Revision 1.9Jun 30, 2026
Informational Update
- 1.1 Use the Latest Package Updates
- 2.1 Configure TCP Wrappers
- 2.10 Disable Removable Volume Manager
- 2.11 Disable automount Service
- 2.12 Disable Telnet Service
- 2.2 Disable Local-only Graphical Login Environment
- 2.3 Configure sendmail Service for Local-Only Mode
- 2.4 Disable RPC Encryption Key
- 2.5 Disable Generic Security Services (GSS)
- 2.6 Disable Apache Service
- 2.7 Disable Kerberos TGT Expiration Warning
- 2.8 Disable NIS Client Services
- 2.9 Disable NIS Server Services
- 3.1 Disable Response to Broadcast ICMPv4 Echo Request
- 3.10 Disable Response to Multicast Echo Request
- 3.11 Ignore ICMP Redirect Messages
- 3.12 Set Strict Multihoming
- 3.13 Disable ICMP Redirect Messages
- 3.14 Disable TCP Reverse IP Source Routing
- 3.15 Set Maximum Number of Half-open TCP Connections
- 3.16 Set Maximum Number of Incoming Connections
- 3.17 Disable Network Routing
- 3.2 Disable Response to ICMP Broadcast Netmask Requests
- 3.3 Enable Strong TCP Sequence Number Generation
- 3.4 Disable Response to ICMP Broadcast Timestamp Requests
- 3.5 Disable Source Packet Forwarding
- 3.6 Disable Directed Broadcast Packet Forwarding
- 3.7 Enable Stack Protection
- 3.8 Restrict Core Dumps to Protected Directory
- 3.9 Disable Response to ICMP Timestamp Requests
- 4.1 Create CIS Audit Class
- 4.2 Enable Auditing of Incoming Network Connections
- 4.3 Enable Auditing of File Metadata Modification Events
- 4.4 Enable Auditing of Process and Privilege Events
- 4.5 Configure Solaris Auditing
- 5.1 Set Sticky Bit on World Writable Directories
- 6.1 Disable login: Services on Serial Ports
- 6.10 Disable Host-based Authentication for Login-based Services
- 6.11 Blocking Authentication Using Empty/Null Passwords for SSH
- 6.12 Limit Consecutive Login Attempts for SSH
- 6.13 Disable X11 Forwarding for SSH
- 6.14 Disable 'nobody' Access for RPC Encryption Key Storage Service
- 6.15 Secure the GRUB Menu (Intel)
- 6.16 Restrict root Login to System Console
- 6.17 Set Retry Limit for Account Lockout
- 6.2 Set EEPROM Security Mode and Log Failed Access (SPARC)
- 6.3 Restrict at/cron to Authorized Users
- 6.4 Set Default Screen Lock for GNOME Users
- 6.5 Remove Autologin Capabilities from the GNOME desktop
- 6.6 Set Delay between Failed Login Attempts to 4
- 6.7 Disable Rhost-based Authentication for SSH
- 6.8 Restrict FTP Use
- 6.9 Disable root login for SSH
- 7.1 Set Password Expiration Parameters on Active Accounts
- 7.2 Set Strong Password Creation Policies
- 7.3 Set Default umask for users
- 7.4 Set Default File Creation Mask for FTP Users
- 7.5 Set 'mesg n' as Default for All Users
- 7.6 Lock Inactive User Accounts
- 8.1 Create Warnings for Standard Login Services
- 8.2 Enable a Warning Banner for the FTP service
- 8.3 Enable a Warning Banner for the SSH Service
- 8.4 Enable a Warning Banner for the GNOME Service
- 8.5 Check that the Banner Setting for telnet is Null
- 9.1 Check for Remote Consoles
- 9.10 Check Permissions on User '.' (Hidden) Files
- 9.11 Check Permissions on User .netrc Files
- 9.12 Check for Presence of User .rhosts Files
- 9.13 Check Groups in passwd
- 9.14 Check That Users Are Assigned Home Directories
- 9.15 Check User Home Directory Ownership
- 9.16 Check for Duplicate UIDs
- 9.17 Check for Duplicate GIDs
- 9.18 Check for Duplicate Group Names
- 9.19 Check for Presence of User .netrc Files
- 9.2 Check for Duplicate User Names
- 9.20 Check for Presence of User .forward Files
- 9.21 Find World Writable Files
- 9.22 Find SUID/SGID System Executables
- 9.23 Find Un-owned Files and Directories
- 9.24 Find Files and Directories with Extended Attributes
- 9.3 Check That Defined Home Directories Exist
- 9.4 Verify System Account Default Passwords
- 9.5 Verify System File Permissions
- 9.6 Ensure Password Fields are Not Empty
- 9.7 Verify No UID 0 Accounts Exist Other than root
- 9.8 Ensure root PATH Integrity
- 9.9 Check Permissions on User Home Directories
