1 # OSSEC Linux Audit - (C) 2018 OSSEC Project
3 # Released under the same license as OSSEC.
4 # More details at the LICENSE file included with OSSEC or online
5 # at: https://github.com/ossec/ossec-hids/blob/master/LICENSE
7 # [Application name] [any or all] [reference]
11 # - f (for file or directory)
12 # - p (process running)
13 # - d (any file inside the directory)
16 # For the registry and for directories, use "->" to look for a specific entry and another
17 # "->" to look for the value.
18 # Also, use " -> r:^\. -> ..." to search all files in a directory
19 # For files, use "->" to look for a specific value in the file.
21 # Values can be preceded by: =: (for equal) - default
22 # r: (for ossec regexes)
23 # >: (for strcmp greater)
24 # <: (for strcmp lower)
25 # Multiple patterns can be specified by using " && " between them.
26 # (All of them must match for it to return true).
29 # CIS Checks for Red Hat / CentOS 6
30 # Based on CIS Benchmark for Red Hat Enterprise Linux 6 v1.3.0
33 $rc_dirs=/etc/rc.d/rc2.d,/etc/rc.d/rc3.d,/etc/rc.d/rc4.d,/etc/rc.d/rc5.d;
36 [CIS - Testing against the CIS Red Hat Enterprise Linux 5 Benchmark v2.1.0] [any required] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
37 f:/etc/redhat-release -> r:^Red Hat Enterprise Linux \S+ release 6;
38 f:/etc/redhat-release -> r:^CentOS && r:release 6;
39 f:/etc/redhat-release -> r:^Cloud && r:release 6;
40 f:/etc/redhat-release -> r:^Oracle && r:release 6;
41 f:/etc/redhat-release -> r:^Better && r:release 6;
43 # 1.1.1 /tmp: partition
44 [CIS - RHEL6 - Build considerations - Robust partition scheme - /tmp is not on its own partition] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
45 f:/etc/fstab -> !r:/tmp;
48 [CIS - RHEL6 - 1.1.2 - Partition /tmp without 'nodev' set {CIS: 1.1.2 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
49 f:/etc/fstab -> !r:^# && r:/tmp && !r:nodev;
52 [CIS - RHEL6 - 1.1.3 - Partition /tmp without 'nosuid' set {CIS: 1.1.3 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
53 f:/etc/fstab -> !r:^# && r:/tmp && !r:nosuid;
56 [CIS - RHEL6 - 1.1.4 - Partition /tmp without 'noexec' set {CIS: 1.1.4 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
57 f:/etc/fstab -> !r:^# && r:/tmp && !r:nodev;
59 # 1.1.5 Build considerations - Partition scheme.
60 [CIS - RHEL6 - Build considerations - Robust partition scheme - /var is not on its own partition {CIS: 1.1.5 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
61 f:/etc/fstab -> !r^# && !r:/var;
63 # 1.1.6 bind mount /var/tmp to /tmp
64 [CIS - RHEL6 - Build considerations - Robust partition scheme - /var/tmp is bound to /tmp {CIS: 1.1.6 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
65 f:/etc/fstab -> r:^# && !r:/var/tmp && !r:bind;
67 # 1.1.7 /var/log: partition
68 [CIS - RHEL6 - Build considerations - Robust partition scheme - /var/log is not on its own partition {CIS: 1.1.7 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
69 f:/etc/fstab -> ^# && !r:/var/log;
71 # 1.1.8 /var/log/audit: partition
72 [CIS - RHEL6 - Build considerations - Robust partition scheme - /var/log/audit is not on its own partition {CIS: 1.1.8 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
73 f:/etc/fstab -> ^# && !r:/var/log/audit;
75 # 1.1.9 /home: partition
76 [CIS - RHEL6 - Build considerations - Robust partition scheme - /home is not on its own partition {CIS: 1.1.9 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
77 f:/etc/fstab -> ^# && !r:/home;
80 [CIS - RHEL6 - 1.1.10 - Partition /home without 'nodev' set {CIS: 1.1.10 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
81 f:/etc/fstab -> !r:^# && r:/home && !r:nodev;
83 # 1.1.11 nodev on removable media partitions (not scored)
84 [CIS - RHEL6 - 1.1.11 - Removable partition /media without 'nodev' set {CIS: 1.1.11 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
85 f:/etc/fstab -> !r:^# && r:/media && !r:nodev;
87 # 1.1.12 noexec on removable media partitions (not scored)
88 [CIS - RHEL6 - 1.1.12 - Removable partition /media without 'noexec' set {CIS: 1.1.12 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
89 f:/etc/fstab -> !r:^# && r:/media && !r:noexec;
91 # 1.1.13 nosuid on removable media partitions (not scored)
92 [CIS - RHEL6 - 1.1.13 - Removable partition /media without 'nosuid' set {CIS: 1.1.13 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
93 f:/etc/fstab -> !r:^# && r:/media && !r:nosuid;
95 # 1.1.14 /dev/shm: nodev
96 [CIS - RHEL6 - 1.1.14 - /dev/shm without 'nodev' set {CIS: 1.1.14 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
97 f:/etc/fstab -> !r:^# && r:/dev/shm && !r:nodev;
99 # 1.1.15 /dev/shm: nosuid
100 [CIS - RHEL6 - 1.1.15 - /dev/shm without 'nosuid' set {CIS: 1.1.15 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
101 f:/etc/fstab -> !r:^# && r:/dev/shm && !r:nosuid;
103 # 1.1.16 /dev/shm: noexec
104 [CIS - RHEL6 - 1.1.16 - /dev/shm without 'noexec' set {CIS: 1.1.16 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
105 f:/etc/fstab -> !r:^# && r:/dev/shm && !r:noexec;
107 # 1.1.17 sticky bit on world writable directories (Scored)
110 # 1.1.18 disable cramfs (not scored)
112 # 1.1.19 disable freevxfs (not scored)
114 # 1.1.20 disable jffs2 (not scored)
116 # 1.1.21 disable hfs (not scored)
118 # 1.1.22 disable hfsplus (not scored)
120 # 1.1.23 disable squashfs (not scored)
122 # 1.1.24 disable udf (not scored)
125 ##########################################
126 # 1.2 Software Updates
127 ##########################################
129 # 1.2.1 Configure rhn updates (not scored)
131 # 1.2.2 verify RPM gpg keys (Scored)
134 # 1.2.3 verify gpgcheck enabled (Scored)
137 # 1.2.4 Disable rhnsd (not scored)
139 # 1.2.5 Obtain Software Package Updates with yum (Not Scored)
141 # 1.2.6 Obtain updates with yum (not scored)
144 ###############################################
145 # 1.3 Advanced Intrusion Detection Environment
146 ###############################################
148 # Skipped, this control is obsoleted by OSSEC
151 ###############################################
152 # 1.4 Configure SELinux
153 ###############################################
155 # 1.4.1 enable selinux in /etc/grub.conf
156 [CIS - RHEL6 - 1.4.1 - SELinux Disabled in /etc/grub.conf {CIS: 1.4.1 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
157 f:/etc/grub.conf -> !r:selinux=0;
159 # 1.4.2 Set selinux state
160 [CIS - RHEL6 - 1.4.2 - SELinux not set to enforcing {CIS: 1.4.2 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
161 f:/etc/selinux/config -> r:SELINUX=enforcing;
163 # 1.4.3 Set seliux policy
164 [CIS - RHEL6 - 1.4.3 - SELinux policy not set to targeted {CIS: 1.4.3 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
165 f:/etc/selinux/config -> r:SELINUXTYPE=targeted;
167 # 1.4.4 Remove SETroubleshoot
168 [CIS - RHEL6 - 1.4.4 - SELinux setroubleshoot enabled {CIS: 1.4.4 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
169 d:$rc_dirs -> ^S\d\dsetroubleshoot$;
171 # 1.4.5 Disable MCS Translation service mcstrans
172 [CIS - RHEL6 - 1.4.5 - SELinux mctrans enabled {CIS: 1.4.5 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
173 d:$rc_dirs -> ^S\d\dmctrans$;
175 # 1.4.6 Check for unconfined daemons
179 ###############################################
180 # 1.5 Secure Boot Settings
181 ###############################################
183 # 1.5.1 Set User/Group Owner on /etc/grub.conf
184 # TODO (no mode tests)
186 # 1.5.2 Set Permissions on /etc/grub.conf (Scored)
187 # TODO (no mode tests)
189 # 1.5.3 Set Boot Loader Password (Scored)
190 [CIS - RHEL6 - 1.5.3 - GRUB Password not set {CIS: 1.5.3 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
191 f:/boot/grub/menu.lst -> !r:^# && !r:password;
193 # 1.5.4 Require Authentication for Single-User Mode (Scored)
194 [CIS - RHEL6 - 1.5.4 - Authentication for single user mode not enabled {CIS: 1.5.4 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
195 f:/etc/inittab -> !r:^# && r:S:wait;
197 # 1.5.5 Disable Interactive Boot (Scored)
198 [CIS - RHEL6 - 1.5.5 - Interactive Boot not disabled {CIS: 1.5.5 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
199 f:/etc/sysconfig/init -> !r:^# && r:PROMPT=no;
202 ###############################################
203 # 1.6 Additional Process Hardening
204 ###############################################
206 # 1.6.1 Restrict Core Dumps (Scored)
207 [CIS - RHEL6 - 1.6.1 - Interactive Boot not disabled {CIS: 1.6.1 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
208 f:/etc/security/limits.conf -> !r:^# && !r:hard\.+core\.+0;
210 # 1.6.2 Configure ExecShield (Scored)
211 [CIS - RHEL6 - 1.6.2 - ExecShield not enabled {CIS: 1.6.2 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
212 f:/proc/sys/kernel/exec-shield -> 0;
214 # 1.6.3 Enable Randomized Virtual Memory Region Placement (Scored)
215 [CIS - RHEL6 - 1.6.3 - Randomized Virtual Memory Region Placement not enabled {CIS: 1.6.3 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
216 f:/proc/sys/kernel/randomize_va_space -> 0;
219 ###############################################
220 # 1.7 Use the Latest OS Release (Not Scored)
221 ###############################################
224 ###############################################
226 ###############################################
228 ###############################################
229 # 2.1 Remove Legacy Services
230 ###############################################
232 # 2.1.1 Remove telnet-server (Scored)
233 # TODO: detect it is installed at all
234 [CIS - RHEL6 - 2.1.1 - Telnet enabled on xinetd {CIS: 2.1.1 RHEL6} {PCI_DSS: 2.2.3}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
235 f:/etc/xinetd.d/telnet -> !r:^# && r:disable && r:no;
238 # 2.1.2 Remove telnet Clients (Scored)
241 # 2.1.3 Remove rsh-server (Scored)
242 [CIS - RHEL6 - 2.1.3 - rsh/rlogin/rcp enabled on xinetd {CIS: 2.1.3 RHEL6} {PCI_DSS: 2.2.3}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
243 f:/etc/xinetd.d/rlogin -> !r:^# && r:disable && r:no;
244 f:/etc/xinetd.d/rsh -> !r:^# && r:disable && r:no;
245 f:/etc/xinetd.d/shell -> !r:^# && r:disable && r:no;
247 # 2.1.4 Remove rsh (Scored)
250 # 2.1.5 Remove NIS Client (Scored)
251 [CIS - RHEL6 - 2.1.5 - Disable standard boot services - NIS (client) Enabled {CIS: 2.1.5 RHEL6} {PCI_DSS: 2.2.3}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
252 d:$rc_dirs -> ^S\d\dypbind$;
254 # 2.1.6 Remove NIS Server (Scored)
255 [CIS - RHEL6 - 2.1.6 - Disable standard boot services - NIS (server) Enabled {CIS: 2.1.6 RHEL6} {PCI_DSS: 2.2.3}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
256 d:$rc_dirs -> ^S\d\dypserv$;
258 # 2.1.7 Remove tftp (Scored)
261 # 2.1.8 Remove tftp-server (Scored)
262 [CIS - RHEL6 - 2.1.8 - tftpd enabled on xinetd {CIS: 2.1.8 RHEL6} {PCI_DSS: 2.2.3}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
263 f:/etc/xinetd.d/tftpd -> !r:^# && r:disable && r:no;
265 # 2.1.9 Remove talk (Scored)
268 # 2.1.10 Remove talk-server (Scored)
269 [CIS - RHEL6 - 2.1.10 - talk enabled on xinetd {CIS: 2.1.10 RHEL6} {PCI_DSS: 2.2.3}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
270 f:/etc/xinetd.d/talk -> !r:^# && r:disable && r:no;
272 # 2.1.11 Remove xinetd (Scored)
275 # 2.1.12 Disable chargen-dgram (Scored)
278 # 2.1.13 Disable chargen-stream (Scored)
281 # 2.1.14 Disable daytime-dgram (Scored)
284 # 2.1.15 Disable daytime-stream (Scored)
287 # 2.1.16 Disable echo-dgram (Scored)
290 # 2.1.17 Disable echo-stream (Scored)
293 # 2.1.18 Disable tcpmux-server (Scored)
297 ###############################################
298 # 3 Special Purpose Services
299 ###############################################
301 # 3.1 Set Daemon umask (Scored)
302 [CIS - RHEL6 - 3.1 - Set daemon umask - Default umask is higher than 027 {CIS: 3.1 RHEL6} {PCI_DSS: 2.2.2}] [all] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
303 f:/etc/init.d/functions -> !r:^# && r:^umask && <:umask 027;
305 # 3.2 Remove X Windows (Scored)
306 [CIS - RHEL6 - 3.2 - X11 not disabled {CIS: 3.2 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
307 f:/etc/inittab -> !r:^# && r:id:5;
309 # 3.3 Disable Avahi Server (Scored)
310 [CIS - RHEL6 - 3.2 - Avahi daemon not disabled {CIS: 3.3 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
313 # 3.4 Disable Print Server - CUPS (Not Scored)
315 # 3.5 Remove DHCP Server (Not Scored)
318 # 3.6 Configure Network Time Protocol (NTP) (Scored)
319 #[CIS - RHEL6 - 3.6 - NTPD not disabled {CIS: 1.1.1 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
322 # 3.7 Remove LDAP (Not Scored)
324 # 3.8 Disable NFS and RPC (Not Scored)
325 [CIS - RHEL6 - 3.8 - Disable standard boot services - NFS Enabled {CIS: 3.8 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
326 d:$rc_dirs -> ^S\d\dnfs$;
327 d:$rc_dirs -> ^S\d\dnfslock$;
329 # 3.9 Remove DNS Server (Not Scored)
332 # 3.10 Remove FTP Server (Not Scored)
333 [CIS - RHEL6 - 3.10 - VSFTP enabled on xinetd {CIS: 3.10 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
334 f:/etc/xinetd.d/vsftpd -> !r:^# && r:disable && r:no;
336 # 3.11 Remove HTTP Server (Not Scored)
337 [CIS - RHEL6 - 3.11 - Disable standard boot services - Apache web server Enabled {CIS: 3.11 RHEL6}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
338 d:$rc_dirs -> ^S\d\dhttpd$;
340 # 3.12 Remove Dovecot (IMAP and POP3 services) (Not Scored)
341 [CIS - RHEL6 - 3.12 - imap enabled on xinetd {CIS: 3.12 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
342 f:/etc/xinetd.d/cyrus-imapd -> !r:^# && r:disable && r:no;
344 [CIS - RHEL6 - 3.12 - pop3 enabled on xinetd {CIS: 3.12 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
345 f:/etc/xinetd.d/dovecot -> !r:^# && r:disable && r:no;
347 # 3.13 Remove Samba (Not Scored)
348 [CIS - RHEL6 - 3.13 - Disable standard boot services - Samba Enabled {CIS: 3.13 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
349 d:$rc_dirs -> ^S\d\dsamba$;
350 d:$rc_dirs -> ^S\d\dsmb$;
352 # 3.14 Remove HTTP Proxy Server (Not Scored)
353 [CIS - RHEL6 - 3.14 - Disable standard boot services - Squid Enabled {CIS: 3.14 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
354 d:$rc_dirs -> ^S\d\dsquid$;
356 # 3.15 Remove SNMP Server (Not Scored)
357 [CIS - RHEL6 - 3.15 - Disable standard boot services - SNMPD process Enabled {CIS: 3.15 RHEL6} {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
358 d:$rc_dirs -> ^S\d\dsnmpd$;
360 # 3.16 Configure Mail Transfer Agent for Local-Only Mode (Scored)
364 ###############################################
365 # 4 Network Configuration and Firewalls
366 ###############################################
368 ###############################################
369 # 4.1 Modify Network Parameters (Host Only)
370 ###############################################
372 # 4.1.1 Disable IP Forwarding (Scored)
373 [CIS - RHEL6 - 4.1.1 - Network parameters - IP Forwarding enabled {CIS: 4.1.1 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
374 f:/proc/sys/net/ipv4/ip_forward -> 1;
375 f:/proc/sys/net/ipv6/ip_forward -> 1;
377 # 4.1.2 Disable Send Packet Redirects (Scored)
378 [CIS - RHEL6 - 4.1.2 - Network parameters - IP send redirects enabled {CIS: 4.1.2 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
379 f:/proc/sys/net/ipv4/conf/all/send_redirects -> 0;
380 f:/proc/sys/net/ipv4/conf/default/send_redirects -> 0;
383 ###############################################
384 # 4.2 Modify Network Parameters (Host and Router)
385 ###############################################
387 # 4.2.1 Disable Source Routed Packet Acceptance (Scored)
388 [CIS - RHEL6 - 4.2.1 - Network parameters - Source routing accepted {CIS: 4.2.1 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
389 f:/proc/sys/net/ipv4/conf/all/accept_source_route -> 1;
391 # 4.2.2 Disable ICMP Redirect Acceptance (Scored)
392 #[CIS - RHEL6 - 4.2.2 - Network parameters - ICMP redirects accepted {CIS: 1.1.1 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
393 #f:/proc/sys/net/ipv4/conf/all/accept_redirects -> 1;
394 #f:/proc/sys/net/ipv4/conf/default/accept_redirects -> 1;
396 # 4.2.3 Disable Secure ICMP Redirect Acceptance (Scored)
397 [CIS - RHEL6 - 4.2.3 - Network parameters - ICMP secure redirects accepted {CIS: 4.2.3 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
398 f:/proc/sys/net/ipv4/conf/all/secure_redirects -> 1;
399 f:/proc/sys/net/ipv4/conf/default/secure_redirects -> 1;
401 # 4.2.4 Log Suspicious Packets (Scored)
402 [CIS - RHEL6 - 4.2.4 - Network parameters - martians not logged {CIS: 4.2.4 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
403 f:/proc/sys/net/ipv4/conf/all/log_martians -> 0;
405 # 4.2.5 Enable Ignore Broadcast Requests (Scored)
406 [CIS - RHEL6 - 4.2.5 - Network parameters - ICMP broadcasts accepted {CIS: 4.2.5 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
407 f:/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts -> 0;
409 # 4.2.6 Enable Bad Error Message Protection (Scored)
410 [CIS - RHEL6 - 4.2.6 - Network parameters - Bad error message protection not enabled {CIS: 4.2.6 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
411 f:/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses -> 0;
413 # 4.2.7 Enable RFC-recommended Source Route Validation (Scored)
414 [CIS - RHEL6 - 4.2.7 - Network parameters - RFC Source route validation not enabled {CIS: 4.2.7 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
415 f:/proc/sys/net/ipv4/conf/all/rp_filter -> 0;
416 f:/proc/sys/net/ipv4/conf/default/rp_filter -> 0;
418 # 4.2.8 Enable TCP SYN Cookies (Scored)
419 [CIS - RHEL6 - 4.2.8 - Network parameters - SYN Cookies not enabled {CIS: 4.2.8 RHEL6} {PCI_DSS: 2.2.4}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
420 f:/proc/sys/net/ipv4/tcp_syncookies -> 0;
423 ###############################################
424 # 4.3 Wireless Networking
425 ###############################################
427 # 4.3.1 Deactivate Wireless Interfaces (Not Scored)
430 ###############################################
432 ###############################################
434 ###############################################
435 # 4.4.1 Configure IPv6
436 ###############################################
438 # 4.4.1.1 Disable IPv6 Router Advertisements (Not Scored)
440 # 4.4.1.2 Disable IPv6 Redirect Acceptance (Not Scored)
442 # 4.4.2 Disable IPv6 (Not Scored)
445 ###############################################
446 # 4.5 Install TCP Wrappers
447 ###############################################
449 # 4.5.1 Install TCP Wrappers (Not Scored)
451 # 4.5.2 Create /etc/hosts.allow (Not Scored)
453 # 4.5.3 Verify Permissions on /etc/hosts.allow (Scored)
456 # 4.5.4 Create /etc/hosts.deny (Not Scored)
458 # 4.5.5 Verify Permissions on /etc/hosts.deny (Scored)
462 ###############################################
463 # 4.6 Uncommon Network Protocols
464 ###############################################
466 # 4.6.1 Disable DCCP (Not Scored)
468 # 4.6.2 Disable SCTP (Not Scored)
470 # 4.6.3 Disable RDS (Not Scored)
472 # 4.6.4 Disable TIPC (Not Scored)
474 # 4.7 Enable IPtables (Scored)
477 # 4.8 Enable IP6tables (Not Scored)
480 ###############################################
481 # 5 Logging and Auditing
482 ###############################################
484 ###############################################
485 # 5.1 Configure Syslog
486 ###############################################
488 # 5.1.1 Install the rsyslog package (Scored)
491 # 5.1.2 Activate the rsyslog Service (Scored)
494 # 5.1.3 Configure /etc/rsyslog.conf (Not Scored)
496 # 5.1.4 Create and Set Permissions on rsyslog Log Files (Scored)
498 # 5.1.5 Configure rsyslog to Send Logs to a Remote Log Host (Scored)
500 # 5.1.6 Accept Remote rsyslog Messages Only on Designated Log Hosts (Not Scored)
503 ###############################################
504 # 5.2 Configure System Accounting (auditd)
505 ###############################################
507 ###############################################
508 # 5.2.1 Configure Data Retention
509 ###############################################
511 # 5.2.1.1 Configure Audit Log Storage Size (Not Scored)
513 # 5.2.1.2 Disable System on Audit Log Full (Not Scored)
515 # 5.2.1.3 Keep All Auditing Information (Scored)
517 # 5.2.2 Enable auditd Service (Scored)
519 # 5.2.3 Enable Auditing for Processes That Start Prior to auditd (Scored)
521 # 5.2.4 Record Events That Modify Date and Time Information (Scored)
523 # 5.2.5 Record Events That Modify User/Group Information (Scored)
525 # 5.2.6 Record Events That Modify the System’s Network Environment (Scored)
527 # 5.2.7 Record Events That Modify the System’s Mandatory Access Controls (Scored)
529 # 5.2.8 Collect Login and Logout Events (Scored)
531 # 5.2.9 Collect Session Initiation Information (Scored)
533 # 5.2.10 Collect Discretionary Access Control Permission Modification Events (Scored)
535 # 5.2.11 Collect Unsuccessful Unauthorized Access Attempts to Files (Scored)
537 # 5.2.12 Collect Use of Privileged Commands (Scored)
539 # 5.2.13 Collect Successful File System Mounts (Scored)
541 # 5.2.14 Collect File Deletion Events by User (Scored)
543 # 5.2.15 Collect Changes to System Administration Scope (sudoers) (Scored)
545 # 5.2.16 Collect System Administrator Actions (sudolog) (Scored)
547 # 5.2.17 Collect Kernel Module Loading and Unloading (Scored)
549 # 5.2.18 Make the Audit Configuration Immutable (Scored)
551 # 5.3 Configure logrotate (Not Scored)
554 ###############################################
555 # 6 System Access, Authentication and Authorization
556 ###############################################
558 ###############################################
559 # 6.1 Configure cron and anacron
560 ###############################################
562 # 6.1.1 Enable anacron Daemon (Scored)
564 # 6.1.2 Enable cron Daemon (Scored)
566 # 6.1.3 Set User/Group Owner and Permission on /etc/anacrontab (Scored)
568 # 6.1.4 Set User/Group Owner and Permission on /etc/crontab (Scored)
570 # 6.1.5 Set User/Group Owner and Permission on /etc/cron.hourly (Scored)
572 # 6.1.6 Set User/Group Owner and Permission on /etc/cron.daily (Scored)
574 # 6.1.7 Set User/Group Owner and Permission on /etc/cron.weekly (Scored)
576 # 6.1.8 Set User/Group Owner and Permission on /etc/cron.monthly (Scored)
578 # 6.1.9 Set User/Group Owner and Permission on /etc/cron.d (Scored)
580 # 6.1.10 Restrict at Daemon (Scored)
582 # 6.1.11 Restrict at/cron to Authorized Users (Scored)
584 ###############################################
586 ###############################################
588 # 6.2.1 Set SSH Protocol to 2 (Scored)
589 [CIS - RHEL6 - 6.2.1 - SSH Configuration - Protocol version 1 enabled {CIS: 6.2.1 RHEL6} {PCI_DSS: 4.1}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
590 f:/etc/ssh/sshd_config -> !r:^# && r:Protocol\.+1;
592 # 6.2.2 Set LogLevel to INFO (Scored)
594 # 6.2.3 Set Permissions on /etc/ssh/sshd_config (Scored)
596 # 6.2.4 Disable SSH X11 Forwarding (Scored)
598 # 6.2.5 Set SSH MaxAuthTries to 4 or Less (Scored)
600 # 6.2.6 Set SSH IgnoreRhosts to Yes (Scored)
601 [CIS - RHEL6 - 6.2.6 - SSH Configuration - IgnoreRHosts disabled {CIS: 6.2.6 RHEL6} {PCI_DSS: 4.1}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
602 f:/etc/ssh/sshd_config -> !r:^# && r:IgnoreRhosts\.+no;
604 # 6.2.7 Set SSH HostbasedAuthentication to No (Scored)
605 [CIS - RHEL6 - 6.2.7 - SSH Configuration - Host based authentication enabled {CIS: 6.2.7 RHEL6} {PCI_DSS: 4.1}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
606 f:/etc/ssh/sshd_config -> !r:^# && r:HostbasedAuthentication\.+yes;
608 # 6.2.8 Disable SSH Root Login (Scored)
609 [CIS - RHEL6 - 6.2.8 - SSH Configuration - Root login allowed {CIS: 6.2.8 RHEL6} {PCI_DSS: 4.1}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
610 f:/etc/ssh/sshd_config -> !r:^# && r:PermitRootLogin\.+yes;
612 # 6.2.9 Set SSH PermitEmptyPasswords to No (Scored)
613 [CIS - RHEL6 - 6.2.9 - SSH Configuration - Empty passwords permitted {CIS: 6.2.9 RHEL6} {PCI_DSS: 4.1}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
614 f:/etc/ssh/sshd_config -> !r:^# && r:^PermitEmptyPasswords\.+yes;
616 # 6.2.10 Do Not Allow Users to Set Environment Options (Scored)
618 # 6.2.11 Use Only Approved Ciphers in Counter Mode (Scored)
620 # 6.2.12 Set Idle Timeout Interval for User Login (Not Scored)
622 # 6.2.13 Limit Access via SSH (Scored)
624 # 6.2.14 Set SSH Banner (Scored)
627 ###############################################
629 ###############################################
631 # 6.3.1 Set Password Creation Requirement Parameters Using pam_cracklib (Scored)
633 # 6.3.2 Set Lockout for Failed Password Attempts (Not Scored)
635 # 6.3.3 Use pam_deny.so to Deny Services (Not Scored)
637 # 6.3.4 Upgrade Password Hashing Algorithm to SHA-512 (Scored)
639 # 6.3.5 Limit Password Reuse (Scored)
641 # 6.4 Restrict root Login to System Console (Not Scored)
643 # 6.5 Restrict Access to the su Command (Scored)
646 ###############################################
647 # 7 User Accounts and Environment
648 ###############################################
650 ###############################################
651 # 7.1 Set Shadow Password Suite Parameters (/etc/login.defs)
652 ###############################################
654 # 7.1.1 Set Password Expiration Days (Scored)
656 # 7.1.2 Set Password Change Minimum Number of Days (Scored)
658 # 7.1.3 Set Password Expiring Warning Days (Scored)
660 # 7.2 Disable System Accounts (Scored)
662 # 7.3 Set Default Group for root Account (Scored)
664 # 7.4 Set Default umask for Users (Scored)
666 # 7.5 Lock Inactive User Accounts (Scored)
669 ###############################################
671 ###############################################
673 ###############################################
674 # 8.1 Warning Banners for Standard Login Services
675 ###############################################
677 # 8.1 Set Warning Banner for Standard Login Services (Scored)
679 # 8.2 Remove OS Information from Login Warning Banners (Scored)
681 # 8.3 Set GNOME Warning Banner (Not Scored)
684 ###############################################
685 # 9 System Maintenance
686 ###############################################
688 ###############################################
689 # 9.1 Verify System File Permissions
690 ###############################################
692 # 9.1.1 Verify System File Permissions (Not Scored)
694 # 9.1.2 Verify Permissions on /etc/passwd (Scored)
696 # 9.1.3 Verify Permissions on /etc/shadow (Scored)
698 # 9.1.4 Verify Permissions on /etc/gshadow (Scored)
700 # 9.1.5 Verify Permissions on /etc/group (Scored)
702 # 9.1.6 Verify User/Group Ownership on /etc/passwd (Scored)
704 # 9.1.7 Verify User/Group Ownership on /etc/shadow (Scored)
706 # 9.1.8 Verify User/Group Ownership on /etc/gshadow (Scored)
708 # 9.1.9 Verify User/Group Ownership on /etc/group (Scored)
710 # 9.1.10 Find World Writable Files (Not Scored)
712 # 9.1.11 Find Un-owned Files and Directories (Scored)
714 # 9.1.12 Find Un-grouped Files and Directories (Scored)
716 # 9.1.13 Find SUID System Executables (Not Scored)
718 # 9.1.14 Find SGID System Executables (Not Scored)
721 ###############################################
722 # 9.2 Review User and Group Settings
723 ###############################################
725 # 9.2.1 Ensure Password Fields are Not Empty (Scored)
727 # 9.2.2 Verify No Legacy "+" Entries Exist in /etc/passwd File (Scored)
729 # 9.2.3 Verify No Legacy "+" Entries Exist in /etc/shadow File (Scored)
731 # 9.2.4 Verify No Legacy "+" Entries Exist in /etc/group File (Scored)
733 # 9.2.5 Verify No UID 0 Accounts Exist Other Than root (Scored)
734 [CIS - RHEL6 - 9.2.5 - Non-root account with uid 0 {CIS: 9.2.5 RHEL6} {PCI_DSS: 10.2.5}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
735 f:/etc/passwd -> !r:^# && !r:^root: && r:^\w+:\w+:0:;
737 # 9.2.6 Ensure root PATH Integrity (Scored)
739 # 9.2.7 Check Permissions on User Home Directories (Scored)
741 # 9.2.8 Check User Dot File Permissions (Scored)
743 # 9.2.9 Check Permissions on User .netrc Files (Scored)
745 # 9.2.10 Check for Presence of User .rhosts Files (Scored)
747 # 9.2.11 Check Groups in /etc/passwd (Scored)
749 # 9.2.12 Check That Users Are Assigned Valid Home Directories (Scored)
751 # 9.2.13 Check User Home Directory Ownership (Scored)
753 # 9.2.14 Check for Duplicate UIDs (Scored)
755 # 9.2.15 Check for Duplicate GIDs (Scored)
757 # 9.2.16 Check for Duplicate User Names (Scored)
759 # 9.2.17 Check for Duplicate Group Names (Scored)
761 # 9.2.18 Check for Presence of User .netrc Files (Scored)
763 # 9.2.19 Check for Presence of User .forward Files (Scored)
767 [CIS - RHEL6 - X.X.X - Account with empty password present {PCI_DSS: 10.2.5}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
768 f:/etc/shadow -> r:^\w+::;
770 [CIS - RHEL6 - X.X.X - User-mounted removable partition allowed on the console] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
771 f:/etc/security/console.perms -> r:^<console> \d+ <cdrom>;
772 f:/etc/security/console.perms -> r:^<console> \d+ <floppy>;
774 [CIS - RHEL6 - X.X.X - Disable standard boot services - Kudzu hardware detection Enabled] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
775 d:$rc_dirs -> ^S\d\dkudzu$;
777 [CIS - RHEL6 - X.X.X - Disable standard boot services - PostgreSQL server Enabled {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
778 d:$rc_dirs -> ^S\d\dpostgresql$;
780 [CIS - RHEL6 - X.X.X - Disable standard boot services - MySQL server Enabled {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
781 d:$rc_dirs -> ^S\d\dmysqld$;
783 [CIS - RHEL6 - X.X.X - Disable standard boot services - DNS server Enabled {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
784 d:$rc_dirs -> ^S\d\dnamed$;
786 [CIS - RHEL6 - X.X.X - Disable standard boot services - NetFS Enabled {PCI_DSS: 2.2.2}] [any] [https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0.pdf]
787 d:$rc_dirs -> ^S\d\dnetfs$;