1.1.1.2 Ensure mounting of udf filesystems is disabled

800-53|CM-7

CSCv6|3.1

CSCv7|5.1

800-53|CM-6

CSCv6|9.1

CSCv7|9.4

1.1.3 Ensure noexec option set on /tmp partition

800-53|AC-6(10)

CSCv7|2.6

1.1.4 Ensure nodev option set on /tmp partition

1.1.5 Ensure nosuid option set on /tmp partition

1.1.6 Ensure /dev/shm is configured - fstab

1.1.6 Ensure /dev/shm is configured - mount

1.1.7 Ensure noexec option set on /dev/shm partition

1.1.8 Ensure nodev option set on /dev/shm partition

1.1.9 Ensure nosuid option set on /dev/shm partition

1.1.12 Ensure noexec option set on /var/tmp partition

1.1.13 Ensure nodev option set on /var/tmp partition

1.1.14 Ensure nosuid option set on /var/tmp partition

1.1.18 Ensure nodev option set on /home partition

1.1.19 Ensure noexec option set on removable media partitions

1.1.20 Ensure nodev option set on removable media partitions

1.1.21 Ensure nosuid option set on removable media partitions

1.1.22 Ensure sticky bit is set on all world-writable directories

800-53|AC-3(3)

800-53|SI-7(6)

CSCv7|3.4

1.2.2 Ensure package manager repositories are configured

800-53|SI-2

1.2.3 Ensure gpgcheck is globally activated

800-53|CM-7(5)

CSCv6|2.2

800-53|AC-3

800-53|AU-12

CSCv7|6.3

CSCv7|14.9

1.4.2 Ensure filesystem integrity is regularly checked - aidecheck.service

1.4.2 Ensure filesystem integrity is regularly checked - aidecheck.timer

1.4.2 Ensure filesystem integrity is regularly checked - cron

800-53|SI-7(1)

1.5.1 Ensure bootloader password is set - password

800-53|SI-7(9)

1.5.1 Ensure bootloader password is set - superusers

1.5.2 Ensure permissions on bootloader config are configured

1.5.3 Ensure authentication required for single user mode - rescue.emergency

1.5.3 Ensure authentication required for single user mode - rescue.service

1.6.1 Ensure core dumps are restricted - fs.suid_dumpable sysctl.conf

1.6.1 Ensure core dumps are restricted - limits.conf

1.6.1 Ensure core dumps are restricted - sysctl fs.suid_dumpable

1.6.1 Ensure core dumps are restricted - systemd-coredump ProcessSizeMax

1.6.1 Ensure core dumps are restricted - systemd-coredump Storage

800-53|SI-16

CSCv7|8.3

1.6.3 Ensure address space layout randomization (ASLR) is enabled - sysctl

1.6.3 Ensure address space layout randomization (ASLR) is enabled - sysctl.conf

800-53|CM-7(4)

1.7.1.1 Ensure AppArmor is installed - apparmor-docs

CSCv7|14.6

1.7.1.1 Ensure AppArmor is installed - apparmor-parser

1.7.1.1 Ensure AppArmor is installed - apparmor-profiles

1.7.1.1 Ensure AppArmor is installed - apparmor-utils

1.7.1.1 Ensure AppArmor is installed - libapparmor1

1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration - apparmor=1

1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration - security=apparmor

1.7.1.3 Ensure all AppArmor Profiles are in enforce or complain mode - processes unconfined

1.7.1.3 Ensure all AppArmor Profiles are in enforce or complain mode - profiles loaded

1.8.1.1 Ensure message of the day is configured properly - content

800-53|AC-8

1.8.1.1 Ensure message of the day is configured properly - site policy banner

1.8.1.2 Ensure local login warning banner is configured properly - invalid entries

1.8.1.2 Ensure local login warning banner is configured properly - site policy banner

1.8.1.3 Ensure remote login warning banner is configured properly - invalid entries

1.8.1.3 Ensure remote login warning banner is configured properly - site policy banner

1.8.1.4 Ensure permissions on /etc/motd are configured

1.8.1.5 Ensure permissions on /etc/issue are configured

1.8.1.6 Ensure permissions on /etc/issue.net are configured

1.9 Ensure updates, patches, and additional security software are installed

1.10 Ensure GDM is removed or login is configured - banner-message-enable

1.10 Ensure GDM is removed or login is configured - banner-message-text

1.10 Ensure GDM is removed or login is configured - disable-user-list

1.10 Ensure GDM is removed or login is configured - file-db

1.10 Ensure GDM is removed or login is configured - system-db

1.10 Ensure GDM is removed or login is configured - user-db

2.2.1.1 Ensure time synchronization is in use

CSCv7|6.1

2.2.1.2 Ensure systemd-timesyncd is configured

800-53|AU-8(1)

2.2.1.3 Ensure chrony is configured - server

2.2.1.3 Ensure chrony is configured - user

2.2.5 Ensure DHCP Server is not installed

CSCv7|9.2

2.2.6 Ensure LDAP server is not installed

2.2.7 Ensure nfs-utils is not installed or the nfs-server service is masked - nfs-kernel-server

2.2.7 Ensure nfs-utils is not installed or the nfs-server service is masked - nfs-utils

2.2.8 Ensure rpcbind is not installed or the rpcbind services are masked - package rpcbind

2.2.8 Ensure rpcbind is not installed or the rpcbind services are masked - service rpcbind

2.2.8 Ensure rpcbind is not installed or the rpcbind services are masked - service rpcbind.socket

2.2.10 Ensure FTP Server is not installed

2.2.11 Ensure HTTP server is not installed

2.2.12 Ensure IMAP and POP3 server is not installed

2.2.14 Ensure HTTP Proxy Server is not installed

2.2.16 Ensure mail transfer agent is configured for local-only mode

2.2.17 Ensure rsync is not installed or the rsyncd service is masked

2.2.18 Ensure NIS server is not installed

2.2.19 Ensure telnet-server is not installed

2.3.3 Ensure talk client is not installed

2.3.4 Ensure telnet client is not installed

2.3.5 Ensure LDAP client is not installed

2.4 Ensure nonessential services are removed or masked

3.2.1 Ensure IP forwarding is disabled - sysctl ipv4

800-53|SC-7(12)

CSCv6|9.2

3.2.1 Ensure IP forwarding is disabled - sysctl ipv4 conf files

3.2.1 Ensure IP forwarding is disabled - sysctl ipv6

3.2.1 Ensure IP forwarding is disabled - sysctl ipv6 conf files

Detections

Analytics

Revision 1.5

May 10, 2021

Functional Update

Miscellaneous