# @(#) $Id: ./src/rootcheck/db/cis_rhel5_linux_rcl.txt, 2011/09/08 dcid Exp $ # # OSSEC Linux Audit - (C) 2008 Daniel B. Cid - dcid@ossec.net # # Released under the same license as OSSEC. # More details at the LICENSE file included with OSSEC or online # at: http://www.ossec.net/en/licensing.html # # [Application name] [any or all] [reference] # type:; # # Type can be: # - f (for file or directory) # - p (process running) # - d (any file inside the directory) # # Additional values: # For the registry , use "->" to look for a specific entry and another # "->" to look for the value. # For files, use "->" to look for a specific value in the file. # # Values can be preceeded by: =: (for equal) - default # r: (for ossec regexes) # >: (for strcmp greater) # <: (for strcmp lower) # Multiple patterns can be specified by using " && " between them. # (All of them must match for it to return true). # CIS Checks for Red Hat (RHEL 2.1, 3.0, 4.0 and Fedora Core 1,2,3,4 and 5). # Based on CIS Benchmark for Red Hat Enterprise Linux 5 v1.1 # RC scripts location $rc_dirs=/etc/rc.d/rc2.d,/etc/rc.d/rc3.d,/etc/rc.d/rc4.d,/etc/rc.d/rc5.d; # Main one. Only valid for Red Hat 5. [CIS - Testing against the CIS Red Hat Enterprise Linux 5 Benchmark v1.1] [any required] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/redhat-release -> r:^Red Hat Enterprise Linux \S+ release 5; f:/etc/redhat-release -> r:^CentOS && r:release 5.2; # Build considerations - Partition scheme. [CIS - RHEL5 - Build considerations - Robust partition scheme - /var is not on its own partition] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/fstab -> !r:/var; # Section 2.3 - SSH configuration [CIS - RHEL5 2.3 - SSH Configuration - Protocol version 1 enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/ssh/sshd_config -> !r:^# && r:Protocol\.+1; [CIS - RHEL5 2.3 - SSH Configuration - IgnoreRHosts disabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/ssh/sshd_config -> !r:^# && r:IgnoreRhosts\.+no; [CIS - RHEL5 2.3 - SSH Configuration - Empty passwords permitted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/ssh/sshd_config -> !r:^# && r:^PermitEmptyPasswords\.+yes; [CIS - RHEL5 2.3 - SSH Configuration - Host based authentication enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/ssh/sshd_config -> !r:^# && r:HostbasedAuthentication\.+yes; [CIS - RHEL5 2.3 - SSH Configuration - Root login allowed] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/ssh/sshd_config -> !r:^# && r:PermitRootLogin\.+yes; # Section 2.4 Enable system accounting #[CIS - RHEL5 2.4 - System Accounting - Sysstat not installed] [all] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] #f:!/var/log/sa; # Section 3 - Minimize xinetd services [CIS - RHEL5 3.3 - Telnet enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/xinetd.c/telnet -> !r:^# && r:disable && r:no; [CIS - RHEL5 3.4 - VSFTP enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/xinetd.c/vsftpd -> !r:^# && r:disable && r:no; [CIS - RHEL5 3.5 - rsh/rlogin/rcp enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/xinetd.c/rlogin -> !r:^# && r:disable && r:no; f:/etc/xinetd.c/rsh -> !r:^# && r:disable && r:no; f:/etc/xinetd.c/shell -> !r:^# && r:disable && r:no; [CIS - RHEL5 3.6 - tftpd enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/xinetd.c/tftpd -> !r:^# && r:disable && r:no; [CIS - RHEL5 3.7 - imap enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/xinetd.c/cyrus-imapd -> !r:^# && r:disable && r:no; [CIS - RHEL5 3.8 - pop3 enabled on xinetd] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/xinetd.c/dovecot -> !r:^# && r:disable && r:no; # Section 4 - Minimize boot services [CIS - RHEL5 4.1 - Set daemon umask - Default umask is higher than 027] [all] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/init.d/functions -> !r:^# && r:^umask && <:umask 027; [CIS - RHEL5 4.4 - GUI login enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/inittab -> !r:^# && r:id:5; [CIS - RHEL5 4.7 - Disable standard boot services - Samba Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dsamba$; d:$rc_dirs -> ^S\d\dsmb$; [CIS - RHEL5 4.8 - Disable standard boot services - NFS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dnfs$; d:$rc_dirs -> ^S\d\dnfslock$; [CIS - RHEL5 4.10 - Disable standard boot services - NIS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dypbind$; d:$rc_dirs -> ^S\d\dypserv$; [CIS - RHEL5 4.13 - Disable standard boot services - NetFS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dnetfs$; [CIS - RHEL5 4.15 - Disable standard boot services - Apache web server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dapache$; [CIS - RHEL5 4.16 - Disable standard boot services - SNMPD process Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dsnmpd$; [CIS - RHEL5 4.17 - Disable standard boot services - DNS server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dnamed$; [CIS - RHEL5 4.18 - Disable standard boot services - MySQL server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dmysqld$; [CIS - RHEL5 4.18 - Disable standard boot services - PostgreSQL server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dpostgresql$; [CIS - RHEL5 4.19 - Disable standard boot services - Squid Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dsquid$; [CIS - RHEL5 4.20 - Disable standard boot services - Kudzu hardware detection Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] d:$rc_dirs -> ^S\d\dkudzu$; # Section 5 - Kernel tuning [CIS - RHEL5 5.1 - Network parameters - Source routing accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/proc/sys/net/ipv4/conf/all/accept_source_route -> 1; [CIS - RHEL5 5.1 - Network parameters - ICMP redirects accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/proc/sys/net/ipv4/conf/all/accept_redirects -> 1; [CIS - RHEL5 5.1 - Network parameters - ICMP secure redirects accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/proc/sys/net/ipv4/conf/all/secure_redirects -> 1; [CIS - RHEL5 5.1 - Network parameters - ICMP broadcasts accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts -> 0; [CIS - RHEL5 5.2 - Network parameters - IP Forwarding enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/proc/sys/net/ipv4/ip_forward -> 1; f:/proc/sys/net/ipv6/ip_forward -> 1; # Section 7 - Permissions [CIS - RHEL5 7.2 - Removable partition /media without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/fstab -> !r:^# && r:/media && !r:nodev; [CIS - RHEL5 7.2 - Removable partition /media without 'nosuid' set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/fstab -> !r:^# && r:/media && !r:nosuid; [CIS - RHEL5 7.3 - User-mounted removable partition allowed on the console] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/security/console.perms -> r:^ \d+ ; f:/etc/security/console.perms -> r:^ \d+ ; # Section 8 - Access and authentication [CIS - RHEL5 8.7 - GRUB Password not set] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/boot/grub/menu.lst -> !r:^# && !r:password; [CIS - RHEL5 9.2 - Account with empty password present] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/shadow -> r:^\w+::; [CIS - RHEL5 SN.11 - Non-root account with uid 0] [any] [http://www.ossec.net/wiki/index.php/CIS_RHEL5] f:/etc/passwd -> !r:^# && !r:^root: && r:^\w+:\w+:0:; # EOF