1.1.1.1 Ensure cramfs kernel module is not available

800-53|CM-6

800-53|CM-7

CSCv7|9.2

1.1.1.2 Ensure freevxfs kernel module is not available

1.1.1.3 Ensure hfs kernel module is not available

1.1.1.4 Ensure hfsplus kernel module is not available

1.1.1.5 Ensure jffs2 kernel module is not available

1.1.1.8 Ensure usb-storage kernel module is not available

800-53|MP-7

CSCv7|13.7

1.1.2.1.1 Ensure /tmp is a separate partition

1.1.2.1.2 Ensure nodev option set on /tmp partition

1.1.2.1.3 Ensure nosuid option set on /tmp partition

800-53|AC-3

800-53|AC-5

800-53|AC-6

800-53|MP-2

CSCv7|14.6

1.1.2.1.4 Ensure noexec option set on /tmp partition

1.1.2.2.1 Ensure /dev/shm is a separate partition

1.1.2.2.2 Ensure nodev option set on /dev/shm partition

1.1.2.2.3 Ensure nosuid option set on /dev/shm partition

1.1.2.2.4 Ensure noexec option set on /dev/shm partition

1.1.2.3.2 Ensure nodev option set on /home partition

1.1.2.3.3 Ensure nosuid option set on /home partition

1.1.2.4.2 Ensure nodev option set on /var partition

1.1.2.4.3 Ensure nosuid option set on /var partition

1.1.2.5.2 Ensure nodev option set on /var/tmp partition

1.1.2.5.3 Ensure nosuid option set on /var/tmp partition

1.1.2.5.4 Ensure noexec option set on /var/tmp partition

1.1.2.6.2 Ensure nodev option set on /var/log partition

1.1.2.6.3 Ensure nosuid option set on /var/log partition

1.1.2.6.4 Ensure noexec option set on /var/log partition

1.1.2.7.2 Ensure nodev option set on /var/log/audit partition

1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition

1.1.2.7.4 Ensure noexec option set on /var/log/audit partition

800-53|RA-5

800-53|SI-2

800-53|SI-2(2)

CSCv7|3.4

CSCv7|3.5

1.2.2 Ensure gpgcheck is globally activated

1.2.4 Ensure package manager repositories are configured

1.2.5 Ensure updates, patches, and additional security software are installed

1.3.2 Ensure permissions on bootloader config are configured

1.3.3 Ensure authentication required for single user mode

800-53|CM-2

800-53|CM-7(1)

800-53|CM-9

800-53|SA-3

800-53|SA-8

800-53|SA-10

CSCv7|5.1

1.4.1 Ensure address space layout randomization (ASLR) is enabled

800-53|SI-16

CSCv7|8.3

1.4.3 Ensure core dump backtraces are disabled

800-53|AC-6(10)

1.4.4 Ensure core dump storage is disabled

1.5.1.2 Ensure SELinux is not disabled in bootloader configuration

1.5.1.3 Ensure SELinux policy is configured

1.5.1.4 Ensure the SELinux mode is not disabled

1.5.1.6 Ensure no unconfined services exist

1.5.1.7 Ensure the MCS Translation Service (mcstrans) is not installed

1.5.1.8 Ensure SETroubleshoot is not installed

1.6.1 Ensure message of the day is configured properly

800-53|AC-8a.

1.6.2 Ensure local login warning banner is configured properly

800-53|AC-8

1.6.3 Ensure remote login warning banner is configured properly

1.6.4 Ensure access to /etc/motd is configured

1.6.5 Ensure access to /etc/issue is configured

1.6.6 Ensure access to /etc/issue.net is configured

1.7.2 Ensure GDM login banner is configured

1.7.3 Ensure GDM disable-user-list option is enabled

800-53|IA-6

1.7.4 Ensure GDM screen locks when the user is idle

800-53|AC-2(5)

800-53|AC-11

800-53|AC-11(1)

800-53|AC-12

CSCv7|16.11

1.7.5 Ensure GDM screen locks cannot be overridden

1.7.6 Ensure GDM automatic mounting of removable media is disabled

CSCv7|8.5

1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden

1.7.8 Ensure GDM autorun-never is enabled

1.7.9 Ensure GDM autorun-never is not overridden

2.1.1 Ensure time synchronization is in use

800-53|AU-7

800-53|AU-8

CSCv7|6.1

2.1.3 Ensure chrony is not run as the root user

2.2.1 Ensure autofs services are not in use

2.2.2 Ensure avahi daemon services are not in use

2.2.3 Ensure dhcp server services are not in use

2.2.4 Ensure dns server services are not in use

2.2.5 Ensure dnsmasq services are not in use

2.2.6 Ensure samba file server services are not in use

2.2.7 Ensure ftp server services are not in use

2.2.8 Ensure message access server services are not in use

2.2.9 Ensure network file system services are not in use

2.2.10 Ensure nis server services are not in use

2.2.11 Ensure print server services are not in use

2.2.12 Ensure rpcbind services are not in use

2.2.13 Ensure rsync services are not in use

2.2.14 Ensure snmp services are not in use

2.2.15 Ensure telnet server services are not in use

CSCv7|2.6

2.2.16 Ensure tftp server services are not in use

2.2.17 Ensure web proxy server services are not in use

2.2.18 Ensure web server services are not in use

2.2.19 Ensure xinetd services are not in use

2.2.21 Ensure mail transfer agents are configured for local-only mode

2.2.22 Ensure only approved services are listening on a network interface

2.3.4 Ensure telnet client is not installed

2.3.5 Ensure tftp client is not installed

3.1.2 Ensure wireless interfaces are disabled

CSCv7|15.4

CSCv7|15.5

3.1.3 Ensure bluetooth services are not in use

3.3.2 Ensure packet redirect sending is disabled

3.3.3 Ensure bogus icmp responses are ignored

3.3.4 Ensure broadcast icmp requests are ignored

3.3.5 Ensure icmp redirects are not accepted

3.3.6 Ensure secure icmp redirects are not accepted

3.3.7 Ensure reverse path filtering is enabled

3.3.8 Ensure source routed packets are not accepted

3.3.9 Ensure suspicious packets are logged

Detections

Analytics

Revision 1.5

Nov 6, 2024

Functional Update