Skip to content
ATO Pathways
  Log In

Sample Security Profile for OpenEmbedded Distros

Rules and Groups employed by this XCCDF Profile

  • Verify Group Who Owns Backup shadow File

    To properly set the owner of /etc/shadow-, run the command: 
    $ sudo chown root /etc/shadow-
    Rule Medium Severity
    Show

  • Verify User Who Owns group File

    To properly set the owner of /etc/group, run the command: 
    $ sudo chown root /etc/group
    Rule Medium Severity
    Show

  • Verify User Who Owns gshadow File

    To properly set the owner of /etc/gshadow, run the command: 
    $ sudo chown root /etc/gshadow
    Rule Medium Severity
    Show

  • Verify User Who Owns passwd File

    To properly set the owner of /etc/passwd, run the command: 
    $ sudo chown root /etc/passwd
    Rule Medium Severity
    Show

  • Verify User Who Owns shadow File

    To properly set the owner of /etc/shadow, run the command: 
    $ sudo chown root /etc/shadow
    Rule Medium Severity
    Show

  • Verify Permissions on Backup group File

    To properly set the permissions of /etc/group-, run the command: 
    $ sudo chmod 0644 /etc/group-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup passwd File

    To properly set the permissions of /etc/passwd-, run the command: 
    $ sudo chmod 0644 /etc/passwd-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup shadow File

    To properly set the permissions of /etc/shadow-, run the command: 
    $ sudo chmod 0000 /etc/shadow-
    Rule Medium Severity
    Show

  • Verify Permissions on group File

    To properly set the permissions of /etc/group, run the command: 
    $ sudo chmod 0644 /etc/group
    Rule Medium Severity
    Show

  • Verify Permissions on passwd File

    To properly set the permissions of /etc/passwd, run the command: 
    $ sudo chmod 0644 /etc/passwd
    Rule Medium Severity
    Show

  • Restrict Programs from Dangerous Execution Patterns

    The recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution ar...
    Group
    Show

  • Disable Core Dumps

    A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases,...
    Group
    Show

  • Disable Core Dumps for All Users

    To disable core dumps for all users, add the following line to <code>/etc/security/limits.conf</code>, or to a file within the <code>/etc/security/...
    Rule Medium Severity
    Show

  • Services

    The best protection against vulnerable software is running less software. This section describes how to review the software which OpenEmbedded inst...
    Group
    Show

  • Avahi Server

    The Avahi daemon implements the DNS Service Discovery and Multicast DNS protocols, which provide service and host discovery on a network. It allows...
    Group
    Show

  • Disable Avahi Server if Possible

    Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Disabling it can reduce the system's vulnerability t...
    Group
    Show

  • Disable Avahi Server Software

    The avahi-daemon service can be disabled with the following command: 
    $ sudo systemctl mask --now avahi-daemon.service
    Rule Medium Severity
    Show

  • Cron and At Daemons

    The cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform n...
    Group
    Show

  • Enable cron Service

    The <code>crond</code> service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary mainte...
    Rule Medium Severity
    Show

  • Verify Group Who Owns cron.d

    To properly set the group owner of /etc/cron.d, run the command: 
    $ sudo chgrp root /etc/cron.d
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules