CIS CentOS Linux 8 Workstation L1 v2.0.0

Audit Details

Name: CIS CentOS Linux 8 Workstation L1 v2.0.0

Updated: 1/10/2023

Authority: CIS

Plugin: Unix

Revision: 1.7

Estimated Item Count: 323

File Details

Filename: CIS_CentOS_8_Workstation_v2.0.0_L1.audit

Size: 895 kB

MD5: 90d507156185e3f0f5e6ec81e96b2354
SHA256: 0a2ad1d7fe8bc83e9b83ab19a25ad8adcd5d1e5259e58aa7602b436f85313489

Audit Items

DescriptionCategories
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - blacklist

CONFIGURATION MANAGEMENT

1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.1 Ensure mounting of cramfs filesystems is disabled - modprobe

CONFIGURATION MANAGEMENT

1.1.2.1 Ensure /tmp is a separate partition - config check

CONFIGURATION MANAGEMENT

1.1.2.1 Ensure /tmp is a separate partition - mount check

CONFIGURATION MANAGEMENT

1.1.2.2 Ensure nodev option set on /tmp partition

CONFIGURATION MANAGEMENT

1.1.2.3 Ensure noexec option set on /tmp partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.2.4 Ensure nosuid option set on /tmp partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.3.2 Ensure nodev option set on /var partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.3.3 Ensure noexec option set on /var partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.3.4 Ensure nosuid option set on /var partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.4.2 Ensure noexec option set on /var/tmp partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.4.3 Ensure nosuid option set on /var/tmp partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.4.4 Ensure nodev option set on /var/tmp partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.5.2 Ensure nodev option set on /var/log partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.5.3 Ensure noexec option set on /var/log partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.5.4 Ensure nosuid option set on /var/log partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.6.2 Ensure noexec option set on /var/log/audit partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.6.3 Ensure nodev option set on /var/log/audit partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.6.4 Ensure nosuid option set on /var/log/audit partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.7.2 Ensure nodev option set on /home partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.7.3 Ensure nosuid option set on /home partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.7.4 Ensure usrquota option set on /home partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.7.5 Ensure grpquota option set on /home partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.8.1 Ensure nodev option set on /dev/shm partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.8.2 Ensure noexec option set on /dev/shm partition

ACCESS CONTROL, MEDIA PROTECTION

1.1.8.3 Ensure nosuid option set on /dev/shm partition

ACCESS CONTROL, MEDIA PROTECTION

1.2.1 Ensure GPG keys are configured - gpgkey

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.2.1 Ensure GPG keys are configured - show rpm keys

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.2.2 Ensure gpgcheck is globally activated - /etc/yum.repos.d/*

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.2.2 Ensure gpgcheck is globally activated - dnf.conf

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.2.3 Ensure package manager repositories are configured

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.3.1 Ensure AIDE is installed

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - cron

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.service

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.timer

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - systemctl status aidecheck.timer

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.4.1 Ensure bootloader password is set

ACCESS CONTROL, MEDIA PROTECTION

1.4.2 Ensure permissions on bootloader config are configured

ACCESS CONTROL, MEDIA PROTECTION

1.4.3 Ensure authentication is required when booting into rescue mode

IDENTIFICATION AND AUTHENTICATION

1.5.1 Ensure core dump storage is disabled

CONFIGURATION MANAGEMENT

1.5.2 Ensure core dump backtraces are disabled

ACCESS CONTROL

1.5.3 Ensure address space layout randomization (ASLR) is enabled - /etc/sysctl.d/*

SYSTEM AND INFORMATION INTEGRITY

1.6.1.1 Ensure SELinux is installed

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.2 Ensure SELinux is not disabled in bootloader configuration

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.3 Ensure SELinux policy is configured - /etc/selinux/config

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.3 Ensure SELinux policy is configured - sestatus

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.4 Ensure the SELinux mode is not disabled - /etc/selinux/config

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.4 Ensure the SELinux mode is not disabled - getenforce

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.6 Ensure no unconfined services exist

ACCESS CONTROL, MEDIA PROTECTION