Skip to content
Log In

Sample Security Profile for OpenEmbedded Distros

Rules and Groups employed by this XCCDF Profile

  • Verify User Who Owns /etc/at.allow file

    If <code>/etc/at.allow</code> exists, it must be owned by <code>root</code>. To properly set the owner of <code>/etc/at.allow</code>, run the command: <pre>$ sudo chown root /etc/at.allow </pre> ...
    Rule Medium Severity
    Show

  • Verify User Who Owns /etc/cron.allow file

    If <code>/etc/cron.allow</code> exists, it must be owned by <code>root</code>. To properly set the owner of <code>/etc/cron.allow</code>, run the command: <pre>$ sudo chown root /etc/cron.allow </...
    Rule Medium Severity
    Show

  • Verify Permissions on /etc/at.allow file

    If <code>/etc/at.allow</code> exists, it must have permissions <code>0640</code> or more restrictive. To properly set the permissions of <code>/etc/at.allow</code>, run the command: <pre>$ sudo c...
    Rule Medium Severity
    Show

  • Verify Permissions on /etc/cron.allow file

    If <code>/etc/cron.allow</code> exists, it must have permissions <code>0640</code> or more restrictive. To properly set the permissions of <code>/etc/cron.allow</code>, run the command: <pre>$ su...
    Rule Medium Severity
    Show

  • DHCP

    The Dynamic Host Configuration Protocol (DHCP) allows systems to request and obtain an IP address and other configuration parameters from a server. <br> <br> This guide recommends configuring...
    Group
    Show

  • Disable DHCP Server

    The DHCP server <code>dhcpd</code> is not installed or activated by default. If the software was installed and activated, but the system does not need to act as a DHCP server, it should be disabled...
    Group
    Show

  • Disable DHCP Service

    The <code>dhcpd</code> service should be disabled on any system that does not need to act as a DHCP server. The <code>dhcpd</code> service can be disabled with the following command: <pre>$ sudo s...
    Rule Medium Severity
    Show

  • DNS Server

    Most organizations have an operational need to run at least one nameserver. However, there are many common attacks involving DNS server software, and this server software should be disabled on any ...
    Group
    Show

  • Disable DNS Server

    DNS software should be disabled on any systems which does not need to be a nameserver. Note that the BIND DNS server software is not installed on OpenEmbedded by default. The remainder of this sect...
    Group
    Show

  • Disable named Service

    The named service can be disabled with the following command: 
    $ sudo systemctl mask --now named.service
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules