1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod

800-53|CM-7b.

CSCv6|13

1.1.1.1 Ensure mounting of cramfs filesystems is disabled - modprobe

CSCv6|3.1

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - lsmod

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - modprobe

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - lsmod

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - modprobe

1.1.1.4 Ensure mounting of hfs filesystems is disabled - lsmod

1.1.1.4 Ensure mounting of hfs filesystems is disabled - modprobe

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - lsmod

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - modprobe

1.1.1.6 Ensure mounting of udf filesystems is disabled - lsmod

1.1.1.6 Ensure mounting of udf filesystems is disabled - modprobe

800-53|CM-6

CSCv7|5.1

1.1.3 Ensure nodev option set on /tmp partition

800-53|AC-6(10)

1.1.4 Ensure nosuid option set on /tmp partition

1.1.5 Ensure noexec option set on /tmp partition

1.1.7 Ensure nodev option set on /dev/shm partition

1.1.8 Ensure nosuid option set on /dev/shm partition

1.1.9 Ensure noexec option set on /dev/shm partition

1.1.12 Ensure /var/tmp partition includes the nodev option

1.1.13 Ensure /var/tmp partition includes the nosuid option

1.1.14 Ensure /var/tmp partition includes the noexec option

1.1.18 Ensure /home partition includes the nodev option

1.1.19 Ensure nodev option set on removable media partitions

1.1.20 Ensure nosuid option set on removable media partitions

1.1.21 Ensure noexec option set on removable media partitions

CSCv6|8

1.1.22 Ensure sticky bit is set on all world-writable directories

800-53|AC-3(3)

800-53|CM-7(4)

CSCv6|8.3

CSCv6|9.1

1.2.1 Ensure package manager repositories are configured

800-53|SI-2

CSCv6|4.5

800-53|SI-7(6)

800-53|CM-7(5)

CSCv6|2.2

CSCv6|3.5

1.3.1 Ensure AIDE is installed - aide-common

1.3.2 Ensure filesystem integrity is regularly checked

800-53|SI-7(1)

1.4.1 Ensure permissions on bootloader config are not overridden - chmod

800-53|CM-6b.

1.4.1 Ensure permissions on bootloader config are not overridden - if line

1.4.2 Ensure bootloader password is set - 'passwd_pbkdf2'

800-53|SI-7(10)

CSCv6|5.1

1.4.2 Ensure bootloader password is set - 'set superusers'

1.4.3 Ensure permissions on bootloader config are configured

800-53|SI-7(9)

1.4.4 Ensure authentication required for single user mode

800-53|IA-5(1)

800-53|SI-16

CSCv6|8.4

1.5.2 Ensure address space layout randomization (ASLR) is enabled - config

1.5.2 Ensure address space layout randomization (ASLR) is enabled - sysctl

1.5.4 Ensure core dumps are restricted - limits config

1.5.4 Ensure core dumps are restricted - processsizemax

1.5.4 Ensure core dumps are restricted - storage

1.5.4 Ensure core dumps are restricted - sysctl

1.5.4 Ensure core dumps are restricted - sysctl config

800-53|CM-7

1.6.1.2 Ensure AppArmor is enabled in the bootloader configuration - apparmor

CSCv6|14.4

1.6.1.2 Ensure AppArmor is enabled in the bootloader configuration - security

1.6.1.3 Ensure all AppArmor Profiles are in enforce or complain mode - loaded

1.6.1.3 Ensure all AppArmor Profiles are in enforce or complain mode - unconfined

1.7.1 Ensure message of the day is configured properly - banner

800-53|AC-8

1.7.1 Ensure message of the day is configured properly - platform flags

1.7.2 Ensure permissions on /etc/issue.net are configured

1.7.3 Ensure permissions on /etc/issue are configured

1.7.4 Ensure permissions on /etc/motd are configured

1.7.5 Ensure remote login warning banner is configured properly - banner

1.7.5 Ensure remote login warning banner is configured properly - platform flags

1.7.6 Ensure local login warning banner is configured properly - banner

1.7.6 Ensure local login warning banner is configured properly - platform flags

1.8.2 Ensure GDM login banner is configured - banner-message-enable

800-53|AC-8a.

1.8.2 Ensure GDM login banner is configured - banner-message-text

1.8.3 Ensure disable-user-list is enabled

1.9 Ensure updates, patches, and additional security software are installed

800-53|SI-2c.

2.1.1.1 Ensure time synchronization is in use

800-53|AU-8

CSCv6|6.1

CSCv7|6.1

2.1.1.2 Ensure systemd-timesyncd is configured - FallbackNTP

800-53|AU-8(2)

2.1.1.2 Ensure systemd-timesyncd is configured - NTP

800-53|AU-8(1)

2.1.1.2 Ensure systemd-timesyncd is configured - RootDistanceMaxSec

2.1.1.3 Ensure chrony is configured - server

2.1.1.3 Ensure chrony is configured - uid

800-53|AC-5

2.1.1.4 Ensure ntp is configured - restrict -4

2.1.1.4 Ensure ntp is configured - restrict -6

2.1.1.4 Ensure ntp is configured - server

2.1.2 Ensure X Window System is not installed

2.1.3 Ensure Avahi Server is not installed

2.1.5 Ensure DHCP Server is not installed - isc-dhcp-server

2.1.6 Ensure LDAP server is not installed

2.1.10 Ensure HTTP server is not installed

2.1.11 Ensure IMAP and POP3 server are not installed - dovecot-imapd

2.1.11 Ensure IMAP and POP3 server are not installed - dovecot-pop3d

2.1.13 Ensure HTTP Proxy Server is not installed

2.1.14 Ensure SNMP Server is not installed

2.1.15 Ensure mail transfer agent is configured for local-only mode

800-53|SC-7(12)

2.1.16 Ensure rsync service is not installed

2.1.17 Ensure NIS Server is not installed

CSCv6|2

CSCv6|3.4

2.2.3 Ensure talk client is not installed

Revision 1.10

Sep 19, 2022

Functional Update

Miscellaneous