Australian Cyber Security Centre (ACSC) ISM Official
Rules and Groups employed by this XCCDF Profile
-
Enable Smartcards in SSSD
SSSD should be configured to authenticate access to the system using smart cards. To enable smart cards in SSSD, set <code>pam_cert_auth</code> to <code>True</code> under the <code>[pam]</code> sec...Rule Medium Severity -
USBGuard daemon
The USBGuard daemon enforces the USB device authorization policy for all USB devices.Group -
Install usbguard Package
Theusbguard
package can be installed with the following command:$ sudo yum install usbguard
Rule Medium Severity -
Enable the USBGuard Service
The USBGuard service should be enabled. Theusbguard
service can be enabled with the following command:$ sudo systemctl enable usbguard.service
Rule Medium Severity -
Enable ExecShield via sysctl
By default on Oracle Linux 9 64-bit systems, ExecShield is enabled and can only be disabled if the hardware does not support ExecShield or is disabled in/etc/default/grub
.Rule Medium Severity -
Prevent non-Privileged Users from Modifying Network Interfaces using nmcli
By default, non-privileged users are given permissions to modify networking interfaces and configurations using the <code>nmcli</code> command. Non-privileged users should not be making configurati...Rule Medium Severity -
Enable the auditadm_exec_content SELinux Boolean
By default, the SELinux boolean <code>auditadm_exec_content</code> is enabled. If this setting is disabled, it should be enabled. To enable the <code>auditadm_exec_content</code> SELinux boolean, ...Rule Medium Severity -
Disable the authlogin_nsswitch_use_ldap SELinux Boolean
By default, the SELinux boolean <code>authlogin_nsswitch_use_ldap</code> is disabled. If this setting is enabled, it should be disabled. To disable the <code>authlogin_nsswitch_use_ldap</code> SEL...Rule Medium Severity -
Disable the authlogin_radius SELinux Boolean
By default, the SELinux boolean <code>authlogin_radius</code> is disabled. If this setting is enabled, it should be disabled. To disable the <code>authlogin_radius</code> SELinux boolean, run the ...Rule Medium Severity -
Enable the kerberos_enabled SELinux Boolean
By default, the SELinux boolean <code>kerberos_enabled</code> is enabled. If this setting is disabled, it should be enabled to allow confined applications to run with Kerberos. To enable the <code...Rule Medium Severity -
Chrony Configure Pool and Server
<code>Chrony</code> is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. M...Rule Medium Severity -
Specify Additional Remote NTP Servers
Depending on specific functional requirements of a concrete production environment, the Oracle Linux 9 system can be configured to utilize the services of the <code>chronyd</code> NTP daemon (the d...Rule Medium Severity -
Disable snmpd Service
Thesnmpd
service can be disabled with the following command:$ sudo systemctl mask --now snmpd.service
Rule Low Severity -
Configure SNMP Service to Use Only SNMPv3 or Newer
Edit <code>/etc/snmp/snmpd.conf</code>, removing any references to <code>rocommunity</code>, <code>rwcommunity</code>, or <code>com2sec</code>. Upon doing that, restart the SNMP service: <pre>$ sud...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.