Skip to content
Log In

CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Server

Rules and Groups employed by this XCCDF Profile

  • Verify User Who Owns shadow File

    To properly set the owner of /etc/shadow, run the command: 
    $ sudo chown root /etc/shadow
    Rule Medium Severity
    Show

  • Verify Permissions on Backup group File

    To properly set the permissions of /etc/group-, run the command: 
    $ sudo chmod 0644 /etc/group-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup gshadow File

    To properly set the permissions of /etc/gshadow-, run the command: 
    $ sudo chmod 0000 /etc/gshadow-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup passwd File

    To properly set the permissions of /etc/passwd-, run the command: 
    $ sudo chmod 0644 /etc/passwd-
    Rule Medium Severity
    Show

  • Verify Permissions on Backup shadow File

    To properly set the permissions of /etc/shadow-, run the command: 
    $ sudo chmod 0000 /etc/shadow-
    Rule Medium Severity
    Show

  • Verify Permissions on group File

    To properly set the permissions of /etc/group, run the command: 
    $ sudo chmod 0644 /etc/group
    Rule Medium Severity
    Show

  • Verify Permissions on gshadow File

    To properly set the permissions of /etc/gshadow, run the command: 
    $ sudo chmod 0000 /etc/gshadow
    Rule Medium Severity
    Show

  • Verify Permissions on passwd File

    To properly set the permissions of /etc/passwd, run the command: 
    $ sudo chmod 0644 /etc/passwd
    Rule Medium Severity
    Show

  • Verify Permissions on shadow File

    To properly set the permissions of /etc/shadow, run the command: 
    $ sudo chmod 0000 /etc/shadow
    Rule Medium Severity
    Show

  • Restrict Dynamic Mounting and Unmounting of Filesystems

    Linux includes a number of facilities for the automated addition and removal of filesystems on a running system. These facilities may be necessary in many environments, but this capability also ca...
    Group
    Show

  • Disable the Automounter

    The <code>autofs</code> daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default c...
    Rule Medium Severity
    Show

  • Disable Mounting of cramfs

    To configure the system to prevent the <code>cramfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/cramfs.conf</code>: <pre>install cramfs /bin/fa...
    Rule Low Severity
    Show

  • Disable Mounting of freevxfs

    To configure the system to prevent the <code>freevxfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/freevxfs.conf</code>: <pre>install freevxfs /...
    Rule Low Severity
    Show

  • Disable Mounting of hfs

    To configure the system to prevent the <code>hfs</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/hfs.conf</code>: <pre>install hfs /bin/false</pre>...
    Rule Low Severity
    Show

  • Disable Mounting of hfsplus

    To configure the system to prevent the <code>hfsplus</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/hfsplus.conf</code>: <pre>install hfsplus /bin...
    Rule Low Severity
    Show

  • Disable Mounting of jffs2

    To configure the system to prevent the <code>jffs2</code> kernel module from being loaded, add the following line to the file <code>/etc/modprobe.d/jffs2.conf</code>: <pre>install jffs2 /bin/false...
    Rule Low Severity
    Show

  • Disable Modprobe Loading of USB Storage Driver

    To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the <code>usb-...
    Rule Medium Severity
    Show

  • Restrict Partition Mount Options

    System partitions can be mounted with certain options that limit what files on those partitions can do. These options are set in the <code>/etc/fstab</code> configuration file, and can be used to m...
    Group
    Show

  • Add nodev Option to /dev/shm

    The <code>nodev</code> mount option can be used to prevent creation of device files in <code>/dev/shm</code>. Legitimate character and block devices should not exist within temporary directories li...
    Rule Medium Severity
    Show

  • Add noexec Option to /dev/shm

    The <code>noexec</code> mount option can be used to prevent binaries from being executed out of <code>/dev/shm</code>. It can be dangerous to allow the execution of binaries from world-writable tem...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules