do. These options are set in the <code>/etc/fstab</code> configuration file, and can be used to m...Group -
Add nodev Option to /dev/shm
The <code>nodev</code> mount option can be used to prevent creation of device files in <code>/dev/shm</code>. Legitimate character and block devices should not exist within temporary directories li...Rule Medium Severity -
Add noexec Option to /dev/shm
The <code>noexec</code> mount option can be used to prevent binaries from being executed out of <code>/dev/shm</code>. It can be dangerous to allow the execution of binaries from world-writable tem...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.