Skip to content
Log In

CIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Workstation

Rules and Groups employed by this XCCDF Profile

  • System Settings

    Contains rules that check correct system settings.
    Group
    Show

  • Installing and Maintaining Software

    The following sections contain information on security-relevant choices during the initial operating system installation process and the setup of software updates.
    Group
    Show

  • System and Software Integrity

    System and software integrity can be gained by installing antivirus, increasing system encryption strength with FIPS, verifying installed software, enabling SELinux, installing an Intrusion Prevent...
    Group
    Show

  • Disable Prelinking

    The prelinking feature changes binaries in an attempt to decrease their startup time. In order to disable it, change or add the following line inside the file <code>/etc/sysconfig/prelink</code>: <...
    Rule Medium Severity
    Show

  • Software Integrity Checking

    Both the AIDE (Advanced Intrusion Detection Environment) software and the RPM package management system provide mechanisms for verifying the integrity of installed software. AIDE uses snapshots of ...
    Group
    Show

  • Verify Integrity with AIDE

    AIDE conducts integrity checks by comparing information about files with previously-gathered information. Ideally, the AIDE database is created immediately after initial system configuration, and t...
    Group
    Show

  • Install AIDE

    The aide package can be installed with the following command: 
    $ sudo zypper install aide
    Rule Medium Severity
    Show

  • Build and Test AIDE Database

    Run the following command to generate a new database: <pre>$ sudo /usr/bin/aide --init</pre> By default, the database will be written to the file <code>/var/lib/aide/aide.db.new</code>. Storing...
    Rule Medium Severity
    Show

  • Disk Partitioning

    To ensure separation and protection of data, there are top-level system directories which should be placed on their own physical partition or logical volume. The installer's default partitioning sc...
    Group
    Show

  • Ensure /dev/shm is configured

    The <code>/dev/shm</code> is a traditional shared memory concept. One program will create a memory portion, which other processes (if permitted) can access. If <code>/dev/shm</code> is not configur...
    Rule Low Severity
    Show

  • Ensure /tmp Located On Separate Partition

    The /tmp directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
    Rule Low Severity
    Show

  • GNOME Desktop Environment

    GNOME is a graphical desktop environment bundled with many Linux distributions that allow users to easily interact with the operating system graphically rather than textually. The GNOME Graphical D...
    Group
    Show

  • Remove the GDM Package Group

    By removing the <code>gdm</code> package, the system no longer has GNOME installed installed. If X Windows is not installed then the system cannot boot into graphical user mode. This prevents the...
    Rule Medium Severity
    Show

  • Make sure that the dconf databases are up-to-date with regards to respective keyfiles

    By default, DConf uses a binary database as a data backend. The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the <pre>dconf update</pre> command. More specific...
    Rule High Severity
    Show

  • Configure GNOME3 DConf User Profile

    By default, DConf provides a standard user profile. This profile contains a list of DConf configuration databases. The user profile and database always take the highest priority. As such the DConf ...
    Rule High Severity
    Show

  • Sudo

    <code>Sudo</code>, which stands for "su 'do'", provides the ability to delegate authority to certain users, groups of users, or system administrators. When configured for system users and/or groups...
    Group
    Show

  • Install sudo Package

    The sudo package can be installed with the following command: 
    $ sudo zypper install sudo
    Rule Medium Severity
    Show

  • Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

    The sudo <code>use_pty</code> tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the <code>use_pty</code> tag exists...
    Rule Medium Severity
    Show

  • Ensure Sudo Logfile Exists - sudo logfile

    A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.
    Rule Low Severity
    Show

  • Updating Software

    The <code>zypper</code> command line tool is used to install and update software packages. The system also provides a graphical software update tool in the <b>System</b> menu, in the <b>Administrat...
    Group
    Show

  • Ensure GPG keys are configured

    The operation system or installed application can be successfully bootstrapped without the GPG key being trusted. However, you cannot install new packages or update them until the keys are truste...
    Rule Medium Severity
    Show

  • Ensure gpgcheck Enabled In Main zypper Configuration

    The <code>gpgcheck</code> option controls whether RPM packages' signatures are always checked prior to installation. To configure zypper to check package signatures before installing them, ensure t...
    Rule High Severity
    Show

  • Ensure gpgcheck Enabled for All zypper Package Repositories

    To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form: 
    gpgcheck=0
    Rule High Severity
    Show

  • Ensure package manager repositories are configured

    Systems need to have package manager repositories configured to ensure they receive the latest patches and updates.
    Rule Medium Severity
    Show

  • Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. Therefore, making it mor...
    Group
    Show

  • Warning Banners for System Accesses

    Each system should expose as little information about itself as possible. <br> <br> System banners, which are typically displayed just before a login prompt, give out information about the s...
    Group
    Show

  • Modify the System Login Banner

    To configure the system login banner edit <code>/etc/issue</code>. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is ei...
    Rule Medium Severity
    Show

  • Modify the System Login Banner for Remote Connections

    To configure the system login banner edit <code>/etc/issue.net</code>. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is ...
    Rule Medium Severity
    Show

  • Modify the System Message of the Day Banner

    To configure the system message banner edit <code>/etc/motd</code>. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is eit...
    Rule Medium Severity
    Show

  • Verify Group Ownership of System Login Banner

    To properly set the group owner of /etc/issue, run the command: 
    $ sudo chgrp root /etc/issue
    Rule Medium Severity
    Show

  • Verify Group Ownership of System Login Banner for Remote Connections

    To properly set the group owner of /etc/issue.net, run the command: 
    $ sudo chgrp root /etc/issue.net
    Rule Medium Severity
    Show

  • Verify Group Ownership of Message of the Day Banner

    To properly set the group owner of /etc/motd, run the command: 
    $ sudo chgrp root /etc/motd
    Rule Medium Severity
    Show

  • Verify ownership of System Login Banner

    To properly set the owner of /etc/issue, run the command: 
    $ sudo chown root /etc/issue
    Rule Medium Severity
    Show

  • Verify ownership of System Login Banner for Remote Connections

    To properly set the owner of /etc/issue.net, run the command: 
    $ sudo chown root /etc/issue.net
    Rule Medium Severity
    Show

  • Verify ownership of Message of the Day Banner

    To properly set the owner of /etc/motd, run the command: 
    $ sudo chown root /etc/motd
    Rule Medium Severity
    Show

  • Verify permissions on System Login Banner

    To properly set the permissions of /etc/issue, run the command: 
    $ sudo chmod 0644 /etc/issue
    Rule Medium Severity
    Show

  • Verify permissions on System Login Banner for Remote Connections

    To properly set the permissions of /etc/issue.net, run the command: 
    $ sudo chmod 0644 /etc/issue.net
    Rule Medium Severity
    Show

  • Verify permissions on Message of the Day Banner

    To properly set the permissions of /etc/motd, run the command: 
    $ sudo chmod 0644 /etc/motd
    Rule Medium Severity
    Show

  • Implement a GUI Warning Banner

    In the default graphical environment, users logging directly into the system are greeted with a login screen provided by the GNOME Display Manager (GDM). The warning banner should be displayed in t...
    Group
    Show

  • Enable GNOME3 Login Warning Banner

    In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting <code>banner-message-enable</code> ...
    Rule Medium Severity
    Show

  • Set the GNOME3 Login Warning Banner Text

    In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting <code>banner-message-tex...
    Rule Medium Severity
    Show

  • Protect Accounts by Configuring PAM

    PAM, or Pluggable Authentication Modules, is a system which implements modular authentication for Linux programs. PAM provides a flexible and configurable architecture for authentication, and it sh...
    Group
    Show

  • Set Lockouts for Failed Password Attempts

    The <code>pam_faillock</code> PAM module provides the capability to lock out user accounts after a number of failed login attempts. Its documentation is available in <code>/usr/share/doc/pam-VERSIO...
    Group
    Show

  • Limit Password Reuse

    Do not allow users to reuse recent passwords. This can be accomplished by using the <code>remember</code> option for the <code>pam_pwhistory</code> PAM modules. <br> <br> In the file <code...
    Rule Medium Severity
    Show

  • Set Deny For Failed Password Attempts

    The SUSE Linux Enterprise 15 operating system must lock an account after - at most - <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_...
    Rule Medium Severity
    Show

  • Configure the root Account lock for Failed Password Attempts via pam_tally2

    This rule configures the system to lock out the root account after a number of incorrect login attempts using pam_tally2.so.
    Rule Medium Severity
    Show

  • Set Lockout Time for Failed Password Attempts using pam_tally2

    This rule configures the system to lock out accounts during a specified time period after a number of incorrect login attempts using pam_tally2.so.
    Rule Medium Severity
    Show

  • Set Password Quality Requirements

    The default <code>pam_pwquality</code> PAM module provides strength checking for passwords. It performs a number of checks, such as making sure passwords are not similar to dictionary words, are of...
    Group
    Show

  • Set Password Quality Requirements, if using pam_cracklib

    The <code>pam_cracklib</code> PAM module can be configured to meet requirements for a variety of policies. <br> <br> For example, to configure <code>pam_cracklib</code> to require at least...
    Group
    Show

  • Set Password Strength Minimum Digit Characters

    The pam_cracklib module's <code>dcredit</code> parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many d...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules