1.1.1 Ensure mounting of squashfs filesystems is disabled - lsmod

800-53|CM-6

CSCv7|5.1

1.1.1 Ensure mounting of squashfs filesystems is disabled - modprobe

CSCv6|3.1

1.1.3 Ensure nodev option set on /tmp partition

1.1.4 Ensure nosuid option set on /tmp partition

1.1.5 Ensure noexec option set on /tmp partition

800-53|CM-11

CSCv7|2.6

1.1.8 Ensure nodev option set on /var/tmp partition

1.1.9 Ensure nosuid option set on /var/tmp partition

1.1.10 Ensure noexec option set on /var/tmp partition

1.1.14 Ensure nodev option set on /home partition

1.1.15 Ensure nodev option set on /dev/shm partition

1.1.16 Ensure nosuid option set on /dev/shm partition

1.1.17 Ensure noexec option set on /dev/shm partition

1.1.18 Ensure sticky bit is set on all world-writable directories

800-53|CM-7(4)

CSCv6|9.1

CSCv7|8.5

1.2.1 Ensure package manager repositories are configured

800-53|SI-2c.

CSCv7|3.4

CSCv7|3.5

1.2.3 Ensure gpgcheck is globally activated

800-53|AU-3

CSCv6|2.2

CSCv7|14.9

1.3.2 Ensure filesystem integrity is regularly checked

1.4.1 Ensure permissions on bootloader config are configured

1.4.2 Ensure authentication required for single user mode - emergency.service

1.4.2 Ensure authentication required for single user mode - rescue.service

1.5.1 Ensure core dumps are restricted - fs.suid_dumpable (sysctl.conf/sysctl.d)

1.5.1 Ensure core dumps are restricted - hard core (limits.conf/limits.d)

1.5.1 Ensure core dumps are restricted - sysctl

1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctl

800-53|CM-2

CSCv7|5.3

1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctl.conf/sysctl.d

1.7.1.1 Ensure message of the day is configured properly - banner text

1.7.1.1 Ensure message of the day is configured properly - msrv

1.7.1.2 Ensure local login warning banner is configured properly - banner check

1.7.1.2 Ensure local login warning banner is configured properly - msrv

1.7.1.3 Ensure remote login warning banner is configured properly - banner check

1.7.1.3 Ensure remote login warning banner is configured properly - msrv

1.7.1.4 Ensure permissions on /etc/motd are configured

1.7.1.5 Ensure permissions on /etc/issue are configured

1.7.1.6 Ensure permissions on /etc/issue.net are configured

1.8 Ensure updates, patches, and additional security software are installed

2.1.1.1 Ensure time synchronization is in use

800-53|AU-8

CSCv7|6.1

2.1.1.2 Ensure ntp is configured - -u ntp:ntp

2.1.1.2 Ensure ntp is configured - NTP server/pool

CSCv6|6.1

2.1.1.2 Ensure ntp is configured - restrict -4

2.1.1.2 Ensure ntp is configured - restrict -6

2.1.1.3 Ensure chrony is configured - chrony server/pool

2.1.1.3 Ensure chrony is configured - OPTIONS

2.1.2 Ensure X Window System is not installed

800-53|SI-4

CSCv7|9.2

2.1.5 Ensure DHCP Server is not enabled - status

2.1.6 Ensure LDAP server is not enabled - status

2.1.7 Ensure NFS and RPC are not enabled - nfs

2.1.7 Ensure NFS and RPC are not enabled - nfs status

2.1.7 Ensure NFS and RPC are not enabled - nfs-server

2.1.7 Ensure NFS and RPC are not enabled - nfs-server status

2.1.7 Ensure NFS and RPC are not enabled - rpcbind

2.1.7 Ensure NFS and RPC are not enabled - rpcbind status

2.1.8 Ensure DNS Server is not enabled - status

2.1.9 Ensure FTP Server is not enabled - status

2.1.10 Ensure HTTP server is not enabled - status

2.1.11 Ensure IMAP and POP3 server is not enabled

2.1.11 Ensure IMAP and POP3 server is not enabled - status

2.1.12 Ensure Samba is not enabled - status

2.1.13 Ensure HTTP Proxy Server is not enabled

2.1.13 Ensure HTTP Proxy Server is not enabled - status

2.1.14 Ensure SNMP Server is not enabled - status

2.1.15 Ensure mail transfer agent is configured for local-only mode

2.1.15 Ensure mail transfer agent is configured for local-only mode - status

2.1.16 Ensure NIS Server is not enabled - status

2.1.17 Ensure rsh server is not enabled - rexec.socket

2.1.17 Ensure rsh server is not enabled - rexec.socket status

2.1.17 Ensure rsh server is not enabled - rlogin.socket

2.1.17 Ensure rsh server is not enabled - rlogin.socket status

2.1.17 Ensure rsh server is not enabled - rsh.socket

2.1.17 Ensure rsh server is not enabled - rsh.socket status

2.1.18 Ensure telnet server is not enabled

2.1.18 Ensure telnet server is not enabled - status

2.1.19 Ensure tftp server is not enabled - status

2.1.20 Ensure rsync service is not enabled

2.1.20 Ensure rsync service is not enabled - status

2.1.21 Ensure talk server is not enabled - status

800-53|IA-5

CSCv7|16.5

2.2.3 Ensure talk client is not installed

2.2.4 Ensure telnet client is not installed

2.2.5 Ensure LDAP client is not installed

3.1.1 Ensure IP forwarding is disabled - ipv6 sysctl

CSCv6|9.2

3.1.1 Ensure IP forwarding is disabled - ipv6 sysctl.conf sysctl.d

3.1.1 Ensure IP forwarding is disabled - sysctl

3.1.1 Ensure IP forwarding is disabled - sysctl.conf sysctl.d

Revision 1.20

Oct 18, 2022

Functional Update

Informational Update