1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod

800-53|CM-1

800-53|CM-2

800-53|CM-6

800-53|CM-7

800-53|CM-7(1)

800-53|CM-9

800-53|SA-3

800-53|SA-8

800-53|SA-10

CSCv6|13

CSCv7|5.1

CSCv7|13

1.1.1.1 Ensure mounting of cramfs filesystems is disabled - modprobe

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - lsmod

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - modprobe

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - lsmod

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - modprobe

1.1.1.4 Ensure mounting of hfs filesystems is disabled - lsmod

1.1.1.4 Ensure mounting of hfs filesystems is disabled - modprobe

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - lsmod

800-53|CM-7(2)

800-53|CM-8(3)

800-53|CM-10

800-53|CM-11

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - modprobe

1.1.1.6 Ensure mounting of squashfs filesystems is disabled - lsmod

1.1.1.6 Ensure mounting of squashfs filesystems is disabled - modprobe

1.1.1.7 Ensure mounting of udf filesystems is disabled - lsmod

1.1.1.7 Ensure mounting of udf filesystems is disabled - modprobe

1.1.2 Ensure /tmp is configured - systemctl

1.1.3 Ensure nodev option set on /tmp partition

1.1.4 Ensure nosuid option set on /tmp partition

1.1.7 Ensure nodev option set on /var/tmp partition

1.1.8 Ensure nosuid option set on /var/tmp partition

1.1.9 Ensure noexec option set on /var/tmp partition

CSCv6|2

CSCv7|2.6

1.1.13 Ensure nodev option set on /home partition

CSCv6|15.1

1.1.14 Ensure nodev option set on /dev/shm partition

1.1.15 Ensure nosuid option set on /dev/shm partition

1.1.16 Ensure noexec option set on /dev/shm partition

1.1.17 Ensure nodev option set on removable media partitions

1.1.18 Ensure nosuid option set on removable media partitions

1.1.19 Ensure noexec option set on removable media partitions

CSCv6|8

1.1.20 Ensure sticky bit is set on all world-writable directories

800-53|MP-7

800-53|SI-3

CSCv6|8.3

CSCv7|8.4

CSCv7|8.5

1.2.1 Ensure package manager repositories are configured

800-53|RA-5

800-53|SI-2

800-53|SI-2(2)

CSCv6|4.5

CSCv7|3.4

CSCv7|3.5

800-53|AC-6(9)

800-53|AU-2

800-53|AU-12

CSCv6|3.5

CSCv7|14.9

1.3.2 Ensure filesystem integrity is regularly checked

1.4.1 Ensure permissions on bootloader config are configured

CSCv6|5.1

1.4.2 Ensure bootloader password is set - password_pbkdf2

1.4.2 Ensure bootloader password is set - set superusers

1.4.3 Ensure authentication required for single user mode

1.5.1 Ensure core dumps are restricted - limits.conf limits.d

1.5.1 Ensure core dumps are restricted - sysctl

800-53|SI-16

CSCv7|8.3

1.5.3 Ensure address space layout randomization (ASLR) is enabled

CSCv6|8.4

1.5.3 Ensure address space layout randomization (ASLR) is enabled - sysctl

1.7.1.1 Ensure message of the day is configured properly

1.7.1.2 Ensure local login warning banner is configured properly

1.7.1.3 Ensure remote login warning banner is configured properly

1.7.1.4 Ensure permissions on /etc/motd are configured

1.7.1.5 Ensure permissions on /etc/issue are configured

1.7.1.6 Ensure permissions on /etc/issue.net are configured

1.7.2 Ensure GDM login banner is configured - banner message enabled

1.7.2 Ensure GDM login banner is configured - banner text

1.8 Ensure updates, patches, and additional security software are installed

CSCv6|9.1

CSCv7|9.2

2.1.2 Ensure inetd is not installed - inetutils-inetd

2.1.2 Ensure inetd is not installed - openbsd-inetd

2.2.1.1 Ensure time synchronization is in use

800-53|AU-7

800-53|AU-8

CSCv6|6.1

CSCv7|6.1

2.2.1.2 Ensure ntp is configured - ntp server

2.2.1.2 Ensure ntp is configured - restrict -4

2.2.1.2 Ensure ntp is configured - restrict -6

2.2.1.2 Ensure ntp is configured - RUNASUSER

2.2.2 Ensure X Window System is not installed

2.2.5 Ensure DHCP Server is not enabled - dhcpd

2.2.5 Ensure DHCP Server is not enabled - isc-dhcp-server6

2.2.7 Ensure NFS and RPC are not enabled - nfs-server

2.2.7 Ensure NFS and RPC are not enabled - rpcbind

2.2.11 Ensure IMAP and POP3 server is not installed

2.2.13 Ensure HTTP Proxy Server is not enabled

2.2.15 Ensure mail transfer agent is configured for local-only mode - /etc/postfix/main.cf

2.2.15 Ensure mail transfer agent is configured for local-only mode - netstat

2.2.16 Ensure rsync service is not enabled

2.3.2 Ensure rsh client is not installed - rsh-client

CSCv6|3.4

CSCv7|4.5

2.3.2 Ensure rsh client is not installed - rsh-redone-client

2.3.3 Ensure talk client is not installed

2.3.4 Ensure telnet client is not installed

2.3.5 Ensure LDAP client is not installed

3.1.1 Ensure IP forwarding is disabled - ipv4 /etc/sysctl.conf /etc/sysctl.d/*

CSCv6|3

CSCv6|11

3.1.1 Ensure IP forwarding is disabled - ipv4 sysctl

3.1.1 Ensure IP forwarding is disabled - ipv6 /etc/sysctl.conf /etc/sysctl.d/*

3.1.1 Ensure IP forwarding is disabled - ipv6 sysctl

3.1.2 Ensure packet redirect sending is disabled - all /etc/sysctl.conf /etc/sysctl.d/*

3.1.2 Ensure packet redirect sending is disabled - all sysctl

3.1.2 Ensure packet redirect sending is disabled - default /etc/sysctl.conf /etc/sysctl.d/*

3.1.2 Ensure packet redirect sending is disabled - default sysctl

3.2.1 Ensure source routed packets are not accepted - files 'net.ipv4.conf.all.accept_source_route = 0'

3.2.1 Ensure source routed packets are not accepted - files 'net.ipv4.conf.default.accept_source_route = 0'

3.2.1 Ensure source routed packets are not accepted - files 'net.ipv6.conf.all.accept_source_route = 0'

3.2.1 Ensure source routed packets are not accepted - files 'net.ipv6.conf.default.accept_source_route = 0'

3.2.1 Ensure source routed packets are not accepted - net.ipv4.conf.all.accept_source_route = 0

Revision 1.7

Sep 19, 2022

Functional Update