Detections
Analytics

CIS CentOS 7 v3.1.2 Workstation L1

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: CIS CentOS 7 v3.1.2 Workstation L1

Updated: 4/12/2024

Authority: CIS

Plugin: Unix

Revision: 1.27

Estimated Item Count: 320

File Details

Filename: CIS_CentOS_7_v3.1.2_Workstation_L1.audit

Size: 747 kB

MD5: 9009487e3ba6ede46e4ac4980565cad9
SHA256: 49743353da6ac94e27abe4efc702ba4a8c480b7f6ed28d8be1a13136f65b2489

Audit Items

DescriptionCategories
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - modprobe
1.1.1.3 Ensure mounting of udf filesystems is disabled - lsmod
1.1.1.3 Ensure mounting of udf filesystems is disabled - modprobe
1.1.2 Ensure /tmp is configured
1.1.3 Ensure noexec option set on /tmp partition
1.1.4 Ensure nodev option set on /tmp partition
1.1.5 Ensure nosuid option set on /tmp partition
1.1.6 Ensure /dev/shm is configured - fstab
1.1.6 Ensure /dev/shm is configured - mount
1.1.7 Ensure noexec option set on /dev/shm partition
1.1.8 Ensure nodev option set on /dev/shm partition
1.1.9 Ensure nosuid option set on /dev/shm partition
1.1.12 Ensure /var/tmp partition includes the noexec option
1.1.13 Ensure /var/tmp partition includes the nodev option
1.1.14 Ensure /var/tmp partition includes the nosuid option
1.1.18 Ensure /home partition includes the nodev option
1.1.19 Ensure removable media partitions include noexec option
1.1.20 Ensure nodev option set on removable media partitions
1.1.21 Ensure nosuid option set on removable media partitions
1.1.22 Ensure sticky bit is set on all world-writable directories
1.2.1 Ensure GPG keys are configured
1.2.2 Ensure package manager repositories are configured
1.2.3 Ensure gpgcheck is globally activated
1.3.1 Ensure AIDE is installed
1.3.2 Ensure filesystem integrity is regularly checked - cron
1.3.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.service
1.3.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.timer
1.3.2 Ensure filesystem integrity is regularly checked - systemctl status aidecheck.timer
1.4.1 Ensure bootloader password is set
1.4.2 Ensure permissions on bootloader config are configured - grub.cfg
1.4.2 Ensure permissions on bootloader config are configured - user.cfg
1.4.3 Ensure authentication required for single user mode - emergency.service
1.4.3 Ensure authentication required for single user mode - rescue.service
1.5.1 Ensure core dumps are restricted - limits.conf limits.d
1.5.1 Ensure core dumps are restricted - sysctl
1.5.1 Ensure core dumps are restricted - sysctl.conf sysctl.d
1.5.1 Ensure core dumps are restricted - systemd-coredump ProcessSizeMax
1.5.1 Ensure core dumps are restricted - systemd-coredump Storage
1.5.2 Ensure XD/NX support is enabled
1.5.3 Ensure address space layout randomization (ASLR) is enabled - sysctl
1.5.3 Ensure address space layout randomization (ASLR) is enabled - sysctl.conf sysctl.d
1.5.4 Ensure prelink is not installed
1.6.1.1 Ensure SELinux is installed
1.6.1.2 Ensure SELinux is not disabled in bootloader configuration
1.6.1.3 Ensure SELinux policy is configured - /etc/selinux/config
1.6.1.3 Ensure SELinux policy is configured - sestatus
1.6.1.4 Ensure the SELinux mode is enforcing or permissive - /etc/selinux/config
1.6.1.4 Ensure the SELinux mode is enforcing or permissive - getenforce
1.6.1.6 Ensure no unconfined services exist