Revision 1.17

Oct 5, 2020

Functional Update

1.4.2 Ensure filesystem integrity is regularly checked
1.5.1 Ensure permissions on bootloader config are configured - grub.cfg
1.5.1 Ensure permissions on bootloader config are configured - grubenv
1.5.2 Ensure bootloader password is set
1.8.2 Ensure GDM login banner is configured - banner message enabled
1.8.2 Ensure GDM login banner is configured - banner message text
2.2.1.1 Ensure time synchronization is in use
2.2.1.2 Ensure chrony is configured - NTP server
2.2.1.2 Ensure chrony is configured - user
2.2.18 Ensure mail transfer agent is configured for local-only mode
3.4.1.1 Ensure a Firewall package is installed
3.4.2.1 Ensure firewalld service is enabled and running - enabled
3.4.2.1 Ensure firewalld service is enabled and running - running
3.4.2.2 Ensure iptables is not enabled - disabled
3.4.2.2 Ensure iptables is not enabled - inactive
3.4.2.3 Ensure nftables is not enabled - disabled
3.4.2.3 Ensure nftables is not enabled - inactive
3.4.2.4 Ensure default zone is set
3.4.2.5 Ensure network interfaces are assigned to appropriate zone
3.4.2.6 Ensure unnecessary services and ports are not accepted
3.4.3.1 Ensure iptables are flushed - ipv4
3.4.3.1 Ensure iptables are flushed - ipv6
3.4.3.2 Ensure a table exists
3.4.3.3 Ensure base chains exist - 'hook forward'
3.4.3.3 Ensure base chains exist - 'hook input'
3.4.3.3 Ensure base chains exist - 'hook output'
3.4.3.4 Ensure loopback traffic is configured
3.4.3.4 Ensure loopback traffic is configured - iif lo accept
3.4.3.4 Ensure loopback traffic is configured - ip saddr
3.4.3.4 Ensure loopback traffic is configured - ip6 saddr
3.4.3.5 Ensure outbound and established connections are configured
3.4.3.6 Ensure default deny firewall policy - Chain FORWARD
3.4.3.6 Ensure default deny firewall policy - Chain INPUT
3.4.3.6 Ensure default deny firewall policy - Chain OUTPUT
3.4.3.7 Ensure nftables service is enabled
3.4.3.8 Ensure nftables rules are permanent
3.4.4.1.1 Ensure default deny firewall policy - Chain FORWARD
3.4.4.1.1 Ensure default deny firewall policy - Chain INPUT
3.4.4.1.1 Ensure default deny firewall policy - Chain OUTPUT
3.4.4.1.2 Ensure loopback traffic is configured - Input accept all lo
3.4.4.1.2 Ensure loopback traffic is configured - Input drop all
3.4.4.1.2 Ensure loopback traffic is configured - Output accept all lo
3.4.4.1.3 Ensure outbound and established connections are configured
3.4.4.1.4 Ensure firewall rules exist for all open ports
3.4.4.2.1 Ensure IPv6 default deny firewall policy - 'Chain FORWARD'
3.4.4.2.1 Ensure IPv6 default deny firewall policy - 'Chain INPUT'
3.4.4.2.1 Ensure IPv6 default deny firewall policy - 'Chain OUTPUT'
3.4.4.2.2 Ensure IPv6 loopback traffic is configured
3.4.4.2.3 Ensure IPv6 outbound and established connections are configured
3.4.4.2.4 Ensure IPv6 firewall rules exist for all open ports - firewall rules
3.4.4.2.4 Ensure IPv6 firewall rules exist for all open ports - ports
4.2.1.1 Ensure rsyslog is installed
4.2.1.2 Ensure rsyslog Service is enabled
4.2.1.3 Ensure rsyslog default file permissions configured
4.2.1.4 Ensure logging is configured
4.2.1.5 Ensure rsyslog is configured to send logs to a remote log host
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts. - InputTCPServerRun
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts. - ModLoad imtcp
4.2.2.1 Ensure journald is configured to send logs to rsyslog

Informational Update

3.4.4.2.2 Ensure IPv6 loopback traffic is configured
3.4.4.2.3 Ensure IPv6 outbound and established connections are configured
3.4.4.2.4 Ensure IPv6 firewall rules exist for all open ports - firewall rules
3.4.4.2.4 Ensure IPv6 firewall rules exist for all open ports - ports
4.2.1.5 Ensure rsyslog is configured to send logs to a remote log host
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts. - InputTCPServerRun
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts. - ModLoad imtcp

Miscellaneous

Platform check updated.