Detections
Analytics

Revision 1.2

Aug 24, 2021
Functional Update
  • 1.1.1.3 Ensure mounting of squashfs filesystems is disabled - modprobe
  • 1.1.1.4 Ensure mounting of udf filesystems is disabled - lsmod
  • 1.1.1.4 Ensure mounting of udf filesystems is disabled - modprobe
  • 1.10 Ensure system-wide crypto policy is not legacy
  • 1.3.2 Ensure sudo commands use pty
  • 1.3.3 Ensure sudo log file exists
  • 1.4.2 Ensure filesystem integrity is regularly checked - cron
  • 1.4.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.service
  • 1.4.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.timer
  • 1.4.2 Ensure filesystem integrity is regularly checked - systemctl status aidecheck.timer
  • 1.6.1 Ensure core dumps are restricted - limits.conf limits.d
  • 1.6.1 Ensure core dumps are restricted - sysctl.conf sysctl.d
  • 1.6.2 Ensure address space layout randomization (ASLR) is enabled - sysctl.conf sysctl.d
  • 3.1.1 Ensure IP forwarding is disabled - ipv4 /etc/sysctl.conf /etc/sysctl.d/*
  • 3.1.1 Ensure IP forwarding is disabled - ipv6 /etc/sysctl.conf /etc/sysctl.d/*
  • 3.1.1 Ensure IP forwarding is disabled - ipv6 sysctl
  • 3.1.2 Ensure packet redirect sending is disabled - files 'net.ipv4.conf.all.send_redirects = 0'
  • 3.1.2 Ensure packet redirect sending is disabled - files 'net.ipv4.conf.default.send_redirects = 0'
  • 3.2.1 Ensure source routed packets are not accepted - 'net.ipv6.conf.all.accept_source_route = 0'
  • 3.2.1 Ensure source routed packets are not accepted - 'net.ipv6.conf.default.accept_source_route = 0'
  • 3.2.1 Ensure source routed packets are not accepted - files 'net.ipv4.conf.all.accept_source_route = 0'
  • 3.2.1 Ensure source routed packets are not accepted - files 'net.ipv4.conf.default.accept_source_route = 0'
  • 3.2.1 Ensure source routed packets are not accepted - files 'net.ipv6.conf.all.accept_source_route = 0'
  • 3.2.1 Ensure source routed packets are not accepted - files 'net.ipv6.conf.default.accept_source_route = 0'
  • 3.2.2 Ensure ICMP redirects are not accepted - files 'net.ipv4.conf.all.accept_redirects = 0'
  • 3.2.2 Ensure ICMP redirects are not accepted - files 'net.ipv4.conf.default.accept_redirects = 0'
  • 3.2.2 Ensure ICMP redirects are not accepted - files 'net.ipv6.conf.all.accept_redirects = 0'
  • 3.2.2 Ensure ICMP redirects are not accepted - files 'net.ipv6.conf.default.accept_redirects = 0'
  • 3.2.2 Ensure ICMP redirects are not accepted - sysctl 'net.ipv6.conf.all.accept_redirects'
  • 3.2.2 Ensure ICMP redirects are not accepted - sysctl 'net.ipv6.conf.default.accept_redirects = 0'
  • 3.2.3 Ensure secure ICMP redirects are not accepted - files 'net.ipv4.conf.all.secure_redirects = 0'
  • 3.2.3 Ensure secure ICMP redirects are not accepted - files 'net.ipv4.conf.default.secure_redirects = 0'
  • 3.2.4 Ensure suspicious packets are logged - files 'net.ipv4.conf.all.log_martians = 1'
  • 3.2.4 Ensure suspicious packets are logged - files 'net.ipv4.conf.default.log_martians = 1'
  • 3.2.5 Ensure broadcast ICMP requests are ignored - sysctl.conf sysctl.d
  • 3.2.6 Ensure bogus ICMP responses are ignored - /etc/sysctl.conf /etc/sysctl.d/*
  • 3.2.7 Ensure Reverse Path Filtering is enabled - files 'net.ipv4.conf.all.rp_filter = 1'
  • 3.2.7 Ensure Reverse Path Filtering is enabled - files 'net.ipv4.conf.default.rp_filter = 1'
  • 3.2.8 Ensure TCP SYN Cookies is enabled - sysctl.conf sysctl.d
  • 3.2.9 Ensure IPv6 router advertisements are not accepted - 'grep net.ipv6.conf.all.accept_ra = 0'
  • 3.2.9 Ensure IPv6 router advertisements are not accepted - 'grep net.ipv6.conf.default.accept_ra = 0'
  • 3.2.9 Ensure IPv6 router advertisements are not accepted - 'sysctl net.ipv6.conf.all.accept_ra = 0'
  • 3.2.9 Ensure IPv6 router advertisements are not accepted - 'sysctl net.ipv6.conf.default.accept_ra = 0'
  • 3.4.3.1 Ensure iptables are flushed with nftables - ipv4
  • 3.4.3.1 Ensure iptables are flushed with nftables - ipv6
  • 3.4.3.2 Ensure an nftables table exists
  • 3.4.3.3 Ensure nftables base chains exist - 'hook forward'
  • 3.4.3.3 Ensure nftables base chains exist - 'hook input'
  • 3.4.3.3 Ensure nftables base chains exist - 'hook output'
  • 3.4.3.4 Ensure nftables loopback traffic is configured
  • 3.4.3.4 Ensure nftables loopback traffic is configured - ip6 saddr
  • 3.4.3.5 Ensure nftables outbound and established connections are configured - incoming, established
  • 3.4.3.5 Ensure nftables outbound and established connections are configured - outgoing, established
  • 3.4.3.6 Ensure nftables default deny firewall policy - Chain FORWARD
  • 3.4.3.6 Ensure nftables default deny firewall policy - Chain INPUT
  • 3.4.3.6 Ensure nftables default deny firewall policy - Chain OUTPUT
  • 3.4.3.7 Ensure nftables service is enabled
  • 3.4.3.8 Ensure nftables rules are permanent - forward
  • 3.4.3.8 Ensure nftables rules are permanent - input
  • 3.4.3.8 Ensure nftables rules are permanent - output
  • 3.4.4.1.1 Ensure iptables default deny firewall policy - Chain FORWARD
  • 3.4.4.1.1 Ensure iptables default deny firewall policy - Chain INPUT
  • 3.4.4.1.1 Ensure iptables default deny firewall policy - Chain OUTPUT
  • 3.4.4.1.2 Ensure iptables loopback traffic is configured - Input accept all lo
  • 3.4.4.1.2 Ensure iptables loopback traffic is configured - Input drop all
  • 3.4.4.1.2 Ensure iptables loopback traffic is configured - Output accept all lo
  • 3.4.4.1.3 Ensure iptables outbound and established connections are configured
  • 3.4.4.1.4 Ensure iptables firewall rules exist for all open ports
  • 3.4.4.2.1 Ensure ip6tables default deny firewall policy - 'Chain FORWARD'
  • 3.4.4.2.1 Ensure ip6tables default deny firewall policy - 'Chain INPUT'
  • 3.4.4.2.1 Ensure ip6tables default deny firewall policy - 'Chain OUTPUT'
  • 3.4.4.2.2 Ensure ip6tables loopback traffic is configured
  • 3.4.4.2.3 Ensure ip6tables outbound and established connections are configured
  • 3.4.4.2.4 Ensure ip6tables firewall rules exist for all open ports - firewall rules
  • 3.4.4.2.4 Ensure ip6tables firewall rules exist for all open ports - ports
  • 3.4.4.2.5 Ensure ip6tables is enabled and active
  • 4.2.2.1 Ensure journald is configured to send logs to rsyslog
  • 4.2.2.2 Ensure journald is configured to compress large log files
  • 4.2.2.3 Ensure journald is configured to write logfiles to persistent disk
  • 5.2.20 Ensure system-wide crypto policy is not over-ridden
  • 5.3.1 Create custom authselect profile
  • 5.4.2 Ensure lockout for failed password attempts is configured
  • 5.5.5 Ensure default user umask is 027 or more restrictive - default user umask
  • 6.2.12 Ensure users' .netrc Files are not group or world accessible
Miscellaneous
  • Variables updated.
Added
  • 5.4.1 Ensure password creation requirements are configured - password complexity
Removed
  • 5.4.1 Ensure password creation requirements are configured - dcredit
  • 5.4.1 Ensure password creation requirements are configured - lcredit
  • 5.4.1 Ensure password creation requirements are configured - ocredit
  • 5.4.1 Ensure password creation requirements are configured - ucredit