Jul 24, 2024 Functional Update- 5.2.6 Ensure SSH PAM is enabled
|
Jul 19, 2024 Functional Update- 5.6.2 Ensure system accounts are secured
|
Jul 9, 2024 Functional Update- 5.1.9 Ensure at is restricted to authorized users
|
Jun 17, 2024 |
Jun 6, 2024 Miscellaneous- Metadata updated.
- Platform check updated.
- References updated.
- Variables updated.
Added- 1.1.1.1 Ensure mounting of cramfs filesystems is disabled
- 1.1.10 Disable USB Storage
- 1.1.2.1 Ensure /tmp is a separate partition
- 1.2.1 Ensure GPG keys are configured
- 1.2.2 Ensure gpgcheck is globally activated
- 1.3.2 Ensure filesystem integrity is regularly checked
- 1.5.3 Ensure address space layout randomization (ASLR) is enabled
- 1.6.1.3 Ensure SELinux policy is configured
- 1.6.1.4 Ensure the SELinux mode is not disabled
- 1.8.2 Ensure GDM login banner is configured
- 1.8.3 Ensure last logged in user display is disabled
- 2.1.2 Ensure chrony is configured
- 2.2.10 Ensure a web server is not installed
- 2.2.11 Ensure IMAP and POP3 server is not installed
- 2.2.18 Ensure nfs-utils is not installed or the nfs-server service is masked
- 2.2.19 Ensure rpcbind is not installed or the rpcbind services are masked
- 2.2.3 Ensure Avahi Server is not installed
- 3.2.2 Ensure packet redirect sending is disabled
- 3.3.1 Ensure source routed packets are not accepted
- 3.3.2 Ensure ICMP redirects are not accepted
- 3.3.3 Ensure secure ICMP redirects are not accepted
- 3.3.4 Ensure suspicious packets are logged
- 3.3.7 Ensure Reverse Path Filtering is enabled
- 3.3.9 Ensure IPv6 router advertisements are not accepted
- 3.4.1.1 Ensure firewalld is installed
- 3.4.1.4 Ensure firewalld service enabled and running
- 3.4.2.11 Ensure nftables rules are permanent
- 3.4.2.4 Ensure iptables are flushed with nftables
- 3.4.2.6 Ensure nftables base chains exist
- 3.4.2.7 Ensure nftables loopback traffic is configured
- 3.4.2.8 Ensure nftables outbound and established connections are configured
- 3.4.2.9 Ensure nftables default deny firewall policy
- 3.4.3.2.1 Ensure iptables loopback traffic is configured
- 3.4.3.2.4 Ensure iptables default deny firewall policy
- 3.4.3.2.6 Ensure iptables is enabled and active
- 3.4.3.3.1 Ensure ip6tables loopback traffic is configured
- 3.4.3.3.4 Ensure ip6tables default deny firewall policy
- 3.4.3.3.6 Ensure ip6tables is enabled and active
- 4.2.1.7 Ensure rsyslog is not configured to recieve logs from a remote client
- 4.2.2.1.4 Ensure journald is not configured to recieve logs from a remote client
- 4.2.3 Ensure permissions on all logfiles are configured
- 5.2.10 Ensure SSH PermitUserEnvironment is disabled
- 5.2.11 Ensure SSH IgnoreRhosts is enabled
- 5.2.16 Ensure SSH MaxAuthTries is set to 4 or less
- 5.2.17 Ensure SSH MaxStartups is configured
- 5.2.18 Ensure SSH MaxSessions is set to 10 or less
- 5.2.19 Ensure SSH LoginGraceTime is set to one minute or less
- 5.2.20 Ensure SSH Idle Timeout Interval is configured
- 5.2.4 Ensure SSH access is limited
- 5.2.5 Ensure SSH LogLevel is appropriate
- 5.2.6 Ensure SSH PAM is enabled
- 5.2.7 Ensure SSH root login is disabled
- 5.2.8 Ensure SSH HostbasedAuthentication is disabled
- 5.2.9 Ensure SSH PermitEmptyPasswords is disabled
- 5.4.2 Ensure authselect includes with-faillock
- 5.5.1 Ensure password creation requirements are configured
- 5.5.2 Ensure lockout for failed password attempts is configured
- 5.5.4 Ensure password hashing algorithm is SHA-512
- 5.6.1.1 Ensure password expiration is 365 days or less
- 5.6.1.2 Ensure minimum days between password changes is 7 or more
- 5.6.1.3 Ensure password expiration warning days is 7 or more
- 5.6.1.4 Ensure inactive password lock is 30 days or less
- 5.6.2 Ensure system accounts are secured
- 5.6.5 Ensure default user umask is 027 or more restrictive
|
Apr 22, 2024 Functional Update- 4.2.1.6 Ensure rsyslog is configured to send logs to a remote log host
|
Mar 18, 2024 Functional Update- 4.2.3 Ensure all logfiles have appropriate access configured
|
Jan 22, 2024 Functional Update- 5.2.20 Ensure SSH Idle Timeout Interval is configured - ClientAliveCountMax sshd output
|
Dec 27, 2023 Functional Update- 4.2.2.1.1 Ensure systemd-journal-remote is installed
- 4.2.2.1.2 Ensure systemd-journal-remote is configured
- 4.2.2.1.3 Ensure systemd-journal-remote is enabled
- 4.2.2.1.4 Ensure journald is not configured to receive logs from a remote client
- 4.2.2.2 Ensure journald service is enabled
- 4.2.2.3 Ensure journald is configured to compress large log files
- 4.2.2.4 Ensure journald is configured to write logfiles to persistent disk
- 4.2.2.5 Ensure journald is not configured to send logs to rsyslog
- 4.2.2.6 Ensure journald log rotation is configured per site policy
- 4.2.2.7 Ensure journald default file permissions configured
- 5.5.2 Ensure lockout for failed password attempts is configured - >= 8.2 unlock_time
|
Dec 8, 2023 Functional Update- 4.2.1.1 Ensure rsyslog is installed
- 4.2.1.2 Ensure rsyslog service is enabled
- 4.2.1.3 Ensure journald is configured to send logs to rsyslog
- 4.2.1.4 Ensure rsyslog default file permissions are configured
- 4.2.1.5 Ensure logging is configured
- 4.2.1.6 Ensure rsyslog is configured to send logs to a remote log host
- 4.2.1.7 Ensure rsyslog is not configured to receive logs from a remote client
- 4.2.2.1.1 Ensure systemd-journal-remote is installed
- 4.2.2.1.2 Ensure systemd-journal-remote is configured
- 4.2.2.1.3 Ensure systemd-journal-remote is enabled
- 4.2.2.1.4 Ensure journald is not configured to receive logs from a remote client
- 4.2.2.2 Ensure journald service is enabled
- 4.2.2.3 Ensure journald is configured to compress large log files
- 4.2.2.4 Ensure journald is configured to write logfiles to persistent disk
- 4.2.2.5 Ensure journald is not configured to send logs to rsyslog
- 4.2.2.6 Ensure journald log rotation is configured per site policy
- 4.2.2.7 Ensure journald default file permissions configured
|
