Detections
Analytics

CIS CentOS Linux 8 Workstation L1 v1.0.1

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: CIS CentOS Linux 8 Workstation L1 v1.0.1

Updated: 10/3/2023

Authority: CIS

Plugin: Unix

Revision: 1.8

Estimated Item Count: 294

File Details

Filename: CIS_CentOS_8_Workstation_v1.0.1_L1.audit

Size: 551 kB

MD5: 74291c9461e0cb355a8df8b46dc6f4c7
SHA256: 89a69a7519347f9a34335991353f5235d4bedfb8f0fd2cbda7207ef69b176811

Audit Items

DescriptionCategories
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - modprobe
1.1.1.3 Ensure mounting of squashfs filesystems is disabled - lsmod
1.1.1.3 Ensure mounting of squashfs filesystems is disabled - modprobe
1.1.1.4 Ensure mounting of udf filesystems is disabled - lsmod
1.1.1.4 Ensure mounting of udf filesystems is disabled - modprobe
1.1.2 Ensure /tmp is configured - config check
1.1.2 Ensure /tmp is configured - mount check
1.1.3 Ensure nodev option set on /tmp partition
1.1.4 Ensure nosuid option set on /tmp partition
1.1.5 Ensure noexec option set on /tmp partition
1.1.8 Ensure nodev option set on /var/tmp partition
1.1.9 Ensure nosuid option set on /var/tmp partition
1.1.10 Ensure noexec option set on /var/tmp partition
1.1.14 Ensure nodev option set on /home partition
1.1.15 Ensure nodev option set on /dev/shm partition
1.1.16 Ensure nosuid option set on /dev/shm partition
1.1.17 Ensure noexec option set on /dev/shm partition
1.1.18 Ensure nodev option set on removable media partitions
1.1.19 Ensure nosuid option set on removable media partitions
1.1.20 Ensure noexec option set on removable media partitions
1.1.21 Ensure sticky bit is set on all world-writable directories
1.2.1 Ensure GPG keys are configured
1.2.2 Ensure gpgcheck is globally activated
1.2.3 Ensure package manager repositories are configured
1.3.1 Ensure sudo is installed
1.3.2 Ensure sudo commands use pty
1.3.3 Ensure sudo log file exists
1.4.1 Ensure AIDE is installed
1.4.2 Ensure filesystem integrity is regularly checked - cron
1.4.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.service
1.4.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.timer
1.4.2 Ensure filesystem integrity is regularly checked - systemctl status aidecheck.timer
1.5.1 Ensure permissions on bootloader config are configured
1.5.2 Ensure bootloader password is set
1.5.3 Ensure authentication required for single user mode - /usr/lib/systemd/system/emergency.service
1.5.3 Ensure authentication required for single user mode - /usr/lib/systemd/system/rescue.service
1.6.1 Ensure core dumps are restricted - /etc/security/limits.d/*
1.6.1 Ensure core dumps are restricted - /etc/sysctl.d/*
1.6.1 Ensure core dumps are restricted - sysctl
1.6.2 Ensure address space layout randomization (ASLR) is enabled - /etc/sysctl.d/*
1.6.2 Ensure address space layout randomization (ASLR) is enabled - sysctl
1.8.1.1 Ensure message of the day is configured properly
1.8.1.2 Ensure local login warning banner is configured properly
1.8.1.3 Ensure remote login warning banner is configured properly
1.8.1.4 Ensure permissions on /etc/motd are configured
1.8.1.5 Ensure permissions on /etc/issue are configured
1.8.1.6 Ensure permissions on /etc/issue.net are configured
1.8.2 Ensure GDM login banner is configured - banner message enabled
1.8.2 Ensure GDM login banner is configured - banner message text