Skip to content
Log In

DRAFT - Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)

Rules and Groups employed by this XCCDF Profile

  • Configure auditing of successful ownership changes (ppc64le)

    Ensure that successful attempts to change an ownership of files or directories are audited. The following rules configure audit as described above: <pre>## Successful ownership change -a always,ex...
    Rule Medium Severity
    Show

  • Configure auditing of unsuccessful permission changes

    Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...
    Rule Medium Severity
    Show

  • Configure auditing of unsuccessful permission changes (AArch64)

    Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...
    Rule Medium Severity
    Show

  • Configure auditing of unsuccessful permission changes (ppc64le)

    Ensure that unsuccessful attempts to change file or directory permissions are audited. The following rules configure audit as described above: <pre>## Unsuccessful permission change -a always,exit...
    Rule Medium Severity
    Show

  • Configure auditing of successful permission changes

    Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...
    Rule Medium Severity
    Show

  • Configure auditing of successful permission changes (AArch64)

    Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...
    Rule Medium Severity
    Show

  • Configure auditing of successful permission changes (ppc64le)

    Ensure that successful attempts to modify permissions of files or directories are audited. The following rules configure audit as described above: <pre>## Successful permission change -a always,ex...
    Rule Medium Severity
    Show

  • GRUB2 bootloader configuration

    During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows for the selection of different kernels - possibly ...
    Group
    Show

  • Disable Recovery Booting

    Red Hat Enterprise Linux 9 systems support an "recovery boot" option that can be used to prevent services from being started. The <code>GRUB_DISABLE_RECOVERY</code> configuration option in <code>/e...
    Rule Medium Severity
    Show

  • Configure kernel to zero out memory before allocation

    To configure the kernel to zero out memory before allocating it, add the <code>init_on_alloc=1</code> argument to the default GRUB 2 command line. To ensure that <code>init_on_alloc=1</code> is add...
    Rule Medium Severity
    Show

  • Enable randomization of the page allocator

    To enable randomization of the page allocator in the kernel, add the <code>page_alloc.shuffle=1</code> argument to the default GRUB 2 command line. To ensure that <code>page_alloc.shuffle=1</code> ...
    Rule Medium Severity
    Show

  • Ensure debug-shell service is not enabled during boot

    systemd's <code>debug-shell</code> service is intended to diagnose systemd related boot issues with various <code>systemctl</code> commands. Once enabled and following a system reboot, the root she...
    Rule Medium Severity
    Show

  • Disable vsyscalls

    To disable use of virtual syscalls, add the argument <code>vsyscall=none</code> to the default GRUB 2 command line for the Linux operating system. To ensure that <code>vsyscall=none</code> is added...
    Rule Medium Severity
    Show

  • UEFI GRUB2 bootloader configuration

    UEFI GRUB2 bootloader configuration
    Group
    Show

  • Set the UEFI Boot Loader Password

    The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br> <br> Since plaintext passwords are a security risk, generat...
    Rule High Severity
    Show

  • zIPL bootloader configuration

    During the boot process, the bootloader is responsible for starting the execution of the kernel and passing options to it. The default Red Hat Enterprise Linux 9 boot loader for s390x systems is ca...
    Group
    Show

  • Enable Auditing to Start Prior to the Audit Daemon in zIPL

    To ensure all processes can be audited, even those which start prior to the audit daemon, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>audit=1</code> included ...
    Rule Medium Severity
    Show

  • Extend Audit Backlog Limit for the Audit Daemon in zIPL

    To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>audit_ba...
    Rule Medium Severity
    Show

  • Ensure all zIPL boot entries are BLS compliant

    Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS) by checking that /etc/zipl.conf doesn't contain image = .
    Rule Medium Severity
    Show

  • Ensure zIPL bootmap is up to date

    Make sure that <code>/boot/bootmap</code> is up to date.<br> Every time a boot entry or zIPL configuration is changed <code>/boot/bootmap</code> needs to be updated to reflect the changes.<br> Run ...
    Rule Medium Severity
    Show

  • Configure kernel to zero out memory before allocation in zIPL

    To ensure that the kernel is configured to zero out memory before allocation, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>init_on_alloc=1</code> included in i...
    Rule Medium Severity
    Show

  • Enable randomization of the page allocator in zIPL

    To enable the randomization of the page allocator in the kernel, check that all boot entries in <code>/boot/loader/entries/*.conf</code> have <code>page_alloc.shuffle=1</code> included in its optio...
    Rule Medium Severity
    Show

  • Ensure debug-shell service is not enabled in zIPL

    systemd's <code>debug-shell</code> service is intended to diagnose systemd related boot issues with various <code>systemctl</code> commands. Once enabled and following a system reboot, the root she...
    Rule Medium Severity
    Show

  • Network Configuration and Firewalls

    Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses the security impact of decisions about networking wh...
    Group
    Show

  • firewalld

    The dynamic firewall daemon <code>firewalld</code> provides a dynamically managed firewall with support for network “zones” to assign a level of trust to a network and its associated connections an...
    Group
    Show

  • Inspect and Activate Default firewalld Rules

    Firewalls can be used to separate networks into different zones based on the level of trust the user has decided to place on the devices and traffic within that network. <code>NetworkManager</code>...
    Group
    Show

  • Install firewalld Package

    The firewalld package can be installed with the following command: 
    $ sudo dnf install firewalld
    Rule Medium Severity
    Show

  • Verify firewalld Enabled

    The firewalld service can be enabled with the following command: 
    $ sudo systemctl enable firewalld.service
    Rule Medium Severity
    Show

  • Uncommon Network Protocols

    The system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code are not frequently discovered, the consequences ca...
    Group
    Show

  • Disable CAN Support

    The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configur...
    Rule Medium Severity
    Show

  • Disable SCTP Support

    The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection...
    Rule Medium Severity
    Show

  • Disable TIPC Support

    The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the <code>tipc</code> kernel module...
    Rule Low Severity
    Show

  • Wireless Networking

    Wireless networking, such as 802.11 (WiFi) and Bluetooth, can present a security risk to sensitive or classified systems and networks. Wireless networking hardware is much more likely to be include...
    Group
    Show

  • Disable Wireless Through Software Configuration

    If it is impossible to remove the wireless hardware from the device in question, disable as much of it as possible through software. The following methods can disable software support for wireless ...
    Group
    Show

  • Disable Bluetooth Kernel Module

    The kernel's module loading system can be configured to prevent loading of the Bluetooth module. Add the following to the appropriate <code>/etc/modprobe.d</code> configuration file to prevent the ...
    Rule Medium Severity
    Show

  • File Permissions and Masks

    Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which they should not have access. <br> <br> ...
    Group
    Show

  • Restrict Partition Mount Options

    System partitions can be mounted with certain options that limit what files on those partitions can do. These options are set in the <code>/etc/fstab</code> configuration file, and can be used to m...
    Group
    Show

  • Add nodev Option to /var/log/audit

    The <code>nodev</code> mount option can be used to prevent device files from being created in <code>/var/log/audit</code>. Legitimate character and block devices should exist only in the <code>/dev...
    Rule Medium Severity
    Show

  • Add noexec Option to /var/log/audit

    The <code>noexec</code> mount option can be used to prevent binaries from being executed out of <code>/var/log/audit</code>. Add the <code>noexec</code> option to the fourth column of <code>/etc/fs...
    Rule Medium Severity
    Show

  • Add nosuid Option to /var/log/audit

    The <code>nosuid</code> mount option can be used to prevent execution of setuid programs in <code>/var/log/audit</code>. The SUID and SGID permissions should not be required in directories containi...
    Rule Medium Severity
    Show

  • Restrict Programs from Dangerous Execution Patterns

    The recommendations in this section are designed to ensure that the system's features to protect against potentially dangerous program execution are activated. These protections are applied at the ...
    Group
    Show

  • Disable storing core dumps

    The <code>kernel.core_pattern</code> option specifies the core dumpfile pattern name. It can be set to an empty string. In this case, the kernel behaves differently based on another related option....
    Rule Medium Severity
    Show

  • Configure file name of core dumps

    To set the runtime status of the <code>kernel.core_uses_pid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.core_uses_pid=0</pre> To make sure that the setting is p...
    Rule Medium Severity
    Show

  • Restrict Access to Kernel Message Buffer

    To set the runtime status of the <code>kernel.dmesg_restrict</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.dmesg_restrict=1</pre> To make sure that the setting is...
    Rule Low Severity
    Show

  • Disable Kernel Image Loading

    To set the runtime status of the <code>kernel.kexec_load_disabled</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.kexec_load_disabled=1</pre> To make sure that the ...
    Rule Medium Severity
    Show

  • Disallow kernel profiling by unprivileged users

    To set the runtime status of the <code>kernel.perf_event_paranoid</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.perf_event_paranoid=2</pre> To make sure that the ...
    Rule Low Severity
    Show

  • Disable Access to Network bpf() Syscall From Unprivileged Processes

    To prevent unprivileged processes from using the <code>bpf()</code> syscall the <code>kernel.unprivileged_bpf_disabled</code> kernel parameter must be set to <code>1</code> or <code>2</code>. Writ...
    Rule Medium Severity
    Show

  • Restrict usage of ptrace to descendant processes

    To set the runtime status of the <code>kernel.yama.ptrace_scope</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w kernel.yama.ptrace_scope=1</pre> To make sure that the sett...
    Rule Medium Severity
    Show

  • Disable the use of user namespaces

    To set the runtime status of the <code>user.max_user_namespaces</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w user.max_user_namespaces=0</pre> To make sure that the set...
    Rule Medium Severity
    Show

  • Disable Core Dumps

    A core dump file is the memory image of an executable program when it was terminated by the operating system due to errant behavior. In most cases, only software developers legitimately need to acc...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules