Skip to content
Log In

Protection Profile for General Purpose Operating Systems

Rules and Groups employed by this XCCDF Profile

  • Mail Server Software

    Mail servers are used to send and receive email over the network. Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious targets of network attack. Ensure that systems are not r...
    Group
    Show

  • Uninstall Sendmail Package

    Sendmail is not the default mail transfer agent and is not installed by default. The <code>sendmail</code> package can be removed with the following command: <pre> $ sudo yum erase sendmail</pre> ...
    Rule Medium Severity
    Show

  • NFS and RPC

    The Network File System is a popular distributed filesystem for the Unix environment, and is very widely deployed. This section discusses the circumstances under which it is possible to disable NF...
    Group
    Show

  • Uninstall nfs-utils Package

    The nfs-utils package can be removed with the following command: 
    $ sudo yum erase nfs-utils
    Rule Low Severity
    Show

  • Network Time Protocol

    The Network Time Protocol is used to manage the system clock over a network. Computer clocks are not very accurate, so time will drift unpredictably on unmanaged systems. Central time protocols can...
    Group
    Show

  • The Chrony package is installed

    System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize th...
    Rule Medium Severity
    Show

  • Disable chrony daemon from acting as server

    The <code>port</code> option in <code>/etc/chrony.conf</code> can be set to <code>0</code> to make chrony daemon to never open any listening port for server operation and to operate strictly in a c...
    Rule Low Severity
    Show

  • Disable network management of chrony daemon

    The cmdport option in /etc/chrony.conf can be set to 0 to stop chrony daemon from listening on the UDP port 323 for management connections made by chronyc.
    Rule Low Severity
    Show

  • SSH Server

    The SSH protocol is recommended for remote login and remote file transfer. SSH provides confidentiality and integrity for data exchanged between two systems, as well as server authentication, throu...
    Group
    Show

  • Install OpenSSH client software

    The openssh-clients package can be installed with the following command: 
    $ sudo yum install openssh-clients
    Rule Medium Severity
    Show

  • Install the OpenSSH Server Package

    The <code>openssh-server</code> package should be installed. The <code>openssh-server</code> package can be installed with the following command: <pre> $ sudo yum install openssh-server</pre> ...
    Rule Medium Severity
    Show

  • Configure OpenSSH Client if Necessary

    The following configuration changes apply to the SSH client. They can improve security parameters relwevant to the client user, e.g. increasing entropy while generating initialization vectors. Note...
    Group
    Show

  • Configure session renegotiation for SSH client

    The <code>RekeyLimit</code> parameter specifies how often the session key is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limi...
    Rule Medium Severity
    Show

  • SSH client uses strong entropy to seed (for CSH like shells)

    To set up SSH client to use entropy from a high-quality source, make sure that the appropriate shell environment variable is configured. The <code>SSH_USE_STRONG_RNG</code> environment variable det...
    Rule Medium Severity
    Show

  • SSH client uses strong entropy to seed (Bash-like shells)

    To set up SSH client to use entropy from a high-quality source, make sure that the appropriate shell environment variable is configured. The <code>SSH_USE_STRONG_RNG</code> environment variable det...
    Rule Medium Severity
    Show

  • Configure OpenSSH Server if Necessary

    If the system needs to act as an SSH server, then certain changes should be made to the OpenSSH daemon configuration file <code>/etc/ssh/sshd_config</code>. The following recommendations can be app...
    Group
    Show

  • Set SSH Client Alive Count Max to zero

    The SSH server sends at most <code>ClientAliveCountMax</code> messages during a SSH session and waits for a response from the SSH client. The option <code>ClientAliveInterval</code> configures time...
    Rule Medium Severity
    Show

  • Set SSH Client Alive Interval

    SSH allows administrators to set a network responsiveness timeout interval. After this interval has passed, the unresponsive client will be automatically logged out. <br> <br> To se...
    Rule Medium Severity
    Show

  • Disable Host-Based Authentication

    SSH's cryptographic host-based authentication is more secure than <code>.rhosts</code> authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organ...
    Rule Medium Severity
    Show

  • Disable SSH Access via Empty Passwords

    Disallow SSH login with empty passwords. The default SSH configuration disables logins with empty passwords. The appropriate configuration is used if no value is set for <code>PermitEmptyPasswords<...
    Rule High Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules