1 # @(#) $Id: cis_rhel_linux_rcl.txt,v 1.5 2008/08/28 12:07:35 dcid Exp $
3 # OSSEC Linux Audit - (C) 2008 Daniel B. Cid - dcid@ossec.net
5 # Released under the same license as OSSEC.
6 # More details at the LICENSE file included with OSSEC or online
7 # at: http://www.ossec.net/en/licensing.html
9 # [Application name] [any or all] [reference]
13 # - f (for file or directory)
14 # - p (process running)
15 # - d (any file inside the directory)
18 # For the registry , use "->" to look for a specific entry and another
19 # "->" to look for the value.
20 # For files, use "->" to look for a specific value in the file.
22 # Values can be preceeded by: =: (for equal) - default
23 # r: (for ossec regexes)
24 # >: (for strcmp greater)
25 # <: (for strcmp lower)
26 # Multiple patterns can be specified by using " && " between them.
27 # (All of them must match for it to return true).
30 # CIS Checks for Red Hat (RHEL 2.1, 3.0, 4.0 and Fedora Core 1,2,3,4 and 5).
31 # Based on CIS Benchmark for Red Hat Enterprise Linux v1.0.5
36 $rc_dirs=/etc/rc.d/rc2.d,/etc/rc.d/rc3.d,/etc/rc.d/rc4.d,/etc/rc.d/rc5.d;
40 # Main one. Only valid for Red Hat/Fedora.
41 [CIS - Testing against the CIS Red Hat Enterprise Linux Benchmark v1.0.5] [any required] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
42 f:/etc/redhat-release -> r:^Red Hat Enterprise Linux \S+ release 4;
43 f:/etc/redhat-release -> r:^Red Hat Enterprise Linux \S+ release 3;
44 f:/etc/redhat-release -> r:^Red Hat Enterprise Linux \S+ release 2.1;
45 f:/etc/fedora-release -> r:^Fedora && r:release 1;
46 f:/etc/fedora-release -> r:^Fedora && r:release 2;
47 f:/etc/fedora-release -> r:^Fedora && r:release 3;
48 f:/etc/fedora-release -> r:^Fedora && r:release 4;
49 f:/etc/fedora-release -> r:^Fedora && r:release 5;
53 # Build considerations - Partition scheme.
54 [CIS - Red Hat Linux - Build considerations - Robust partition scheme - /var is not on its own partition] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
55 f:/etc/fstab -> !r:/var;
57 [CIS - Red Hat Linux - Build considerations - Robust partition scheme - /home is not on its own partition] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
58 f:/etc/fstab -> !r:/home;
63 # Section 1.3 - SSH configuration
64 [CIS - Red Hat Linux 1.3 - SSH Configuration - Protocol version 1 enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
65 f:/etc/ssh/sshd_config -> !r:^# && r:Protocol\.+1;
67 [CIS - Red Hat Linux 1.3 - SSH Configuration - IgnoreRHosts disabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
68 f:/etc/ssh/sshd_config -> !r:^# && r:IgnoreRhosts\.+no;
70 [CIS - Red Hat Linux 1.3 - SSH Configuration - Empty passwords permitted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
71 f:/etc/ssh/sshd_config -> !r:^# && r:^PermitEmptyPasswords\.+yes;
73 [CIS - Red Hat Linux 1.3 - SSH Configuration - Host based authentication enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
74 f:/etc/ssh/sshd_config -> !r:^# && r:HostbasedAuthentication\.+yes;
76 [CIS - Red Hat Linux 1.3 - SSH Configuration - Root login allowed] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
77 f:/etc/ssh/sshd_config -> !r:^# && r:PermitRootLogin\.+yes;
81 # Section 1.4 Enable system accounting
82 [CIS - Red Hat Linux 1.4 - System Accounting - Sysstat not installed] [all] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
87 # Section 2.5 Install and run Bastille
88 [CIS - Red Hat Linux 1.5 - System harderning - Bastille is not installed] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
93 # Section 2 - Minimize xinetd services
94 [CIS - Red Hat Linux 2.3 - Telnet enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
95 f:/etc/xinetd.c/telnet -> !r:^# && r:disable && r:no;
97 [CIS - Red Hat Linux 2.4 - VSFTP enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
98 f:/etc/xinetd.c/vsftpd -> !r:^# && r:disable && r:no;
100 [CIS - Red Hat Linux 2.4 - WU-FTP enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
101 f:/etc/xinetd.c/wu-ftpd -> !r:^# && r:disable && r:no;
103 [CIS - Red Hat Linux 2.5 - rsh/rlogin/rcp enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
104 f:/etc/xinetd.c/rlogin -> !r:^# && r:disable && r:no;
105 f:/etc/xinetd.c/rsh -> !r:^# && r:disable && r:no;
106 f:/etc/xinetd.c/shell -> !r:^# && r:disable && r:no;
108 [CIS - Red Hat Linux 2.6 - tftpd enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
109 f:/etc/xinetd.c/tftpd -> !r:^# && r:disable && r:no;
111 [CIS - Red Hat Linux 2.7 - imap enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
112 f:/etc/xinetd.c/imap -> !r:^# && r:disable && r:no;
113 f:/etc/xinetd.c/imaps -> !r:^# && r:disable && r:no;
115 [CIS - Red Hat Linux 2.8 - pop3 enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
116 f:/etc/xinetd.c/ipop3 -> !r:^# && r:disable && r:no;
117 f:/etc/xinetd.c/pop3s -> !r:^# && r:disable && r:no;
121 # Section 3 - Minimize boot services
122 [CIS - Red Hat Linux 3.1 - Set daemon umask - Default umask is higher than 027] [all] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
123 f:/etc/init.d/functions -> !r:^# && r:^umask && >:umask 027;
125 [CIS - Red Hat Linux 3.4 - GUI login enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
126 f:/etc/inittab -> !r:^# && r:id:5;
128 [CIS - Red Hat Linux 3.7 - Disable standard boot services - Samba Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
129 d:$rc_dirs -> ^S\d\dsamba$;
130 d:$rc_dirs -> ^S\d\dsmb$;
132 [CIS - Red Hat Linux 3.8 - Disable standard boot services - NFS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
133 d:$rc_dirs -> ^S\d\dnfs$;
134 d:$rc_dirs -> ^S\d\dnfslock$;
136 [CIS - Red Hat Linux 3.10 - Disable standard boot services - NIS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
137 d:$rc_dirs -> ^S\d\dypbind$;
138 d:$rc_dirs -> ^S\d\dypserv$;
140 [CIS - Red Hat Linux 3.13 - Disable standard boot services - NetFS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
141 d:$rc_dirs -> ^S\d\dnetfs$;
143 [CIS - Red Hat Linux 3.15 - Disable standard boot services - Apache web server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
144 d:$rc_dirs -> ^S\d\dapache$;
145 d:$rc_dirs -> ^S\d\dhttpd$;
147 [CIS - Red Hat Linux 3.15 - Disable standard boot services - TUX web server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
148 d:$rc_dirs -> ^S\d\dtux$;
150 [CIS - Red Hat Linux 3.16 - Disable standard boot services - SNMPD process Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
151 d:$rc_dirs -> ^S\d\dsnmpd$;
153 [CIS - Red Hat Linux 3.17 - Disable standard boot services - DNS server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
154 d:$rc_dirs -> ^S\d\dnamed$;
156 [CIS - Red Hat Linux 3.18 - Disable standard boot services - MySQL server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
157 d:$rc_dirs -> ^S\d\dmysqld$;
159 [CIS - Red Hat Linux 3.18 - Disable standard boot services - PostgreSQL server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
160 d:$rc_dirs -> ^S\d\dpostgresql$;
162 [CIS - Red Hat Linux 3.19 - Disable standard boot services - Webmin Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
163 d:$rc_dirs -> ^S\d\dwebmin$;
165 [CIS - Red Hat Linux 3.20 - Disable standard boot services - Squid Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
166 d:$rc_dirs -> ^S\d\dsquid$;
168 [CIS - Red Hat Linux 3.21 - Disable standard boot services - Kudzu hardware detection Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
169 d:$rc_dirs -> ^S\d\dkudzu$;
173 # Section 4 - Kernel tuning
174 [CIS - Red Hat Linux 4.1 - Network parameters - Source routing accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
175 f:/proc/sys/net/ipv4/conf/all/accept_source_route -> 1;
177 [CIS - Red Hat Linux 4.1 - Network parameters - ICMP broadcasts accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
178 f:/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts -> 0;
180 [CIS - Red Hat Linux 4.2 - Network parameters - IP Forwarding enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
181 f:/proc/sys/net/ipv4/ip_forward -> 1;
182 f:/proc/sys/net/ipv6/ip_forward -> 1;
186 # Section 6 - Permissions
187 [CIS - Red Hat Linux 6.1 - Partition /var without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
188 f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/var && !r:nodev;
190 [CIS - Red Hat Linux 6.1 - Partition /tmp without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
191 f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/tmp && !r:nodev;
193 [CIS - Red Hat Linux 6.1 - Partition /opt without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
194 f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/opt && !r:nodev;
196 [CIS - Red Hat Linux 6.1 - Partition /home without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
197 f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/home && !r:nodev ;
199 [CIS - Red Hat Linux 6.2 - Removable partition /media without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
200 f:/etc/fstab -> !r:^# && r:/media && !r:nodev;
202 [CIS - Red Hat Linux 6.2 - Removable partition /media without 'nosuid' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
203 f:/etc/fstab -> !r:^# && r:/media && !r:nosuid;
205 [CIS - Red Hat Linux 6.3 - User-mounted removable partition allowed on the console] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
206 f:/etc/security/console.perms -> r:^<console> \d+ <cdrom>;
207 f:/etc/security/console.perms -> r:^<console> \d+ <floppy>;
211 # Section 7 - Access and authentication
212 [CIS - Red Hat Linux 7.8 - LILO Password not set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
213 f:/etc/lilo.conf -> !r:^# && !r:restricted;
214 f:/etc/lilo.conf -> !r:^# && !r:password=;
216 [CIS - Red Hat Linux 7.8 - GRUB Password not set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
217 f:/boot/grub/menu.lst -> !r:^# && !r:password;
219 [CIS - Red Hat Linux 8.2 - Account with empty password present] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
220 f:/etc/shadow -> r:^\w+::;
222 [CIS - Red Hat Linux SN.11 - Non-root account with uid 0] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL]
223 f:/etc/passwd -> !r:^# && !r:^root: && r:^\w+:\w+:0:;
227 # Tests specific for VMware ESX - Runs on Red Hat Linux
228 # Will not be tested anywhere else.
229 [VMware ESX - Testing against the Security Harderning benchmark VI3 for ESX 3.5] [any required] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
230 f:/etc/vmware-release -> r:^VMware ESX;
233 # Virtual Machine Files and Settings - 1
235 [VMware ESX - VM settings - Copy operation between guest and console enabled] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
236 d:/vmfs/volumes -> .vmx$ -> !r:^isolation.tools.copy.disable;
237 d:/vmfs/volumes -> .vmx$ -> r:^isolation.tools.copy.disable && r:false;
240 [VMware ESX - VM settings - Paste operation between guest and console enabled] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
241 d:/vmfs/volumes -> .vmx$ -> !r:^isolation.tools.paste.disable;
242 d:/vmfs/volumes -> .vmx$ -> r:^isolation.tools.paste.disable && r:false;
245 [VMware ESX - VM settings - GUI Options enabled] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
246 d:/vmfs/volumes -> .vmx$ -> r:^isolation.tools.setGUIOptions.enable && r:true;
249 [VMware ESX - VM settings - Data Flow from the Virtual Machine to the Datastore not limited - Rotate size not 100KB] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
250 d:/vmfs/volumes -> .vmx$ -> !r:^log.rotateSize;
251 d:/vmfs/volumes -> .vmx$ -> r:^log.rotateSize && !r:"100000";
254 [VMware ESX - VM settings - Data Flow from the Virtual Machine to the Datastore not limited - Maximum number of logs not 10] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
255 d:/vmfs/volumes -> .vmx$ -> !r:^log.keepOld;
256 d:/vmfs/volumes -> .vmx$ -> r:^log.keepOld && r:"10";
259 [VMware ESX - VM settings - Data Flow from the Virtual Machine to the Datastore not limited - Guests allowed to write SetInfo data to config] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
260 d:/vmfs/volumes -> .vmx$ -> !r:^isolation.tools.setinfo.disable;
261 d:/vmfs/volumes -> .vmx$ -> r:^isolation.tools.setinfo.disable && r:false;
264 [VMware ESX - VM settings - Nonpersistent Disks being used] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
265 d:/vmfs/volumes -> .vmx$ -> r:^scsi\d:\d.mode && r:!independent-nonpersistent;
268 [VMware ESX - VM settings - Floppy drive present] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
269 d:/vmfs/volumes -> .vmx$ -> r:^floppy\d+.present && r:!false;
271 [VMware ESX - VM settings - Serial port present] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
272 d:/vmfs/volumes -> .vmx$ -> r:^serial\d+.present && r:!false;
274 [VMware ESX - VM settings - Parallel port present] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
275 d:/vmfs/volumes -> .vmx$ -> r:^parallel\d+.present && r:!false;
278 [VMware ESX - VM settings - Unauthorized Removal or Connection of Devices allowed] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
279 d:/vmfs/volumes -> .vmx$ -> !r:^Isolation.tools.connectable.disable;
280 d:/vmfs/volumes -> .vmx$ -> r:^Isolation.tools.connectable.disable && r:false;
283 [VMware ESX - VM settings - Avoid Denial of Service Caused by Virtual Disk Modification Operations - diskWiper enabled] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
284 d:/vmfs/volumes -> .vmx$ -> !r:^isolation.tools.diskWiper.disable;
285 d:/vmfs/volumes -> .vmx$ -> r:^isolation.tools.diskWiper.disable && r:false;
287 [VMware ESX - VM settings - Avoid Denial of Service Caused by Virtual Disk Modification Operations - diskShrink enabled] [any] [http://www.ossec.net/wiki/index.php/SecurityHardening_VMwareESX]
288 d:/vmfs/volumes -> .vmx$ -> !r:^isolation.tools.diskShrink.disable;
289 d:/vmfs/volumes -> .vmx$ -> r:^isolation.tools.diskShrink.disable && r:false;
292 # Configuring the Service Console in ESX 3.5 - 2