Revision 1.24Jun 6, 2024
Miscellaneous
- Metadata updated.
- Platform check updated.
- References updated.
- Variables updated.
Added
- 1.1.6 Ensure /dev/shm is configured
- 1.10 Ensure GDM is removed or login is configured
- 1.4.2 Ensure filesystem integrity is regularly checked
- 1.5.1 Ensure bootloader password is set
- 1.5.3 Ensure authentication required for single user mode
- 1.6.1 Ensure core dumps are restricted
- 1.6.3 Ensure address space layout randomization (ASLR) is enabled
- 1.7.1.1 Ensure AppArmor is installed
- 1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration
- 1.7.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
- 1.8.1.1 Ensure message of the day is configured properly
- 1.8.1.2 Ensure local login warning banner is configured properly
- 1.8.1.3 Ensure remote login warning banner is configured properly
- 2.2.1.3 Ensure chrony is configured
- 2.2.7 Ensure nfs-utils is not installed or the nfs-server service is masked
- 2.2.8 Ensure rpcbind is not installed or the rpcbind services are masked
- 3.2.1 Ensure IP forwarding is disabled
- 3.2.2 Ensure packet redirect sending is disabled
- 3.3.1 Ensure source routed packets are not accepted
- 3.3.2 Ensure ICMP redirects are not accepted
- 3.3.3 Ensure secure ICMP redirects are not accepted
- 3.3.4 Ensure suspicious packets are logged
- 3.3.5 Ensure broadcast ICMP requests are ignored
- 3.3.6 Ensure bogus ICMP responses are ignored
- 3.3.7 Ensure Reverse Path Filtering is enabled
- 3.3.8 Ensure TCP SYN Cookies is enabled
- 3.3.9 Ensure IPv6 router advertisements are not accepted
- 3.5.1.1 Ensure FirewallD is installed
- 3.5.1.2 Ensure nftables is not installed or stopped and masked
- 3.5.1.3 Ensure firewalld service is enabled and running
- 3.5.2.2 Ensure firewalld is not installed or stopped and masked
- 3.5.2.5 Ensure base chains exist
- 3.5.2.6 Ensure loopback traffic is configured
- 3.5.2.7 Ensure outbound and established connections are configured
- 3.5.2.8 Ensure default deny firewall policy
- 3.5.3.1.3 Ensure firewalld is not installed or stopped and masked
- 3.5.3.2.2 Ensure loopback traffic is configured
- 3.5.3.3.2 Ensure IPv6 loopback traffic is configured
- 4.2.1.2 Ensure rsyslog Service is enabled and running
- 4.2.1.3 Ensure rsyslog default file permissions configured
- 4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts.
- 5.1.1 Ensure cron daemon is enabled and running
- 5.1.8 Ensure cron is restricted to authorized users
- 5.1.9 Ensure at is restricted to authorized users
- 5.2.16 Ensure SSH Idle Timeout Interval is configured
- 5.3.1 Ensure password creation requirements are configured
- 5.3.2 Ensure lockout for failed password attempts is configured
- 5.4.1.2 Ensure password expiration is 365 days or less
- 5.4.1.3 Ensure minimum days between password changes is configured
- 5.4.1.4 Ensure password expiration warning days is 7 or more
- 5.4.1.5 Ensure inactive password lock is 30 days or less
- 5.4.2 Ensure system accounts are secured
- 5.4.5 Ensure default user umask is configured