Red Hat Enterprise Linux 6 Security TIPS and Hardening

$ mount | grep "on /tmp "

If /tmp has its own partition or volume group, a line will be returned. If no line is returned, this is a finding.

$ mount | grep "on /var "

If /var has its own partition or volume group, a line will be returned. If no line is returned, this is a finding.

$ mount | grep "on /var/log "

If /var/log has its own partition or volume group, a line will be returned. If no line is returned, this is a finding.

$ mount | grep "on /var/log/audit "

If /var/log/audit has its own partition or volume group, a line will be returned. If no line is returned, this is a finding.

space_left_action

Acceptable values are email, suspend, single, and halt. If the system is not configured to send an email to the system administrator when disk space is starting to run low, this is a finding.

space_left_action = ACTION

Possible values for ACTION are described in the auditd.conf man page. These include:

• ignore
• syslog
• email
• exec
• suspend
• single
• halt

Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.

$ mount | grep "on /home "

If /home has its own partition or volume group, a line will be returned. If no line is returned, this is a finding.

$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey

The command should return the string below:

gpg(Red Hat, Inc. (release key 2)  <security@redhat.com>

If the Red Hat GPG Key is not installed, this is a finding.

$ sudo rhn_register

If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom, use the following command as the root user to import it into the keyring:

$ sudo rpm --import /media/cdrom/RPM-GPG-KEY

# chkconfig rhnsd --list

Output should indicate the rhnsd service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig rhnsd --list
rhnsd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify rhnsd is disabled through current runtime configuration:

# service rhnsd status

If the service is disabled the command will return the following output:

rhnsd is stopped

If the service is running, this is a finding.

# chkconfig rhnsd off

$ sudo yum check-update

If the system is not configured to update from one of these sources, run the following command to list when each package was last updated:

$ rpm -qa -last

Compare this to Red Hat Security Advisories (RHSA) listed at https://access.redhat.com/security/updates/active/ to determine if the system is missing applicable updates. If updates are not installed, this is a finding.

$ sudo yum update

If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the Red Hat Network and installed using rpm.

gpgcheck=1

A value of 1 indicates that gpgcheck is enabled. Absence of a gpgcheck line or a setting of 0 indicates that it is disabled. If GPG checking is not enabled, this is a finding.

gpgcheck=1

gpgcheck=0

A value of 0 indicates that gpgcheck has been disabled for that repo. If GPG checking is disabled, this is a finding.

gpgcheck=0

# rpm -q aide

If the package is not installed, this is a finding.

$ sudo yum install aide

$ sudo ls -l DBDIR/database_file_name

If there is no database file, this is a finding.

$ sudo /usr/sbin/aide --init

By default, the database will be written to the file /var/lib/aide/aide.db.new.gz. Storing the database, the configuration file /etc/aide.conf, and the binary /usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:

$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

To initiate a manual check, run the following command:

$ sudo /usr/sbin/aide --check

If this check produces any unexpected output, investigate.

$ sudo rm /etc/hosts.equiv

$ rm ~/.rhosts

SELINUX=enforcing

If SELINUX is not set to enforcing, this is a finding.

SELINUX=

SELINUXTYPE=targeted

If it does not, this is a finding.

SELINUXTYPE=

Other policies, such as mls, provide additional security labeling and greater confinement but are not compatible with many general-purpose use cases.

$ sudo ls -RZ /dev | grep unlabeled_t

It should produce no output in a well-configured system. If there is output, this is a finding.

$ sudo grep ^vc/[0-9] /etc/securetty

If any output is returned, then root logins over virtual console devices is permitted. If root login over virtual console devices is permitted, this is a finding.

vc/1
vc/2
vc/3
vc/4

$ sudo grep ^ttyS/[0-9] /etc/securetty

If any output is returned, then root login over serial ports is permitted. If root login over serial ports is permitted, this is a finding.

ttyS0
ttyS1

$ grep nullok /etc/pam.d/system-auth

If this produces any output, it may be possible to log into accounts with empty passwords. If NULL passwords can be used, this is a finding.

$ awk -F: '($2 != "x") {print}' /etc/passwd

If it produces any output, then a password hash is stored in /etc/passwd. If any stored hashes are found in /etc/passwd, this is a finding.

$ awk -F: '($3 == "0") {print}' /etc/passwd

This should print only one line, for the user root. If any account other than root has a UID of 0, this is a finding.

$ ls -lL /etc/shadow

If properly configured, the output should indicate the following owner: root If it does not, this is a finding.

# chown root/etc/shadow

$ ls -lL /etc/shadow

If properly configured, the output should indicate the following group-owner. root If it does not, this is a finding.

# chgrp root/etc/shadow

$ ls -l /etc/shadow

If properly configured, the output should indicate the following permissions: ---------- If it does not, this is a finding.

# chmod 0000/etc/shadow

$ ls -lL /etc/gshadow

If properly configured, the output should indicate the following owner: root If it does not, this is a finding.

# chown root/etc/gshadow

$ ls -lL /etc/gshadow

If properly configured, the output should indicate the following group-owner. root If it does not, this is a finding.

# chgrp root/etc/gshadow

$ ls -l /etc/gshadow

If properly configured, the output should indicate the following permissions: ---------- If it does not, this is a finding.

# chmod 0000/etc/gshadow

$ ls -lL /etc/passwd

If properly configured, the output should indicate the following owner: root If it does not, this is a finding.

# chown root/etc/passwd

$ ls -lL /etc/passwd

If properly configured, the output should indicate the following group-owner. root If it does not, this is a finding.

# chgrp root/etc/passwd

$ ls -l /etc/passwd

If properly configured, the output should indicate the following permissions: -rw-r--r-- If it does not, this is a finding.

# chmod 0644/etc/passwd

$ ls -lL /etc/group

If properly configured, the output should indicate the following owner: root If it does not, this is a finding.

# chown root/etc/group

$ ls -lL /etc/group

If properly configured, the output should indicate the following group-owner. root If it does not, this is a finding.

# chgrp root/etc/group

$ ls -l /etc/group

If properly configured, the output should indicate the following permissions: -rw-r--r-- If it does not, this is a finding.

# chmod 644/etc/group

/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable, run the following command for each directory DIR which contains shared libraries:

$ sudo find -L DIR -perm /022 -type f

If any of these files are group-writable or world-writable, this is a finding.

/lib
/lib64
/usr/lib
/usr/lib64

Kernel modules, which can be added to the kernel during runtime, are stored in /lib/modules. All files in these directories should not be group-writable or world-writable. If any file in these directories is found to be group-writable or world-writable, correct its permission with the following command:

$ sudo chmod go-w FILE

/lib
/lib64
/usr/lib
/usr/lib64

For each of these directories, run the following command to find files not owned by root:

$ sudo find -L $DIR \! -user root -exec chown root {} \;

If any of these files are not owned by root, this is a finding.

/lib
/lib64
/usr/lib
/usr/lib64

Kernel modules, which can be added to the kernel during runtime, are also stored in /lib/modules. All files in these directories should be owned by the root user. If the directory, or any file in these directories, is found to be owned by a user other than root correct its ownership with the following command:

$ sudo chown root FILE

/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin

To find system executables that are group-writable or world-writable, run the following command for each directory DIR which contains system executables:

$ sudo find -L DIR -perm /022 -type f

If any system executables are found to be group or world writable, this is a finding.

/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin

All files in these directories should not be group-writable or world-writable. If any file FILE in these directories is found to be group-writable or world-writable, correct its permission with the following command:

$ sudo chmod go-w FILE

/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin

To find system executables that are not owned by root, run the following command for each directory DIR which contains system executables:

$ sudo find DIR/ \! -user root

If any system executables are found to not be owned by root, this is a finding.

/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin

All files in these directories should be owned by the root user. If any file FILE in these directories is found to be owned by a user other than root, correct its ownership with the following command:

$ sudo chown root FILE

$ grep PASS_MIN_LEN /etc/login.defs

The DoD requirement is 14. If it is not set to the required value, this is a finding.

PASS_MIN_LEN

The DoD requirement is 14. The FISMA requirement is 12. If a program consults /etc/login.defs and also another PAM module (such as pam_cracklib) during a password change operation, then the most restrictive must be satisfied. See PAM section for more information about enforcing password quality requirements.

$ grep PASS_MIN_DAYS /etc/login.defs

The DoD and FISMA requirement is 1. If it is not set to the required value, this is a finding.

PASS_MIN_DAYS 

A value of 1 day is considered for sufficient for many environments. The DoD requirement is 1.

$ grep PASS_MAX_DAYS /etc/login.defs

The DoD and FISMA requirement is 60. A value of 180 days is sufficient for many environments. If it is not set to the required value, this is a finding.

PASS_MAX_DAYS 

A value of 180 days is sufficient for many environments. The DoD requirement is 60.

$ grep PASS_WARN_AGE /etc/login.defs

The DoD requirement is 7. If it is not set to the required value, this is a finding.

PASS_WARN_AGE 

The DoD requirement is 7.

$ grep pam_cracklib /etc/pam.d/system-auth

The dcredit parameter (as a negative number) will indicate how many digits are required. The DoD requires at least one digit in a password. This would appear as dcredit=-1. If dcredit is not found or not set to the required value, this is a finding.

$ grep pam_cracklib /etc/pam.d/system-auth

The ucredit parameter (as a negative number) will indicate how many uppercase characters are required. The DoD and FISMA require at least one uppercase character in a password. This would appear as ucredit=-1. If ucredit is not found or not set to the required value, this is a finding.

$ grep pam_cracklib /etc/pam.d/system-auth

The ocredit parameter (as a negative number) will indicate how many special characters are required. The DoD and FISMA require at least one special character in a password. This would appear as ocredit=-1. If ocredit is not found or not set to the required value, this is a finding.

$ grep pam_cracklib /etc/pam.d/system-auth

The lcredit parameter (as a negative number) will indicate how many special characters are required. The DoD and FISMA require at least one lowercase character in a password. This would appear as lcredit=-1. If lcredit is not found or not set to the required value, this is a finding.

$ grep pam_cracklib /etc/pam.d/system-auth

The difok parameter will indicate how many characters must differ. The DoD requires four characters differ during a password change. This would appear as difok=4. If difok is not found or not set to the required value, this is a finding.

$ grep pam_faillock /etc/pam.d/system-auth

The output should show deny=3. If that is not the case, this is a finding.

Add the following lines immediately below the pam_unix.so statement in AUTH section of both /etc/pam.d/system-auth and /etc/pam.d/password-auth:

auth [default=die] pam_faillock.so authfail deny= unlock_time=604800 fail_interval=900

auth required pam_faillock.so authsucc deny= unlock_time=604800 fail_interval=900

$ grep sha512 /etc/pam.d/system-auth

If it does not, this is a finding.

password    sufficient    pam_unix.so sha512 other arguments...

This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.

ENCRYPT_METHOD SHA512

If it does not, this is a finding.

ENCRYPT_METHOD SHA512

crypt_style = sha512

If it does not, this is a finding.

crypt_style = sha512

$ ls -lL /etc/grub.conf

If properly configured, the output should indicate the following owner: root If it does not, this is a finding.

# chown root/etc/grub.conf

$ ls -lL /etc/grub.conf

If properly configured, the output should indicate the following group-owner. root If it does not, this is a finding.

# chgrp root/etc/grub.conf

$ sudo ls -lL /etc/grub.conf

If properly configured, the output should indicate the following permissions: -rw------- If it does not, this is a finding.

# chmod 600/boot/grub/grub.conf

$ sudo grep password /etc/grub.conf

The output should show the following:

password --encrypted password-hash

If it does not, this is a finding.

$ grub-crypt --sha-512

When prompted to enter a password, insert the following line into /etc/grub.conf immediately after the header comments. (Use the output from grub-crypt as the value of password-hash):

password --encrypted password-hash

NOTE: To meet FISMA Moderate, the bootloader password MUST differ from the root password.

$ grep SINGLE /etc/sysconfig/init

The output should be the following:

SINGLE=/sbin/sulogin

If the output is different, this is a finding.

To require entry of the root password even if the system is started in single-user mode, add or correct the following line in the file /etc/sysconfig/init:

SINGLE=/sbin/sulogin

$ grep PROMPT /etc/sysconfig/init

If interactive boot is disabled, the output will show:

PROMPT=no

If it does not, this is a finding.

PROMPT=no

The PROMPT option allows the console user to perform an interactive system startup, in which it is possible to select the set of services which are started on boot.

# rpm -q screen

If the package is not installed, this is a finding.

$ sudo yum install screen

Instruct users to begin new terminal sessions with the following command:

$ screen

The console can now be locked with the following key combination:

ctrl+a x

$ cat /etc/issue

If it does not display the required banner, this is a finding.

Edit /etc/issue. Replace the default text with a message compliant with the local site policy or a legal disclaimer. The DoD required text is either:

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

OR:

I've read & consent to terms in IS user agreem't.

$ sysctl kernel.randomize_va_space

The output of the command should indicate a value of 2. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w kernel.randomize_va_space=2

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

kernel.randomize_va_space = 2

$ sysctl kernel.exec-shield

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w kernel.exec-shield=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

kernel.exec-shield = 1

$ sysctl net.ipv4.conf.default.send_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.default.send_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.default.send_redirects = 0

$ sysctl net.ipv4.conf.all.send_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.all.send_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.all.send_redirects = 0

$ sysctl net.ipv4.ip_forward

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. The ability to forward packets is only appropriate for routers. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.ip_forward=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.ip_forward = 0

$ sysctl net.ipv4.conf.all.accept_source_route

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.all.accept_source_route=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.all.accept_source_route = 0

$ sysctl net.ipv4.conf.all.accept_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.all.accept_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.all.accept_redirects = 0

$ sysctl net.ipv4.conf.all.secure_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.all.secure_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.all.secure_redirects = 0

$ sysctl net.ipv4.conf.all.log_martians

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.all.log_martians=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.all.log_martians = 1

$ sysctl net.ipv4.conf.default.accept_source_route

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.default.accept_source_route=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.default.accept_source_route = 0

$ sysctl net.ipv4.conf.default.secure_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.default.secure_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.default.secure_redirects = 0

$ sysctl net.ipv4.conf.default.accept_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.default.accept_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.default.accept_redirects = 0

$ sysctl net.ipv4.icmp_echo_ignore_broadcasts

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_broadcasts = 1

$ sysctl net.ipv4.icmp_ignore_bogus_error_responses

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.icmp_ignore_bogus_error_responses = 1

$ sysctl net.ipv4.tcp_syncookies

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.tcp_syncookies=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.tcp_syncookies = 1

$ sysctl net.ipv4.conf.all.rp_filter

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.all.rp_filter=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.all.rp_filter = 1

$ sysctl net.ipv4.conf.default.rp_filter

The output of the command should indicate a value of 1. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv4.conf.default.rp_filter=1

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv4.conf.default.rp_filter = 1

If the system is configured to prevent the loading of the ipv6 kernel module, it will contain a line of the form:

options ipv6 disable=1

Such lines may be inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf. This permits insertion of the IPv6 kernel module (which other parts of the system expect to be present), but otherwise keeps it inactive. Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:

$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d

If the ipv6 kernel module is loaded, this is a finding.

options ipv6 disable=1

This permits the IPv6 module to be loaded (and thus satisfy other modules that depend on it), while disabling support for the IPv6 protocol.

$ sysctl net.ipv6.conf.default.accept_redirects

The output of the command should indicate a value of 0. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in /etc/sysctl.conf. If the correct value is not returned, this is a finding.

# sysctl -w net.ipv6.conf.default.accept_redirects=0

If this is not the system’s default value, add the following line to /etc/sysctl.conf:

net.ipv6.conf.default.accept_redirects = 0

Run the following command to determine the current status of the ip6tables service:

# service ip6tables status

If the service is enabled, it should return the following:

ip6tables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ip6tables on

Run the following command to determine the current status of the ip6tables service:

# service ip6tables status

If the service is enabled, it should return the following:

ip6tables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ip6tables on

Run the following command to determine the current status of the ip6tables service:

# service ip6tables status

If the service is enabled, it should return the following:

ip6tables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ip6tables on

Run the following command to determine the current status of the ip6tables service:

# service ip6tables status

If the service is enabled, it should return the following:

ip6tables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ip6tables on

Run the following command to determine the current status of the ip6tables service:

# service ip6tables status

If the service is enabled, it should return the following:

ip6tables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ip6tables on

Run the following command to determine the current status of the ip6tables service:

# service ip6tables status

If the service is enabled, it should return the following:

ip6tables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ip6tables on

# service iptables status

If the service is enabled, it should return the following:

iptables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 iptables on

# service iptables status

If the service is enabled, it should return the following:

iptables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 iptables on

# service iptables status

If the service is enabled, it should return the following:

iptables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 iptables on

# service iptables status

If the service is enabled, it should return the following:

iptables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 iptables on

# service iptables status

If the service is enabled, it should return the following:

iptables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 iptables on

# service iptables status

If the service is enabled, it should return the following:

iptables is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 iptables on

$ sudo grep ":INPUT" /etc/sysconfig/iptables

If the default policy for the INPUT chain is not set to DROP, this is a finding.

:INPUT DROP [0:0]

$ sudo grep ":INPUT" /etc/sysconfig/iptables

If the default policy for the INPUT chain is not set to DROP, this is a finding.

:INPUT DROP [0:0]

$ sudo grep ":INPUT" /etc/sysconfig/iptables

If the default policy for the INPUT chain is not set to DROP, this is a finding.

:INPUT DROP [0:0]

$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install dccp /bin/false

$ grep -r sctp /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install sctp /bin/false

$ grep -r rds /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install rds /bin/false

$ grep -r tipc /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install tipc /bin/false

$ ls -l LOGFILE

If the owner is not root, this is a finding.

$ ls -l LOGFILE

If the owner is not root, run the following command to correct this:

$ sudo chown root LOGFILE

$ ls -l LOGFILE

If the group-owner is not root, this is a finding.

$ ls -l LOGFILE

If the owner is not root, run the following command to correct this:

$ sudo chgrp root LOGFILE

$ ls -l LOGFILE

The permissions should be 600, or more restrictive. If the permissions are not correct, this is a finding.

$ ls -l LOGFILE

If the permissions are not 600 or more restrictive, run the following command to correct this:

$ sudo chmod 0600 LOGFILE

 *.* @loghost.example.com

If using TCP, a line similar to the following should be present:

 *.* @@loghost.example.com

If using RELP, a line similar to the following should be present:

 *.* :omrelp:loghost.example.com

If none of these are present, this is a finding.

*.* @loghost.example.com

To use TCP for log message delivery:

*.* @@loghost.example.com

To use RELP for log message delivery:

*.* :omrelp:loghost.example.com

 *.* @loghost.example.com

If using TCP, a line similar to the following should be present:

 *.* @@loghost.example.com

If using RELP, a line similar to the following should be present:

 *.* :omrelp:loghost.example.com

If none of these are present, this is a finding.

*.* @loghost.example.com

To use TCP for log message delivery:

*.* @@loghost.example.com

To use RELP for log message delivery:

*.* :omrelp:loghost.example.com

$ sudo grep logrotate /var/log/cron*

If logrotate is configured properly, output should include references to /etc/cron.daily. If logrotate is not configured to run daily, this is a finding.

# rotate log files frequency
daily

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

# service auditd status

If the service is enabled, it should return the following:

auditd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 auditd on

kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1

num_logs = 5

If the system log file retention has not been properly configured, this is a finding.

num_logs = NUMLOGS

Set the value to 5 for general-purpose systems. Note that values less than 2 result in no log rotation.

max_log_file = 6

If the system audit data threshold has not been properly configured, this is a finding.

max_log_file = STOREMB

Set the value to 6 (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.

max_log_file_action rotate

If the system has not been properly configured to rotate audit logs, this is a finding.

max_log_file_action = ACTION

Possible values for ACTION are described in the auditd.conf man page. These include:

• ignore
• syslog
• suspend
• rotate
• keep_logs

Set the ACTION to rotate to ensure log rotation occurs. This is the default. The setting is case-insensitive.

# auditctl -l | grep syscall | grep adjtimex

If the system is configured to audit this activity, it will return a line. If the system is not configured to audit time changes, this is a finding.

# audit_time_rules
-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules

On a 64-bit system, add the following to /etc/audit/audit.rules:

# audit_time_rules
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
-k audit_time_rules

# auditctl -l | grep syscall | grep settimeofday

If the system is configured to audit this activity, it will return a line. If the system is not configured to audit time changes, this is a finding.

# audit_time_rules
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules

On a 64-bit system, add the following to /etc/audit/audit.rules:

# audit_time_rules
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
-k audit_time_rules

# auditctl -l | grep syscall | grep stime

If the system is configured to audit this activity, it will return a line. If the system is not configured to audit time changes, this is a finding.

# audit_time_rules
-a always,exit -F arch=b32 -S stime -k audit_time_rules

On a 64-bit system, the “-S stime” is not necessary. The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
-k audit_time_rules

# auditctl -l | grep syscall | grep clock_settime

If the system is configured to audit this activity, it will return a line. If the system is not configured to audit time changes, this is a finding.

# audit_time_rules
-a always,exit -F arch=b32 -S clock_settime -k audit_time_rules

On a 64-bit system, add the following to /etc/audit/audit.rules:

# audit_time_rules
-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime 
-k audit_time_rules

$ sudo auditctl -l | grep "watch=/etc/localtime"

If the system is configured to audit this activity, it will return a line. If the system is not configured to audit time changes, this is a finding.

-w /etc/localtime -p wa -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used.

auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'

If the system is configured to watch for account changes, lines should be returned for each file specified (and with perm=wa for each). If the system is not configured to audit account changes, this is a finding.

# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'

If the system is configured to watch for account changes, lines should be returned for each file specified (and with perm=wa for each). If the system is not configured to audit account changes, this is a finding.

# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'

If the system is configured to watch for account changes, lines should be returned for each file specified (and with perm=wa for each). If the system is not configured to audit account changes, this is a finding.

# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'

If the system is configured to watch for account changes, lines should be returned for each file specified (and with perm=wa for each). If the system is not configured to audit account changes, this is a finding.

# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'

If the system is configured to watch for network configuration changes, a line should be returned for each file specified (and perm=wa should be indicated for each). If the system is not configured to audit changes of the network configuration, this is a finding.

# audit_network_modifications
-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
-w /etc/issue -p wa -k audit_network_modifications
-w /etc/issue.net -p wa -k audit_network_modifications
-w /etc/hosts -p wa -k audit_network_modifications
-w /etc/sysconfig/network -p wa -k audit_network_modifications

$ sudo auditctl -l | grep "dir=/etc/selinux"

If the system is configured to watch for changes to its SELinux configuration, a line should be returned (including perm=wa indicating permissions that are watched). If the system is not configured to audit attempts to change the MAC policy, this is a finding.

-w /etc/selinux/ -p wa -k MAC-policy

# auditctl -l | grep syscall | grep chmod

If the system is configured to audit this activity, it will return a line. If the system is not configured to audit permission changes, this is a finding.

-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S chmod  -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep chown

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep fchmod

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep fchmodat

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep fchown

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep fchownat

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep fremovexattr

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep fsetxattr

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep lchown

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep lremovexattr

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep lsetxattr

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep removexattr

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

# auditctl -l | grep syscall | grep setxattr

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

If the system is 64 bit then also add the following:

-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

$ sudo grep EACCES /etc/audit/audit.rules

$ sudo grep EPERM /etc/audit/audit.rules

If 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM, this is a finding.

-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access

$ sudo find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null

Run the following command to verify entries in the audit rules for all programs found with the previous command:

$ sudo grep path /etc/audit/audit.rules

It should be the case that all relevant setuid / setgid programs have a line in the audit rules. If it is not the case, this is a finding.

$ sudo find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null

Then, for each setuid / setgid program on the system, add a line of the following form to /etc/audit/audit.rules, where SETUID_PROG_PATH is the full path to each setuid / setgid program in the list:

-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

$ sudo auditctl -l | grep syscall | grep mount

If there is not output, this is a finding.

-a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k export

# auditctl -l | grep syscall | grep unlink

If the system is configured to audit this activity, it will return a line. To determine if the system is configured to audit calls to the unlinkat system call, run the following command:

# auditctl -l | grep syscall | grep unlinkat

If the system is configured to audit this activity, it will return a line. To determine if the system is configured to audit calls to the rename system call, run the following command:

# auditctl -l | grep syscall | grep rename

If the system is configured to audit this activity, it will return a line. To determine if the system is configured to audit calls to the renameat system call, run the following command:

# auditctl -l | grep syscall | grep renameat

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

$ sudo auditctl -l | grep "watch=/etc/sudoers"

If there is not output, this is a finding.

-w /etc/sudoers -p wa -k actions

# auditctl -l | grep syscall | grep init_module

If the system is configured to audit this activity, it will return a line. To determine if the system is configured to audit calls to the delete_module system call, run the following command:

# auditctl -l | grep syscall | grep delete_module

If the system is configured to audit this activity, it will return a line. If no line is returned, this is a finding.

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=ARCH -S init_module -S delete_module -k modules

To check that the xinetd service is disabled in system boot configuration, run the following command:

# chkconfig xinetd --list

Output should indicate the xinetd service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig xinetd --list
xinetd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify xinetd is disabled through current runtime configuration:

# service xinetd status

If the service is disabled the command will return the following output:

xinetd is stopped

If the service is running, this is a finding.

# chkconfig xinetd off

Run the following command to determine if the xinetd package is installed:

# rpm -q xinetd

If the package is installed, this is a finding.

$ sudo yum erase xinetd

# rpm -q telnet-server

If the package is installed, this is a finding.

$ sudo yum erase telnet-server

# chkconfig telnet --list

Output should indicate the telnet service has either not been installed, or has been disabled, as shown in the example below:

# chkconfig telnet --list
telnet       off

If the service is running, this is a finding.

# chkconfig telnet off

# rpm -q rsh-server

If the package is installed, this is a finding.

$ sudo yum erase rsh-server

# chkconfig rsh --list

Output should indicate the rsh service has either not been installed, or has been disabled, as shown in the example below:

# chkconfig rsh --list
rsh       off

If the service is running, this is a finding.

# chkconfig rsh off

# chkconfig rexec --list

Output should indicate the rexec service has either not been installed, or has been disabled, as shown in the example below:

# chkconfig rexec --list
rexec       off

If the service is running, this is a finding.

# chkconfig rexec off

# chkconfig rlogin --list

Output should indicate the rlogin service has either not been installed, or has been disabled, as shown in the example below:

# chkconfig rlogin --list
rlogin       off

If the service is running, this is a finding.

# chkconfig rlogin off

# rpm -q ypserv

If the package is installed, this is a finding.

$ sudo yum erase ypserv

# chkconfig ypbind --list

Output should indicate the ypbind service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig ypbind --list
ypbind       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify ypbind is disabled through current runtime configuration:

# service ypbind status

If the service is disabled the command will return the following output:

ypbind is stopped

If the service is running, this is a finding.

# chkconfig ypbind off

# rpm -q tftp-server

If the package is installed, this is a finding.

# yum erase tftp-server

# chkconfig tftp --list

Output should indicate the tftp service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig tftp --list
tftp       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify tftp is disabled through current runtime configuration:

# service tftp status

If the service is disabled the command will return the following output:

tftp is stopped

If the service is running, this is a finding.

# chkconfig tftp off

# service crond status

If the service is enabled, it should return the following:

crond is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 crond on

$ sudo grep Protocol /etc/ssh/sshd_config

If configured properly, output should be

Protocol 2

If it is not, this is a finding.

Protocol 2

$ sudo grep ClientAliveInterval /etc/ssh/sshd_config

If properly configured, the output should be:

ClientAliveInterval 900

If it is not, this is a finding.

To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as follows:

ClientAliveInterval 

The timeout interval is given in seconds. To have a timeout of 15 minutes, set interval to 900.

If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made here. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.

$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config

If properly configured, output should be:

ClientAliveCountMax 0

If it is not, this is a finding.

ClientAliveCountMax 0

# grep -i IgnoreRhosts /etc/ssh/sshd_config

If no line, a commented line, or a line indicating the value yes is returned, then the required value is set. If the required value is not set, this is a finding.

To ensure this behavior is disabled, add or correct the following line in /etc/ssh/sshd_config:

IgnoreRhosts yes

# grep -i HostbasedAuthentication /etc/ssh/sshd_config

If no line, a commented line, or a line indicating the value no is returned, then the required value is set. If the required value is not set, this is a finding.

To disable host-based authentication, add or correct the following line in /etc/ssh/sshd_config:

HostbasedAuthentication no

# grep -i HostbasedAuthentication /etc/ssh/sshd_config

If no line, a commented line, or a line indicating the value no is returned, then the required value is set. If the required value is not set, this is a finding.

To disable host-based authentication, add or correct the following line in /etc/ssh/sshd_config:

HostbasedAuthentication no

# grep -i PermitRootLogin /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set. If the required value is not set, this is a finding.

PermitRootLogin no

# grep -i PermitEmptyPasswords /etc/ssh/sshd_config

If no line, a commented line, or a line indicating the value no is returned, then the required value is set. If the required value is not set, this is a finding.

PermitEmptyPasswords no

Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

# grep -i Banner /etc/ssh/sshd_config

If a line indicating /etc/issue is returned, then the required value is set. If the required value is not set, this is a finding.

Banner /etc/issue

Another section contains information on how to create an appropriate system-wide warning banner.

$ sudo grep PermitUserEnvironment /etc/ssh/sshd_config

If properly configured, output should be:

PermitUserEnvironment no

If it is not, this is a finding.

PermitUserEnvironment no

$ sudo grep Ciphers /etc/ssh/sshd_config

The output should contain only those ciphers which are FIPS-approved, namely, the AES and 3DES ciphers. If that is not the case, this is a finding.

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The man page sshd_config(5) contains a list of supported ciphers.

$ sudo grep Ciphers /etc/ssh/sshd_config

The output should contain only those ciphers which are FIPS-approved, namely, the AES and 3DES ciphers. If that is not the case, this is a finding.

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The man page sshd_config(5) contains a list of supported ciphers.

$ sudo grep Ciphers /etc/ssh/sshd_config

The output should contain only those ciphers which are FIPS-approved, namely, the AES and 3DES ciphers. If that is not the case, this is a finding.

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The man page sshd_config(5) contains a list of supported ciphers.

# chkconfig avahi-daemon --list

Output should indicate the avahi-daemon service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig avahi-daemon --list
avahi-daemon       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify avahi-daemon is disabled through current runtime configuration:

# service avahi-daemon status

If the service is disabled the command will return the following output:

avahi-daemon is stopped

If the service is running, this is a finding.

# chkconfig avahi-daemon off

The NTP daemon offers all of the functionality of ntpdate, which is now deprecated. Additional information on this is available at http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate

# service ntpd status

If the service is enabled, it should return the following:

ntpd is running...

If the service is not running, this is a finding.

# chkconfig --level 2345 ntpd on

/etc/ntp.conf

In the file, there should be a section similar to the following:

server ntpserver

If this is not the case, this is a finding.

server ntpserver

This instructs the NTP software to contact that remote server to obtain time data.

$ grep inet_interfaces /etc/postfix/main.cf

If properly configured, the output should show only localhost. If it does not, this is a finding.

inet_interfaces = localhost

$ grep start_tls /etc/pam_ldap.conf

If no lines are returned, this is a finding.

ssl start_tls

Then review the LDAP server and ensure TLS has been configured.

$ grep cert /etc/pam_ldap.conf

If there is no output, or the lines are commented out, this is a finding.

tls_cacertdir /etc/pki/tls/CA

or

tls_cacertfile /etc/pki/tls/CA/cacert.pem

Then review the LDAP server and ensure TLS has been configured.

$ rpm -q openldap-servers

The output should show the following:

package openldap-servers is not installed

If it does not, this is a finding.

$ sudo yum erase openldap-servers

The openldap-servers RPM is not installed by default on RHEL 6 machines. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed.

$ gconftool-2 -g /desktop/gnome/session/idle_delay

If properly configured, the output should be 15. If it is not, this is a finding.

$ sudo gconftool-2 \
  --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type int \
  --set /desktop/gnome/session/idle_delay

$ gconftool-2 -g /apps/gnome-screensaver/idle_activation_enabled

If properly configured, the output should be true. If it is not, this is a finding.

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gnome-screensaver/idle_activation_enabled true

$ gconftool-2 -g /apps/gnome-screensaver/lock_enabled

If properly configured, the output should be true. If it is not, this is a finding.

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gnome-screensaver/lock_enabled true

$ gconftool-2 -g /apps/gnome-screensaver/mode

If properly configured, the output should be blank-only If it is not, this is a finding.

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /apps/gnome-screensaver/mode blank-only

# chkconfig abrtd --list

Output should indicate the abrtd service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig abrtd --list
abrtd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify abrtd is disabled through current runtime configuration:

# service abrtd status

If the service is disabled the command will return the following output:

abrtd is stopped

If the service is running, this is a finding.

# chkconfig abrtd off

# chkconfig atd --list

Output should indicate the atd service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig atd --list
atd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify atd is disabled through current runtime configuration:

# service atd status

If the service is disabled the command will return the following output:

atd is stopped

If the service is running, this is a finding.

# chkconfig atd off

# chkconfig autofs --list

Output should indicate the autofs service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig autofs --list
autofs       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify autofs is disabled through current runtime configuration:

# service autofs status

If the service is disabled the command will return the following output:

autofs is stopped

If the service is running, this is a finding.

The autofs service can be disabled with the following command:

# chkconfig autofs off

# chkconfig ntpdate --list

Output should indicate the ntpdate service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig ntpdate --list
ntpdate       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify ntpdate is disabled through current runtime configuration:

# service ntpdate status

If the service is disabled the command will return the following output:

ntpdate is stopped

If the service is running, this is a finding.

# chkconfig ntpdate off

# chkconfig oddjobd --list

Output should indicate the oddjobd service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig oddjobd --list
oddjobd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify oddjobd is disabled through current runtime configuration:

# service oddjobd status

If the service is disabled the command will return the following output:

oddjobd is stopped

If the service is running, this is a finding.

# chkconfig oddjobd off

# chkconfig qpidd --list

Output should indicate the qpidd service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig qpidd --list
qpidd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify qpidd is disabled through current runtime configuration:

# service qpidd status

If the service is disabled the command will return the following output:

qpidd is stopped

If the service is running, this is a finding.

# chkconfig qpidd off

# chkconfig rdisc --list

Output should indicate the rdisc service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig rdisc --list
rdisc       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify rdisc is disabled through current runtime configuration:

# service rdisc status

If the service is disabled the command will return the following output:

rdisc is stopped

If the service is running, this is a finding.

# chkconfig rdisc off

$ mount | grep nfs

All NFS mounts should show the nodev setting in parentheses. This is not applicable if NFS is not implemented. If the setting does not show, this is a finding.

$ mount | grep nfs

All NFS mounts should show the nosuid setting in parentheses. This is not applicable if NFS is not implemented. If the setting does not show, this is a finding.

$ grep -v noexec /etc/fstab

The resulting output will show partitions which do not have the noexec flag. Verify all partitions in the output are not removable media. If removable media partitions are present, this is a finding.

$ grep signing /etc/samba/smb.conf

The output should show:

client signing = mandatory

If it is not, this is a finding.

client signing = mandatory

Requiring samba clients such as smbclient to use packet signing ensures they can only communicate with servers that support packet signing.

$ grep sec /etc/fstab

The output should show either krb5i or ntlmv2i in use. If it does not, this is a finding.

See the mount.cifs(8) man page for more information. A Samba client should only communicate with servers who can support SMB packet signing.

$ grep remember /etc/pam.d/system-auth

The output should show the following at the end of the line:

remember=24

If it does not, this is a finding.

password sufficient pam_unix.so existing_options remember=

The DoD STIG requirement is 5 passwords.

For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.

For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:

part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE

Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.

Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html

For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.

For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:

part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE

Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.

Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html

For manual installations, select the Encrypt checkbox during partition creation to encrypt the partition. When this option is selected the system will prompt for a passphrase to use in decrypting the partition. The passphrase will subsequently need to be entered manually every time the system boots.

For automated/unattended installations, it is possible to use Kickstart by adding the --encrypted and --passphrase= options to the definition of each partition to be encrypted. For example, the following line would encrypt the root partition:

part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE

Any PASSPHRASE is stored in the Kickstart in plaintext, and the Kickstart must then be protected accordingly. Omitting the --passphrase= option from the partition definition will cause the installer to pause and interactively ask for the passphrase during installation.

Detailed information on encrypting partitions using LUKS can be found on the Red Hat Documentation web site:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html

$ sudo find / -xdev -type f -perm -002

If there is output, this is a finding.

$ sudo /sbin/service nails status

To check on the age of uvscan virus definition files, run the following command:

$ sudo cd /opt/NAI/LinuxShield/engine/dat
$ sudo ls -la avvscan.dat avvnames.dat avvclean.dat

If virus scanning software does not run continuously, or at least daily, or has signatures that are out of date, this is a finding.

exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"

If the system is configured to run the shutdown command, this is a finding.

exec /sbin/shutdown -r now "Control-Alt-Delete pressed"

To configure the system to log a message instead of rebooting the system, alter that line to read as follows:

exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"

# service postfix status

If the service is enabled, it should return the following:

postfix is running...

If the system is not a cross domain solution and the service is not enabled, this is a finding.

# chkconfig --level 2345 postfix on

# rpm -q sendmail

If the package is installed, this is a finding.

# yum erase sendmail

# chkconfig netconsole --list

Output should indicate the netconsole service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig netconsole --list
netconsole       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify netconsole is disabled through current runtime configuration:

# service netconsole status

If the service is disabled the command will return the following output:

netconsole is stopped

If the service is running, this is a finding.

# chkconfig netconsole off

$ grep initdefault /etc/inittab

The output should show the following:

id:3:initdefault:

If it does not, this is a finding.

id:3:initdefault:

$ rpm -qi xorg-x11-server-common

The output should be:

package xorg-x11-server-common is not installed

If it is not, this is a finding.

$ sudo yum groupremove "X Window System"

# /etc/sysconfig/network-scripts/ifcfg-interface

Look for the following:

BOOTPROTO=none

and the following, substituting the appropriate values based on your site’s addressing scheme:

NETMASK=255.255.255.0
IPADDR=192.168.1.2
GATEWAY=192.168.1.1

If it does not, this is a finding.

• Correct the BOOTPROTO line to read:

  BOOTPROTO=none

• Add or correct the following lines, substituting the appropriate values based on your site’s addressing scheme:

  NETMASK=255.255.255.0
  IPADDR=192.168.1.2
  GATEWAY=192.168.1.1

$ sudo pwck -qr

There should be no output. If there is output, this is a finding.

$ sudo pwck -qr

If there are no duplicate names, no line will be returned. If a line is returned, this is a finding.

$ grep pam_cracklib /etc/pam.d/system-auth

Look for the value of the maxrepeat parameter. The DoD requirement is 3. If maxrepeat is not found or not set to the required value, this is a finding.

$ sudo find PART -xdev -nouser -print

If files exist that are not owned by a valid user, this is a finding.

$ sudo find PART -xdev -nogroup -print

If there is output, this is a finding.

$ grep aide /etc/crontab

If there is no output, this is a finding.

05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

$ grep aide /etc/crontab

If there is no output, this is a finding.

05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

$ grep aide /etc/crontab

If there is no output, this is a finding.

05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

$ grep aide /etc/crontab

If there is no output, this is a finding.

05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

$ grep aide /etc/crontab

If there is no output, this is a finding.

05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

$ grep aide /etc/crontab

If there is no output, this is a finding.

05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example.

$ grep core /etc/security/limits.conf

The output should be:

*     hard   core    0

If it is not, this is a finding.

*     hard   core    0

$ grep insecure_locks /etc/exports

If there is output, this is a finding.

space_left_action

Acceptable values are email, suspend, single, and halt. If the system is not configured to send an email to the system administrator when disk space is starting to run low, this is a finding.

space_left_action = ACTION

Possible values for ACTION are described in the auditd.conf man page. These include:

• ignore
• syslog
• email
• exec
• suspend
• single
• halt

Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.

action_mail_acct = root

If auditd is not configured to send emails per identified actions, this is a finding.

action_mail_acct =

$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d

If the system is configured to prevent the loading of the net-pf-31 kernel module, it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf. These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event. Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:

$ grep -r net-pf-31 /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install net-pf-31 /bin/false
install bluetooth /bin/false

$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install usb-storage /bin/false

This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

$ grep "maxlogins" /etc/security/limits.conf

You should receive output similar to the following:

*		hard	maxlogins	10

If it is not similar, this is a finding.

* hard maxlogins

grep ":FORWARD" /etc/sysconfig/iptables

The output should be similar to the following:

$ sudo grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0

If the default policy for the FORWARD chain is not set to DROP, this is a finding.

:FORWARD DROP [0:0]

# rpm -q openswan

If the package is not installed, this is a finding.

# yum install openswan

$ gconftool-2 -g /apps/gdm/simple-greeter/banner_message_enable

Search for the banner_message_enable schema. If properly configured, the default value should be true. If it is not, this is a finding.

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gdm/simple-greeter/banner_message_enable true

To display a banner, this setting must be enabled and then banner text must also be set.

$ gconftool-2 -g /apps/gdm/simple-greeter/banner_message_text

If properly configured, the proper banner text will appear within this schema. If it does not, this is a finding.

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /apps/gdm/simple-greeter/banner_message_text \
  "Text of the warning banner here"

When entering a warning banner that spans several lines, remember to begin and end the string with ". This command writes directly either to the /etc/gconf/gconf.xml.mandatory/%gconf-tree.xml if it exists or to the file /etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml. Either of these files can later be edited directly if necessary.

# chkconfig bluetooth --list

Output should indicate the bluetooth service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig bluetooth --list
bluetooth       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify bluetooth is disabled through current runtime configuration:

# service bluetooth status

If the service is disabled the command will return the following output:

bluetooth is stopped

If the service is running, this is a finding.

# chkconfig bluetooth off

$ sudo service bluetooth stop

grep "INACTIVE" /etc/default/useradd

The output should indicate the INACTIVE configuration option is set to an appropriate integer as shown in the example below:

$ sudo grep "INACTIVE" /etc/default/useradd
INACTIVE=35

If it does not, this is a finding.

INACTIVE=NUM_DAYS

A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a “normal” period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.

grep "INACTIVE" /etc/default/useradd

The output should indicate the INACTIVE configuration option is set to an appropriate integer as shown in the example below:

$ sudo grep "INACTIVE" /etc/default/useradd
INACTIVE=35

If it does not, this is a finding.

INACTIVE=NUM_DAYS

A value of 35 is recommended. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a “normal” period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.

The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as /tmp), and for directories requiring global read/write access.

$ sudo find / -xdev -type d -perm 002 ! -perm 1000

If any world-writable directories are missing the sticky bit, this is a finding.

$ sudo chmod +t DIR

$ sudo find PART -xdev -type d -perm -0002 -uid +499 -print

If there is output, this is a finding.

$ rpm -qa | grep tftp

Verify tftp is configured by with the -s option by running the following command:

grep "server_args" /etc/xinetd.d/tftp

The output should indicate the server_args variable is configured with the -s flag, matching the example below:

 $ grep "server_args" /etc/xinetd.d/tftp
server_args = -s /var/lib/tftpboot

If this flag is missing, this is a finding.

server_args = -s /var/lib/tftpboot

Procedures:

If vsftpd is started by xinetd the following command will indicate the xinetd.d startup file:

$ grep vsftpd /etc/xinetd.d/*

$ grep server_args vsftpd xinetd.d startup file

This will indicate the vsftpd config file used when starting through xinetd. If the server_args line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.

$ sudo grep xferlog_enable vsftpd config file

If xferlog_enable is missing, or is not set to yes, this is a finding.

xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES

$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"

There should be no output. If there is output, this is a finding.

$ sudo service snmpd restart

$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep public

There should be no output. If there is output, this is a finding.

$ sudo service snmpd restart

$ grep "umask" /etc/bashrc

All output must show the value of umask set to 077, as shown below:

$ grep "umask" /etc/bashrc
umask 077
umask 077

If the above command returns no output, or if the umask is configured incorrectly, this is a finding.

umask

$ grep "umask" /etc/csh.cshrc

All output must show the value of umask set to 077, as shown in the below:

$ grep "umask" /etc/csh.cshrc
umask 077

If the above command returns no output, or if the umask is configured incorrectly, this is a finding.

umask

$ grep "umask" /etc/profile

All output must show the value of umask set to 077, as shown in the below:

$ grep "umask" /etc/profile
umask 077

If the above command returns no output, or if the umask is configured incorrectly, this is a finding.

umask

$ grep -i "UMASK" /etc/login.defs

All output must show the value of umask set to 077, as shown in the below:

$ grep -i "UMASK" /etc/login.defs
umask 077

If the above command returns no output, or if the umask is configured incorrectly, this is a finding.

UMASK

$ grep umask /etc/init.d/functions

The output should show either 022 or 027. If it does not, this is a finding.

umask 

Setting the umask to too restrictive a setting can cause serious errors at runtime. Many daemons on the system already individually restrict themselves to a umask of 077 in their own init scripts.

$ sudo find /home -xdev -name .netrc

If any .netrc files exist, this is a finding.

To verify this configuration, run the following command:

grep "banner_file" /etc/vsftpd/vsftpd.conf

The output should show the value of banner_file is set to /etc/issue, an example of which is shown below:

$ sudo grep "banner_file" /etc/vsftpd/vsftpd.conf
banner_file=/etc/issue

If it does not, this is a finding.

banner_file=/etc/issue

• SIPRNET systems
• Standalone systems
• Application accounts
• Temporary employee accounts, such as students or interns, who cannot easily receive a CAC or PIV
• Operational tactical locations that are not collocated with RAPIDS workstations to issue CAC or ALT
• Test systems, such as those with an Interim Approval to Test (IATT) and use a separate VPN, firewall, or security measure preventing access to network and system components from outside the protection boundary documented in the IATT.

If non-exempt accounts are not using CAC authentication, this is a finding.

• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html

For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:

• https://access.redhat.com/solutions/82273

$ grep pam_faillock /etc/pam.d/system-auth

The output should show unlock_time=<some-large-number>. If that is not the case, this is a finding.

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth:

auth [default=die] pam_faillock.so authfail deny=3 unlock_time= fail_interval=900

auth required pam_faillock.so authsucc deny=3 unlock_time= fail_interval=900

$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth

For each file, the output should show fail_interval=<interval-in-seconds> where interval-in-seconds is 900 (15 minutes) or greater. If the fail_interval parameter is not set, the default setting of 900 seconds is acceptable. If that is not the case, this is a finding.

Add the following fail_interval directives to pam_faillock.so immediately below the pam_env.so statement in /etc/pam.d/system-auth and /etc/pam.d/password-auth:

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=

auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=

$ grep pam_lastlog.so /etc/pam.d/system-auth

The output should show output showfailed. If that is not the case, this is a finding.

session       required     pam_lastlog.so showfailed

$ sudo ls -l /var/log/audit

Audit logs must be mode 0640 or less permissive. If any are more permissive, this is a finding.

$ sudo chmod 0640 audit_file

$ ls -lL /var/log

If properly configured, the output should indicate the following owner: root If it does not, this is a finding.

# chown root/var/log

If the OS update process limits automatic updates of software packages, where such updates would impede normal system operation, to scheduled maintenance windows, but still within IAVM-dictated timeframes, this is not a finding. If , this is a finding.

$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d

If no line is returned, this is a finding.

install usb-storage /bin/false

This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

$ sudo grep active /etc/audisp/plugins.d/syslog.conf

If the plugin is active, the output will show yes. If it is not, this is a finding.

$ sudo service auditd restart

$ rpm -Va | grep '^.M'

If there is output, this is a finding.

$ rpm -qf FILENAME

Next, run the following command to reset its permissions to the correct values:

$ sudo rpm --setperms PACKAGENAME

$ rpm -Va | awk '$1 ~ /..5/ && $2 != "c"'

If there is output, this is a finding.

$ rpm -Va | grep '^..5'

A “c” in the second column indicates that a file is a configuration file, which may appropriately be expected to change. If the file was not expected to change, investigate the cause of the change using audit logs or other means. The package can then be reinstalled to restore the file. Run the following command to determine which package owns the file:

$ rpm -qf FILENAME

The package can be reinstalled from a yum repository using the command:

$ sudo yum reinstall PACKAGENAME

Alternatively, the package can be reinstalled from trusted media using the command:

$ sudo rpm -Uvh PACKAGENAME

Inspect the file /etc/sysconfig/ip6tables to determine the default policy for the INPUT chain. It should be set to DROP:

$ sudo grep ":INPUT" /etc/sysconfig/ip6tables

If the default policy for the INPUT chain is not set to DROP, this is a finding.

:INPUT DROP [0:0]

If changes were required, reload the ip6tables rules:

$ sudo service ip6tables reload

kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1

# chkconfig autofs --list

Output should indicate the autofs service has either not been installed, or has been disabled at all runlevels, as shown in the example below:

# chkconfig autofs --list
autofs       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify autofs is disabled through current runtime configuration:

# service autofs status

If the service is disabled the command will return the following output:

autofs is stopped

If the service is running, this is a finding.

The autofs service can be disabled with the following command:

# chkconfig autofs off