1.1.1.1 Ensure mounting of freevxfs filesystems is disabled - lsmod

CSCv7|5.1

1.1.1.1 Ensure mounting of freevxfs filesystems is disabled - modprobe

CSCv6|3.1

1.1.1.2 Ensure mounting of jffs2 filesystems is disabled - lsmod

1.1.1.2 Ensure mounting of jffs2 filesystems is disabled - modprobe

1.1.1.3 Ensure mounting of hfs filesystems is disabled - lsmod

1.1.1.3 Ensure mounting of hfs filesystems is disabled - modprobe

1.1.1.4 Ensure mounting of hfsplus filesystems is disabled - lsmod

1.1.1.4 Ensure mounting of hfsplus filesystems is disabled - modprobe

1.1.1.5 Ensure mounting of squashfs filesystems is disabled - lsmod

1.1.1.5 Ensure mounting of squashfs filesystems is disabled - modprobe

1.1.1.6 Ensure mounting of udf filesystems is disabled - lsmod

1.1.1.6 Ensure mounting of udf filesystems is disabled - modprobe

1.1.2 Ensure /tmp is configured - systemctl

CSCv6|9.1

1.1.3 Ensure nodev option set on /tmp partition

1.1.4 Ensure nosuid option set on /tmp partition

1.1.5 Ensure noexec option set on /tmp partition

CSCv7|2.6

1.1.8 Ensure nodev option set on /var/tmp partition

1.1.9 Ensure nosuid option set on /var/tmp partition

1.1.10 Ensure noexec option set on /var/tmp partition

1.1.14 Ensure nodev option set on /home partition

1.1.15 Ensure nodev option set on /dev/shm partition

1.1.16 Ensure nosuid option set on /dev/shm partition

1.1.17 Ensure noexec option set on /dev/shm partition

1.1.18 Ensure nodev option set on removable media partitions

1.1.19 Ensure nosuid option set on removable media partitions

1.1.20 Ensure noexec option set on removable media partitions

1.1.21 Ensure sticky bit is set on all world-writable directories

CSCv7|8.4

CSCv7|8.5

1.2.1 Ensure package manager repositories are configured

CSCv7|3.4

CSCv7|3.5

CSCv7|4.3

CSCv7|6.3

CSCv6|2.2

CSCv7|14.9

1.4.2 Ensure filesystem integrity is regularly checked

1.5.1 Ensure permissions on bootloader config are configured

1.5.2 Ensure bootloader password is set - password_pbkdf2

1.5.2 Ensure bootloader password is set - set superusers

1.5.3 Ensure authentication required for single user mode

CSCv7|8.3

1.6.2 Ensure address space layout randomization (ASLR) is enabled

1.6.2 Ensure address space layout randomization (ASLR) is enabled - sysctl

1.6.4 Ensure core dumps are restricted - /etc/sysctl.conf

1.6.4 Ensure core dumps are restricted - limits.conf limits.d

1.6.4 Ensure core dumps are restricted - processsizemax

1.6.4 Ensure core dumps are restricted - storage

1.6.4 Ensure core dumps are restricted - sysctl

CSCv7|14.6

1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration - apparmor=1

1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration - security=apparmor

1.7.1.3 Ensure all AppArmor Profiles are in enforce or complain mode - 0 processes are unconfined

1.7.1.3 Ensure all AppArmor Profiles are in enforce or complain mode - profiles loaded

1.8.1.1 Ensure message of the day is configured properly

1.8.1.2 Ensure local login warning banner is configured properly

1.8.1.3 Ensure remote login warning banner is configured properly

1.8.1.4 Ensure permissions on /etc/motd are configured

1.8.1.5 Ensure permissions on /etc/issue are configured

1.8.1.6 Ensure permissions on /etc/issue.net are configured

1.8.2 Ensure GDM login banner is configured - banner message enabled

1.8.2 Ensure GDM login banner is configured - banner text

1.9 Ensure updates, patches, and additional security software are installed

CSCv7|9.2

2.1.2 Ensure openbsd-inetd is not installed

2.2.1.1 Ensure time synchronization is in use

CSCv7|6.1

2.2.1.2 Ensure systemd-timesyncd is configured - FallbackNTP

2.2.1.2 Ensure systemd-timesyncd is configured - NTP

2.2.1.2 Ensure systemd-timesyncd is configured - RootDistanceMax

2.2.1.2 Ensure systemd-timesyncd is configured - systemctl

2.2.1.3 Ensure chrony is configured - ntp server

2.2.1.3 Ensure chrony is configured - user

2.2.1.4 Ensure ntp is configured - ntp server

CSCv6|6.1

2.2.1.4 Ensure ntp is configured - restrict -4

2.2.1.4 Ensure ntp is configured - restrict -6

2.2.1.4 Ensure ntp is configured - RUNASUSER

2.2.2 Ensure X Window System is not installed

2.2.5 Ensure DHCP Server is not enabled - dhcpd

2.2.5 Ensure DHCP Server is not enabled - isc-dhcp-server6

2.2.7 Ensure NFS and RPC are not enabled - nfs-server

2.2.7 Ensure NFS and RPC are not enabled - rpcbind

2.2.11 Ensure email services are not enabled

2.2.13 Ensure HTTP Proxy Server is not enabled

2.2.15 Ensure mail transfer agent is configured for local-only mode - /etc/exim4/update-exim4.conf.conf

2.2.15 Ensure mail transfer agent is configured for local-only mode - ss

2.2.16 Ensure rsync service is not enabled

CSCv7|4.5

2.3.3 Ensure talk client is not installed

Detections

Analytics

Revision 1.35

Jul 11, 2023

Functional Update