1.1.1.1 Ensure mounting of cramfs filesystems is disabled

800-53|CM-6

800-53|CM-7

CSCv7|9.2

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled

1.1.1.4 Ensure mounting of hfs filesystems is disabled

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled

1.1.2.1 Ensure /tmp is a separate partition

800-53|AC-3

800-53|AC-5

800-53|AC-6

800-53|MP-2

CSCv7|14.6

1.1.2.2 Ensure nodev option set on /tmp partition

1.1.2.3 Ensure noexec option set on /tmp partition

1.1.2.4 Ensure nosuid option set on /tmp partition

1.1.3.2 Ensure nodev option set on /var partition

1.1.3.3 Ensure nosuid option set on /var partition

1.1.4.2 Ensure nodev option set on /var/tmp partition

1.1.4.3 Ensure noexec option set on /var/tmp partition

1.1.4.4 Ensure nosuid option set on /var/tmp partition

1.1.5.2 Ensure nodev option set on /var/log partition

1.1.5.3 Ensure noexec option set on /var/log partition

1.1.5.4 Ensure nosuid option set on /var/log partition

1.1.6.2 Ensure nodev option set on /var/log/audit partition

1.1.6.3 Ensure noexec option set on /var/log/audit partition

1.1.6.4 Ensure nosuid option set on /var/log/audit partition

1.1.7.2 Ensure nodev option set on /home partition

1.1.7.3 Ensure nosuid option set on /home partition

1.1.8.1 Ensure nodev option set on /dev/shm partition

1.1.8.2 Ensure noexec option set on /dev/shm partition

1.1.8.3 Ensure nosuid option set on /dev/shm partition

800-53|AC-6(9)

800-53|AU-2

800-53|AU-12

CSCv7|14.9

1.2.2 Ensure filesystem integrity is regularly checked

800-53|AU-3

800-53|AU-3(1)

800-53|AU-7

1.3.1 Ensure updates, patches, and additional security software are installed

800-53|RA-5

800-53|SI-2

800-53|SI-2(2)

CSCv7|3.4

CSCv7|3.5

1.3.2 Ensure package manager repositories are configured

800-53|IA-5(1)

CSCv7|4.4

1.4.2 Ensure permissions on bootloader config are configured

1.4.3 Ensure authentication required for single user mode

1.5.2 Ensure address space layout randomization (ASLR) is enabled

800-53|SI-16

CSCv7|8.3

1.5.4 Ensure Automatic Error Reporting is not enabled

800-53|AC-6(10)

1.6.1.2 Ensure AppArmor is enabled in the bootloader configuration

1.6.1.3 Ensure all AppArmor Profiles are in enforce or complain mode

1.7.1 Ensure message of the day is configured properly

800-53|AC-8a.

1.7.2 Ensure local login warning banner is configured properly

800-53|AC-8

1.7.3 Ensure remote login warning banner is configured properly

1.7.4 Ensure permissions on /etc/motd are configured

1.7.5 Ensure permissions on /etc/issue are configured

1.7.6 Ensure permissions on /etc/issue.net are configured

1.8.2 Ensure GDM login banner is configured

1.8.3 Ensure GDM disable-user-list option is enabled

800-53|CM-1

800-53|CM-2

800-53|CM-7(1)

800-53|CM-9

800-53|SA-3

800-53|SA-8

800-53|SA-10

1.8.4 Ensure GDM screen locks when the user is idle

800-53|AC-2(5)

800-53|AC-11

800-53|AC-11(1)

800-53|AC-12

CSCv7|16.11

1.8.5 Ensure GDM screen locks cannot be overridden

1.8.8 Ensure GDM autorun-never is enabled

800-53|MP-7

CSCv7|8.5

1.8.9 Ensure GDM autorun-never is not overridden

2.1.1.1 Ensure a single time synchronization daemon is in use

800-53|AU-8

CSCv7|6.1

2.1.2.1 Ensure chrony is configured with authorized timeserver

2.1.2.2 Ensure chrony is running as user _chrony

2.1.2.3 Ensure chrony is enabled and running

2.1.3.1 Ensure systemd-timesyncd configured with authorized timeserver

2.1.3.2 Ensure systemd-timesyncd is enabled and running

2.1.4.1 Ensure ntp access control is configured

2.1.4.2 Ensure ntp is configured with authorized timeserver

2.1.4.3 Ensure ntp is running as user ntp

2.1.4.4 Ensure ntp is enabled and running

2.2.2 Ensure Avahi Server is not installed

2.2.4 Ensure DHCP Server is not installed

2.2.5 Ensure LDAP server is not installed

2.2.9 Ensure HTTP server is not installed

2.2.10 Ensure IMAP and POP3 server are not installed

2.2.12 Ensure HTTP Proxy Server is not installed

2.2.13 Ensure SNMP Server is not installed

2.2.14 Ensure NIS Server is not installed

2.2.16 Ensure mail transfer agent is configured for local-only mode

2.2.17 Ensure rsync service is either not installed or is masked

CSCv7|2.6

2.3.3 Ensure talk client is not installed

2.3.4 Ensure telnet client is not installed

2.3.5 Ensure LDAP client is not installed

2.4 Ensure nonessential services are removed or masked

3.2.1 Ensure packet redirect sending is disabled

3.3.1 Ensure source routed packets are not accepted

3.3.2 Ensure ICMP redirects are not accepted

3.3.3 Ensure secure ICMP redirects are not accepted

3.3.4 Ensure suspicious packets are logged

CSCv7|6.2

CSCv7|6.3

3.3.5 Ensure broadcast ICMP requests are ignored

3.3.6 Ensure bogus ICMP responses are ignored

3.3.7 Ensure Reverse Path Filtering is enabled

3.3.9 Ensure IPv6 router advertisements are not accepted

800-53|CA-9

800-53|SC-7

800-53|SC-7(5)

CSCv7|9.4

3.4.1.2 Ensure iptables-persistent is not installed with ufw

Detections

Analytics

Revision 1.21

Nov 6, 2024

Functional Update