II - Mission Support Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000257
Group -
The operating system must protect audit tools from unauthorized modification.
Failure to maintain system configurations may result in privilege escalation.Rule Medium Severity -
SRG-OS-000258
Group -
The operating system must protect audit tools from unauthorized deletion.
Failure to maintain system configurations may result in privilege escalation.Rule Medium Severity -
SRG-OS-000278
Group -
System packages must be configured with the vendor-provided files, permissions, and ownerships.
Failure to maintain system configurations may result in privilege escalation.Rule Medium Severity -
SRG-OS-000480
Group -
The finger daemon package must not be installed.
Finger is an insecure protocol.Rule Low Severity -
SRG-OS-000480
Group -
The legacy remote network access utilities daemons must not be installed.
Legacy remote access utilities allow remote control of a system without proper authentication.Rule Medium Severity -
SRG-OS-000480
Group -
The NIS package must not be installed.
NIS is an insecure protocol.Rule High Severity -
SRG-OS-000480
Group -
The pidgin IM client package must not be installed.
Instant messaging is an insecure protocol.Rule Low Severity -
SRG-OS-000480
Group -
The FTP daemon must not be installed unless required.
FTP is an insecure protocol.Rule High Severity -
SRG-OS-000480
Group -
The TFTP service daemon must not be installed unless required.
TFTP is an insecure protocol.Rule High Severity -
SRG-OS-000480
Group -
The telnet service daemon must not be installed unless required.
Telnet is an insecure protocol.Rule High Severity -
SRG-OS-000480
Group -
The UUCP service daemon must not be installed unless required.
UUCP is an insecure protocol.Rule Low Severity -
SRG-OS-000480
Group -
The rpcbind service must be configured for local only services unless organizationally defined.
The portmap and rpcbind services increase the attack surface of the system and should only be used when needed. The portmap or rpcbind services are used by a variety of services using remote proced...Rule Medium Severity -
SRG-OS-000480
Group -
The VNC server package must not be installed unless required.
The VNC service uses weak authentication capabilities and provides the user complete graphical system access.Rule Medium Severity -
SRG-OS-000095
Group -
The operating system must be configured to provide essential capabilities.
Operating systems are capable of providing a wide variety of functions and services. Execution must be disabled based on organization-defined specifications.Rule Medium Severity -
SRG-OS-000480
Group -
All run control scripts must have mode 0755 or less permissive.
If the startup files are writable by other users, these users could modify the startup files to insert malicious commands into the startup files.Rule Medium Severity -
SRG-OS-000480
Group -
All run control scripts must have no extended ACLs.
If the startup files are writable by other users, these users could modify the startup files to insert malicious commands into the startup files.Rule Medium Severity -
SRG-OS-000480
Group -
Run control scripts executable search paths must contain only authorized paths.
The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory ...Rule Medium Severity -
SRG-OS-000480
Group -
Run control scripts library search paths must contain only authorized paths.
The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relati...Rule Medium Severity -
SRG-OS-000480
Group -
Run control scripts lists of preloaded libraries must contain only authorized paths.
The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to librari...Rule Medium Severity -
SRG-OS-000480
Group -
Run control scripts must not execute world writable programs or scripts.
World writable files could be modified accidentally or maliciously to compromise system integrity.Rule Medium Severity -
SRG-OS-000480
Group -
All system start-up files must be owned by root.
System start-up files not owned by root could lead to system compromise by allowing malicious users or applications to modify them for unauthorized purposes. This could lead to system and network ...Rule Medium Severity -
SRG-OS-000480
Group -
All system start-up files must be group-owned by root, sys, or bin.
If system start-up files do not have a group owner of root or a system group, the files may be modified by malicious users or intruders.Rule Medium Severity -
SRG-OS-000480
Group -
System start-up files must only execute programs owned by a privileged UID or an application.
System start-up files executing programs owned by other than root (or another privileged user) or an application indicates the system may have been compromised.Rule Medium Severity -
SRG-OS-000480
Group -
Any X Windows host must write .Xauthority files.
.Xauthority files ensure the user is authorized to access the specific X Windows host. If .Xauthority files are not used, it may be possible to obtain unauthorized access to the X Windows host.Rule Medium Severity -
SRG-OS-000480
Group -
All .Xauthority files must have mode 0600 or less permissive.
.Xauthority files ensure the user is authorized to access the specific X Windows host. Excessive permissions may permit unauthorized modification of these files, which could lead to Denial of Servi...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.