CIS Aliyun Linux 2 L2 v1.0.0

Audit Details

Name: CIS Aliyun Linux 2 L2 v1.0.0

Updated: 10/6/2023

Authority: CIS

Plugin: Unix

Revision: 1.17

Estimated Item Count: 116

File Details

Filename: CIS_Aliyun_Linux_2_L2_v1.0.0.audit

Size: 309 kB

MD5: ad2f7421fb57257a5e38cb06d103626c
SHA256: 5293f40a5fad5cd1ac2b0dd89273317bdeb9dae11d2028a712081a6b236984c1

Audit Items

DescriptionCategories
1.1.6 Ensure separate partition exists for /var

CONFIGURATION MANAGEMENT

1.1.7 Ensure separate partition exists for /var/tmp

CONFIGURATION MANAGEMENT

1.1.11 Ensure separate partition exists for /var/log

AUDIT AND ACCOUNTABILITY

1.1.12 Ensure separate partition exists for /var/log/audit

AUDIT AND ACCOUNTABILITY

1.1.13 Ensure separate partition exists for /home

CONFIGURATION MANAGEMENT

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration - enforcing

ACCESS CONTROL

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration - selinux

ACCESS CONTROL

1.6.1.2 Ensure the SELinux state is enforcing - /etc/selinux/config

ACCESS CONTROL

1.6.1.2 Ensure the SELinux state is enforcing - sestatus

ACCESS CONTROL

1.6.1.3 Ensure SELinux policy is configured - /etc/selinux/config

ACCESS CONTROL

1.6.1.3 Ensure SELinux policy is configured - sestatus

ACCESS CONTROL

1.6.1.4 Ensure SETroubleshoot is not installed

CONFIGURATION MANAGEMENT

1.6.1.5 Ensure the MCS Translation Service (mcstrans) is not installed

CONFIGURATION MANAGEMENT

1.6.1.6 Ensure no unconfined daemons exist

CONFIGURATION MANAGEMENT

1.6.2 Ensure SELinux is installed

ACCESS CONTROL

3.6 Disable IPv6

SYSTEM AND INFORMATION INTEGRITY

4.1.1.1 Ensure audit log storage size is configured

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure system is disabled when audit logs are full - email

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure system is disabled when audit logs are full - halt

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure system is disabled when audit logs are full - root

AUDIT AND ACCOUNTABILITY

4.1.1.3 Ensure audit logs are not automatically deleted

AUDIT AND ACCOUNTABILITY

4.1.2 Ensure auditd service is enabled

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure auditing for processes that start prior to auditd is enabled

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - /etc/localtime

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - adjtimex

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - adjtimex (32-bit)

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - clock_settime

CONFIGURATION MANAGEMENT

4.1.4 Ensure events that modify date and time information are collected - clock_settime (32-bit)

CONFIGURATION MANAGEMENT

4.1.5 Ensure events that modify user/group information are collected

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - /etc/group

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - /etc/gshadow

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - /etc/passwd

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - /etc/security/opasswd

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - /etc/shadow

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/gshadow

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/passwd

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - auditctl /etc/shadow

AUDIT AND ACCOUNTABILITY

4.1.6 Ensure events that modify the system's network environment are collected - /etc/hosts

CONFIGURATION MANAGEMENT

4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue

CONFIGURATION MANAGEMENT

4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue.net

CONFIGURATION MANAGEMENT

4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network

CONFIGURATION MANAGEMENT

4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network-scripts

CONFIGURATION MANAGEMENT

4.1.6 Ensure events that modify the system's network environment are collected - auditctl /etc/hosts

CONFIGURATION MANAGEMENT

4.1.6 Ensure events that modify the system's network environment are collected - auditctl /etc/issue

CONFIGURATION MANAGEMENT