HP-UX 11.31 Security Technical Implementation Guide
- Version/Release: V1R19
- Published: 2019-01-08
-
Expand All:
- Severity:
-
Sort:
Compare
Select any two versions of this STIG to compare the individual requirements
View
Select any old version/release of this STIG to view the previous requirements
- RMF Control
- AC-3
- Severity
- Medium
- CCI
- CCI-000213
- Version
- GEN000020
- Vuln IDs
-
- V-756
- Rule IDs
-
- SV-38318r2_rule
Checks: C-36228r2_chk
Check the /tcb/files/auth/system/default entry. # grep “:d_boot_authenticate” /tcb/files/auth/system/default If the returned entry looks like “:d_boot_authenticate@:”, single user boot authentication is disabled, and this is a finding. For SMSE: Check the setting for BOOT_AUTH is set to N=1. # grep BOOT_AUTH /etc/default/security /var/adm/userdb/* If BOOT_AUTH=0, then single user boot authentication is disabled, and this is a finding.
Fix: F-31487r2_fix
For Trusted Mode: If single user boot authentication is disabled, use the System Administration Manager (SAM) or the System Management Homepage (SMH) to enable single user boot (for root only) authentication. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute. See the below example: BOOT_AUTH=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor."
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000770
- Version
- GEN000280
- Vuln IDs
-
- V-760
- Rule IDs
-
- SV-38441r1_rule
Checks: C-36244r1_chk
Use the last command to check for multiple accesses to an account from different workstations/IP addresses. If users log directly onto accounts, rather than using the su command from their own named account to access them, this is a finding (such as logging directly on to Oracle). Also, ask the SA or the IAO if shared accounts are logged into directly or if users log on to an individual account and switch user to the shared account. # last <unix account>
Fix: F-31501r1_fix
Use the switch user (su) command from a named account login to access shared accounts. Maintain audit trails identifying the actual user of the account name. Document requirements and procedures for users/administrators to log into their own accounts first and then switch user (su) to the account that must be shared.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000764
- Version
- GEN000300
- Vuln IDs
-
- V-761
- Rule IDs
-
- SV-38442r2_rule
Checks: C-36245r4_chk
Verify the consistency of the assigned home directories in the authentication database. For Trusted Mode: # authck -av For SMSE: # pwck If any duplicate account names are found, this is a finding.
Fix: F-31502r2_fix
Determine if the duplicate accounts have the same or different UIDs. # cat /etc/passwd | cut -f 1,1 -d “:” | sort | uniq -d If the UIDs are different, the account name must be changed. If the UIDs are the same, disable/remove one of the two (or more) password file entries via the SAM/SMH interface.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000764
- Version
- GEN000320
- Vuln IDs
-
- V-762
- Rule IDs
-
- SV-38443r2_rule
Checks: C-36246r2_chk
Verify the consistency of the assigned home directories in the authentication database. For Trusted Mode: # authck -av For SMSE: # pwck If a non-unique UID is found in the password file, this is a finding.
Fix: F-31503r2_fix
Determine if the duplicate UIDs are associated with the same or a different account name. # cat /etc/passwd | grep <non-uniqueUID> or, for multiple non-unique UIDs: # cat /etc/passwd | egrep “<non-uniqueUID1>|<non-uniqueUID2>|,non-uniqueUIDn>“ If the account names are unique, the UIDs must also be modified to be unique. If the account names are the same, disable/remove one of the two (or more) password file entries via the SAM/SMH interface. .
- RMF Control
- AC-8
- Severity
- Medium
- CCI
- CCI-000048
- Version
- GEN000400
- Vuln IDs
-
- V-763
- Rule IDs
-
- SV-38444r1_rule
Checks: C-36247r1_chk
NOTE: This will virtually always require a manual review. Access the system console and make a login attempt. Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
Fix: F-31504r1_fix
Edit /etc/issue and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN000440
- Vuln IDs
-
- V-765
- Rule IDs
-
- SV-27082r1_rule
Checks: C-27995r1_chk
List the logged successful logons to determine if successful logons are being logged. # last -R | more List the logged unsuccessful logons to determine if unsuccessful logons are being logged. # lastb -R | more If logs do not contain successful and unsuccessful logins, this is a finding.
Fix: F-31505r1_fix
Verify that login logs are handled correctly in the /etc/syslog.conf file. Verify that service startup scripts for syslog and (w/b)tmp (if present) are enabled. NOTE: Also examine the syslog.conf file for any references to remote log hosts if last/lastb produce no results. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep "\@"
- RMF Control
- AC-7
- Severity
- Medium
- CCI
- CCI-000044
- Version
- GEN000460
- Vuln IDs
-
- V-766
- Rule IDs
-
- SV-38445r3_rule
Checks: C-36249r4_chk
For Trusted Mode: The u_maxtries attribute in the /tcb/files/auth/system/default file controls whether an account is locked after too many consecutive authentication failures. An account is locked after “N” consecutive authentication failures. Check the global setting for “u_maxtries” is set to “N=3”. # grep u_maxtries /tcb/files/auth/system/default If the “u_maxtries” attribute is not set to “3”, this is a finding. For SMSE: The AUTH_MAXTRIES attribute in the /etc/default/security configuration file controls whether an account is locked after too many consecutive authentication failures. An account is locked after N+1 consecutive authentication failures. Check the setting for “AUTH_MAXTRIES” attribute is set to “N=2”. # userdbget -a AUTH_MAXTRIES If the attribute “AUTH_MAXTRIES” is not set to “2”, this is a finding.
Fix: F-31506r3_fix
For Trusted Mode: Use the SAM/SMH interface or edit the /tcb/files/auth/system/default file and update the u_maxtries attribute. See the below example: :u_maxtries#3: If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute. See the below example: AUTH_MAXTRIES=2 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-7
- Severity
- Medium
- CCI
- CCI-002238
- Version
- GEN000480
- Vuln IDs
-
- V-768
- Rule IDs
-
- SV-38446r3_rule
Checks: C-36250r2_chk
For Trusted Mode: Check the t_logdelay setting. # more /tcb/files/auth/system/default Verify the value of the t_logdelay variable. If the value is less than 4, this is a finding. For SMSE: By default, PAM executes a built-in, 3 second standard delay if user authentication fails. This delay cannot be extended. The “nodelay” parameter disables the built-in delay. Ensure that the “nodelay” parameter is not found in the /etc/pam.conf file. The HP-SMSE environment does not meet the failed authentication 4 second minimum delay requirement. This check will always result in a finding.
Fix: F-31507r2_fix
For Trusted Mode: Use the SAM/SMH interface to ensure that the t_logdelay setting is 4. For SMSE: There is no fix, however, there are attack mitigations to minimize risk (see mitigations).
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000520
- Vuln IDs
-
- V-769
- Rule IDs
-
- SV-38447r1_rule
Checks: C-36251r1_chk
NOTE: This will virtually always require a manual review. If there is an application running on the system that is continuously in use (such as a network monitoring application), ask the SA what the name of the application is. Execute ps -ef | more to determine which user owns the process(es) associated with the application. If the owner is root, this is a finding.
Fix: F-31508r1_fix
Configure the system so the owner of a session requiring a continuous screen display, such as a network management display, is not root. Ensure the display is also located in a secure, controlled access area. Document and justify this requirement and ensure the terminal and keyboard for the display (or workstation) are secure from all but authorized personnel by maintaining them in a secure area, in a locked cabinet where a swipe card, or other positive forms of identification, must be used to gain entry.
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- GEN000560
- Vuln IDs
-
- V-770
- Rule IDs
-
- SV-38448r2_rule
Checks: C-36252r2_chk
For Trusted Mode: Verify that user accounts do not have blank passwords. # cd /tcb/files/auth && grep “u_pwd=::” */* If any user account with a blank password is found, this is a finding. For SMSE: Inspect the password (2nd) field in the /etc/shadow file. # cat /etc/shadow If any user account in the /etc/shadow file contains a null password field, this is a finding.
Fix: F-31509r2_fix
For Trusted Mode: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to disable null passwords and immediately expire the password for any account with a null password, forcing the user to create a password on the very next login. Alternatively, the account may also be disabled. Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Verify that SAM/SMH has now disabled null passwords for all accounts. # grep “:u_nullpw@:” /tcb/files/auth/[a-z,A-Z] For SMSE: Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute(s). See the below example: LOGIN_POLICY_STRICT=1 ALLOW_NULL_PASSWORD=0 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor. Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to immediately expire the password for any account with a null password, forcing the user to create a password on the very next login. Alternatively, the account may also be disabled.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000880
- Vuln IDs
-
- V-773
- Rule IDs
-
- SV-38449r1_rule
Checks: C-36271r1_chk
Check the system for duplicate UID 0 assignments by listing all accounts assigned UID 0. # cat /etc/passwd | cut -f 1,3 -d ":" | grep ":0" If any accounts other than root are assigned UID 0, this is a finding.
Fix: F-31528r1_fix
Remove or change the UID of accounts other than root that have UID 0.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN000900
- Vuln IDs
-
- V-774
- Rule IDs
-
- SV-34829r1_rule
Checks: C-36272r1_chk
Determine if root is assigned a home directory other than / by listing its home directory. # cat /etc/passwd | grep "^root" | cut -f 6,6 -d ":" If the root user home directory is /, this is a finding.
Fix: F-31529r1_fix
The root home directory should be something other than / (such as /roothome). # mkdir /rootdir # chown root /rootdir # chgrp root /rootdir # chmod 700 /rootdir # cp -r /.??* /rootdir/. Edit the passwd file and change the root home directory to /rootdir. The cp -r /.??* command copies all files and subdirectories of file names that begin with "." into the new root directory, which preserves the previous root environment. Ensure you are in the "/" directory when executing the "cp" command.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000920
- Vuln IDs
-
- V-775
- Rule IDs
-
- SV-38450r1_rule
Checks: C-36273r1_chk
Check the mode of the root home directory. Procedure: # cat /etc/passwd | grep "^root" | cut -f 6,6 -d ":" # ls -lLd <root home directory> If the mode of the directory is not equal to 0700, this is a finding. If the home directory is /, this check will be marked Not Applicable.
Fix: F-31530r1_fix
The root home directory will have permissions of 0700. Do not change the protections of the / directory. Use the following command to change protections for the root home directory: # chmod 0700 /rootdir.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000940
- Vuln IDs
-
- V-776
- Rule IDs
-
- SV-38451r3_rule
Checks: C-36274r3_chk
To view the root user's PATH, log in as the root user, and execute: # env | grep PATH This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31531r2_fix
Edit the root user's local initialization files and remove any relative path entries that have not been documented with the ISSO. Edit the root user’s local initialization files and remove any empty entry that is defined.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000960
- Vuln IDs
-
- V-777
- Rule IDs
-
- SV-38452r1_rule
Checks: C-36275r1_chk
Check for world-writable permissions on all directories in the root user's executable search path. Procedure: # ls -ld `echo $PATH | sed "s/:/ /g"` If any of the directories in the PATH variable are world-writable, this is a finding.
Fix: F-31532r1_fix
For each world-writable path in root's executable search path, do one of the following: 1. Remove the world-writable permission on the directory. Procedure: # chmod o-w <path> 2. Remove the world-writable directory from the executable search path. Procedure: Identify and edit the initialization file referencing the world-writable directory and remove it from the PATH variable.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000770
- Version
- GEN000980
- Vuln IDs
-
- V-778
- Rule IDs
-
- SV-38453r2_rule
Checks: C-36276r2_chk
Check the /etc/securetty file contents. # more /etc/securetty If /etc/securetty does not exist, or has contents other than console or /dev/null, this is a finding.
Fix: F-31533r3_fix
If the /etc/securetty file does not exist, create the file containing only the word console and ensure correct file properties. # echo “console” > /etc/securetty
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000360
- Vuln IDs
-
- V-780
- Rule IDs
-
- SV-38454r1_rule
Checks: C-36253r3_chk
Confirm all accounts with a GID of 99 and below are used by a system account. If a GID reserved for system accounts (0 - 99) is used by a non-system account, this is a finding. The vendor-supplied system default group "users" (gid=20) is considered an exception to this check. # cat /etc/passwd | cut -f 1,4 -d ":"
Fix: F-31510r1_fix
Change the primary group GID numbers for non-system accounts with reserved primary group GIDs (those less or equal to 99). # usermod -g <new_group> <user>
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN000380
- Vuln IDs
-
- V-781
- Rule IDs
-
- SV-38455r1_rule
Checks: C-36254r1_chk
Determine if any GIDs referenced in /etc/passwd are not defined in /etc/group. Procedure: # cat /etc/passwd | cut -f 4,4 -d ":" | sort | uniq With the above GIDs, manually execute the following command for every GID from above. Note that this command is expected to return line entry information from /etc/group. # grep -n <GID> /etc/group If any GIDs referenced in /etc/passwd and not defined in /etc/group are returned, this is a finding.
Fix: F-31511r2_fix
Add a group to the system (edit /etc/group) for each GID referenced without a corresponding group.
- RMF Control
- SI-4
- Severity
- Medium
- CCI
- CCI-001259
- Version
- GEN006480
- Vuln IDs
-
- V-782
- Rule IDs
-
- SV-35141r1_rule
Checks: C-34998r1_chk
A few applications providing host-based network intrusion protection are: - Dragon Squire by Enterasys Networks - ITA by Symantec - Hostsentry by Psionic Software - Logcheck by Psionic Software - RealSecure agent by ISS - Swatch by Stanford University Ask the SA or IAO if a host-based intrusion detection application is loaded on the system (where <daemon name> is the name of the primary application daemon) to determine if the application is loaded on the system. # find / -name <daemon> | xargs -n1 ls -lL Determine if the application is active on the system. # ps -ef | grep <daemon name> If no host-based intrusion detection system is installed on the system, this is a finding.
Fix: F-32105r1_fix
Install a host-based intrusion detection tool.
- RMF Control
- SI-2
- Severity
- Medium
- CCI
- CCI-001227
- Version
- GEN000120
- Vuln IDs
-
- V-783
- Rule IDs
-
- SV-38456r2_rule
Checks: C-36230r3_chk
Obtain the list of available security patches from HP. Alternatively, obtain, install, and use HP's Patch Tool Bundle to compile a list of superseded patches based on the installed software Product Bundle Patch list(s): # show_patches -s Verify the available security patches have been installed on the system. To list patches installed on the system, use the swlist utility. Example: # swlist -l fileset If there are security patches available and applicable for the system that have not been installed, this is a finding.
Fix: F-31489r2_fix
Use a web browser to access the vendor's support website. Follow the instructions to set up an account with a login and a password. Once this is done it is possible to download the needed patches. Use SMH or # swinstall to apply the patches.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001140
- Vuln IDs
-
- V-784
- Rule IDs
-
- SV-38457r1_rule
Checks: C-36277r1_chk
Check system directories for uneven file permissions. Procedure: # ls -lL /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin Uneven file permissions exist if the file owner has less permissions than the group or other user classes. If any of the files in the above listed directories contain uneven file permissions, this is a finding.
Fix: F-31534r1_fix
Change the mode of files with uneven permissions so owners do not have less permissions than group or world users.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001160
- Vuln IDs
-
- V-785
- Rule IDs
-
- SV-34833r1_rule
Checks: C-290r2_chk
Check the system for files with no assigned owner. Procedure: # find / -nouser -print If any files have no assigned owner, this is a finding.
Fix: F-939r2_fix
All directories and files (executable and data) will have an identifiable owner and group name. Either trace files to an authorized user, change the file's owner to root, or delete them. Determine the legitimate owner of the files and use the chown command to set the owner and group to the correct value. If the legitimate owner cannot be determined, change the owner to root (but make sure none of the changed files remain executable because they could be Trojan horses or other malicious code). Examine the files to determine their origin and the reason for their lack of an owner/group.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001180
- Vuln IDs
-
- V-786
- Rule IDs
-
- SV-38458r1_rule
Checks: C-36301r1_chk
Check the mode of network services daemons. # ls -lLa /usr/lbin If the mode of a network services daemon is more permissive than 0755, this is a finding. NOTE: Network daemons that may not reside in these directories (such as httpd or sshd) must also be checked for the correct permissions.
Fix: F-31556r1_fix
Change the mode of the network services daemon. # chmod 0755 <path>/<daemon>
- RMF Control
- SI-11
- Severity
- Medium
- CCI
- CCI-001314
- Version
- GEN001260
- Vuln IDs
-
- V-787
- Rule IDs
-
- SV-35275r1_rule
Checks: C-36302r1_chk
Check the mode of log files. # ls -lLR /var/log /var/log/syslog /var/adm /var/opt Note that some of the above directories will contain more than just system log files. For example: /var/adm/sa, /var/adm/sw, etc. Any non-system log files contained within the above directories should be excluded from this requirement. If any of the system log files have modes more permissive than 0640, this is a finding.
Fix: F-31557r1_fix
Change the mode of the system log files to 0640 or less permissive. # chmod 0640 <path>/<system-log-file> NOTE: Do not confuse system log files with audit logs.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001800
- Vuln IDs
-
- V-788
- Rule IDs
-
- SV-38459r1_rule
Checks: C-36364r1_chk
Check skeleton files permissions. # ls -alL /etc/skel If a skeleton file has a mode more permissive than 0444, this is a finding.
Fix: F-31701r1_fix
Change the mode of skeleton files with incorrect mode. # chmod 0444 <skeleton file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001320
- Vuln IDs
-
- V-789
- Rule IDs
-
- SV-38460r1_rule
Checks: C-36303r1_chk
Check NIS file ownership. Procedure: # ls -lLa /var/yp/<nis domainname> If the file ownership is not root, sys, or bin, this is a finding.
Fix: F-31558r1_fix
Change the ownership of NIS/NIS+/yp files to root, sys, or bin. Consult vendor documentation to determine the location of the files. Procedure (example): # chown root <filename>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001340
- Vuln IDs
-
- V-790
- Rule IDs
-
- SV-38461r1_rule
Checks: C-36304r3_chk
Check NIS file ownership. # ls -alLR /var/yp/`domainname` If the file group owner is not root, sys, bin (the default), or other, this is a finding.
Fix: F-31559r2_fix
Change the group owner of the NIS files to root, sys, bin, or other. # chgrp root <filename>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001360
- Vuln IDs
-
- V-791
- Rule IDs
-
- SV-38462r1_rule
Checks: C-36305r1_chk
Check NIS file mode. Procedure: # grep -i NIS_DOMAIN /etc/rc.config.d/namesvrs # ls -lLa /var/yp/<NIS_DOMAIN> If the file's mode is more permissive than 0755, this is a finding.
Fix: F-31560r1_fix
Change the mode of NIS/NIS+/yp command files to 0755 or less permissive. Procedure (example): # chmod 0755 <filename>
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001280
- Vuln IDs
-
- V-792
- Rule IDs
-
- SV-38463r2_rule
Checks: C-39552r3_chk
Check the mode of the manual page files. # find `env | grep MANPATH | cut -f 2,2 -d "=" | tr ':' ' ' ` -type f \( -perm -100 -o -perm -030 -o -perm -003 \) -exec ls -al {} + If any manual page file mode is more permissive than 0644, this is a finding.
Fix: F-31561r1_fix
Change the mode of manual page files to 0644 or less permissive. Example: # chmod 0644 <path>/<manpage>
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- GEN001300
- Vuln IDs
-
- V-793
- Rule IDs
-
- SV-38464r1_rule
Checks: C-36307r2_chk
Check the mode of library files. Procedure: # ls -lLR /usr/lib /lib If any of the library files have a mode more permissive than 755, this is a finding.
Fix: F-31562r1_fix
Change the mode of library files to 0755 or less permissive. Procedure (example): # chmod 0755 <path>/<library-file> NOTE: Library files should have an extension of ".a" or ".so" (a=archive, so=shared object) extension, possibly followed by a version number.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- GEN001200
- Vuln IDs
-
- V-794
- Rule IDs
-
- SV-38465r1_rule
Checks: C-36308r1_chk
Check the permissions for files in /etc, /bin, /usr/bin, /usr/lbin, /sbin, and /usr/sbin. # ls -lL /etc /bin /usr/bin /usr/lbin /sbin /usr/sbin If any file listed has a mode more permissive than 755, this is a finding. Note: Elevate to Severity Code I if any file is listed as world-writable.
Fix: F-31563r1_fix
Change the mode for system command files to 755 or less permissive. # chmod 755 <filename>
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- GEN001220
- Vuln IDs
-
- V-795
- Rule IDs
-
- SV-38466r1_rule
Checks: C-36309r1_chk
Check the ownership of system files, programs, and directories. Procedure: # ls -lLa /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin If any of the system files, programs, or directories are not owned by a system account, this is a finding.
Fix: F-31564r1_fix
Change the owner of system files, programs, and directories to a system account. Procedure: # chown root <path>/<system file> (A different system user may be used in place of root.)
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- GEN001240
- Vuln IDs
-
- V-796
- Rule IDs
-
- SV-38467r1_rule
Checks: C-36310r1_chk
Check the group ownership of system files, programs, and directories. Procedure: # ls -lLa /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin If any system file, program, or directory is not owned by a system group, this is a finding.
Fix: F-31565r1_fix
Change the group owner of system files to a system group. Procedure: # chgrp root <path>/<system file> (System groups other than root may be used.)
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001400
- Vuln IDs
-
- V-797
- Rule IDs
-
- SV-38468r2_rule
Checks: C-36330r4_chk
For Trusted Mode: Check the ownership of the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file exists and is not owned by root, this is a finding. NOTE: /etc/shadow should not exist if the system is in Trusted Mode. Check the ownership of the TCB auth files and directories. # ls -lLd /tcb /tcb/files /tcb/files/auth # ls -lL /tcb/files/auth/[a-z,A-Z]/* If the owner of any of the /tcb files and directories is not root, this is a finding. For SMSE: Check the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file exists and is not owned by root, this is a finding.
Fix: F-31585r2_fix
For Trusted Mode: # chown root /tcb # chown root /tcb/files /tcb/files/auth # chown root /tcb/files/auth/[a-z]/* For SMSE: # chown root /etc/shadow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001380
- Vuln IDs
-
- V-798
- Rule IDs
-
- SV-38469r1_rule
Checks: C-36331r1_chk
Check the mode of the /etc/passwd file. Procedure: # ls -lL /etc/passwd If /etc/passwd has a mode more permissive than 0444, this is a finding.
Fix: F-31586r1_fix
Change the mode of the passwd file to 0444. # chmod 0444 /etc/passwd Document all changes.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001420
- Vuln IDs
-
- V-800
- Rule IDs
-
- SV-38470r2_rule
Checks: C-36332r2_chk
For Trusted Mode: Check the TCB auth files and directories. # ls -lLd /tcb /tcb/files /tcp/files/auth # ls -lL /tcb/files/auth/[a-z,A-Z]/* If the mode of /tcb directory is more permissive than 0555, this is a finding. If the mode of /tcb/files or /tcb/files/auth directories is more permissive than 0771, this is a finding. If the mode of any of the /tcb/files/auth/[a-z]/* is more permissive than 0664, this is a finding. For SMSE: Check the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file has a mode more permissive than 0400, this is a finding. NOTE: The /etc/shadow file will not exist if the system is in Trusted Mode.
Fix: F-31587r3_fix
For Trusted Mode: # chmod 0555 /tcb # chmod 0771 /tcb/files /tcb/files/auth # chmod 0664 /tcb/files/auth/[a-z]/* For SMSE: # chmod 0400 /etc/shadow
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000368
- Version
- GEN002380
- Vuln IDs
-
- V-801
- Rule IDs
-
- SV-38471r1_rule
Checks: C-36399r1_chk
Files with the setuid bit set will allow anyone running these files to be temporarily assigned the user or group ID of the file. If an executable with setuid allows shell escapes, the user can operate on the system with the effective permission rights of the user or group owner. List all setuid files on the system. Procedure: # find / -perm -4000 -exec ls -l {} \; | more NOTE: Executing these commands may result in large listings of files; the output may be redirected to a file for easier analysis. Ask the SA or IAO if files with the suid bit set have been documented. If any undocumented file has its suid bit set, this is a finding.
Fix: F-31738r1_fix
Document the files with the suid bit set or unset the suid bit on the executable.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000368
- Version
- GEN002440
- Vuln IDs
-
- V-802
- Rule IDs
-
- SV-34943r1_rule
Checks: C-36401r1_chk
Locate all setgid files on the system. Procedure: # find / -perm -2000 If the ownership, permissions, location, and ACLs of all files with the setgid bit set are not documented, this is a finding.
Fix: F-31740r1_fix
All files with the sgid bit set will be documented in the system baseline and authorized by the Information Systems Security Officer (ISSO). Locate all sgid files with the following command: find / -perm -2000 -exec ls -lL {} \; Ensure sgid files are part of the operating system software, documented application software, documented utility software, or documented locally developed software. Ensure none are text files or shell programs.
- RMF Control
- CM-3
- Severity
- Medium
- CCI
- CCI-000318
- Version
- GEN002400
- Vuln IDs
-
- V-803
- Rule IDs
-
- SV-38472r1_rule
Checks: C-36400r1_chk
NOTE: This will virtually always require a manual review. Determine if a weekly automated or manual process is used to generate a list of suid files on the system and compare it with the prior list. If no such process is in place, this is a finding.
Fix: F-31739r1_fix
Establish a weekly automated or manual process to generate a list of suid files on the system and compare it with the prior list. To create a list of suid files: # find / -perm -4000 > suid-file-list
- RMF Control
- CM-3
- Severity
- Medium
- CCI
- CCI-000318
- Version
- GEN002460
- Vuln IDs
-
- V-804
- Rule IDs
-
- SV-38473r1_rule
Checks: C-36402r1_chk
NOTE: This will virtually always require a manual review. Determine if a weekly automated or manual process is used to generate a list of sgid files on the system and compare it with the prior list. If no such process is in place, this is a finding.
Fix: F-31741r1_fix
Establish a weekly automated or manual process to generate a list of sgid files on the system and compare it with the prior list. To create a list of sgid files: # find / -type f -perm -2000 -exec ls -lL {} \; >> sgid-file-list
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002420
- Vuln IDs
-
- V-805
- Rule IDs
-
- SV-34946r1_rule
Checks: C-36403r1_chk
Check /etc/fstab and verify the nosuid mount option is used on file systems mounted from removable media, network shares, or any other file system not containing approved setuid or setgid files. Each file system line entry must contain a device specific file and may additionally contain all of the following fields, in the following order: mount directory, type, options, backup frequency, pass number (on parallel fsck) and comment. # cat /etc/fstab | grep -v "^#" If the "nosuid" mount option is not used on file systems mounted from removable media, network shares, or any other file system that does not contain approved setuid or setgid files, this is a finding.
Fix: F-31742r1_fix
Edit /etc/fstab and add the nosuid mount option to all file systems mounted from removable media or network shares, and any file system not containing approved setuid or setgid files.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN002500
- Vuln IDs
-
- V-806
- Rule IDs
-
- SV-38474r1_rule
Checks: C-36405r1_chk
Verify all world-writable directories have the sticky bit set. Procedure: # find / -type d -perm -002 ! -perm -1000 -exec ls -lLd {} \; | tee wwlist If the sticky bit is not set on a world-writable directory, this is a finding.
Fix: F-31743r1_fix
Set the sticky bit on all public directories. Procedure: # chmod 1777 <world writeable directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002520
- Vuln IDs
-
- V-807
- Rule IDs
-
- SV-34950r1_rule
Checks: C-36406r1_chk
Check the ownership of all public directories. Procedure: # find / -type d -perm -1002 -exec ls -ld {} \; If any public directory is not owned by root or an application user, this is a finding.
Fix: F-31744r1_fix
Change the owner of public directories to root or an application account. Procedure: # chown root <public directory>
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002560
- Vuln IDs
-
- V-808
- Rule IDs
-
- SV-38475r1_rule
Checks: C-36407r1_chk
Check global initialization files for the configured umask value. # grep umask /etc/* | grep -v ":#" | grep "umask [0-9]" Check local initialization files for the configured umask value. Procedure: # grep umask /userhomedirectory/.* If the system and user default umask is not 077, this is a finding. NOTE: If the default umask is 000 or allows for the creation of world-writable files this becomes a Severity Code I (CAT I) finding.
Fix: F-31745r1_fix
Edit local and global initialization files containing umask and change them to use 077 instead of the current value.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000178
- Version
- GEN002640
- Vuln IDs
-
- V-810
- Rule IDs
-
- SV-27264r2_rule
Checks: C-36408r2_chk
Account/password locking is typically accomplished with the asterisk (*). System logins that never had a password use a double exclamation mark (!!) and accounts that have been locked have the valid password entry invalidated by a single exclamation mark (!) prefix. For Trusted Mode: Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Next check if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled. # grep “u_pwd=“ /tcb/files/auth/[a-z,A-Z]/* If any default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have not been disabled, this is a finding. For SMSE: Check if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled. # cat /etc/shadow If any default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have not been disabled, this is a finding.
Fix: F-31746r2_fix
For Trusted Mode and SMSE: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to lock/disable or remove any enabled default system accounts.
- RMF Control
- AU-12
- Severity
- Medium
- CCI
- CCI-000169
- Version
- GEN002660
- Vuln IDs
-
- V-811
- Rule IDs
-
- SV-38476r1_rule
Checks: C-36409r1_chk
Determine if auditing is enabled. # audsys If the audit service is not running, this is a finding.
Fix: F-31747r1_fix
Turn on the auditing system. The system will use existing current and next audit trails (if configured). # audsys -n Alternatively, use the HP SMH to configure and enable auditing on the system.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000162
- Version
- GEN002680
- Vuln IDs
-
- V-812
- Rule IDs
-
- SV-38477r2_rule
Checks: C-36424r2_chk
Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following: PRI_AUDFILE=/var/.audit/file1 SEC_AUDFILE=/var/.audit/file2 # egrep “PRI_AUDFILE|SEC_AUDFILE” /etc/rc.config.d/auditing For each audit log directory/file, check the ownership. # ls -lLd <audit directory> # ls -lLa <audit file> If any audit log directory/file is not owned by root, this is a finding.
Fix: F-31763r2_fix
As root, change the ownership. # chown root <audit directory> # chown root <audit file>
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000163
- Version
- GEN002700
- Vuln IDs
-
- V-813
- Rule IDs
-
- SV-38478r2_rule
Checks: C-36425r2_chk
Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following: PRI_AUDFILE=/var/.audit/file1 SEC_AUDFILE=/var/.audit/file2 # egrep “PRI_AUDFILE|SEC_AUDFILE” /etc/rc.config.d/auditing For each audit log directory/file, check the permissions. # ls -lLd <audit directory> # ls -lLa <audit file> If any audit log file has permissions greater than 0640 (0750 for directories), this is a finding.
Fix: F-31764r2_fix
As root, change the permissions. # chmod 0750 <audit directory> # chmod 0640 <audit file>
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN002720
- Vuln IDs
-
- V-814
- Rule IDs
-
- SV-38479r1_rule
Checks: C-36426r1_chk
Check the system audit configuration to determine if failed attempts to access files and programs are audited. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep open If no results are returned, this is a finding.
Fix: F-31765r1_fix
Edit /etc/rc.config.d/auditing and add -e open to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN002740
- Vuln IDs
-
- V-815
- Rule IDs
-
- SV-38480r1_rule
Checks: C-36427r1_chk
Check the system audit configuration to determine if failed attempts to access files and programs are audited. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep delete If no results are returned, this is a finding.
Fix: F-31766r1_fix
Edit /etc/rc.config.d/auditing and add -e delete to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-000347
- Version
- GEN002760
- Vuln IDs
-
- V-816
- Rule IDs
-
- SV-38481r1_rule
Checks: C-36428r1_chk
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin # grep -i audevent_args1 /etc/rc.config.d/auditing | grep removable If no results are returned for either of these commands, this is a finding.
Fix: F-31767r1_fix
Edit /etc/rc.config.d/auditing and add -e admin and -e removable to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN002800
- Vuln IDs
-
- V-818
- Rule IDs
-
- SV-38482r1_rule
Checks: C-36429r1_chk
Check the system's audit configuration. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep login If no results are returned, this is a finding.
Fix: F-31768r1_fix
Edit /etc/rc.config.d/auditing and add -e login to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN002820
- Vuln IDs
-
- V-819
- Rule IDs
-
- SV-38483r1_rule
Checks: C-36430r1_chk
Check the system's audit configuration. The term moddac is code for MODify Dicscretionary Access Control (i.e., chown, chmod, etc.). # grep -i audevent_args1 /etc/rc.config.d/auditing | grep moddac If no results are returned, this is a finding.
Fix: F-31769r1_fix
Edit /etc/rc.config.d/auditing and add -e moddac to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003720
- Vuln IDs
-
- V-821
- Rule IDs
-
- SV-35067r1_rule
Checks: C-34933r1_chk
Check the ownership of the xinetd.d directory, the (x)inetd.conf file and any files identified by the configuration file includedir stanza. # find / -type d -name xinetd.d | xargs -n1 ls -lLd # find / -type f -name inetd.conf -o -name xinetd.conf | xargs -n1 ls -lL # grep includedir <PATH>/xinetd.conf If any of the above named files, included files or directories are not owned by root or bin, this is a finding.
Fix: F-30239r1_fix
Change the ownership of the inetd.conf file to root or bin. # chown root <file or directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003740
- Vuln IDs
-
- V-822
- Rule IDs
-
- SV-35072r1_rule
Checks: C-34936r1_chk
Check the mode of the (x)inetd.conf file and any files identified by the configuration file includedir stanza: # find / -type f -name inetd.conf -o -name xinetd.conf | xargs -n1 ls -lL # grep includedir <PATH>/xinetd.conf # ls -lL <includedir files from previous command> If any of the above file mode are more permissive than 0440, this is a finding.
Fix: F-30242r1_fix
Change the mode of the (x)inetd.conf file. # chmod 0440 <file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003760
- Vuln IDs
-
- V-823
- Rule IDs
-
- SV-35077r1_rule
Checks: C-34941r1_chk
Check the ownership of the services file. NOTE: The typical ownership of the services file is bin. # ls -lL /etc/services If the services file is not owned by root or bin, this is a finding.
Fix: F-30246r1_fix
Change the ownership of the services file to root or bin. # chown root /etc/services
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003780
- Vuln IDs
-
- V-824
- Rule IDs
-
- SV-35078r1_rule
Checks: C-34942r1_chk
Check the mode of the services file. NOTE: The typical default mode of the services file is 0444. # ls -lL /etc/services If the services file has a mode more permissive than 0444, this is a finding.
Fix: F-30247r1_fix
Change the mode of the services file to 0444 or less permissive. # chmod 0444 /etc/services
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN001780
- Vuln IDs
-
- V-825
- Rule IDs
-
- SV-38484r1_rule
Checks: C-36365r1_chk
Check global initialization files for the presence of mesg -n or mesg n. Procedure: # grep "mesg" /etc/.login /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc If global initialization files exist and do not contain mesg -n or mesg n, this is a finding.
Fix: F-31702r1_fix
Edit /etc/profile or another global initialization script, and add the mesg -n command.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN003900
- Vuln IDs
-
- V-827
- Rule IDs
-
- SV-35140r1_rule
Checks: C-34997r1_chk
Look for the presence of a print service configuration file. The hosts.lpd file is not used on HP, only inetd.sec, hosts.equiv, and/or the system (lp) .rhosts will apply. When rlpdaemon is started via inetd, access control is provided via the fileinetd.sec to allow or prevent a host from making print requests. When rlpdaemon is started at boot via a run command file, all requests must come from one of the machines listed in the file /etc/hosts.equiv or /var/spool/lp/.rhosts. Procedure: First, determine the rlpdaemon startup method: 1) Print services started via inetd? # cat /etc/inetd.conf | grep -v "^#" | grep -c rlpdaemon If the above command return value is 1, check the services file. # cat /etc/services | grep -v "^#" | grep printer | grep -c spooler If the above command return value is 1, check the inetd.sec file. # cat /var/adm/inetd.sec | grep -v "^#" | tr '\011' ' ' | tr -s ' ' | grep printer | grep allow | grep -c "\+" If the above command return value is 1, this is a finding. 2) The rlpdaemon is started as a service, and not via inetd. Verify neither the /etc/hosts.equiv nor /var/spool/lp/.rhosts contains a "+": # cat /etc/hosts.equiv | grep -v "^#" | grep -c "\+" # cat /var/spool/lp/.rhosts | grep -v "^#" | grep -c "\+" If the return value of either of the above two command(s) is 1, this is a finding. If none of the files are found, this check should be marked not a finding. Otherwise, examine the configuration file. # more <print service file> Check for entries containing a "+" or "_" character. If any are found, this is a finding.
Fix: F-30292r1_fix
Remove the "+" entries from the hosts.lpd (or equivalent) file.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003920
- Vuln IDs
-
- V-828
- Rule IDs
-
- SV-35143r1_rule
Checks: C-35001r1_chk
Locate any print service configuration file(s) on the system. HP vendor documentation identifies the following names and locations of print service configuration files on the system that can be checked via the following commands: # ls -lL /var/spool/lp/.rhosts # ls -lL /var/adm/inetd.sec # ls -lL /etc/hosts.equiv If no print service configuration file is found, this is not a finding. Check the ownership of the print service configuration file(s). # ls -lL <print service configuration file> If the owner of the file is not root, sys, bin, or lp, this is a finding.
Fix: F-30294r1_fix
Change the owner of the /etc/hosts.lpd file (or equivalent) to root, lp, or another privileged UID. # chown root <print service configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003940
- Vuln IDs
-
- V-829
- Rule IDs
-
- SV-35148r1_rule
Checks: C-35005r1_chk
Locate any print service configuration file(s) on the system. HP vendor documentation identifies the following names and locations of print service configuration files on the system that can be checked via the following commands: # ls -lL /var/spool/lp/.rhosts # ls -lL /var/adm/inetd.sec # ls -lL /etc/hosts.equiv If no print service configuration file is found, this is not a finding. Check the mode of the print service configuration file. # ls -lL <print service configuration file> If the mode of the print service configuration file is more permissive than 0644, this is a finding.
Fix: F-30299r1_fix
Change the mode of the /etc/hosts.lpd file (or equivalent) to 0644 or less permissive. Procedure: # chmod 0644 <print service configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004360
- Vuln IDs
-
- V-831
- Rule IDs
-
- SV-35161r1_rule
Checks: C-35014r1_chk
Find the aliases file on the system and check the ownership. # ls -lL /etc/mail/aliases If the file is not owned by root, this is a finding.
Fix: F-30308r1_fix
Change the owner of the /etc/mail/aliases file (or equivalent) to root. # chown root /etc/mail/aliases
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004380
- Vuln IDs
-
- V-832
- Rule IDs
-
- SV-35165r1_rule
Checks: C-35017r1_chk
Find the aliases file on the system. Procedure: # ls -lL /etc/mail/aliases If the aliases file exists with a mode more permissive than 0644, this is a finding.
Fix: F-30311r1_fix
Change the mode of the aliases file (or equivalent) to 0644. # chmod 0644 /etc/mail/aliases
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN004400
- Vuln IDs
-
- V-833
- Rule IDs
-
- SV-35169r1_rule
Checks: C-35019r1_chk
Examine the aliases file for any utilized directories or paths. # cat/etc/mail/aliases | cut -f 2,2 -d ":" | grep "|" For example, the alias file entry will look like: msgs: "|/usr/bin/msgs -s" The entry must be an absolute path name: # ls -lLd `dirname <entry>` # ls -lL <entry> If the file or parent directory is not owned by root, this a finding.
Fix: F-30312r1_fix
Edit the /etc/mail/aliases file Locate the entries executing a program. They will appear similar to the following line: alias: "|/usr/local/bin/ls" (or some other program name) Ensure root owns the programs and the directory(ies) they reside in by using the chown command to change owner to root. For a directory entry: # chown root <entry> For a file entry (change BOTH the directory and file, where/as necessary: # chown root <entry> # chown root `dirname <entry>`
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004420
- Vuln IDs
-
- V-834
- Rule IDs
-
- SV-35043r1_rule
Checks: C-36562r1_chk
Examine the aliases file on the system for any utilized directories or paths. # cat /etc/mail/aliases | cut -f 2,2 -d ":" | grep "|" Check the permissions for any file paths referenced. # ls -lL <path/file> If any file referenced from the aliases file has a mode more permissive than 0755, this is a finding.
Fix: F-31930r1_fix
Use the chmod command to change the access permissions for files executed from the aliases file. For example: # chmod 0755 <path/file>
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN004440
- Vuln IDs
-
- V-835
- Rule IDs
-
- SV-35047r1_rule
Checks: C-36564r1_chk
The sendmail.cf log level option line will typically appear as follows: O LogLevel=N Check if Sendmail logging is set to level 9 via the following command: # cat /etc/mail/sendmail.cf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ grep -i loglevel | tr '\011' ' ' | tr -d ' ' | cut -f 2,2 -d "=" If logging is not set, i.e., line is missing or commented, this is a finding. If logging is set to less than 9, this is a finding.
Fix: F-31932r1_fix
Edit the sendmail.cf file, locate the entry (and where necessary uncomment it and/or create it) and modify/set it to 9.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN004460
- Vuln IDs
-
- V-836
- Rule IDs
-
- SV-35051r1_rule
Checks: C-36565r1_chk
The syslog.conf file critical mail logging option line will typically appear as one of the following examples: mail.crit /var/adm/messages mail.* /var/adm/messages *.* /var/adm/messages *.crit /var/adm/messages Check the syslog configuration file for mail.crit logging configuration. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | egrep -i "mail.crit|mail.\*|\*.crit|\*.\*" If syslog is not configured to log critical sendmail messages, this is a finding.
Fix: F-31933r1_fix
Edit the syslog.conf file and add a configuration line specifying an appropriate destination for critical "mail" syslogs, for example: mail.crit /var/adm/messages mail.* /var/adm/messages *.* /var/adm/messages *.crit /var/adm/messages
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004480
- Vuln IDs
-
- V-837
- Rule IDs
-
- SV-35053r1_rule
Checks: C-36566r1_chk
Locate any Sendmail log files by checking the syslog configuration file. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ egrep -i "mail.info|mail.debug|mail.\*|\*.info|\*.debug|\*.\*" | cut -f 2,2 -d " " | uniq | xargs -n1 ls -lL Identify any log files configured for the "mail" service at any severity level, or those configured for all services. Check the ownership of these log files. If any mail log file is not owned by root, this is a finding.
Fix: F-31934r1_fix
Change the ownership of the sendmail log file. # chown root <sendmail log file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004500
- Vuln IDs
-
- V-838
- Rule IDs
-
- SV-35058r1_rule
Checks: C-36567r1_chk
Check the mode of the SMTP service log file. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | egrep -i "mail.info|mail.debug|mail.\*|\*.info|\*.debug|\*.\*" | cut -f 2,2 -d " " | uniq | xargs -n1 ls -lL Check the configuration to determine which log files contain logs for mail. # ls -lL <sendmail log file> If any Sendmail log file permissions are greater than 0644, this is a finding.
Fix: F-31935r1_fix
Change the mode of the SMTP service log file. # chmod 0644 <sendmail log file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004880
- Vuln IDs
-
- V-840
- Rule IDs
-
- SV-35102r1_rule
Checks: C-36582r1_chk
Check for the existence of the ftpusers file. This file is normally located in the /etc/ftpd directory. # ls -lL /etc/ftpd/ftpusers OR alternatively # find / -type f -name ftpusers -exec ls -lL {} \; If the ftpusers file does not exist, this is a finding.
Fix: F-31950r1_fix
Create a /etc/ftpd/ftpusers (or equivalent) file containing a list of /etc/passwd accounts not authorized for FTP.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004900
- Vuln IDs
-
- V-841
- Rule IDs
-
- SV-35103r1_rule
Checks: C-36583r1_chk
Check the contents of the ftpusers file. # more /etc/ftpd/ftpusers OR alternatively # find / -type f -name ftpusers -exec ls -lL {} \; If the system has accounts not allowed to use FTP and not listed in the ftpusers file, this is a finding.
Fix: F-31951r1_fix
Add accounts not allowed to use FTP to the /etc/ftpd/ftpusers (or equivalent) file.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004920
- Vuln IDs
-
- V-842
- Rule IDs
-
- SV-38485r1_rule
Checks: C-36584r1_chk
Check the ownership of the ftpusers file. # ls -lL /etc/ftpd/ftpusers If the ftpusers file is not owned by root, this is a finding.
Fix: F-31952r1_fix
Change the owner of the ftpusers file to root. # chown root /etc/ftpd/ftpusers
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004940
- Vuln IDs
-
- V-843
- Rule IDs
-
- SV-38486r1_rule
Checks: C-36586r1_chk
Check the permissions of the ftpusers file. # ls -lL /etc/ftpd/ftpusers If the ftpusers file has a mode more permissive than 0640, this is a finding.
Fix: F-31954r1_fix
Change the mode of the ftpusers file to 0640. # chmod 0640 /etc/ftpd/ftpusers
- RMF Control
- AU-3
- Severity
- Low
- CCI
- CCI-000130
- Version
- GEN004980
- Vuln IDs
-
- V-845
- Rule IDs
-
- SV-38995r1_rule
Checks: C-37978r2_chk
Perform: # grep ftpd /etc/inetd.conf Check the line for ftpd to see if the -v options are invoked. If not, this is a finding.
Fix: F-33221r1_fix
The v option enables more verbose logging, shows the accessed file names, and the logout timestamp. The syslog.conf file must be configured to log daemon.info and daemon.debug to a proper log file in which to capture the data. The output goes into the system log file. The log file is /var/adm/syslog. Edit the inetd.conf file. Locate the line that defines ftpd by typing /ftpd/cr. Add the v option where ftpd appears to the right of the pathname for ftpd. For instance: ftp stream tcp nowait root /usr/sbin/in.ftpd in.ftpd -v This is a requirement even when the system is using TCP_WRAPPERS and/or secure shell. The only time it is not a requirement is if the ftp daemon is not configured to run.
- RMF Control
- AC-22
- Severity
- Medium
- CCI
- CCI-001475
- Version
- GEN004820
- Vuln IDs
-
- V-846
- Rule IDs
-
- SV-35100r1_rule
Checks: C-36580r2_chk
Attempt to log in with anonymous or ftp. The user can type any string of characters as a password. (By convention, the password is the host name of the user's host or the user's email address.) The anonymous user is then given access only to user ftp's home directory, usually called /home/ftp. If the login is successful, this is a finding.
Fix: F-31948r2_fix
Configure the FTP service to not permit anonymous logins. Remove the user(s) ftp and/or anonymous from the /etc/passwd file.
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- GEN005080
- Vuln IDs
-
- V-847
- Rule IDs
-
- SV-35110r1_rule
Checks: C-36593r1_chk
Determine if the TFTP daemon is installed, started, and running in secure mode. # cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | cut -f 6,7 -d " " | grep -i tftp If the tftpd process is not configured with exactly one path argument (example: "/usr/lbin/tftpd tftpd"), this is a finding.
Fix: F-31960r1_fix
Edit /etc/inetd.conf and add one path argument, representing the TFTP root directory, to the tftpd command.
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN005100
- Vuln IDs
-
- V-848
- Rule IDs
-
- SV-35155r1_rule
Checks: C-36594r1_chk
Check the mode of the TFTP daemon. # ls -lL /usr/lbin/tftpd If the mode of the file is more permissive than 0755, this is a finding.
Fix: F-31961r1_fix
Change the mode of the TFTP daemon. # chmod 0755 /usr/lbin/tftpd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005120
- Vuln IDs
-
- V-849
- Rule IDs
-
- SV-35157r1_rule
Checks: C-715r2_chk
Check the /etc/passwd file to determine if TFTP is configured properly. Procedure: # grep tftp /etc/passwd If a TFTP user account does not exist and TFTP is active, this is a finding. Check the user shell for the TFTP user. If it is not /bin/false or equivalent, this is a finding. Check the home directory assigned to the TFTP user. If no home directory is set, or the directory specified is not dedicated to the use of the TFTP service, this is a finding.
Fix: F-31962r1_fix
Create a tftp user account if none exists. Assign a non-login shell to the tftp user account, such as /usr/bin/false. Assign/create the tftp user account home directory where/as necessary. Ensure the home directory is owned by the tftp user.
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000297
- Version
- GEN005160
- Vuln IDs
-
- V-850
- Rule IDs
-
- SV-35160r1_rule
Checks: C-36598r1_chk
Check for .Xauthority files being utilized by looking for such files in the home directory of a user using X. Get a list of (non-system account) users and the associated home directories. # cat /etc/passwd | cut -f 1,6 -d ":" Inspect individual user home directories for the .Xauthority file. # find <f6 from the above command> -type f -name "\.Xauthority" -exec ls -lLa {} \; If the .Xauthority file does not exist, ask the SA if the user is using X Windows. If the user is utilizing X Windows and the .Xauthority file does not exist, this is a finding.
Fix: F-31964r1_fix
Ensure the X Windows host is configured to write .Xauthority files into user home directories. Edit the file. Ensure the line writing the .Xauthority file is uncommented.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001435
- Version
- GEN006400
- Vuln IDs
-
- V-867
- Rule IDs
-
- SV-38487r1_rule
Checks: C-36720r1_chk
Perform the following to determine if NIS is active on the system. # ps -ef | grep -v grep | egrep "ypbind|ypserv" If NIS is found active on the system, this is a finding.
Fix: F-32102r1_fix
Disable the use of NIS. Possible replacements are NIS+ and LDAP-UX.
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001440
- Vuln IDs
-
- V-899
- Rule IDs
-
- SV-38488r2_rule
Checks: C-36333r3_chk
Verify the consistency of the assigned home directories in the authentication database. For Trusted Mode: # authck -av If any user is not assigned a home directory, this is a finding. For SMSE: # pwck If any user is not assigned a home directory, this is a finding.
Fix: F-31588r2_fix
For Trusted Mode: Determine why the user is not assigned a home directory. Possible actions include: account deletion or disablement. If the account is determined to be valid, manually create the home directory if required (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) and assign to the user in the /etc/passwd file or take corrective action via the HP SMH/SAM utility. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Determine why the user is not assigned a home directory. Possible actions include: account deletion or disablement. If the account is determined to be valid, manually create the home directory if required (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) and assign to the user in the /etc/passwd file or take corrective action via the HP SMH/SAM utility. Additionally, use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the ABORT_LOGIN_ON_MISSING_HOMEDIR attribute. See the below example: ABORT_LOGIN_ON_MISSING_HOMEDIR=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001460
- Vuln IDs
-
- V-900
- Rule IDs
-
- SV-38489r2_rule
Checks: C-36334r3_chk
Verify the consistency of the assigned home directories in the authentication database. For Trusted Mode: # authck -av If any assigned home directory does not exist, this is a finding. For SMSE: # pwck If any assigned home directory does not exist, this is a finding.
Fix: F-31589r2_fix
Determine why the user home directory does not exist. Possible actions include: account deletion or disablement. If the account is determined to be valid, create the home directory either manually (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) or via the HP SMH/SAM utility.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001480
- Vuln IDs
-
- V-901
- Rule IDs
-
- SV-34870r1_rule
Checks: C-36335r1_chk
Check the home directory mode of each user in /etc/passwd. Procedure: # ls -lLd `cat /etc/passwd | cut -f 6,6 -d ":"` | more If a user's home directory mode is more permissive than 0750, this is a finding. NOTE: Application directories are allowed to and may need 0755 permissions (or greater) for correct operation.
Fix: F-31590r1_fix
Change the mode of user's home directory to 0750 or less permissive. Procedure (example): # chmod 0750 <home directory> NOTE: Application directories are allowed to and may need 0755 permissions (or greater) for correct operation.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001500
- Vuln IDs
-
- V-902
- Rule IDs
-
- SV-38490r1_rule
Checks: C-36336r1_chk
Check the ownership of each user home directory listed in the /etc/passwd file. Procedure: # ls -lLd <user home directory> OR # ls -lLd `cat /etc/passwd | cut -f 6,6 -d ":"` | more If any user home directory is not owned by the assigned user, this is a finding.
Fix: F-31591r1_fix
Change the owner of a user's home directory to its assigned user. Procedure: # chown <user> <home directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001520
- Vuln IDs
-
- V-903
- Rule IDs
-
- SV-38491r1_rule
Checks: C-36337r1_chk
Check the group ownership for each user in the /etc/passwd file. Procedure: # ls -lLd <user home directory> OR # ls -lLd `cat /etc/passwd | cut -f 6,6 -d ":"` | more If any user home directory is not group-owned by the assigned user's primary group, this is a finding. Home directories for application accounts requiring different group ownership must be documented using site-defined procedures.
Fix: F-31592r1_fix
Change the group-owner for user home directories to the primary group of the assigned user. Procedure: # chgrp groupname directoryname (Replace examples with appropriate group and home directory.) Document all changes.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001860
- Vuln IDs
-
- V-904
- Rule IDs
-
- SV-38492r1_rule
Checks: C-36366r2_chk
Check the ownership of local initialization files. Procedure: # ls -alL /<usershomedirectory>/.login # ls -alL /<usershomedirectory>/.cshrc # ls -alL /<usershomedirectory>/.logout # ls -alL /<usershomedirectory>/.profile # ls -alL /<usershomedirectory>/.bash_profile # ls -alL /<usershomedirectory>/.bashrc # ls -alL /<usershomedirectory>/.bash_logout # ls -alL /<usershomedirectory>/.env # ls -alL /<usershomedirectory>/.dtprofile # ls -alL /<usershomedirectory>/.dispatch # ls -alL /<usershomedirectory>/.emacs # ls -alL /<usershomedirectory>/.exrc # find /<usershomedirectory>/.dt ! -fstype nfs ! -user <username> -exec ls -ld {} \; If local initialization files are not owned by the home directory's user or root, this is a finding.
Fix: F-31703r1_fix
Change the ownership of the startup and login files in the user's directory to the user or root, as appropriate. Examine each user's home directory and verify all filenames beginning with "." are owned by the owner of the directory or root. If they are not, use the chown command to change the owner to the user and research the reasons why the owners were not assigned as required.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001880
- Vuln IDs
-
- V-905
- Rule IDs
-
- SV-38493r1_rule
Checks: C-36367r1_chk
Check the modes of local initialization files. Procedure: # ls -alL /<usershomedirectory>/.login # ls -alL /<usershomedirectory>/.cschrc # ls -alL /<usershomedirectory>/.logout # ls -alL /<usershomedirectory>/.profile # ls -alL /<usershomedirectory>/.bash_profile # ls -alL /<usershomedirectory>/.bashrc # ls -alL /<usershomedirectory>/.bash_logout # ls -alL /<usershomedirectory>/.env # ls -alL /<usershomedirectory>/.dtprofile (permissions should be 0755) # ls -alL /<usershomedirectory>/.dispatch # ls -alL /<usershomedirectory>/.emacs # ls -alL /<usershomedirectory>/.exrc # find /<usershomedirecotory>/.dt ! -fstype nfs \( -perm -0002 -o -perm -0020 \) -exec ls -ld {} \; (permissions not to be more permissive than 0755) If local initialization files are more permissive than 0740, the .dt directory is more permissive than 0755, or the .dtprofile file is more permissive than 0755, this is a finding.
Fix: F-31704r1_fix
Ensure user startup files have permissions of 0740 or more restrictive. Examine each user's home directory and verify all file names beginning with "." have access permissions of 0740 or more restrictive. If they do not, use the chmod command to correct the vulnerability. Procedure: # chmod 0740 .filename NOTE: The period is part of the file name and is required.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001580
- Vuln IDs
-
- V-906
- Rule IDs
-
- SV-38494r1_rule
Checks: C-36338r1_chk
Verify run control scripts have no extended ACLs. # ls -lLa /sbin/init.d/[a-z,A-Z,0-9]* If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31593r1_fix
Ensure all system startup files have mode 0755 or less permissive. Examine the rc files, all files in the rc1.d (rc2.d, and so on) directories, and in the /etc/init.d directory to ensure they are not world-writable. If they are world-writable, use the chmod command to correct the vulnerability, and research why they are world-writable. # chmod 755 startupfile
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001600
- Vuln IDs
-
- V-907
- Rule IDs
-
- SV-38495r3_rule
Checks: C-36339r3_chk
Verify the run control scripts search paths do not contain references to the current working directory or other relative paths that have not been authorized by the ISSO. # grep "PATH" /sbin/init.d/[a-z,A-Z,0-9]* | grep -v "_PATH" This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31594r2_fix
Edit the run control script and remove the relative path entries from the executable search path variable that are not documented with the ISSO. Edit the run control script and remove any empty entry that is defined.
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN001640
- Vuln IDs
-
- V-910
- Rule IDs
-
- SV-38496r2_rule
Checks: C-402r9_chk
Check the permissions on the files or scripts executed from system startup scripts to see if they are world-writable. Create a list of all potential run command level scripts. # ls -l /etc/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " " OR # ls -l /sbin/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " " Create a list of world writeable files. # find / -perm -002 -type f >> worldWriteableFileList Determine if any of the world writeable files in worldWriteableFileList are called from the run command level scripts. Note: Depending upon the number of scripts vs world writeable files, it may be easier to inspect the scripts manually. # more `ls -l /etc/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " "` OR # more `ls -l /sbin/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " "` If any system startup script executes any file or script that is world-writable, this is a finding.
Fix: F-1064r2_fix
Remove the world-writable permission from programs or scripts executed by run control scripts. Procedure: # chmod o-w <program or script executed from run control script>
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000196
- Version
- GEN002000
- Vuln IDs
-
- V-913
- Rule IDs
-
- SV-38499r1_rule
Checks: C-36369r1_chk
Check the system for the existence of any .netrc files. Procedure: # find / -name .netrc If any .netrc file exists, this is a finding.
Fix: F-31706r1_fix
Remove the .netrc file(s). Procedure: # rm .netrc
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001540
- Vuln IDs
-
- V-914
- Rule IDs
-
- SV-38497r1_rule
Checks: C-36340r5_chk
For each user in the /etc/passwd file, check for the presence of files and directories within the user's home directory that are not owned by the home directory owner. # find /<usershomedirectory> ! -fstype nfs ! -user <username> ! \( -name .login -o -name .cshrc -o -name .logout -o -name .profile -o -name .bash_profile -o -name .bashrc -o -name .env -o -name .dtprofile -o -name .dispatch -o -name .emacs -o -name .exrc \) -exec ls -ld {} \; Or # ls -lLR `cat /etc/passwd | cut -f 6,6 -d ":"` | more If user home directories contain files or directories not owned by the home directory owner, this is a finding.
Fix: F-31595r1_fix
Change the ownership of files and directories in user home directories to the owner of the home directory. Procedure: # chown <account-owner> <filename>
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001560
- Vuln IDs
-
- V-915
- Rule IDs
-
- SV-38498r1_rule
Checks: C-36341r5_chk
For each user in the /etc/passwd file, check for files and directories with a mode more permissive than 0750. NOTE the following exclusions/exemptions: HP installed users "hpsmh" and "cimsrvr". Note that some home directories "may" restrict access to their files. # find /<usershomedirectory> ! -fstype nfs ! \( -name .login -o -name .cshrc -o -name .logout -o -name .profile -o -name .bash_profile -o -name .bbashrc -o -name .env -o -name .dtprofile -o -name .dispatch -o -name .emacs -o -name .exrc \) \( -perm -0001 -o -perm -0002 -o -perm -0004 -o -perm -0020 -o -perm -2000 -o -perm -4000 \) -exec ls -ld {} \; Or # ls -lLR `cat /etc/passwd | cut -f 6,6 -d ":"` | more If user home directories contain files or directories more permissive than 0750, this is a finding.
Fix: F-31596r1_fix
Change the mode of files and directories within user home directories to 0750. Procedure: # chmod 0750 filename Document all changes.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002120
- Vuln IDs
-
- V-916
- Rule IDs
-
- SV-34952r1_rule
Checks: C-36410r1_chk
Verify /etc/shells exists. # ls -l /etc/shells If the file does not exist, this is a finding.
Fix: F-31748r1_fix
Create /etc/shells file containing a list of valid system shells. Consult vendor documentation for an appropriate list of system shells. Procedure: Typical installed shells include: /sbin/sh /usr/bin/sh /usr/bin/rsh /usr/bin/ksh /usr/bin/rksh /usr/bin/csh /usr/bin/keysh # echo "/sbin/sh" >> /etc/shells (Repeat as necessary for all existing shell programs.)
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002140
- Vuln IDs
-
- V-917
- Rule IDs
-
- SV-34953r1_rule
Checks: C-36411r1_chk
Confirm the login shells referenced in the /etc/passwd file are listed in the /etc/shells file. Procedure: # more /etc/passwd # more /etc/shells The /usr/bin/false, /bin/false, /dev/null, /sbin/nologin, (and equivalents), and sdshell will be considered valid shells for use in the /etc/passwd file, but will not be listed in the /etc/shells file. If a shell referenced in /etc/passwd is not listed in the shells file, excluding the above mentioned shells, this is a finding.
Fix: F-31749r1_fix
Use the chsh utility or edit the /etc/passwd file and correct the error by changing the default shell of the account in error to an acceptable shell name contained in the /etc/shells file. Alternatively, use the HP SMH to change the /etc/passwd shell entry.
- RMF Control
- AC-2
- Severity
- Medium
- CCI
- CCI-000017
- Version
- GEN000760
- Vuln IDs
-
- V-918
- Rule IDs
-
- SV-38500r2_rule
Checks: C-36270r3_chk
For Trusted Mode: Verify that user accounts are locked after 35 days of inactivity. Note: The “u_llogin” attribute is stored in seconds: 86400 seconds/day * 35 days = 3024000 seconds. # cd /tcb/files/auth && cat */* | egrep “:u_name=|:u_llogin=“ If user account is not set to lock after 35 days of inactivity, this is a finding. For SMSE: Check the INACTIVITY_MAXDAYS setting. # grep INACTIVITY_MAXDAYS /etc/default/security /var/adm/userdb/* If INACTIVITY_MAXDAYS is set to 0 or greater than 35 for any user, this is a finding.
Fix: F-31527r3_fix
For Trusted Mode: Use the SAM/SMH interface to update the “u_llogin” (user last login) /tcb database attribute. See the /tcb database entry example below: :u_llogin#3024000: For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the INACTIVITY_MAXDAYS attribute. See the below example: INACTIVITY_MAXDAYS=35 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002200
- Vuln IDs
-
- V-921
- Rule IDs
-
- SV-38501r1_rule
Checks: C-36412r1_chk
Check the ownership of the system shells. # cat /etc/shells | xargs -n1 ls -lL If any shell is not owned by root or bin, this is a finding.
Fix: F-31750r1_fix
Change the ownership of any system shell not owned by root or bin: # chown root <path/shell>
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN002220
- Vuln IDs
-
- V-922
- Rule IDs
-
- SV-38502r1_rule
Checks: C-36413r1_chk
If /etc/shells exists, check the group ownership of each shell referenced. # cat /etc/shells | xargs -n1 ls -lL Otherwise, check any shells found on the system. # find / -name "*sh" | xargs -n1 ls -lL If a shell has a mode more permissive than 0755, this is a finding.
Fix: F-31751r1_fix
Change the mode of the shell. # chmod 0755 <shell>
- RMF Control
- CM-3
- Severity
- Low
- CCI
- CCI-000318
- Version
- GEN002260
- Vuln IDs
-
- V-923
- Rule IDs
-
- SV-38504r1_rule
Checks: C-36414r1_chk
NOTE: This will virtually always be a manual review. Check the system for an automated job, or check with the SA, to determine if the system is checked for extraneous device files on a weekly basis. If no automated or manual process is in place, this is a finding.
Fix: F-31752r1_fix
Establish a weekly automated or manual process to create a list of device files on the system and determine if any files have been added, moved, or deleted since the last list was generated. A list of device files can be generated with this command: # find / -type b -o -type c -o -type n > device-file-list
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002280
- Vuln IDs
-
- V-924
- Rule IDs
-
- SV-38505r2_rule
Checks: C-36415r2_chk
Find all device special files existing anywhere on the system. Types include: b=block, c=character, p=fifo. Example: # find / -type b -print >> devicelist # find / -type c -print >> devicelist # find / -type p -print >> devicelist Check the permissions on the directories above subdirectories that contain device files. If any device file, or directory containing device files, is world-writable, except device files specifically intended to be world-writable such as /dev/null, this is a finding. Note the following exception/exclusion list: /dev/pts/*, /dev/pty/*, /dev/ptym/*, the following in dev: full, zero, null, tty, ptmx, pty*, tcp, udp, ip, arp, udp6, tcp6, rawip6, ip6, rawip, rtsock, ipsecpol, ipseckey, sad, dlpi*, sasd*, ttyp*, ttyq*, ttyr*, strlog, telnetm, tlclts, asyncdsk, async, tlcots, tlcotsod, echo, beep, gvid0, gvid, poll, log, log.um, stcpmap, nuls, usctp6, sctp6, usctp, syscon, and sctp.
Fix: F-31753r1_fix
Remove the world-writable permission from the device file(s). # chmod o-w <device file> Document all changes.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002300
- Vuln IDs
-
- V-925
- Rule IDs
-
- SV-38506r1_rule
Checks: C-36416r1_chk
Check the system for device files read/write enabled for users other than root or the backup user. Example: # find / \( -perm -0020 -o -perm -0040 -o -perm -0002 -o -perm -0004 \) -a \( -type b -o -type c -o -type n \) -exec ls -ld {} \; If any device files used for backup are read/write enabled for users other than root, this is a finding.
Fix: F-31754r1_fix
Use the chmod command to remove the read/write bit(s) from the backup device files. # chmod o-r <b/u device file name> # chmod o-w <b/u device file name> # chmod g-r <b/u device file name> # chmod g-w <b/u device file name> Document all changes.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001435
- Version
- GEN006460
- Vuln IDs
-
- V-926
- Rule IDs
-
- SV-38537r1_rule
Checks: C-36723r1_chk
If the system is not using NIS+, this is not applicable. Check the system to determine if NIS+ security level two is implemented. Execute this command: # niscat cred.org_dir If the second column does not contain DES, the system is not using NIS+ security level two, and this is a finding.
Fix: F-32104r1_fix
Configure the NIS+ server to use security level 2.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005740
- Vuln IDs
-
- V-928
- Rule IDs
-
- SV-35180r1_rule
Checks: C-37986r2_chk
Check the owner of the /etc/dfs/dfstab file. # echo `ls -lL /etc/dfs/dfstab` | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | cut -f 3,3 -d " " If the /etc/dfs/dfstab configuration file is not owned by root or bin, this is a finding.
Fix: F-33229r3_fix
Change the owner of the /etc/dfs/dfstab file to root. # chown root /etc/dfs/dfstab
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN005760
- Vuln IDs
-
- V-929
- Rule IDs
-
- SV-35184r1_rule
Checks: C-37992r1_chk
# echo `ls -lL /etc/dfs/dfstab` | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | cut -f 1,1 -d " " If the file has a mode more permissive than 0644, this is a finding.
Fix: F-33232r1_fix
# chmod 0644 /etc/dfs/dfstab
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005800
- Vuln IDs
-
- V-931
- Rule IDs
-
- SV-35191r3_rule
Checks: C-38000r2_chk
Check for NFS shared file systems. # cat /etc/dfs/sharetab This will display all of the shared file systems. For each file system displayed, check the ownership. Check the owner of the NFS share configuration file. # echo ` ls -lLad <shared file system path>` | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' If the files and directories are not owned by root or a system account, this is a finding.
Fix: F-33234r2_fix
Change the ownership of shared file systems not owned by root, or a system account. # chown root <path>
- RMF Control
- AC-14
- Severity
- Medium
- CCI
- CCI-000062
- Version
- GEN005820
- Vuln IDs
-
- V-932
- Rule IDs
-
- SV-35199r1_rule
Checks: C-38003r1_chk
Check if the 'anon' option is set correctly for shared file systems. # cat /etc/dfs/dfstab Each of the shared file systems should include an entry for the 'anon=' option set to -1 or an equivalent (60001, 65534, or 65535). If an appropriate 'anon=' setting is not present for a shared file system, this is a finding.
Fix: F-33237r1_fix
Edit /etc/dfs/sharetab and set the anon=-1 option for shares without it. Re-export the file systems.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005840
- Vuln IDs
-
- V-933
- Rule IDs
-
- SV-35201r1_rule
Checks: C-38005r1_chk
Check the permissions on shared NFS file systems. Procedure: # cat /etc/dfs/sharetab If the shared file systems do not contain the "rw" or "ro" options that specify a list of hosts or networks, this is a finding.
Fix: F-33239r1_fix
Edit /etc/dfs/dfstab and add ro and/or rw options (as appropriate) that specify a list of hosts or networks which are permitted access. Re-share the file systems via the following commands: # unshare <the file system entry that was modified> # share <the file system entry that was modified>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005880
- Vuln IDs
-
- V-935
- Rule IDs
-
- SV-35202r1_rule
Checks: C-38008r1_chk
Determine if the NFS server is sharing with the root access option. # cat /etc/dfs/sharetab | grep "root=" If a share with the root option is found, this is a finding.
Fix: F-33243r1_fix
Edit /etc/dfs/dfstab and remove the root= option for all shares. Re-share the file systems.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005900
- Vuln IDs
-
- V-936
- Rule IDs
-
- SV-35204r1_rule
Checks: C-35048r1_chk
Check the system for NFS mounts that do not use the nosuid option. # mount -v | grep " type nfs " | grep -v "nosuid" If the mounted file systems do not have the nosuid option, this is a finding.
Fix: F-30338r1_fix
Edit /etc/fstab and add the nosuid option for all NFS file systems. Remount the NFS file systems to make the change take effect.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006580
- Vuln IDs
-
- V-940
- Rule IDs
-
- SV-35198r1_rule
Checks: C-35044r1_chk
Locate the inetd.conf file (normally located within the /etc directory). # find /etc -type f -name inetd.conf Determine if TCP_WRAPPERS is used. The following example demonstrates one possible single inetd.conf line first without and then with the service tcp wrapped. telnet stream tcp6 nowait root /usr/sbin/telnetd telnetd telnet stream tcp6 nowait root /usr/sbin/tcpd telnetd # cat <path>/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | grep tcpd If there are unwrapped active services listed, this is a finding.
Fix: F-30334r1_fix
Edit /etc/inetd.conf and use tcpd to wrap active services.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN006600
- Vuln IDs
-
- V-941
- Rule IDs
-
- SV-35206r2_rule
Checks: C-35049r2_chk
Normally, tcpd logs to the mail facility in the syslog.conf file (normally located within the /etc directory). Determine if syslog is configured to log events by tcpd. # find /etc -type f -name syslog.conf # cat <path>/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v “^#” | egrep “mail.debug|mail.info|mail.\*” Look for an entry similar to the following, indicating that mail alerts are being logged: mail.* /var/log/maillog If no entries for mail exist, then tcpd is not logging and this is a finding.
Fix: F-32112r1_fix
Configure the access restriction program to log every access attempt. Ensure the implementation instructions for TCP_WRAPPERS are followed so logging of system access attempts is logged into the system log files. If an alternate application is used, it must support this function.
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000293
- Version
- GEN000000-HPUX0020
- Vuln IDs
-
- V-960
- Rule IDs
-
- SV-38681r2_rule
Checks: C-2278r4_chk
For Trusted Mode: Determine if the /tcb directory tree exists. # ls -lLd /tcb If the /tcb directory tree does not exist, this is a finding. For SMSE: Determine if the userdb directory tree and the /etc/shadow file exists. # ls -lL /var/adm/userdb # ls -lL /etc/shadow If both the /var/adm/userdb directory tree and the /etc/shadow file do not exist, this is a finding.
Fix: F-33047r2_fix
SAM/SMH must be used to convert standard mode HP-UX to Trusted Mode (optional for SMSE). For Trusted Mode only: The following command may be used to “manually” convert from Standard Mode to Trusted Mode (note that its use is not vendor supported): # tsconvert -c For SMSE only: The following command may be used to “manually” create the /etc/shadow file with information from the /etc/passwd file (use of this commend is vendor supported). # pwconv Note that additional software bundles and/or patches may be required in order to completely convert a standard mode system to SMSE.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000000-HPUX0080
- Vuln IDs
-
- V-965
- Rule IDs
-
- SV-965r2_rule
Checks: C-2289r2_chk
ls -lL /etc/securetty
Fix: F-1119r2_fix
Change the group-owner of the /etc/securetty to root, bin, or sys. Example: # chgrp root /etc/securetty
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000000-HPUX0060
- Vuln IDs
-
- V-966
- Rule IDs
-
- SV-38682r1_rule
Checks: C-37789r1_chk
Check the ownership of the /etc/securetty file. ls -lL /etc/securetty If /etc/securetty is not owned by root, sys, or bin, this is a finding.
Fix: F-1120r2_fix
Change the owner of the /etc/securetty file to root. # chown root /etc/securetty
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000000-HPUX0100
- Vuln IDs
-
- V-967
- Rule IDs
-
- SV-967r2_rule
Checks: C-2290r2_chk
Check the mode of the securetty file. Example: # ls -lL /etc/securetty If /etc/securetty has a mode more permissive than 0640, this is a finding.
Fix: F-1121r2_fix
Change the mode of the /etc/securetty file to 0640. Example: # chmod 0640 /etc/securetty
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002960
- Vuln IDs
-
- V-974
- Rule IDs
-
- SV-38541r1_rule
Checks: C-36431r1_chk
Check for the existence of the cron.allow and cron.deny files. # ls -lL /var/adm/cron/cron.allow # ls -lL /var/adm/cron/cron.deny If neither file exists, this is a finding.
Fix: F-31770r1_fix
Create /var/adm/cron/cron.allow and/or /var/adm/cron/cron.deny with appropriate local content.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002980
- Vuln IDs
-
- V-975
- Rule IDs
-
- SV-38542r1_rule
Checks: C-36432r1_chk
Check mode of the cron.allow file. Procedure: # ls -lL /var/adm/cron/cron.allow If the file has a mode more permissive than 0600, this is a finding.
Fix: F-31771r1_fix
Change the mode of the cron.allow file to 0600. Procedure: # chmod 0600 /var/adm/cron/cron.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003000
- Vuln IDs
-
- V-976
- Rule IDs
-
- SV-38543r1_rule
Checks: C-36434r1_chk
List all cronjobs on the system. Procedure: # ls -lL /var/spool/cron/crontabs If cron jobs exist under any of the above directories, search for programs executed by cron. Procedure: # more <cron job file> Determine if the file is group-writable or world-writable. Procedure: # ls -lLa <cron program file> If cron executes group-writable or world-writable files, this is a finding.
Fix: F-31773r1_fix
Remove the world-writable and group-writable permissions from the cron program file(s) identified. # chmod go-w <cron program file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003020
- Vuln IDs
-
- V-977
- Rule IDs
-
- SV-38544r1_rule
Checks: C-36433r1_chk
List all cronjobs on the system. Procedure: # ls -lL /var/spool/cron/crontabs If cron jobs exist under any of the above directories, search for programs executed by cron: Procedure: # more <cron job file> Determine if the directory containing programs executed from cron is world-writable. Procedure: # ls -lLd <cron program directory> If cron executes programs in world-writable directories, this is a finding.
Fix: F-31772r1_fix
Remove the world-writable permission from the cron program directories identified. Procedure: # chmod o-w <cron program directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003080
- Vuln IDs
-
- V-978
- Rule IDs
-
- SV-38545r1_rule
Checks: C-36451r1_chk
Check the mode of the crontab files. # ls -lL /var/spool/cron/crontabs If any crontab file has a mode more permissive than 0600, this is a finding.
Fix: F-31790r1_fix
Change the mode of the crontab files. # chmod 0600 /var/spool/cron/crontabs/*
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003100
- Vuln IDs
-
- V-979
- Rule IDs
-
- SV-38546r1_rule
Checks: C-36452r1_chk
Check the mode of the crontab directory. # ls -lLd /var/spool/cron/crontabs If the mode of the crontab directory is more permissive than 0755, this is a finding.
Fix: F-1133r2_fix
Change the mode of crontab directories to 0755.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003120
- Vuln IDs
-
- V-980
- Rule IDs
-
- SV-38547r1_rule
Checks: C-36453r1_chk
Check the owner of the crontab directory. # ls -ld /var/spool/cron/crontabs If the owner of the crontab directory is not root or bin, this is a finding.
Fix: F-31792r1_fix
Change the mode of the crontab directory. # chown root /var/spool/cron/crontabs
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003140
- Vuln IDs
-
- V-981
- Rule IDs
-
- SV-38548r1_rule
Checks: C-36454r1_chk
Check the group owner of the crontab directories. # ls -lLd /var/spool/cron/crontabs If the directory is not group-owned by root, sys, bin or other, this is a finding.
Fix: F-31793r1_fix
Change the group owner of the crontab directories to root, sys, bin or other. # chown root /var/spool/cron/crontabs
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN003160
- Vuln IDs
-
- V-982
- Rule IDs
-
- SV-38549r1_rule
Checks: C-36455r1_chk
# ls -lL /var/adm/cron/log If this file does not exist, or has a timestamp older than the last cron job, this is a finding.
Fix: F-31794r1_fix
Enable cron/logging on the system via: # /sbin/init.d/cron stop # mv <current cron log> <to a new location and new name> # /sbin/init.d/cron start # more /var/adm/cron/log Cron automatically handles its own logging function and (at least) the Start Time should be visible at the beginning of the new log file /var/adm/cron/log.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003180
- Vuln IDs
-
- V-983
- Rule IDs
-
- SV-38550r1_rule
Checks: C-36456r1_chk
Check the mode of the cron log file. # ls -lL /var/adm/cron/log If the mode is more permissive than 0600, this is a finding.
Fix: F-31795r1_fix
Change the mode of the cron log file. # chmod 0600 /var/adm/cron/log
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003280
- Vuln IDs
-
- V-984
- Rule IDs
-
- SV-35033r1_rule
Checks: C-36457r1_chk
Check for the existence of at.allow and at.deny files. # ls -lL /var/adm/cron/at.allow # ls -lL /var/adm/cron/at.deny If neither file exists, this is a finding.
Fix: F-31796r1_fix
Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the at facility supported by the cron daemon.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003300
- Vuln IDs
-
- V-985
- Rule IDs
-
- SV-38551r1_rule
Checks: C-36458r1_chk
# more /var/adm/cron/at.deny If the at.deny file exists and is empty, this is a finding.
Fix: F-31797r1_fix
Add appropriate users to the at.deny file, or remove the empty at.deny file if an at.allow file exists.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003320
- Vuln IDs
-
- V-986
- Rule IDs
-
- SV-38552r1_rule
Checks: C-36459r1_chk
# more /var/adm/cron/at.allow If default accounts (such as bin, sys, adm, and others) are listed in the at.allow file, this is a finding.
Fix: F-31799r1_fix
Remove the default accounts (such as bin, sys, adm, and others) from the at.allow file.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003340
- Vuln IDs
-
- V-987
- Rule IDs
-
- SV-38553r1_rule
Checks: C-36460r1_chk
Check the mode of the at.allow file. # ls -lL /var/adm/cron/at.allow If the at.allow file has a mode more permissive than 0600, this is a finding.
Fix: F-31800r1_fix
Change the mode of the at.allow file. # chmod 0600 /var/adm/cron/at.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003360
- Vuln IDs
-
- V-988
- Rule IDs
-
- SV-38554r1_rule
Checks: C-36461r1_chk
List the at jobs on the system. Procedure: # ls -lLa /var/spool/cron/atjobs For each at job file, determine which programs are executed. # more <at job file> Check each program executed by at for group- or world-writable permissions. # ls -lLa <at program file> If at executes programs that are group- or world-writable, this is a finding.
Fix: F-31801r1_fix
Remove group-write and world-write permissions from files executed by at jobs. # chmod go-w <file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003380
- Vuln IDs
-
- V-989
- Rule IDs
-
- SV-38555r1_rule
Checks: C-36462r1_chk
List any at jobs on the system. # ls -lLa /var/spool/cron/atjobs For each at job, determine which programs are executed by at. # more <at job file> Check the directory containing each program executed by at for world-writable permissions. # ls -lL <at program file directory> If at executes programs in world-writable directories, this is a finding.
Fix: F-31802r1_fix
Remove the world-writable permission from directories containing programs executed by at. # chmod o-w <at program directory>
- RMF Control
- IA-5
- Severity
- High
- CCI
- CCI-000178
- Version
- GEN005300
- Vuln IDs
-
- V-993
- Rule IDs
-
- SV-35172r1_rule
Checks: C-36606r1_chk
Check the SNMP configuration for default passwords. Locate and examine the SNMP configuration. # more /etc/SnmpAgent.d/snmpd.conf Alternatively: # cat /etc/SnmpAgent.d/snmpd.conf | grep -i community Identify any community names or user password configuration. If any community name or password is set to a default value such as public, private, snmp-trap, or password, or any value which does not meet DISA password requirements, this is a finding.
Fix: F-31974r1_fix
Change the default passwords. To change them, edit the /etc/SnmpAgent.d/snmpd.conf file. Locate the line system-group-read-community which has a default password of public and make the password something more random (less guessable). Do the same for the lines reading system-group-write-community, read-community, write-community, trap, and trap-community. Read the information in the file carefully. The trap is defining who to send traps to, for instance, by default. It will not be a password, but the name of a host.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005320
- Vuln IDs
-
- V-994
- Rule IDs
-
- SV-35176r1_rule
Checks: C-36612r1_chk
Check the mode of the SNMP daemon configuration file. # ls -lL /etc/SnmpAgent.d/snmpd.conf If the /etc/SnmpAgent.d/snmpd.conf file has a mode more permissive than 0600, this is a finding.
Fix: F-31978r1_fix
Change the mode of the SNMP daemon configuration file to 0600. # chmod 0600 /etc/SnmpAgent.d/snmpd.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005340
- Vuln IDs
-
- V-995
- Rule IDs
-
- SV-35178r1_rule
Checks: C-36613r1_chk
Check the modes for all MIB files on the system. # find / -type f -name *.mib -exec ls -lL {} \; If any file is returned without a mode 0640 or less permissive, this is a finding.
Fix: F-31979r1_fix
Change the mode of MIB files to 0640. # chmod 0640 <mib file>
- RMF Control
- AU-3
- Severity
- Low
- CCI
- CCI-000134
- Version
- GEN003800
- Vuln IDs
-
- V-1011
- Rule IDs
-
- SV-35085r1_rule
Checks: C-36533r1_chk
# ps -ef | grep -v grep | egrep -i "inetd|xinetd" If the -l logging parameter is not used, this is a finding. If the (x)inetd process is not running, this is not a finding.
Fix: F-31897r1_fix
Edit the (x)inetd startup script to include the -l parameter for the internet daemon process.
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- GEN008600
- Vuln IDs
-
- V-1013
- Rule IDs
-
- SV-38234r1_rule
Checks: C-36795r1_chk
HP-UX 11-v3 may be booted from the following system startup media (must have been previously configured by root): • Hard drives • CD/DVD drives (for installation) • Tape drives (for installation) • USB directly connected drives (no hubs) Determine if the system is configured to boot from devices other than the system startup media. Verification should (optimally) be performed during IPL/ISL boot. In lieu of rebooting the system, ask the SA if the system is configured to boot from devices other than system startup media. If so, this is a finding.
Fix: F-32173r1_fix
Configure the system to only boot from system startup media. The system must first be rebooted in order to set primary and alternate boot paths for the desired system startup media.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000381
- Version
- GEN006240
- Vuln IDs
-
- V-1023
- Rule IDs
-
- SV-38236r1_rule
Checks: C-36722r2_chk
Check the domain name for NIS maps. Procedure: # domainname If the name returned is simple to guess, such as the organization name, building, or room name, etc., this is a finding.
Fix: F-32085r1_fix
Disable the INN server.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN006080
- Vuln IDs
-
- V-1026
- Rule IDs
-
- SV-35211r1_rule
Checks: C-36693r3_chk
Determine if the CIFS (HP SAMBA) bundle is installed (SWAT is included). # swlist -l bundle | egrep -i "CIFS-CLIENT|CIFS-SERVER" If the HP bundle is not installed, this is not applicable. If the HP bundle is installed, ask the SA if the Samba Web Administration Tool (SWAT) has been configured to use SSL. If SWAT is not configured to use SSL, this is a finding.
Fix: F-32068r2_fix
Disable SWAT. # chmod 0000 <path>/swat OR # rm -i <path>/swat
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006100
- Vuln IDs
-
- V-1027
- Rule IDs
-
- SV-35213r1_rule
Checks: C-36694r1_chk
Check the ownership of the /etc/smb.conf file. # ls -lL /etc/opt/samba/smb.conf If the smb.conf file is not owned by root, this is a finding.
Fix: F-32069r1_fix
Change the ownership of the smb.conf file. # chown root /etc/opt/samba/smb.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006140
- Vuln IDs
-
- V-1028
- Rule IDs
-
- SV-35221r1_rule
Checks: C-36697r1_chk
Check the mode of the smb.conf file. # ls -lL /etc/opt/samba/smb.conf If the smb.conf has a mode more permissive than 0644, this is a finding.
Fix: F-32071r1_fix
Change the mode of the smb.conf file to 0644 or less permissive. # chmod 0644 /etc/opt/samba/smb.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006160
- Vuln IDs
-
- V-1029
- Rule IDs
-
- SV-35225r1_rule
Checks: C-36700r1_chk
Check the ownership of the smbpasswd file. # ls -lL /var/opt/samba/private/smbpasswd If the smbpasswd file is not owned by root, this is a finding.
Fix: F-32074r1_fix
Use the chown command to configure the smb passwd file. # chown root <path>/smbpasswd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006220
- Vuln IDs
-
- V-1030
- Rule IDs
-
- SV-35107r1_rule
Checks: C-36704r1_chk
Examine the smb.conf file. # cat /etc/opt/samba/smb.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | egrep "^hosts|^ hosts allow|^hosts deny" If the hosts option is not present to restrict access to a list of authorized hosts and networks, this is a finding.
Fix: F-32079r1_fix
Edit the smb.conf file and set the hosts option to permit only authorized hosts access Samba. An example might be: hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 hosts deny = 0.0.0.0/0 The above will only allow SMB connections from the localhost and from the two private networks 192.168.2 and 192.168.3. All other connections will be refused as soon as the client sends its first packet.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000198
- Version
- GEN000540
- Vuln IDs
-
- V-1032
- Rule IDs
-
- SV-38199r2_rule
Checks: C-36255r3_chk
For Trusted Mode: Check the “u_minchg” attribute in the users TS database entry. Individual user: # export PATH=$PATH:/usr/lbin # getprpw -r -m mintm <USER> All users: # logins -o -x | awk -F: '{print $1” “$10}' If the value is less than 1 for any user, this is a finding. For SMSE: Check the PASSWORD_MINDAYS attribute. # grep PASSWORD_MINDAYS /etc/default/security /var/adm/userdb/* If the attribute PASSWORD_MINDAYS is less than 1, this is a finding.
Fix: F-31512r2_fix
For both Trusted Mode and SMSE: Use the SAM/SMH interface to ensure that password changes are restricted to no less than once every 24 hours. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to ensure that password changes are restricted to no less than once every 24 hours. See the below example: PASSWORD_MINDAYS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- High
- CCI
- CCI-000197
- Version
- GEN001100
- Vuln IDs
-
- V-1046
- Rule IDs
-
- SV-38240r1_rule
Checks: C-36280r1_chk
Perform the following to determine if root has logged in over an unencrypted network connection. The first command determines if root has logged in over a network. The second will check to see if the SSH daemon is running. Procedure: # last -R | grep "^root " | egrep -v "reboot|console" | more # ps -ef |grep sshd If the output from the last command shows root has logged in over the network and sshd is not running, this is a finding.
Fix: F-31537r1_fix
Enable SSH on the system and use it for all remote connections used to attain root access.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000770
- Version
- GEN001120
- Vuln IDs
-
- V-1047
- Rule IDs
-
- SV-38207r1_rule
Checks: C-36279r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=PermitRootLogin Required arg(s)=no Default arg values include: "yes" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> are not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "PermitRootLogin" If the return value is yes, without-password or forced-commands-only, this is a finding.
Fix: F-24426r1_fix
Edit the configuration file and set the PermitRootLogin option to no.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002320
- Vuln IDs
-
- V-1048
- Rule IDs
-
- SV-38241r1_rule
Checks: C-36418r1_chk
Check the mode of audio device files. Determine audio devices and class identifiers, i.e., audio should be listed as audio. # ioscan Determine audio device special files. # ioscan -fn -C <audio class ID from the above command output> Determine the device file mode. # ls -lL <device special file> If the mode of any audio device file is more permissive than 0660, this is a finding.
Fix: F-31756r1_fix
Change the mode of audio devices. # chmod 0660 <audio device>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002340
- Vuln IDs
-
- V-1049
- Rule IDs
-
- SV-38242r1_rule
Checks: C-36419r1_chk
Check the owner of audio devices. Determine audio devices and class identifiers, i.e., audio should be listed as audio. # ioscan Determine audio device special files. # ioscan -fn -C <audio class ID from the above command output> Determine the device file mode. # ls -lL <device special file> If the owner of any audio device file is not root, this is a finding.
Fix: F-31757r1_fix
Change the owner of the audio device. # chown root <audio device>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006120
- Vuln IDs
-
- V-1056
- Rule IDs
-
- SV-35219r1_rule
Checks: C-35063r1_chk
Check the group ownership of the smb.conf file. # find / -type f -name smb.conf | xargs -n1 ls -lL If the smb.conf file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-30350r1_fix
Change the group owner of the "smb.conf" file. # chgrp root /etc/samba/smb.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006180
- Vuln IDs
-
- V-1058
- Rule IDs
-
- SV-37880r1_rule
Checks: C-37107r1_chk
Check smbpasswd ownership: # ls -lL /var/opt/samba/private/smbpasswd If the smbpasswd file is not group-owned by root, this is a finding.
Fix: F-32374r1_fix
Use the chgrp command to ensure that the group owner of the smbpasswd file is root. # chgrp root <path>/smbpasswd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006200
- Vuln IDs
-
- V-1059
- Rule IDs
-
- SV-37883r1_rule
Checks: C-37108r1_chk
Check the mode of files maintained using smbpasswd. # ls -lL /var/opt/samba/private/smbpasswd If the smbpasswd file is more permissive than 0600, this is a finding.
Fix: F-32376r1_fix
Change the mode of the smbpasswd file to 0600. # chmod 0600 <path>/smbpasswd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002360
- Vuln IDs
-
- V-1061
- Rule IDs
-
- SV-27252r1_rule
Checks: C-28284r1_chk
Check the group-owner of audio devices. Procedure: # /usr/sbin/ioscan -f # ls -lL <audio device file> If the group-owner of an audio device is not root, sys, bin, or system, this is a finding.
Fix: F-1215r2_fix
Change the group owner of the audio device. Procedure: # chgrp system <audio device>
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN001080
- Vuln IDs
-
- V-1062
- Rule IDs
-
- SV-38208r1_rule
Checks: C-36281r1_chk
Determine if the root shell is located on / (IE: a non-mounted file system). # cat /etc/passwd | grep "^root:" | awk -F ":" '{print $NF}' # grep <shell location from above> /etc/fstab If the root shell is located on a mountable file system listed in /etc/fstab, this is a finding.
Fix: F-31538r1_fix
Change the root account's shell to one present on the / file system.
- RMF Control
- AC-11
- Severity
- Medium
- CCI
- CCI-000057
- Version
- GEN000500
- Vuln IDs
-
- V-4083
- Rule IDs
-
- SV-38416r2_rule
Checks: C-36256r2_chk
If a graphical desktop environment is not installed on the system, this is not applicable. Examine the dtsession timeout variable setting. # cat /etc/dt/config/C/sys.resources | grep -i dtsession | grep -i lockTimeout If the dtsession timeout is higher than 15, commented or does not exist, this is a finding.
Fix: F-31513r2_fix
Configure the CDE lock manager to lock your screen after a certain amount of inactive time. To configure the CDE lock manager to lock the screen after 15 minutes of inactive time, enter the following commands (ensure to NOT overwrite an existing file): # cp /usr/dt/config/C/sys.resources /etc/dt/config/C/sys.resources # vi /etc/dt/config/C/sys.resources Locate and add/uncomment/change the line to N=15 dtsession*lockTimeout: <N> dtsession*lockTimeout: 15 Log out of CDE and log back in to verify the timeout is in effect.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000200
- Version
- GEN000800
- Vuln IDs
-
- V-4084
- Rule IDs
-
- SV-38417r2_rule
Checks: C-36283r2_chk
For Trusted Mode: Check the PASSWORD_HISTORY_DEPTH setting. # cat /etc/default/security | grep PASSWORD_HISTORY_DEPTH If PASSWORD_HISTORY_DEPTH is not set to 5 or greater, this is a finding. For SMSE: Check the PASSWORD_HISTORY_DEPTH setting. # grep PASSWORD_HISTORY_DEPTH /etc/default/security /var/adm/userdb/* If PASSWORD_HISTORY_DEPTH is not set to 5 or greater, this is a finding.
Fix: F-31540r2_fix
For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001940
- Vuln IDs
-
- V-4087
- Rule IDs
-
- SV-38418r1_rule
Checks: C-36370r1_chk
Check local initialization files for any executed world-writable programs or scripts. Procedure: # more /<usershomedirectory>/.* # ls -alL <program or script> If any local initialization file executes a world-writable program or script, this is a finding.
Fix: F-31707r1_fix
Remove the world-writable permission of files referenced by local initialization scripts, or remove the references to these files in the local initialization scripts.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001660
- Vuln IDs
-
- V-4089
- Rule IDs
-
- SV-38420r1_rule
Checks: C-36372r2_chk
System start-up files are identified as follows: Run control scripts reside in the /sbin/init.d directory. Links to the run control scripts exist in the /sbin/rc*.d directories. Run control configuration files exist in the /etc/rc.config.d directory. Check all system start-up script file ownership. # ls -lL /sbin/init.d/* /sbin/rc*.d/* /etc/rc.config.d/* If any system start-up script file is not owned by root or bin, this is a finding.
Fix: F-31709r1_fix
Change the ownership of the run control script(s) with incorrect ownership. # chown root <run control script>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001680
- Vuln IDs
-
- V-4090
- Rule IDs
-
- SV-38421r1_rule
Checks: C-36373r2_chk
System start-up files are identified as follows: Run control scripts reside in the /sbin/init.d directory. Links to the run control scripts exist in the /sbin/rc*.d directories. Run control script configuration files exist in the /etc/rc.config.d directory. Check system start-up script file group ownership. # ls -lL /sbin/init.d/* /etc/rc.config.d/* /etc/rc.config.d/* If any system start-up script file is not group-owned by root, sys, bin or other, this is a finding.
Fix: F-31711r1_fix
Change the group ownership of the run control script(s) with incorrect group ownership. Procedure: # chgrp root <run control script>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001700
- Vuln IDs
-
- V-4091
- Rule IDs
-
- SV-38422r1_rule
Checks: C-36374r2_chk
Determine the ownership of programs executed by system start-up files. # more `ls -alL /sbin/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " "` If any executed program is not owned by root, sys, bin, or in rare cases, an application account, this is a finding.
Fix: F-31712r2_fix
Change the ownership of the file executed from system startup scripts to root, bin, sys, or the application account, where required. # chown root <executed file>
- RMF Control
- AC-3
- Severity
- Medium
- CCI
- CCI-000213
- Version
- GEN008620
- Vuln IDs
-
- V-4246
- Rule IDs
-
- SV-38423r1_rule
Checks: C-36797r1_chk
On systems with a BIOS or system controller, verify a supervisor or administrator password is set. If a password is not set, this is a finding. Attempt to log into the system controller first using the user/pwd format of Admin/Admin, then as Oper/Oper. Also, depending upon the MP/SP/GSP, it may also allow for simple carriage return entry <CR>/<CR> if account(s)/password(s) are uninitialized. If the BIOS or system controller supports user-level access in addition to supervisor/administrator access, determine if this access is enabled. If so, this is a finding.
Fix: F-32174r1_fix
Access the system's BIOS or system controller. Set a supervisor/administrator password if one has not been set. Disable a user-level password if one has been set.
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- GEN008640
- Vuln IDs
-
- V-4247
- Rule IDs
-
- SV-38424r1_rule
Checks: C-40611r1_chk
Ask the SA if the system uses removable media for the boot loader. If it does, this is a finding.
Fix: F-32175r1_fix
Configure the system to use a bootloader installed on fixed media.
- RMF Control
- SC-32
- Severity
- High
- CCI
- CCI-001208
- Version
- GEN008680
- Vuln IDs
-
- V-4255
- Rule IDs
-
- SV-38425r1_rule
Checks: C-36799r1_chk
Ask the SA if the system boots from removable media. If so, ask if the boot media is stored in a secure container when not in use. If it is not, this is a finding.
Fix: F-32176r1_fix
Store the system boot media in a secure container when not in use.
- RMF Control
- AC-2
- Severity
- Medium
- CCI
- CCI-000012
- Version
- GEN000290
- Vuln IDs
-
- V-4269
- Rule IDs
-
- SV-38426r1_rule
Checks: C-36257r1_chk
Check the system for unnecessary user accounts. Procedure: # more /etc/passwd Some examples of unnecessary accounts include games, news, gopher, ftp and lp. If any unnecessary accounts are found, this is a finding.
Fix: F-31514r1_fix
Remove all unnecessary accounts (such as games) from the /etc/password file before connecting a system to the network. Accounts such as news and gopher associated with a service not in use should also be removed.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006260
- Vuln IDs
-
- V-4273
- Rule IDs
-
- SV-35114r1_rule
Checks: C-34958r1_chk
Locate/check the hosts.nntp permissions. # find / -type f -name hosts.nntp | xargs -n1 ls -lL If hosts.nntp has a mode more permissive than 0600, this is a finding.
Fix: F-30262r1_fix
Change the mode of the hosts.nntp file to 0600. # chmod 0600 <path>/hosts.nntp
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006280
- Vuln IDs
-
- V-4274
- Rule IDs
-
- SV-35116r1_rule
Checks: C-34960r1_chk
Check hosts.nntp.nolimit permissions. # find / -type f -name hosts.nntp.nolimit | xargs -n1 ls -lL If hosts.nntp.nolimit has a mode more permissive than 0600, this is a finding.
Fix: F-30264r1_fix
Change the mode of hosts.nntp.nolimit to 0600. # chmod 0600 <path>/hosts.nntp.nolimit
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006300
- Vuln IDs
-
- V-4275
- Rule IDs
-
- SV-35118r1_rule
Checks: C-34971r1_chk
Check nnrp.access permissions. # find / -type f -name nnrp.access | xargs -n1 ls -lL If nnrp.access has a mode more permissive than 0600, this is a finding.
Fix: F-30266r1_fix
Change the mode of the nnrp.access file to 0600. # chmod 0600 <path>/nnrp.access
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006320
- Vuln IDs
-
- V-4276
- Rule IDs
-
- SV-35120r1_rule
Checks: C-34978r1_chk
Check passwd.nntp permissions. # find / -type f -name passwd.nntp | xargs -n1 ls -lL If passwd.nntp has a mode more permissive than 0600, this is a finding.
Fix: F-30272r1_fix
Change the mode of the passwd.nntp file. # chmod 0600 <path>/passwd.nntp
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006340
- Vuln IDs
-
- V-4277
- Rule IDs
-
- SV-35122r1_rule
Checks: C-34980r4_chk
Check the ownership of the files in news. # find /var/news -type f | xargs -n1 ls -lL If any files are not owned by root or news, this is a finding.
Fix: F-30274r1_fix
Change the ownership of the files in <path>/news to root or news. # chown root <path>/news/*
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006360
- Vuln IDs
-
- V-4278
- Rule IDs
-
- SV-35126r1_rule
Checks: C-34984r3_chk
Check news files group ownership. # find /var/news -type f | xargs -n1 ls -lL If news files are not group-owned by root or news, this is a finding.
Fix: F-30278r1_fix
Change the group owner of the files in news to root or news. # chgrp root <path>/news/*
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN000000-HPUX0040
- Vuln IDs
-
- V-4290
- Rule IDs
-
- SV-38429r2_rule
Checks: C-36226r2_chk
Check the /etc/rc.config.d/auditing file AUDOMON_ARGS settings: # cat /etc/rc.config.d/auditing | tr “\011” “ “ | tr -s “ “ | sed -e 's/^[ \t]*//' grep -v “#” The above command should return a single line with the following information: AUDOMON_ARGS=“-p 20, -t 1, -w 90” If “p”, “t”, or “w” flags are not set to “20”, “1”, and “90”, respectively, this is a finding.
Fix: F-31485r2_fix
Edit the /etc/rc.config.d/auditing file and insert the following line: AUDOMON_ARGS=“-p 20, -t 1, -w 90” Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start
- RMF Control
- AC-17
- Severity
- High
- CCI
- CCI-001436
- Version
- GEN005500
- Vuln IDs
-
- V-4295
- Rule IDs
-
- SV-35209r1_rule
Checks: C-35053r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Protocol Required arg(s)=2 Default arg values include: "2,1" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> are not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "Protocol" | cut -f 2,2 -d " " If the return value is "1" or "2,1" (double quotes are for emphasis only) , this is a finding.
Fix: F-30340r1_fix
Edit the configuration file and modify the Protocol line entry to appear as follows: Protocol 2
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-000070
- Version
- GEN001000
- Vuln IDs
-
- V-4298
- Rule IDs
-
- SV-27148r2_rule
Checks: C-28074r3_chk
Check /etc/securetty # more /etc/securetty If the /etc/securetty file does not exist, or contains other than "console" or "/dev/null" this is a finding.
Fix: F-24422r4_fix
If the /etc/securetty file does not exist, create the file containing only the word console and ensure correct file properties. # echo “console” > /etc/securetty
- RMF Control
- AU-8
- Severity
- Medium
- CCI
- CCI-001492
- Version
- GEN000240
- Vuln IDs
-
- V-4301
- Rule IDs
-
- SV-38428r1_rule
Checks: C-36233r4_chk
Check Content: Check the root crontab for ntpdate jobs running at least daily. If cron is used, this command must return a line with the following required format: columns 3, 4, and 5 must be an asterisk (*) for the job to be run daily. # crontab -l | grep ntpdate OR Check that ntpd is used for system clock synchronization. If ntpd is used, this command must return a line starting with an asterisk followed by the name of the remote host that the local system is synchronized with. # ntpq -p | grep "^*" If the system clock is not being synchronized continuously (via ntpd) or at least daily (via cron), this is a finding.
Fix: F-31492r2_fix
Use a local authoritative time server synchronizing to an authorized DoD time source. Ensure all systems in the facility feed from one or more local time servers feeding from the authoritative time server. View the current system (x)ntpd man page for a detailed discussion of configuration option details: # man xntpd Create/edit the ntp.conf file, delete any non-local and/or non-U.S. DoD sources and insert the local or an authoritative U.S. DoD source. Example /etc/ntp.conf file: # # server : ntp server used (poll) to obtain time server <IP or hostname for 1st server> server <IP or hostname for 2nd server> # # peer : a peer relationship with another ntp server peer <IP or hostname for ntp peer> # # driftfile : track local clock time (drift of the local clock) driftfile <drift file name, default is /etc/ntp.drift> Stop/restart (x)ntpd. The default system script to start ntp should be found in the system startup directory /sbin/init.d : # /sbin/init.d/xntpd start
- RMF Control
- CP-10
- Severity
- Medium
- CCI
- CCI-000553
- Version
- GEN003640
- Vuln IDs
-
- V-4304
- Rule IDs
-
- SV-35057r1_rule
Checks: C-34927r1_chk
Logging should be enabled for those types of files systems that do not turn on logging by default. # mount Alternatively: # cat /etc/fstab | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ cut -f 2,3 -d " " | grep "/ " | grep -c -i "vxfs" If the above command return value is 1, vxfs journaling is in use, this is not a finding. JFS, VXFS, HFS, XFS, reiserfs, EXT3 and EXT4 all turn logging on by default and will not be a finding. The ZFS file system uses other mechanisms to provide for file system consistency, and will not be a finding. For other file systems types, if the root file system does not have the logging option, this is a finding. If the nolog option is set on the root file system, this is a finding.
Fix: F-30232r1_fix
Implement file system journaling for the root file system, or use a file system that uses other mechanisms to ensure file system consistency. If the root file system supports journaling, enable it. If the file system does not support journaling or another mechanism to ensure file system consistency, a migration to a different file system will be necessary.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN006060
- Vuln IDs
-
- V-4321
- Rule IDs
-
- SV-35208r1_rule
Checks: C-36692r1_chk
Check the system for a running Samba server. # ps -ef |grep -v grep | grep smbd If the Samba server is running, ask the SA if the Samba server is operationally required. If it is not, this is a finding.
Fix: F-32067r1_fix
If there is no functional need for Samba and the daemon is running, disable the daemon by killing the process ID as noted from the output of ps -ef |grep smbd. The utility should also be removed or not installed if there is no functional requirement.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002860
- Vuln IDs
-
- V-4357
- Rule IDs
-
- SV-38427r1_rule
Checks: C-36435r1_chk
Check for a crontab entry that rotates audit logs. # crontab -l If any cron job to rotate audit logs is found, this is not a finding. Otherwise, query the SA. If there is a process that automatically rotates audit logs, this is not a finding. If the SA manually rotates audit logs, this is still a finding, because if the SA is not there, it will not be accomplished. If the audit output is not archived daily, to tape or disk, this is a finding. This can be ascertained by looking at the audit log directory and, if more than one file is there, or if the file does not have today's date, this is a finding.
Fix: F-31774r1_fix
Configure a cron job or other automated process to rotate the audit logs on a daily basis.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003200
- Vuln IDs
-
- V-4358
- Rule IDs
-
- SV-38430r1_rule
Checks: C-36463r1_chk
Check the mode of the cron.deny file. # ls -lL /var/adm/cron/cron.deny If the cron.deny file is more permissive than 0600, this is a finding.
Fix: F-31803r1_fix
Change the mode of the cron.deny file. # chmod 0600 /var/adm/cron/cron.deny
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003220
- Vuln IDs
-
- V-4360
- Rule IDs
-
- SV-38431r1_rule
Checks: C-36464r1_chk
Determine if there are any crontabs by viewing a long listing of the directory. If there are crontabs, examine them to determine what cron jobs exist. Check for any programs specifying an umask. # ls -lL /var/spool/cron/crontabs # cat <crontab file> # grep umask <cron program> If there are no cron jobs present, this vulnerability is not applicable. If any cron job contains an umask value more permissive than 077, this is a finding.
Fix: F-31804r1_fix
Edit cron script files and modify the umask to 077.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003240
- Vuln IDs
-
- V-4361
- Rule IDs
-
- SV-38432r1_rule
Checks: C-36465r1_chk
# ls -lL /var/adm/cron/cron.allow If the cron.allow file is not owned by root, sys, or bin, this is a finding.
Fix: F-31807r1_fix
# chown root /var/adm/cron/cron.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003400
- Vuln IDs
-
- V-4364
- Rule IDs
-
- SV-38433r1_rule
Checks: C-36466r1_chk
Check the mode of the at directory. # ls -lLd /var/spool/cron/atjobs /var/spool/atjobs /var/spool/at If the directory mode is more permissive than 0755, this is a finding.
Fix: F-31808r1_fix
Change the mode of the at directory to 0755. # chmod 0755 <at directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003420
- Vuln IDs
-
- V-4365
- Rule IDs
-
- SV-38434r1_rule
Checks: C-36467r1_chk
Check the ownership of the at directory: # ls -lLd /var/spool/cron/atjobs /var/spool/atjobs /var/spool/at If the directory exists and is not owned by root, sys, or bin, this is a finding.
Fix: F-31809r1_fix
Change the owner of the existing at directory to root, bin, or sys. # chown root <at directory> (Replace root with another system group and/or <at directory> with a different at directory as necessary.)
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003440
- Vuln IDs
-
- V-4366
- Rule IDs
-
- SV-34996r1_rule
Checks: C-34871r1_chk
Determine what at jobs exist on the system. Procedure: # ls /var/spool/cron/atjobs If there are no at jobs present, this is not applicable. Determine if any of the at jobs or any scripts referenced execute the umask command. Check for any umask setting more permissive than 077. # grep -n umask <at job or referenced script> If any at job or referenced script sets umask to a value more permissive than 077, this is a finding. NOTE: The at facility will set the execution environment umask to 022. A grep of the at file will normally yield a line in the file that may look like umask 2. When examining any at job command file, this should not be mistaken for a user defined umask (re-)setting.
Fix: F-30201r1_fix
Edit at jobs or referenced scripts to remove umask commands setting the umask value more permissive than 077.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003460
- Vuln IDs
-
- V-4367
- Rule IDs
-
- SV-34997r1_rule
Checks: C-34872r1_chk
# ls -lL /var/adm/cron/at.allow If the at.allow file is not owned by root, sys or bin, this is a finding.
Fix: F-30202r1_fix
Change the owner of the at.allow file. # chown root /var/adm/cron/at.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003480
- Vuln IDs
-
- V-4368
- Rule IDs
-
- SV-34998r1_rule
Checks: C-34873r1_chk
# ls -lL /usr/lib/cron/at.deny If the at.deny file is not owned by root, sys, or bin, this is a finding.
Fix: F-30203r1_fix
Change the owner of the at.deny file. # chown root /usr/lib/cron/at.deny
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003960
- Vuln IDs
-
- V-4369
- Rule IDs
-
- SV-35151r1_rule
Checks: C-35008r2_chk
# ls -lL /usr/contrib/bin/traceroute If the traceroute command is not owned by root, this is a finding.
Fix: F-30302r2_fix
Change the owner of the traceroute command to root. # chown root /usr/contrib/bin/traceroute
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003980
- Vuln IDs
-
- V-4370
- Rule IDs
-
- SV-35154r1_rule
Checks: C-35010r1_chk
Check the group ownership of the traceroute file. Procedure: # ls -lL /usr/contrib/bin/traceroute If the traceroute command is not group-owned by root, sys, bin, or other, this is a finding.
Fix: F-30305r1_fix
Change the group-owner of the traceroute command to root. See the following example: # chgrp root /usr/contrib/bin/traceroute
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004000
- Vuln IDs
-
- V-4371
- Rule IDs
-
- SV-38435r1_rule
Checks: C-36553r1_chk
# ls -lL /usr/contrib/bin/traceroute If the traceroute command has a mode more permissive than 0700, this is a finding.
Fix: F-31919r1_fix
Change the mode of the traceroute command. # chmod 0700 /usr/contrib/bin/traceroute
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN004220
- Vuln IDs
-
- V-4382
- Rule IDs
-
- SV-35158r1_rule
Checks: C-35012r4_chk
Look in the root account home directory for a .netscape or a .mozilla directory. If none exists, this is not a finding. If there is one, verify with the root users and the IAO what the intent of the browsing is. Some evidence may be obtained by using the browser to view cached pages under the .netscape directory. # find `cat /etc/passwd | grep "^root" | cut -f 6,6 -d ":"` -type d \( -name \.mozilla -o -name .netscape \) If the find command returns any output for either browser directories, this is a finding. After the fact, it should be verified with the root users and the IAO what official business function(s) the browsers support and that it has been correctly documented.
Fix: F-30307r1_fix
Enforce policy requiring administrative accounts use Web browsers only for local service administration.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN004560
- Vuln IDs
-
- V-4384
- Rule IDs
-
- SV-38436r1_rule
Checks: C-36570r1_chk
To check for the Sendmail version being displayed in the greeting: # telnet localhost 25 If a version number is displayed, this is a finding.
Fix: F-31938r1_fix
Ensure Sendmail or its equivalent has been configured to mask the version information. If necessary, change the O SmtpGreetingMessage line in the /etc/sendmail.cf file as noted below: O SmtpGreetingMessage=$j Sendmail $v/$Z; $b change it to: O SmtpGreetingMessage= Mail Server Ready ; $b Then restart the Sendmail service.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN004580
- Vuln IDs
-
- V-4385
- Rule IDs
-
- SV-35061r1_rule
Checks: C-36571r1_chk
Search for any .forward files (typically found in a user's home directory) on the system by: # find / -type f -name .forward This is considered a finding if any .forward files are found on the system.
Fix: F-31939r1_fix
Remove .forward files from the system.
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN005000
- Vuln IDs
-
- V-4387
- Rule IDs
-
- SV-35106r1_rule
Checks: C-36588r1_chk
Check the shell for the anonymous FTP account. # cat /etc/passwd | grep "^ftp" | cut -f 7,7 -d ":" | \ egrep -c -i "\/bin\/false|\/dev\/null|\/usr\/bin\/false|\/bin\/true|\/sbin\/nologin" This is a finding if the seventh field is empty (the entry ends with a colon[:]) or if the seventh field does not contain one of the following: /bin/false /dev/null /usr/bin/false /bin/true /sbin/nologin
Fix: F-31956r1_fix
Configure anonymous FTP accounts to use a non-functional shell. If necessary, edit the /etc/passwd file to remove any functioning shells associated with the FTP account and replace them with non-functioning shells, such as /dev/null.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005020
- Vuln IDs
-
- V-4388
- Rule IDs
-
- SV-35108r1_rule
Checks: C-36590r2_chk
Is FTP installed? # ls -lL /usr/lbin/ftpd If ftpd is not installed, this is not a finding. If ftpd is installed, determine if there is an anonymous ftp user configured in /etc/passwd. # cat /etc/passwd | egrep -c "^ftp|^anonymous" The /etc/passwd file, home directory entry for the anonymous FTP user should appear as the following example: ftp:4rL2xXxDatENY:509:159::/home/ftp/./:/usr/bin/false If there is an anonymous ftp user configured in /etc/passwd, determine if the ftp/anonymous user's home directory entry in the /etc/passwd file configured for chroot? # cat /etc/passwd | egrep "^ftp|^anonymous" | cut -f 6,6 -d ":" A dot (.) in field 6 of the FTP /etc/passwd file determines where the chroot will be performed. In the above example, the new root directory is /home/ftp. If an anonymous ftp user is found and the above command does not return an absolute path with a home directory of "dot" (see the above example), this is a finding.
Fix: F-31957r2_fix
Using the HP-SMH, configure the anonymous FTP service to operate in a chroot environment.
- RMF Control
- SC-32
- Severity
- Medium
- CCI
- CCI-001208
- Version
- GEN005380
- Vuln IDs
-
- V-4392
- Rule IDs
-
- SV-35181r1_rule
Checks: C-35026r1_chk
NOTE: This will virtually always require a manual review. Ask the SA if this is an NMS server. If it is an NMS server, then ask what other applications run on it. If there is anything other than network management software and DBMS software used only for the storage and inquiry of NMS data, this is a finding.
Fix: F-30318r1_fix
Ensure only authorized software is loaded on a designated NMS server. Authorized software is limited to the NMS software itself, a database management system for the NMS server if necessary, and network management software.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005400
- Vuln IDs
-
- V-4393
- Rule IDs
-
- SV-38437r1_rule
Checks: C-36621r1_chk
Check /etc/syslog.conf ownership. # ls -lL /etc/syslog.conf If either /etc/syslog.conf is not owned by bin, this is a finding.
Fix: F-31988r1_fix
Use the chown command to set the owner to bin. # chown bin /etc/syslog.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005420
- Vuln IDs
-
- V-4394
- Rule IDs
-
- SV-35186r1_rule
Checks: C-35030r1_chk
Check /etc/syslog.conf group ownership. # ls -lL /etc/syslog.conf If /etc/syslog.conf is not group-owned by root, sys, bin, or other, this is a finding.
Fix: F-30322r1_fix
Change the group owner of the /etc/syslog.conf file to root, bin, sys, or other. # chgrp root /etc/syslog.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005460
- Vuln IDs
-
- V-4395
- Rule IDs
-
- SV-35192r1_rule
Checks: C-35037r1_chk
Examine the syslog.conf file for any references to remote log hosts. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep "\@" Destinations beginning with the @ symbol represent log hosts. If the log host name is a local alias such as loghost, consult the /etc/hosts or other name databases as necessary to obtain the canonical name or address for the log host. Determine if the host referenced is a log host documented using site-defined procedures. If an undocumented log host is referenced, this is a finding.
Fix: F-30328r1_fix
Remove or document the referenced undocumented log host.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005560
- Vuln IDs
-
- V-4397
- Rule IDs
-
- SV-30080r1_rule
Checks: C-36669r1_chk
Check the system for an IPv4 default route. # netstat -r |grep default If a default route is not defined, this is a finding.
Fix: F-32042r1_fix
Edit /etc/rc.config.d/netconf and add configuration for a default route. For a default gateway of 192.168.3.1: ROUTE_DESTINATION[0]=default ROUTE_MASK[0]="" ROUTE_GATEWAY[0]=192.168.3.1 ROUTE_COUNT[0]=1 ROUTE_ARGS[0]="" Restart the system for the setting to take effect.
- RMF Control
- SC-32
- Severity
- Medium
- CCI
- CCI-001208
- Version
- GEN005580
- Vuln IDs
-
- V-4398
- Rule IDs
-
- SV-35156r1_rule
Checks: C-35011r1_chk
Ask the SA if the system is a designated router. If it is not, this is not applicable. If this system is a designated router, check the system for non-routing network services. # netstat -a | grep -i listen # ps -ef If non-routing services, including Web servers, file servers, DNS servers, or applications servers, but excluding management services such as SSH and SNMP, are running on the system, this is a finding.
Fix: F-30306r1_fix
Ensure only authorized software is loaded on a designated router. Authorized software will be limited to the most current version of routing protocols and SSH for system administration purposes.
- RMF Control
- AC-17
- Severity
- High
- CCI
- CCI-001436
- Version
- GEN006380
- Vuln IDs
-
- V-4399
- Rule IDs
-
- SV-35147r1_rule
Checks: C-36719r1_chk
If the system does not use NIS or NIS+, this is not applicable. Check if NIS or NIS+ is implemented using UDP. # rpcinfo -p | grep yp | grep udp If NIS or NIS+ is implemented using UDP, this is a finding.
Fix: F-30298r1_fix
Configure the system to not use UDP for NIS and NIS+. HP-UX specific documentation (note the major version of NIS+ currently running) should be consulted for the required procedure.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002020
- Vuln IDs
-
- V-4427
- Rule IDs
-
- SV-38438r1_rule
Checks: C-36375r1_chk
Locate and examine all .rhosts, .shosts, hosts.equiv, and shosts.equiv files. Procedure: # find / -name .rhosts # more /<directorylocation>/.rhosts # find / -name .shosts # more /<directorylocation>/.shosts # find / -name hosts.equiv # more /<directorylocation>/hosts.equiv # find / -name shosts.equiv # more /<directorylocation>/shosts.equiv If any .rhosts, .shosts, hosts.equiv, or shosts.equiv file contains anything other than host-user pairs, this is a finding.
Fix: F-32971r1_fix
Locate and examine all .rhosts, .shosts, hosts.equiv, and shosts.equiv files. Procedure: # find / -name .rhosts # more /<directorylocation>/.rhosts # find / -name .shosts # more /<directorylocation>/.shosts # find / -name hosts.equiv # more /<directorylocation>/hosts.equiv # find / -name shosts.equiv # more /<directorylocation>/shosts.equiv If any .rhosts, .shosts, hosts.equiv, or shosts.equiv file contains anything other than host-user pairs, this is a finding.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002060
- Vuln IDs
-
- V-4428
- Rule IDs
-
- SV-34960r1_rule
Checks: C-8220r2_chk
# find / -type f -name .rhosts # ls -alL /<directorylocation>/.rhosts # find / -type f -name .shosts # ls -alL /<directorylocation>/.shosts # find / -type f -name hosts.equiv # ls -lL /<directorylocation>/hosts.equiv # find / -type f -name shosts.equiv # ls -lL /<directorylocation>/shosts.equiv If the .rhosts, .shosts, hosts.equiv, or shosts.equiv files have permissions greater than 700, this is a finding.
Fix: F-4327r2_fix
Ensure the permission for these files is set at 700 or less and the owner is the owner of the home directory that it is in. These files, outside of home directories (other than hosts.equiv which is in /etc and owned by root), have no meaning.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003260
- Vuln IDs
-
- V-4430
- Rule IDs
-
- SV-38439r1_rule
Checks: C-36468r1_chk
# ls -lL /var/adm/cron/cron.deny If the cron.deny file is not owned by root, sys, or bin, this is a finding.
Fix: F-31810r1_fix
# chown root /var/adm/cron/cron.deny
- RMF Control
- AC-17
- Severity
- High
- CCI
- CCI-000068
- Version
- GEN003820
- Vuln IDs
-
- V-4687
- Rule IDs
-
- SV-35130r1_rule
Checks: C-34988r1_chk
# cat /etc/inetd.conf | grep -v "^#" | grep -c remshd If the above command return value is greater than 0, this is a finding.
Fix: F-30282r1_fix
Edit /etc/inetd.conf and comment out the remshd service. Refresh the inetd service. # inetd -c
- RMF Control
- AC-17
- Severity
- High
- CCI
- CCI-001435
- Version
- GEN003840
- Vuln IDs
-
- V-4688
- Rule IDs
-
- SV-35132r2_rule
Checks: C-34990r3_chk
# cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | \ cut -f 6,7 -d " " | grep -c -i rexecd If any results are returned, this is a finding.
Fix: F-30284r1_fix
Edit /etc/inetd.conf and comment out the line for the rexec daemon service. Restart the inetd service via the following command: # inetd -c
- RMF Control
- SI-2
- Severity
- High
- CCI
- CCI-001230
- Version
- GEN004600
- Vuln IDs
-
- V-4689
- Rule IDs
-
- SV-35065r2_rule
Checks: C-36572r2_chk
Determine the version of the SMTP service software. To obtain version information for the Sendmail daemon: # what /usr/sbin/sendmail OR # strings /usr/sbin/sendmail | grep -i version If the Sendmail version is not at least 8.14.4, or if it is not the vendor's latest version, this is a finding.
Fix: F-31940r1_fix
Obtain and install a newer version of Sendmail from the operating system vendor or from http://www.sendmail.org or ftp://ftp.cs.berkeley.edu/ucb/sendmail.
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- GEN004620
- Vuln IDs
-
- V-4690
- Rule IDs
-
- SV-35070r1_rule
Checks: C-36573r1_chk
Check for an enabled debug command provided by the SMTP service. # telnet localhost 25 debug If the command does not return a 500 error code of command unrecognized, this is a finding.
Fix: F-4618r2_fix
Obtain and install a more recent version of Sendmail, which does not implement the DEBUG feature.
- RMF Control
- SI-2
- Severity
- High
- CCI
- CCI-001230
- Version
- GEN004640
- Vuln IDs
-
- V-4691
- Rule IDs
-
- SV-35071r1_rule
Checks: C-36574r1_chk
Check the SMTP service for an active decode command. # telnet localhost 25 decode If the command does not return a 500 error code of command unrecognized, this is a finding.
Fix: F-31942r1_fix
Disable mail aliases for decode and uudecode. If the /etc/mail/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the newaliases command. For more information on mail aliases, refer to the man page for aliases. Disabled aliases would be similar to these (commented) file entry examples: # decode: |/usr/bin/uudecode # uudecode: |/usr/bin/uuencode -d
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN004660
- Vuln IDs
-
- V-4692
- Rule IDs
-
- SV-35076r1_rule
Checks: C-36575r1_chk
Perform the following to determine if EXPN is disabled: # telnet localhost 25 expn root If the command does not return a 500 error code (command unrecognized), this is a finding. OR Check the sendmail.cf configuration file by: # cat /etc/mail/sendmail.cf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" |\ grep -i privacyoptions | egrep -c -i "noexpn|goaway" The O PrivacyOptions should have the noexpn or the goaway option (covering both noexpn and novrfy). If the EXPN command is not disabled, this is a finding.
Fix: F-31943r1_fix
Edit the /etc/mail/sendmail.cf file and add or edit the following line: O PrivacyOptions=goaway Then restart the Sendmail service.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN004680
- Vuln IDs
-
- V-4693
- Rule IDs
-
- SV-35083r1_rule
Checks: C-36576r1_chk
Determine if VRFY is disabled. # telnet localhost 25 vrfy root If the command does not return a 500 error code of command unrecognized, this is a finding. OR Check the sendmail.cf configuration file by: # cat /etc/mail/sendmail.cf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ grep -i privacyoptions | egrep -c -i "goaway|novrfy" Ensure the VRFY command is disabled with an entry in the sendmail.cf file. The entry could be any one of Opnovrfy, novrfy, or goaway, which could also have other options included, such as noexpn. The goaway argument encompasses many things, such as novrfy and noexpn. If no setting to disable VRFY is found, this is a finding.
Fix: F-31944r1_fix
If running Sendmail, add the line Opnovrfy to the Sendmail configuration file, usually located in /etc/mail/sendmail.cf. For other mail servers, contact the vendor for information on how to disable the verify command. Newer versions of Sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail. Edit the /etc/mail/sendmail.cf file and add or edit (one of) the following line(s): O PrivacyOptions=novrfy O PrivacyOptions=goaway Then restart the Sendmail service.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN004700
- Vuln IDs
-
- V-4694
- Rule IDs
-
- SV-35093r1_rule
Checks: C-36577r1_chk
Check the /etc/mail/sendmail.cf configuration file for "wiz" configuration. # cat /etc/mail/sendmail.cf |tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" |\ grep -i wiz If an entry is found for wiz, this is a finding.
Fix: F-31945r1_fix
If the WIZ command is enabled on Sendmail, it should be disabled by adding this line to the sendmail.cf configuration file (note that it must be typed in uppercase): OW* For the change to take effect, kill the Sendmail process, refreeze the sendmail.cf file, and restart the Sendmail process.
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN005140
- Vuln IDs
-
- V-4695
- Rule IDs
-
- SV-38440r1_rule
Checks: C-36597r1_chk
Determine if the TFTP daemon is active. # grep -v "^#" /etc/inetd.conf |grep tftp If TFTP is enabled, it is a finding if it is not documented by site-defined procedures.
Fix: F-31963r1_fix
Disable the TFTP daemon. Edit /etc/inetd.conf and comment out the tftp line. Restart the inetd service via the command: # inetd -c
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN005280
- Vuln IDs
-
- V-4696
- Rule IDs
-
- SV-35171r1_rule
Checks: C-36605r1_chk
# cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i uucp If uucp is found enabled, this is a finding.
Fix: F-31973r1_fix
Edit /etc/inetd.conf and comment the uucp service entry. Restart the inetd service. # inetd -c
- RMF Control
- AC-6
- Severity
- High
- CCI
- CCI-000225
- Version
- GEN005200
- Vuln IDs
-
- V-4697
- Rule IDs
-
- SV-35168r1_rule
Checks: C-36601r1_chk
Windows is not used on the system, this is not applicable. Check the output of the "xhost" command from an X terminal. First, verify the DISPLAY variable is correctly set. $ echo $DISPLAY NOTE: It may be necessary to define the display if the command reports it cannot open the display. MachineName may be replaced with an Internet Protocol Address. Repeat the check procedure after setting the display. $ DISPLAY=MachineName:0.0; export DISPLAY $ xhost If the output reports access control is enabled (and possibly lists the hosts that can receive X window logins), this is not a finding. If the xhost command returns a line indicating access control is disabled, this is a finding.
Fix: F-31968r1_fix
If using an xhost-type authentication the xhost - command can be used to remove current trusted hosts and then selectively allow only trusted hosts to connect with xhost + commands. A cryptographically secure authentication, such as provided by the xauth program, is always preferred.
- RMF Control
- AC-4
- Severity
- Low
- CCI
- CCI-001551
- Version
- GEN003860
- Vuln IDs
-
- V-4701
- Rule IDs
-
- SV-35136r1_rule
Checks: C-34994r1_chk
# cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | \ cut -f 6,7 -d " " | grep -c -i fingerd If the fingerd service is not disabled, this is a finding.
Fix: F-30288r1_fix
Edit /etc/inetd.conf and comment out the fingerd line. Restart the inetd service via the following command: # inetd -c
- RMF Control
- IA-4
- Severity
- Medium
- CCI
- CCI-000787
- Version
- GEN004840
- Vuln IDs
-
- V-4702
- Rule IDs
-
- SV-35101r1_rule
Checks: C-36581r1_chk
Use the command ftp to connect the system's FTP service. Attempt to log into this host with a user name of anonymous and a password of guest (also try the password of guest@mail.com). If the logon is not successful, this check is not applicable. # ftp localhost OR # ftp `hostname` Ask the SA if the system is located on a DMZ network. If the system is not located on a DMZ network, this is a finding.
Fix: F-31949r1_fix
Move the system to a DMZ network.
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000293
- Version
- GEN000140
- Vuln IDs
-
- V-11941
- Rule IDs
-
- SV-38271r1_rule
Checks: C-36231r2_chk
This will always be a manual review. Determine if a file integrity baseline, which includes cryptographic hashes, has been created and maintained for the system. While HPUX-HIDS has the ability to detect file system changes, it does not currently support the creation of a system baseline. A number of third-party vendors (TripWire, for example) may be used for this purpose. Additionally, local scripts may also be used to create and maintain the system baseline, though this would not be the preferred method. Ask the SA if a file system baseline has been created and is being maintained on an ongoing basis. If no file integrity baseline exists for the system, this is a finding. If the file integrity baseline contains no cryptographic hashes, this is a finding. If the file integrity baseline is not maintained (i.e., the baseline has not been updated to be consistent with the latest approved system configuration changes), this is a finding.
Fix: F-31490r1_fix
Create a file integrity baseline, including cryptographic hashes, for the system. # find / -depth -print | tee HP11-v3_Baseline Open the above file and either manually execute md5sum or the chksum command on each file. Alternatively, write a script to perform the above. NOTE: For security purposes, md5sum is preferred over chksum.
- RMF Control
- RA-5
- Severity
- Medium
- CCI
- CCI-001069
- Version
- GEN000220
- Vuln IDs
-
- V-11945
- Rule IDs
-
- SV-28610r2_rule
Checks: C-28849r3_chk
Determine if there is a cron job, scheduled to run weekly or more frequently, to run the file integrity tool to check for unauthorized system libraries or binaries, or unauthorized modification to authorized system libraries or binaries. Procedure: # crontab -l If there is no cron job meeting these requirements, this is a finding. NOTE: The frequency may be increased to daily, if necessary, in accordance with the contingency plan.
Fix: F-25883r3_fix
Create a cron job, scheduled to run weekly or more frequently, to run the file integrity tool to check for unauthorized system libraries or binaries, or unauthorized modification to authorized system libraries or binaries. NOTE: The frequency may be increased to daily, if necessary, in accordance with the contingency plan.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000340
- Vuln IDs
-
- V-11946
- Rule IDs
-
- SV-38209r1_rule
Checks: C-36258r1_chk
Check the UID assignments of all accounts. # more /etc/passwd Confirm all accounts with a UID of 99 and below are used by a system account. If a UID reserved for system accounts (0 - 99) is used by a non-system account, this is a finding.
Fix: F-31515r1_fix
Using the passwd command, change the UID numbers for non-system accounts with reserved UIDs (those less or equal to 99). SMH can alternatively be used for this same purpose.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000205
- Version
- GEN000580
- Vuln IDs
-
- V-11947
- Rule IDs
-
- SV-27111r4_rule
Checks: C-28027r5_chk
For Trusted Mode: Check the system password length setting. For Trusted systems, the range of supported values for N is 6 to 80. # grep MIN_PASSWORD_LENGTH /etc/default/security If the MIN_PASSWORD_LENGTH attribute (N) is not set to 15 or greater, this is a finding. For SMSE: Check the system password length setting. For Standard (non-SMSE enabled) systems, the maximum supported length is N=8. Once the /etc/shadow file is created and long passwords are enabled (may require additional software product installations), check the system password length setting. The LONG_PASSWORD attribute is valid only when the LongPassword11i3 product is installed and the password hash algorithm is different from the traditional DES-based hash algorithm. # egrep "CRYPT_ALGORITHMS_DEPRECATE|CRYPT_DEFAULT|LONG_PASSWORD|MIN_PASSWORD_LENGTH" /etc/default/security /var/adm/userdb/* The following is an example output from the above command: CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 LONG_PASSWORD=1 MIN_PASSWORD_LENGTH=15 Note: The MIN_PASSWORD_LENGTH attribute may exceed 15 characters. If the attributes CRYPT_ALGORITHMS_DEPRECATE, CRYPT_DEFAULT, LONG_PASSWORD, and MIN_PASSWORD_LENGTH are not set per the above example output, this is a finding.
Fix: F-24374r5_fix
For Trusted Mode: Use the SAM/SMH interface to set the system password length attribute “MIN_PASSWORD_LENGTH” to 15 or greater. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Install the additional LongPassword11i3 and PHI11i3 product bundles where/as required. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute(s). See the below example(s): CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 LONG_PASSWORD=1 MIN_PASSWORD_LENGTH=15 Note: The MIN_PASSWORD_LENGTH attribute must be set equal to or greater than 15. If the "vi" editor was used to update the /etc/default/security file, save the file before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000192
- Version
- GEN000600
- Vuln IDs
-
- V-11948
- Rule IDs
-
- SV-38244r2_rule
Checks: C-36284r2_chk
For Trusted Mode: Check the PASSWORD_MIN_UPPER_CASE_CHARS setting. # cat /etc/default/security | grep PASSWORD_MIN_UPPER_CASE_CHARS If PASSWORD_MIN_UPPER_CASE_CHARS is not set to 1 or greater, this is a finding. For SMSE: Check the PASSWORD_MIN_UPPER_CASE_CHARS setting. # grep PASSWORD_MIN_UPPER_CASE_CHARS /etc/default/security /var/adm/userdb/* If PASSWORD_MIN_UPPER_CASE_CHARS is not set to 1 or more, this is a finding.
Fix: F-31541r2_fix
For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_UPPER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_UPPER_CASE_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_UPPER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_UPPER_CASE_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000194
- Version
- GEN000620
- Vuln IDs
-
- V-11972
- Rule IDs
-
- SV-38245r2_rule
Checks: C-36285r2_chk
For Trusted Mode: Check the PASSWORD_MIN_DIGIT_CHARS setting. # cat /etc/default/security | grep PASSWORD_MIN_DIGIT_CHARS If PASSWORD_MIN_DIGIT_CHARS is not set to 1 or greater this is a finding. For SMSE: Check the PASSWORD_MIN_DIGIT_CHARS setting. # grep PASSWORD_MIN_DIGIT_CHARS /etc/default/security /var/adm/userdb/* If PASSWORD_MIN_DIGIT_CHARS is not set to 1 or greater, this is a finding.
Fix: F-31542r2_fix
For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_DIGIT_CHARS attribute. See the below example: PASSWORD_MIN_DIGIT_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_DIGIT_CHARS attribute. See the below example: PASSWORD_MIN_DIGIT_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-001619
- Version
- GEN000640
- Vuln IDs
-
- V-11973
- Rule IDs
-
- SV-38246r2_rule
Checks: C-36286r2_chk
For Trusted Mode: Check the PASSWORD_MIN_SPECIAL_CHARS setting. # cat /etc/default/security | grep PASSWORD_MIN_SPECIAL_CHARS If PASSWORD_MIN_SPECIAL_CHARS is not set to 1 or greater this is a finding. For SMSE: Check the PASSWORD_MIN_SPECIAL_CHARS setting. # grep PASSWORD_MIN_SPECIAL_CHARS /etc/default/security /var/adm/userdb/* If PASSWORD_MIN_SPECIAL_CHARS is not set to 1 or greater, this is a finding.
Fix: F-31543r2_fix
For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_SPECIAL_CHARS attribute. See the below example: PASSWORD_MIN_SPECIAL_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_SPECIAL_CHARS attribute. See the below example: PASSWORD_MIN_SPECIAL_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000180
- Version
- GEN000700
- Vuln IDs
-
- V-11976
- Rule IDs
-
- SV-38247r3_rule
Checks: C-36288r3_chk
For Trusted Mode: Check the exptm field for each user, or for all accounts: # getprpw -r -m exptm <USER> # logins -o -x | awk -F: '{print $1” “$11}' If the exptm attribute is set equal to -1, 0, or greater than 60 for any user, this is a finding. For SMSE: Check the PASSWORD_MAXDAYS setting. The command and an example output is seen directly below: # egrep “PASSWORD_MAXDAYS|PASSWORD_WARNDAYS” /etc/default/security /var/adm/userdb/* Example output from the above command, with the correctly assigned attribute values. Note that PASSWORD_MAXDAYS may deviate from 60. Illegal values include 0 (no warning). PASSWORD_MAXDAYS attribute exceptions that must not be used are 1-7 (values less than or equal to the required PASSWORD_WARNDAYS attribute setting): PASSWORD_MAXDAYS=60 PASSWORD_WARNDAYS=7 If the above attributes are either missing or not set per the above attribute values (exceptions noted above), this is a finding.
Fix: F-31545r2_fix
For Trusted Mode: Set the password maximum days field to 60 for all user accounts. # passwd -x 60 <user> For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MAXDAYS attribute. See the below example: PASSWORD_MAXDAYS=60 PASSWORD_WARNDAYS=7 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000199
- Version
- GEN000740
- Vuln IDs
-
- V-11977
- Rule IDs
-
- SV-38211r1_rule
Checks: C-36296r1_chk
NOTE: This will always require a manual review. This is a local policy issue/question. Ask the Systems Administrator (SA) if there are any automated processing accounts on the system. If there are, ask the SA if the passwords for those automated accounts are changed at least once a year. If SA indicates passwords for automated processing accounts are not changed once per year, this is a finding
Fix: F-31546r1_fix
Implement or establish procedures to change the passwords of automated processing accounts at least once per year.
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000770
- Version
- GEN001020
- Vuln IDs
-
- V-11979
- Rule IDs
-
- SV-38212r2_rule
Checks: C-36290r5_chk
For Trusted Mode: Check the /tcb database to determine if root account auditing is enabled and the last login log for direct root logins. Note that for the /tcb audit flag entry that numeric values are specified as positive numbers, 0, or -1. A value of -1 indicates that the field has not been assigned a value in the database. A value of 0 indicates that auditing is not enabled. # getprpw -m audflg root && last root | grep -v reboot If any direct login records for root are listed, this is a finding. For SMSE: Check the root AUDIT_FLAG attribute setting. Note that for the /etc/default/security file audit flag entry that numeric values are specified as 0, or 1. A value of 1 indicates that auditing is enabled. A value of 0 indicates that auditing is not enabled. # grep AUDIT_FLAG /etc/default/security /var/adm/userdb/* && last root | grep -v reboot If any direct login records for root are listed, this is a finding.
Fix: F-31547r2_fix
Enforce policies requiring all root account access is attained by first logging into a user account and then becoming root (using “su”, for example). Note: GEN000980 limits direct login by root to the console (requires physical access). GEN001120 prohibits direct root logins via SSH. GEN003850 disallows telnet access. GEN003830 prohibits rlogin access. GEN002100 prohibits .rhost PAM support. GEN002040 prohibits .rhosts, .shosts, hosts.equiv, or shosts.equiv system files. Ensure that root logging is enabled. For Trusted Mode: # modprpw -l -m audflg=1 root For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute. See the below example: AUDIT_FLAG=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN001060
- Vuln IDs
-
- V-11980
- Rule IDs
-
- SV-38248r2_rule
Checks: C-36291r2_chk
Check the following log files to determine if access attempts to the root account are being logged. Try su - and enter an incorrect password. # more /var/adm/sulog /var/adm/syslog If root account access login attempts are not being logged, this is a finding.
Fix: F-31548r2_fix
For Trusted Mode: Ensure that all users are being audited. List users from the passwd file and check the user entries in the /tcb database. See the example below. Note that the “getprpw” command must be executed individually for all users. Users associated with “audflg” set to zero (disabled) must be corrected. # cat /etc/passwd | cut -f 1,1 -d “:” # getprpw -m audflg <user> # modprpw -l -m audflg=1 <user> Use the SAM/SMH interface (/etc/default/security file) to update the SU_ROOT_GROUP attribute. See the below example: SU_ROOT_GROUP=root,<user1>,<user2> For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the AUDIT_FLAG and SU_ROOT_GROUP attributes. See the below example: AUDIT_FLAG=1 SU_ROOT_GROUP=root,<user1>,<user2> Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001720
- Vuln IDs
-
- V-11981
- Rule IDs
-
- SV-38266r1_rule
Checks: C-36376r1_chk
Check global initialization files permissions: # ls -lL /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/.login If global initialization files are more permissive than 0444, this is a finding.
Fix: F-31714r1_fix
Change the mode of the global initialization file(s) to 0444. # chmod 0444 <global initialization file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001740
- Vuln IDs
-
- V-11982
- Rule IDs
-
- SV-38267r1_rule
Checks: C-36377r1_chk
Check the ownership of global initialization files. # ls -lL /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/.login If any global initialization file is not owned by bin, this is a finding.
Fix: F-31715r1_fix
Change the ownership of global initialization files with incorrect ownership. # chown bin <global initialization files>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001760
- Vuln IDs
-
- V-11983
- Rule IDs
-
- SV-38268r1_rule
Checks: C-36378r1_chk
Check the group ownership of global initialization files. # ls -lL /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/.login If any global initialization file is not group-owned by root, sys, bin, other, or the system default, this is a finding.
Fix: F-31716r1_fix
Change the group ownership of the global initialization file(s) with incorrect group ownership. # chgrp root <global initialization file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001820
- Vuln IDs
-
- V-11984
- Rule IDs
-
- SV-38269r1_rule
Checks: C-36379r1_chk
Check skeleton files ownership. # ls -alL /etc/skel If a skeleton file is not owned by bin, this is a finding.
Fix: F-31717r1_fix
Change the ownership of skeleton files with incorrect mode. # chown bin <skeleton file>
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001840
- Vuln IDs
-
- V-11985
- Rule IDs
-
- SV-38270r3_rule
Checks: C-36380r4_chk
Check the global initialization files' executable search paths. # grep PATH /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/environment /etc/.login This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31718r2_fix
Edit the global initialization file(s) with PATH variables containing relative paths and remove any relative path form the PATH variables that have not been documented with the ISSO. Edit the global initialization file(s) and remove any empty entry that is defined.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001900
- Vuln IDs
-
- V-11986
- Rule IDs
-
- SV-34915r3_rule
Checks: C-37677r3_chk
Verify local initialization files have executable search path containing only authorized paths. # cat /etc/passwd | cut -f 1,1 -d ":" | xargs -n1 -I USER sh -c 'grep PATH ~USER/.*' This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-32917r2_fix
Edit the local initialization file and remove the relative path entries from the PATH variable that have not been documented with the ISSO. Edit the local initialization file and remove any empty entry that is defined.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001980
- Vuln IDs
-
- V-11987
- Rule IDs
-
- SV-34922r1_rule
Checks: C-37678r1_chk
Check system configuration files for plus (+) entries. Procedure: # find / -name .rhosts # cat /<directorylocation>/.rhosts | grep -v "^#" | grep "\+" # find / -name .shosts # cat /<directorylocation>/.shosts | grep -v "^#" | grep "\+" # find / -name hosts.equiv # cat /<directorylocation>/hosts.equiv | grep -v "^#" | grep "\+" # find / -name shosts.equiv # cat /<directorylocation>/shosts.equiv | grep -v "^#" | grep "\+" # cat /etc/passwd | grep -v "^#" | grep "\+" # cat /etc/shadow | grep -v "^#" | grep "\+" # cat /etc/group | grep -v "^#" | grep "\+" If the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files contain a plus (+) and do not define entries for NIS+ netgroups, this is a finding.
Fix: F-32918r1_fix
Edit the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files and remove entries containing a plus (+).
- RMF Control
- CM-6
- Severity
- High
- CCI
- CCI-000366
- Version
- GEN002040
- Vuln IDs
-
- V-11988
- Rule IDs
-
- SV-38249r1_rule
Checks: C-36421r1_chk
Check for the existence of the files. # find / -type f -name .rhosts # find / -type f -name .shosts # find / -type f -name hosts.equiv # find / -type f -name shosts.equiv If .rhosts, .shosts, hosts.equiv, or shosts.equiv are found, this is a finding.
Fix: F-31760r1_fix
Remove the .rhosts, .shosts, hosts.equiv, and/or shosts.equiv files.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002100
- Vuln IDs
-
- V-11989
- Rule IDs
-
- SV-38264r2_rule
Checks: C-36422r3_chk
Verify the remsh and rexec services have not been configured to use the PAM module: # cat /etc/pam.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep "^rcomds" | egrep "auth|account" | egrep "libpam_unix|libpam_hpsec" If any of the following lines are returned, this is a finding. rcomds auth required libpam_hpsec.so.1 rcomds auth required libpam_unix.so.1 rcomds account required libpam_hpsec.so.1 rcomds account required libpam_unix.so.1
Fix: F-31761r1_fix
Edit /etc/pam.conf and comment/remove the "rcomds" line(s).
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002540
- Vuln IDs
-
- V-11990
- Rule IDs
-
- SV-38265r1_rule
Checks: C-36423r2_chk
Check the group-ownership of public directories. Procedure: # find / -type d -perm -1002 -exec ls -ld {} \; If any public directory is not group-owned by root, sys, bin, other or an application group, this is a finding.
Fix: F-31762r1_fix
Change the group-ownership of the public directory. Procedure: # chgrp root <public directory> (Replace root with a different system group as necessary.)
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003040
- Vuln IDs
-
- V-11994
- Rule IDs
-
- SV-38250r1_rule
Checks: C-36480r1_chk
List all crontabs on the system. # ls -lL /var/spool/cron/crontabs/* If any crontab file is not owned by root or the creating user, this is a finding.
Fix: F-31827r1_fix
Change the crontab file owner to root or the crontab creator. # chown root <crontab file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003060
- Vuln IDs
-
- V-11995
- Rule IDs
-
- SV-38251r1_rule
Checks: C-36469r1_chk
Check the cron.allow and cron.deny files for the system. # more /var/adm/cron/cron.allow # more /var/adm/cron/cron.deny If a default system account (such as bin, sys, adm, or other sys acct) is listed in the cron.allow file, or not listed in the cron.deny file if no cron.allow file exists, this is a finding.
Fix: F-31812r1_fix
Remove default system accounts (such as bin, sys, adm, or others) from the cron.allow file if it exists, or add those accounts to the cron.deny file.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN003500
- Vuln IDs
-
- V-11996
- Rule IDs
-
- SV-35008r1_rule
Checks: C-36487r1_chk
# grep -c ulimit /etc/profile If the return value of this command is 0, this is a finding. If the return value of this command is not 0: # grep ulimit /etc/profile If the -c argument with a value of 0 is not present, this is a finding.
Fix: F-31839r1_fix
Edit /etc/profile, ensure the ulimit command is present with the -c argument of the ulimit command set to 0.
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003520
- Vuln IDs
-
- V-11997
- Rule IDs
-
- SV-38253r1_rule
Checks: C-36494r1_chk
Check the ownership of the kernel core dump data directory. # ls -lLd /var/adm/crash If the kernel core dump data directory is not owned by root, this is a finding.
Fix: F-31848r1_fix
Change the owner of the kernel core dump data directory to root. # chown root /var/adm/crash
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN003540
- Vuln IDs
-
- V-11999
- Rule IDs
-
- SV-35009r1_rule
Checks: C-36498r1_chk
Determine if the system implements non-executable program stacks. # kctune | grep -i "executable_stack" | tr '\011' ' ' | tr -s ' ' | \ sed -e 's/^[ \t]*//' | cut -f 2,2 -d " " If the executable_stack tunable is set to 1, this is a finding.
Fix: F-31853r1_fix
# kctune executable_stack=0 The system will require a restart/reboot for the setting to take effect.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN003580
- Vuln IDs
-
- V-12001
- Rule IDs
-
- SV-35010r1_rule
Checks: C-36499r1_chk
# ndd -get /dev/tcp tcp_isn_passphrase If the value 1 is not returned, this is a finding.
Fix: F-31854r1_fix
# ndd -set /dev/tcp tcp_isn_passphrase <a random passphrase> Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = tcp NDD_NAME[x] = tcp_isn_passphrase NDD_VALUE[x] = <a random passphrase>
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003600
- Vuln IDs
-
- V-12002
- Rule IDs
-
- SV-38259r1_rule
Checks: C-36500r1_chk
Determine if the system is configured to forward source-routed IP packets. # ndd -get /dev/ip ip_forward_src_routed If the returned value is not 0, then this feature is enabled, this is a finding.
Fix: F-31855r1_fix
Disable the IP source-routed forwarding feature. # ndd -set /dev/ip ip_forward_src_routed 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = ip NDD_NAME[x] = ip_forward_src_routed NDD_VALUE[x] = 0
- RMF Control
- SC-32
- Severity
- Low
- CCI
- CCI-001208
- Version
- GEN003620
- Vuln IDs
-
- V-12003
- Rule IDs
-
- SV-35048r1_rule
Checks: C-36514r1_chk
Determine if the /home path is a separate filesystem. # cat /etc/fstab | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | \ grep -v "^#" | cut -f 2,2 -d " " | grep "^/home" | grep -v "/home/" If the above command returns nothing, /home is not on a separate filesystem and this is a finding.
Fix: F-31874r1_fix
Migrate the /home (or equivalent) path onto a separate file system.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN003660
- Vuln IDs
-
- V-12004
- Rule IDs
-
- SV-35062r1_rule
Checks: C-36521r1_chk
Check /etc/syslog.conf and verify the auth facility is logging both the notice and info (NOTE that auth.info includes auth.notice and the auth.debug includes both auth.info and auth.notice) level messages by: # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | egrep -i "auth.info|auth.debug|auth.\*|\*.info|\*.debug" If auth.* is not found, or auth.notice or auth.debug or *.info and *.debug are not found, this is a finding.
Fix: F-31881r1_fix
Edit /etc/syslog.conf and add local log destinations for auth.*, auth.debug, auth.info, *.debug or *.info. NOTE: In general and though not required, it is always advisable to explicitly declare auth.info or auth.debug entries rather than use the wildcard notation method.
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN003700
- Vuln IDs
-
- V-12005
- Rule IDs
-
- SV-35064r1_rule
Checks: C-36522r1_chk
First determine if (x)inetd is running: # ps -ef | grep -v "grep" | egrep -i "inetd|xinetd" Then, determine the contents of the configuration file: # find / -type f -name xinetd.conf -o -name inetd.conf | xargs -n1 cat | \ tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" If inetd is running and no active services are found (i.e., the configuration file does not exist, is empty or is completely commented out), this is a finding. If inetd is not running and the configuration file does not exist, is empty or is completely commented out, this is not a finding. If inetd is running and active services are found via the ps command and are also in the inetd.conf file, this is not a finding.
Fix: F-31882r1_fix
Remove or disable the inetd startup scripts and kill the service.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN004540
- Vuln IDs
-
- V-12006
- Rule IDs
-
- SV-35059r2_rule
Checks: C-36569r2_chk
Verify that the Help command is disabled in Sendmail: # ls -al /etc/mail/helpfile If the file does not exist, this is not a finding. If the help file does exist, verify that the file is empty: # cat /etc/mail/helpfile If the help file is not empty, this is a finding.
Fix: F-11266r3_fix
To disable the SMTP HELP command, remove or empty the Sendmail help file: /etc/mail/helpfile.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN004800
- Vuln IDs
-
- V-12010
- Rule IDs
-
- SV-35098r1_rule
Checks: C-36579r3_chk
Determine if unencrypted FTP is enabled. # cat /etc/inetd.conf | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep -c -i "^ftp" If the service is found (i.e., the command returns a non-zero value), and not commented, ask the SA if this service is encrypted. If not, this is a finding.
Fix: F-31947r2_fix
Edit /etc/inetd.conf and comment out or remove the ftp service. Refresh the inet daemon. inetd -c
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005040
- Vuln IDs
-
- V-12011
- Rule IDs
-
- SV-38263r1_rule
Checks: C-36591r1_chk
Check the umask setting for the "ftp" user. # su - ftp $ umask If the umask value does not return 077, this is a finding.
Fix: F-31958r1_fix
Edit the initialization files for the ftp user and set the umask to 077.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005180
- Vuln IDs
-
- V-12014
- Rule IDs
-
- SV-35162r1_rule
Checks: C-36599r1_chk
Get a list of (non-system account) users and the associated home directories. # cat /etc/passwd | cut -f 1,6 -d ":" Check the file permissions for the user .Xauthority files. # ls -lLa .Xauthority If the file mode is more permissive than 0600, this is finding.
Fix: F-31965r1_fix
Change the mode of the .Xauthority files. # chmod 0600 .Xauthority
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000297
- Version
- GEN005220
- Vuln IDs
-
- V-12016
- Rule IDs
-
- SV-38287r1_rule
Checks: C-36602r1_chk
Determine if the X server is running. # ps -ef |grep -v grep | grep X Determine if xauth is being used. # xauth # xauth> list If the above command sequence does not show any host other than the localhost, then xauth is not being used. Search the system for an X*.hosts files (typically found only in /etc), where * is a display number that may be used to limit X window connections. If no files are found, X*.hosts files are not being used. If the X*.hosts files contain any unauthorized hosts, this is a finding. If both xauth and X*.hosts files are not being used, this is a finding.
Fix: F-31969r1_fix
Create an X*.hosts file, where * is a display number that may be used to limit X window connections. Add the list of authorized X clients to the file.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005240
- Vuln IDs
-
- V-12017
- Rule IDs
-
- SV-38288r1_rule
Checks: C-36603r1_chk
Verify the X window system access is limited to authorized clients. # xauth # xauth> list Ask the SA if the clients listed are authorized. If any are not, this is a finding.
Fix: F-31970r1_fix
Remove unauthorized clients from the xauth configuration. # xauth remove <display name>
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN005260
- Vuln IDs
-
- V-12018
- Rule IDs
-
- SV-35170r1_rule
Checks: C-36604r1_chk
Determine if the X window system is running. # ps -ef |grep -v grep | grep X Ask the SA if the X window system is an operational requirement. If it is not, this is a finding.
Fix: F-31972r1_fix
Disable the X Windows server on the system.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005360
- Vuln IDs
-
- V-12019
- Rule IDs
-
- SV-35203r1_rule
Checks: C-36615r2_chk
Determine the owner of the SNMP configuration file. # ls -lL /etc/SnmpAgent.d/snmpd.conf If the snmpd.conf file is not owned by bin, this is a finding.
Fix: F-31981r2_fix
Change the owner of the snmpd.conf file to bin. # chown bin /etc/SnmpAgent.d/snmpd.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005440
- Vuln IDs
-
- V-12020
- Rule IDs
-
- SV-35187r1_rule
Checks: C-36623r2_chk
The syslog server's /etc/syslog.conf file must have the client(s) listed along with the logging facility. The following example is a syslog.conf entry for the syslog client machine moe.larry.com: +example.com *.* /var/adm/log/example_com.log NOTE: This will virtually always require a manual review. Ask the SA if the loghost server is collecting data for hosts outside the local enclave. If it is, this is a finding.
Fix: F-31990r2_fix
Configure hosts outside of the local enclave to not log to this system.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005480
- Vuln IDs
-
- V-12021
- Rule IDs
-
- SV-35195r1_rule
Checks: C-36626r1_chk
Examine the /etc/rc.config.d/syslogd file for the syslog daemon option(s): # cat /etc/rc.config.d/syslogd | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep "SYSLOG_OPTS" Note that the default line entry format (IE: whitespace-seperated options, quotation marks, etc) of the syslogd file is as follows : SYSLOGD_OPTS="-N" If the -N option is not present, this is a finding.
Fix: F-31993r1_fix
Edit the /etc/rc.config.d/syslogd configuration startup script and add the -N option to the syslogd command. Restart the syslogd service via the following command(s): # /sbin/init.d/syslogd stop # /sbin/init.d/syslogd start
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005540
- Vuln IDs
-
- V-12022
- Rule IDs
-
- SV-35149r1_rule
Checks: C-36667r1_chk
Check the TCP wrappers configuration files to determine if sshd is configured to use TCP wrappers. # cat /etc/hosts.deny | grep -i sshd # cat /etc/hosts.allow| grep -i sshd If no entries are returned, the TCP wrappers are not configured for sshd, this is a finding.
Fix: F-32040r1_fix
Add appropriate IP restrictions for SSH to the /etc/hosts.deny and/or /etc/hosts.allow files.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005600
- Vuln IDs
-
- V-12023
- Rule IDs
-
- SV-35177r1_rule
Checks: C-36675r1_chk
The configuration file entries will appear as follows: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_forwarding NDD_VALUE[x]=0 NOTE: The setting for the "ip_forwarding" interface will be initialized on a separate line referencing a specific NDD index. # cat /etc/rc.config.d/nddconf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | \ grep -i ip_forwarding | cut -f 1,1 -d "=" | tr -d [:alpha:] | tr -d [:punct:] If the above command returns nothing, this check is not a finding. If the above command does return an index value: # cat /etc/rc.config.d/nddconf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | \ grep "[the ip_forwarding INDEX number from the above command]" NOTE: The above command must (literally) contain the ASCII punctuation characters [ and ] exactly as depicted above. If the return value is not set to 0, ask the SA if the machine is a designated router. If it is not a designated router, this is a finding. If it is a designated router, this is not a finding.
Fix: F-32046r1_fix
Edit /etc/rc.config.d/nddconf and set the ip_forwarding option to 0.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006000
- Vuln IDs
-
- V-12024
- Rule IDs
-
- SV-35205r1_rule
Checks: C-36690r1_chk
NOTE: This will virtually always require a manual review. If an IM client is installed, ask the SA if it has access to any public domain IM servers. If it does have access to public servers, this is a finding.
Fix: F-32064r1_fix
Uninstall the IM client from the system, or configure the client to only connect to DoD-approved IM services.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN006040
- Vuln IDs
-
- V-12025
- Rule IDs
-
- SV-35207r1_rule
Checks: C-36691r1_chk
Note that this will virtually always require a Manual Review. Ask the SA if any peer-to-peer file-sharing applications are installed. Some examples of these applications include: - Napster - Kazaa - ARES - Limewire - IRC Chat Relay - BitTorrent If any of these applications are installed, this is a finding.
Fix: F-32065r1_fix
Uninstall the peer-to-peer file sharing application(s) from the system.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006420
- Vuln IDs
-
- V-12026
- Rule IDs
-
- SV-35153r1_rule
Checks: C-36722r2_chk
Check the domain name for NIS maps. Procedure: # domainname If the name returned is simple to guess, such as the organization name, building, or room name, etc., this is a finding.
Fix: F-32103r1_fix
Change the NIS domain name to a value difficult to guess. Consult vendor documentation, i.e., domain name (1) in the HP-UX man pages, for the required procedure.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006560
- Vuln IDs
-
- V-12028
- Rule IDs
-
- SV-35159r1_rule
Checks: C-36725r2_chk
Ask the SA if any security tool application is loaded on the system. Security tool applications include, but are not limited to, antivirus, file integrity, root kit detection, host-based intrusion detection, and vulnerability assessment tools. For each security tool on the system, determine if the tool is configured to notify the IAO and SA of any detected security problem. If such notifications are not configured, this is a finding.
Fix: F-32106r1_fix
Configure the security tools on the system to notify the IAO and SA when any security issues are detected.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006620
- Vuln IDs
-
- V-12030
- Rule IDs
-
- SV-35222r1_rule
Checks: C-36733r1_chk
Check for the existence of the /etc/hosts.allow and /etc/hosts.deny files (normally located within the /etc directory). # find /etc -type f -name hosts.allow -o -name hosts.deny | xargs -n1 ls -lL If either file does not exist, this is a finding. Check for the presence of a deny by default entry. cat <path>/hosts.deny | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | egrep "ALL: ALL" If the ALL: ALL entry is not present the hosts.deny file, any TCP service from a host or network not matching other rules will be allowed access. If the entry is not in hosts.deny, this is a finding.
Fix: F-32114r1_fix
Edit the <path>/hosts.allow and <path/hosts.deny files to configure access restrictions.
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN003865
- Vuln IDs
-
- V-12049
- Rule IDs
-
- SV-35138r2_rule
Checks: C-36544r2_chk
Determine if any network analysis tools are installed. Search for the binary: # find / -type f -name ethereal | xargs -n1 ls -lL # find / -type f -name wireshark | xargs -n1 ls -lL # find / -type f -name tshark | xargs -n1 ls -lL # find / -type f -name netcat | xargs -n1 ls -lL # find / -type f -name tcpdump | xargs -n1 ls -lL # find / -type f -name snoop | xargs -n1 ls -lL # find / -type f -name nettl | xargs -n1 ls -lL If any network analysis tools are found, this is a finding.
Fix: F-31909r1_fix
Remove the network analysis tool binary from the system. Consult vendor documentation for removing packaged software, or remove the binary directly via the following example: # rm -i <binary>
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000241
- Vuln IDs
-
- V-22290
- Rule IDs
-
- SV-38289r1_rule
Checks: C-36234r1_chk
Check the root crontab for ntpdate jobs running at least daily. # crontab -l | grep ntpdate columns 3, 4, and 5 must be an asterisk (*) for the job to be run daily. If this job exists, this is not a finding. OR Verify the auto-startup of (x)ntpd in /etc/rc.config.d/netdaemons. # cat /etc/rc.config.d/netdaemons | grep -v "^#" | grep -i "XNTPD=1" Check the system for a running NTP daemon, which is the preferred method. # ps -ef | grep ntp If an (x)ntpd process exists, this is not a finding. Otherwise, this is a finding.
Fix: F-31493r1_fix
Enable the NTP daemon for continuous synchronization. Edit /etc/rc.config.d/netdaemons and set XNTPD=1 Edit /etc/ntp.conf and add the ntp server entry. Then: # /sbin/init.d/xntpd start OR Add a daily or more frequent cronjob to perform synchronization using ntpdate. NOTE: While it is possible to run ntpdate from a cron script, it is important to mention that ntpdate with contrived cron scripts is no substitute for the NTP daemon, which uses sophisticated algorithms to maximize accuracy and reliability while minimizing resource use. Finally, since ntpdate polling does not discipline the host clock frequency as does (x)ntpd, the accuracy using ntpdate is limited. The process of passively listening for NTP broadcasts (i.e., placing the line broadcastclient yes in the /etc/ntp.conf file) is preferred over any procedural form of direct server polling for a large network with many nodes needing to be time-synchronized. This method is preferred because it significantly reduces the network traffic load related to NTP.
- RMF Control
- AU-8
- Severity
- Medium
- CCI
- CCI-000160
- Version
- GEN000242
- Vuln IDs
-
- V-22291
- Rule IDs
-
- SV-38297r1_rule
Checks: C-36235r1_chk
Check the system for a running NTP daemon. # ps -ef | grep ntp Verify the auto-startup of (x)ntpd in /etc/rc.config.d/netdaemons. # cat /etc/rc.config.d/netdaemons | grep -v "^#" | grep -i "XNTPD=1" Verify at least two external NTP servers are listed in the /etc/ntp.conf file. # cat /etc/ntp.conf | grep -v "^#" | grep -i server | \ egrep -v "127.127.1.1|127.127.1.0" If xntpd is not invoked with at least two external NTP servers listed (127.127.1.0 or 127.127.1.1 are local clock references and therefore not allowed), this is a finding.
Fix: F-31494r1_fix
If auto-starting (x)ntpd, add (when necessary) the correct number of (at least two) external servers to the /etc/ntp.conf file. If using ntpdate, add additional NTP servers (at least two are required) to the cron job running ntpdate.
- RMF Control
- AU-8
- Severity
- Low
- CCI
- CCI-000160
- Version
- GEN000244
- Vuln IDs
-
- V-22292
- Rule IDs
-
- SV-38298r1_rule
Checks: C-36237r1_chk
Check the root crontab for ntpdate entries. # crontab -l | grep ntpdate If the ntpdate command is invoked with NTP servers outside of the enclave, this is a finding. Check the NTP daemon configuration. # grep "^server" ntp.conf If an NTP server is listed outside of the enclave, this is a finding.
Fix: F-31495r1_fix
If using ntpdate, remove NTP servers external to the enclave from the cron job running ntpdate. If using the NTP daemon, remove the server line from ntp.conf for each NTP server external to the enclave.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000250
- Vuln IDs
-
- V-22294
- Rule IDs
-
- SV-38272r1_rule
Checks: C-36240r1_chk
Check the ownership of the NTP configuration file. # ls -lL /etc/ntp.conf If the owner is not root, this is a finding.
Fix: F-31497r1_fix
Change the owner of the NTP configuration file. # chown root /etc/ntp.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000251
- Vuln IDs
-
- V-22295
- Rule IDs
-
- SV-38273r1_rule
Checks: C-36241r1_chk
Check the group ownership of the NTP configuration file. Procedure: # ls -lL /etc/ntp.conf If the group owner is not root, bin, sys, or other, this is a finding.
Fix: F-31498r1_fix
Change the group-owner of the NTP configuration file. Procedure: # chgrp root /etc/ntp.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000252
- Vuln IDs
-
- V-22296
- Rule IDs
-
- SV-38274r1_rule
Checks: C-36242r1_chk
# ls -lL /etc/ntp.conf If the mode is more permissive than 0640, this is a finding.
Fix: F-31499r1_fix
Change the mode of the NTP configuration file to 0640 or less permissive. # chmod 0640 /etc/ntp.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000253
- Vuln IDs
-
- V-22297
- Rule IDs
-
- SV-38301r1_rule
Checks: C-36243r1_chk
Verify the NTP configuration file has no extended ACL. # ls -lL /etc/ntp.conf If the permissions include a "+" the file has an extended ACL and this is a finding.
Fix: F-31500r1_fix
Remove the optional ACL from the file. # chacl -z /etc/ntp.conf
- RMF Control
- AC-10
- Severity
- Low
- CCI
- CCI-000054
- Version
- GEN000450
- Vuln IDs
-
- V-22298
- Rule IDs
-
- SV-26319r2_rule
Checks: C-36260r2_chk
For Trusted Mode: Check the attribute setting. # grep NUMBER_OF_LOGINS_ALLOWED /etc/default/security If NUMBER_OF_LOGINS_ALLOWED is set to greater than 10, this is a finding. For SMSE: Check the attribute setting. # grep NUMBER_OF_LOGINS_ALLOWED /etc/default/security /var/adm/userdb/* If NUMBER_OF_LOGINS_ALLOWED is set to greater than 10, this is a finding.
Fix: F-31517r2_fix
For Trusted Mode: Use the SAM/SMH interface (/etc/default/security file) to update attribute. See the below example: NUMBER_OF_LOGINS_ALLOWED=10 For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update attribute. See the below example: NUMBER_OF_LOGINS_ALLOWED=10 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-9
- Severity
- Low
- CCI
- CCI-000052
- Version
- GEN000452
- Vuln IDs
-
- V-22299
- Rule IDs
-
- SV-38302r1_rule
Checks: C-36261r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=PrintLastLog Required arg(s)=yes Default arg values include: "yes" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> are not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "PrintLastLog" | cut -f 2,2 -d " " If the return value is no, this is a finding.
Fix: F-31518r1_fix
Edit the configuration file and modify the PrintLastLog line entry as follows: PrintLastLog yes
- RMF Control
- AC-14
- Severity
- Low
- CCI
- CCI-000061
- Version
- GEN000510
- Vuln IDs
-
- V-22301
- Rule IDs
-
- SV-38275r1_rule
Checks: C-36263r1_chk
NOTE: This will virtually always be a manual review. Determine if a publicly-viewable pattern is displayed during a session lock. If the session lock pattern is not publicly-viewable, this is a finding.
Fix: F-31520r1_fix
Configure the system to display a publicly-viewable pattern during a session lock.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000205
- Version
- GEN000585
- Vuln IDs
-
- V-22302
- Rule IDs
-
- SV-52487r1_rule
Checks: C-47033r1_chk
Note that in certain instances, the password field of any given password database may present as “*” or “!!”, indicating that the account is locked or disabled. For Trusted Mode: Verify that password hashes in /tcb do not begin with a character other than a dollar sign ($). # cd /tcb/files/auth && cat */* | egrep “:u_name=|:u_pwd=“ If user account password hashes begins with any character other than a dollar sign ($), this is a finding. For SMSE: Verify that password hashes in /etc/shadow do not begin with a character other than a dollar sign ($). # cat /etc/shadow | cut -f 2,2 -d “:” | egrep -v “^\\$|\\*|\\!\\!” If any password hash without a leading dollar sign is returned by the above command, this is a finding.
Fix: F-45446r1_fix
For Trusted Mode: NOTE: There is no fix for Trusted Mode/Systems (TS). MD5 is currently used, and per vendor documentation, this algorithm will not be updated, due to TS being deprecated for HP-UX 11i-v3 (11.31). For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) to update the attribute. See the below example: CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-7
- Severity
- Medium
- CCI
- CCI-000803
- Version
- GEN000590
- Vuln IDs
-
- V-22303
- Rule IDs
-
- SV-52489r3_rule
Checks: C-47035r3_chk
For Trusted Mode: MD5 is currently the only available hashing function. Per vendor documentation, this algorithm will not be updated, due to TS being deprecated/replaced by SMSE. For SMSE: Check the system password for use of cryptographic hashes using the SHA-2 family of algorithms or FIPS 140-2-approved successors. # egrep “CRYPT_ALGORITHMS_DEPRECATE|CRYPT_DEFAULT” /etc/default/security The following is an example output from the above command: CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 If the attributes “CRYPT_ALGORITHMS_DEPRECATE” and “CRYPT_DEFAULT” are not set per the above example output, this is a finding.
Fix: F-45448r2_fix
For Trusted Mode: Note: There is no fix for Trusted Mode/Systems (TS). MD5 is currently used, and per vendor documentation, this algorithm will not be updated due to TS being deprecated/replaced by SMSE. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) to update the attribute. See the below example: CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000196
- Version
- GEN000595
- Vuln IDs
-
- V-22304
- Rule IDs
-
- SV-52491r2_rule
Checks: C-47037r1_chk
Note that in certain instances, the password field of any given password database may present as “*” or “!!”, indicating that the account is locked or disabled. For Trusted Mode: Verify that the first 3 characters in the /tcb password hashes begin with the characters “$6$” (note that double quotes are for emphasis only). # cd /tcb/files/auth && cat */* | egrep “:u_name=|:u_pwd=“ If user account password hashes begins with any characters other than “$6$”, this is a finding. For SMSE: Verify that password hashes in /etc/shadow begin with the characters “$6$” (note that double quotes are for emphasis only). # cat /etc/shadow | cut -f 2,2 -d “:” | egrep -v “^\\*|\\!\\!” If user account password hashes begins with any characters other than “$6$”, this is a finding.
Fix: F-45450r1_fix
For Trusted Mode: NOTE: There is no fix for Trusted Mode/Systems (TS). MD5 is currently used, and per vendor documentation, this algorithm will not be updated, due to TS being deprecated/replaced by SMSE. This will always result in a finding. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) to update the attribute. See the below example: CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000193
- Version
- GEN000610
- Vuln IDs
-
- V-22305
- Rule IDs
-
- SV-38304r2_rule
Checks: C-36292r2_chk
For Trusted Mode: Check the PASSWORD_MIN_LOWER_CASE_CHARS setting. # cat /etc/default/security | grep PASSWORD_MIN_LOWER_CASE_CHARS If PASSWORD_MIN_LOWER_CASE_CHARS is not set to 1 or greater, this is a finding. For SMSE: Check the PASSWORD_MIN_LOWER_CASE_CHARS setting. # grep PASSWORD_MIN_LOWER_CASE_CHARS /etc/default/security /var/adm/userdb/* If PASSWORD_MIN_LOWER_CASE_CHARS is not set to 1 or greater, this is a finding.
Fix: F-31549r2_fix
For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_LOWER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_LOWER_CASE_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_LOWER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_LOWER_CASE_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- AC-2
- Severity
- Low
- CCI
- CCI-000009
- Version
- GEN000850
- Vuln IDs
-
- V-22308
- Rule IDs
-
- SV-26349r1_rule
Checks: C-36297r1_chk
Check /etc/default/security for the SU_ROOT_GROUP setting. # grep SU_ROOT_GROUP /etc/default/security Unless this setting is present, configured, and not commented out, this is a finding.
Fix: F-31552r1_fix
Edit /etc/default/security and uncomment, set, or add the SU_ROOT_GROUP setting with a value of wheel or equivalent. If necessary, create a wheel group and add administrative users to the group.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000930
- Vuln IDs
-
- V-22309
- Rule IDs
-
- SV-38305r1_rule
Checks: C-36298r1_chk
Verify the root account's home directory has no extended ACL. # ls -lLd ~root If the permissions include a "+", the directory has an extended ACL, and this is a finding.
Fix: F-31553r1_fix
Remove the optional ACL from the file. # chacl -z ~root
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000945
- Vuln IDs
-
- V-22310
- Rule IDs
-
- SV-38307r1_rule
Checks: C-36299r1_chk
Check that the LD_LIBRARY_PATH and SHLIB_PATH variables are empty or not defined for the root user. Example: # echo $LD_LIBRARY_PATH # echo $SHLIB_PATH If a path list is returned, this is a finding.
Fix: F-31554r1_fix
Edit the root user initialization files and remove any definition of LD_LIBRARY_PATH and SHLIB_PATH.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000950
- Vuln IDs
-
- V-22311
- Rule IDs
-
- SV-38308r1_rule
Checks: C-36300r1_chk
Verify the LD_PRELOAD environment variable is empty or not defined for the root user. # echo $LD_PRELOAD If a path list is returned, this is a finding.
Fix: F-31555r1_fix
Edit the root user initialization files and remove any definition of LD_PRELOAD.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001170
- Vuln IDs
-
- V-22312
- Rule IDs
-
- SV-38279r1_rule
Checks: C-36311r1_chk
Search the system for files without a valid group owner. # find / -nogroup -print If any files are found, this is a finding.
Fix: F-31566r1_fix
Change the group-owner for each file without a valid group-owner. # chgrp <a-valid-group> <path>/<file-without-a-valid-group-owner>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001190
- Vuln IDs
-
- V-22313
- Rule IDs
-
- SV-38280r1_rule
Checks: C-36312r3_chk
Check Content: Verify network services daemon files have no extended ACLs. # cat /etc/inetd.conf | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v '^#' | cut -f6,6 -d " " | xargs -n1 ls -lL If the permissions include a "+", the file has an extended ACL, and this is a finding.
Fix: F-31567r1_fix
Remove the optional ACL from the file. # chacl -z <path>/< network-services-daemon>
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- GEN001210
- Vuln IDs
-
- V-22314
- Rule IDs
-
- SV-38281r1_rule
Checks: C-36313r1_chk
Verify all system command files have no extended ACLs. # ls -lL /etc /bin /usr/bin /usr/lbin /usr/usb /sbin /usr/sbin If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31568r1_fix
Remove the optional ACL from the file. # chacl -z <path>/<file-with-extended-ACL>
- RMF Control
- SI-11
- Severity
- Medium
- CCI
- CCI-001314
- Version
- GEN001270
- Vuln IDs
-
- V-22315
- Rule IDs
-
- SV-38309r1_rule
Checks: C-36314r2_chk
Verify all system log files have no extended ACLs. # ls -lL /var/log /var/log/syslog /var/adm /var/opt If the permissions include a "+" the file has an extended ACL. If an extended ACL exists, verify with the SA if the ACL is required to support authorized software and provides the minimum necessary permissions. If an extended ACL exists providing access beyond the needs of authorized software, this is a finding.
Fix: F-31569r1_fix
Remove the optional ACL from the file. # chacl -z /var/adm/*
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001290
- Vuln IDs
-
- V-22316
- Rule IDs
-
- SV-38282r2_rule
Checks: C-36315r5_chk
Verify that all manual page files do not have extended ACLs. # find `env | grep MANPATH | cut -f 2,2 -d "=" | tr ':' ' ' ` -type f -exec ls -al '{}' | grep '^[a-zA-Z\-]\{10\}+' If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31570r2_fix
Remove the optional ACL from the file(s). # chacl -z /usr/share/man/* /usr/share/info/* /usr/share/infopage/*
- RMF Control
- CM-5
- Severity
- Medium
- CCI
- CCI-001499
- Version
- GEN001310
- Vuln IDs
-
- V-22317
- Rule IDs
-
- SV-38283r1_rule
Checks: C-36316r2_chk
Verify system libraries have no extended ACLs. # ls -lLR /usr/lib/* /lib/* If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31571r1_fix
Remove the optional ACL from the file. # chacl -z /usr/lib/* /lib/*
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001361
- Vuln IDs
-
- V-22318
- Rule IDs
-
- SV-38284r1_rule
Checks: C-36317r1_chk
Verify NIS/NIS+/yp files have no extended ACLs. # ls -lL /var/yp/* If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31572r1_fix
Remove the optional ACL from the file. # chacl -z /var/yp/*
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001362
- Vuln IDs
-
- V-22319
- Rule IDs
-
- SV-38310r1_rule
Checks: C-36318r1_chk
Verify the /etc/resolv.conf file is owned by root. # ls -lL /etc/resolv.conf If the file is not owned by root, this is a finding.
Fix: F-31573r1_fix
As root, change the owner of the /etc/resolv.conf file to root. # chown root /etc/resolv.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001363
- Vuln IDs
-
- V-22320
- Rule IDs
-
- SV-38311r1_rule
Checks: C-36319r1_chk
Check the group ownership of the resolv.conf file. Procedure: # ls -lL /etc/resolv.conf If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31574r1_fix
Change the group owner of the /etc/resolv.conf file to root, bin, sys, or other. Procedure: # chgrp root /etc/resolv.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001364
- Vuln IDs
-
- V-22321
- Rule IDs
-
- SV-38312r1_rule
Checks: C-36320r1_chk
Check the mode of the /etc/resolv.conf file. # ls -lL /etc/resolv.conf If the file mode is more permissive than 0644, this is a finding.
Fix: F-31575r1_fix
Change the mode of the /etc/resolv.conf file to 0644 or less permissive. # chmod 0644 /etc/resolv.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001365
- Vuln IDs
-
- V-22322
- Rule IDs
-
- SV-38285r1_rule
Checks: C-36321r1_chk
Verify /etc/resolv.conf has no extended ACL. # ls -lL /etc/resolv.conf If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31576r1_fix
Remove the optional ACL from the file. # chacl -z /etc/resolv.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001366
- Vuln IDs
-
- V-22323
- Rule IDs
-
- SV-38313r1_rule
Checks: C-36322r1_chk
Verify the /etc/hosts file is owned by root. # ls -lL /etc/hosts If the file is not owned by root, this is a finding.
Fix: F-31577r1_fix
Change the owner of the /etc/hosts file to root. # chown root /etc/hosts
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001367
- Vuln IDs
-
- V-22324
- Rule IDs
-
- SV-38314r1_rule
Checks: C-36323r1_chk
Check the /etc/hosts file's group ownership. Procedure: # ls -lL /etc/hosts If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31578r1_fix
Change the group owner of the /etc/hosts file to root, sys, bin, or other. Procedure: # chgrp root /etc/hosts
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001368
- Vuln IDs
-
- V-22325
- Rule IDs
-
- SV-38315r1_rule
Checks: C-36324r1_chk
Check the mode of the /etc/hosts file. # ls -lL /etc/hosts If the file mode is more permissive than 0644, this is a finding.
Fix: F-31579r1_fix
Change the mode of the /etc/hosts file to 0644 or less permissive. # chmod 0644 /etc/hosts
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001369
- Vuln IDs
-
- V-22326
- Rule IDs
-
- SV-38286r1_rule
Checks: C-36325r1_chk
Verify /etc/hosts has no extended ACL. # ls -lL /etc/hosts If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31580r1_fix
Remove the optional ACL from the file. # chacl -z /etc/hosts
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001371
- Vuln IDs
-
- V-22327
- Rule IDs
-
- SV-38316r1_rule
Checks: C-36326r1_chk
Verify the /etc/nsswitch.conf file is owned by root. # ls -lL /etc/nsswitch.conf If the file is not owned by root, this is a finding.
Fix: F-31581r1_fix
Change the owner of the /etc/nsswitch.conf file to root. # chown root /etc/nsswitch.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001372
- Vuln IDs
-
- V-22328
- Rule IDs
-
- SV-38317r1_rule
Checks: C-36327r1_chk
Check the group ownership of the nsswitch.conf file. Procedure: # ls -lL /etc/nsswitch.conf If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31582r1_fix
Change the group-owner of the /etc/nsswitch.conf file to root, bin, sys, or other. Procedure: # chgrp root /etc/nsswitch.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001373
- Vuln IDs
-
- V-22329
- Rule IDs
-
- SV-38319r1_rule
Checks: C-36328r1_chk
Check the mode of the /etc/nsswitch.conf file. # ls -lL /etc/nsswitch.conf If the file mode is more permissive than 0644, this is a finding.
Fix: F-31583r1_fix
Change the mode of the /etc/nsswitch.conf file to 0644 or less permissive. # chmod 0644 /etc/nsswitch.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001374
- Vuln IDs
-
- V-22330
- Rule IDs
-
- SV-38320r1_rule
Checks: C-36329r1_chk
Verify /etc/nsswitch.conf has no extended ACL. # ls -lL /etc/nsswitch.conf If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31584r1_fix
Remove the optional ACL from the file. # chacl -z /etc/nsswitch.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001378
- Vuln IDs
-
- V-22332
- Rule IDs
-
- SV-38335r1_rule
Checks: C-36343r1_chk
Verify the /etc/passwd file is owned by root. # ls -lL /etc/passwd If the file is not owned by root, this is a finding.
Fix: F-31602r1_fix
Change the owner of the /etc/passwd file to root. # chown root /etc/passwd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001379
- Vuln IDs
-
- V-22333
- Rule IDs
-
- SV-38336r1_rule
Checks: C-36344r1_chk
Check the group ownership of the passwd file. Procedure: # ls -lL /etc/passwd If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31603r1_fix
Change the group owner of the /etc/passwd file to root, bin, sys, or other. Procedure: # chgrp root /etc/passwd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001390
- Vuln IDs
-
- V-22334
- Rule IDs
-
- SV-38321r1_rule
Checks: C-36345r1_chk
Verify /etc/passwd has no extended ACL. # ls -lL /etc/passwd If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31600r1_fix
Remove the optional ACL from the file. # chacl -z /etc/passwd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001391
- Vuln IDs
-
- V-22335
- Rule IDs
-
- SV-38337r1_rule
Checks: C-36346r1_chk
Verify the /etc/group file is owned by bin. # ls -lL /etc/group If the file is not owned by bin, this is a finding.
Fix: F-31601r1_fix
Change the owner of the /etc/group file to bin. # chown bin /etc/group
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001392
- Vuln IDs
-
- V-22336
- Rule IDs
-
- SV-38338r1_rule
Checks: C-36353r1_chk
Check the group ownership of the /etc/group file. Procedure: # ls -lL /etc/group If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31652r1_fix
Change the group owner of the /etc/group file. Procedure: # chgrp root /etc/group
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001393
- Vuln IDs
-
- V-22337
- Rule IDs
-
- SV-38339r1_rule
Checks: C-37724r1_chk
Check the mode of the /etc/group file. # ls -l /etc/group If the file mode is more permissive than 0444, this is a finding.
Fix: F-31653r1_fix
Change the mode of the /etc/group file to 0444 or less permissive. # chmod 0444 /etc/group
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001394
- Vuln IDs
-
- V-22338
- Rule IDs
-
- SV-38322r1_rule
Checks: C-36355r1_chk
Verify /etc/group has no extended ACL. # ls -lL /etc/group If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31654r1_fix
Remove the extended ACL from the /etc/group file. # chacl -z /etc/group
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001410
- Vuln IDs
-
- V-22339
- Rule IDs
-
- SV-38340r2_rule
Checks: C-36356r2_chk
For Trusted Mode: Check the TCB auth files and directories. # ls -lLd /tcb /tcb/files /tcp/files/auth # ls -lL /tcb/files/auth/[a-z,A-Z]/* If the group-owner of any of the /tcb files and directories is not root, bin, sys, or other, this is a finding. For SMSE: Check the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-31655r2_fix
For Trusted Mode: # chgrp root /tcb #chgrp root /tcb/files /tcb/files/auth # chgrp root /tcb/files/auth/[a-z]/* For SMSE: # chgrp root /etc/shadow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001430
- Vuln IDs
-
- V-22340
- Rule IDs
-
- SV-26441r2_rule
Checks: C-36357r4_chk
For Trusted Mode: Check the TCB auth files and directories. # ls -lLd /tcb /tcb/files /tcp/files/auth # ls -lL /tcb/files/auth/[a-z,A-Z]/* If the permissions of any of the /tcb files and directories include a “+”, this is a finding. For SMSE: Check the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file permissions include a “+”, the file has an extended ACL, this is a finding.
Fix: F-31693r3_fix
For Trusted Mode: # chacl -z /tcb # chacl -z /tcb/files /tcb/files/auth # chacl -z /tcb/files/auth/[a-z]/* For SMSE: # chacl -z /etc/shadow
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000201
- Version
- GEN001470
- Vuln IDs
-
- V-22347
- Rule IDs
-
- SV-38323r2_rule
Checks: C-36358r2_chk
Verify no password hashes are present in /etc/passwd. # cat /etc/passwd | cut -f 2,2 -d “:” If any password hashes are returned, this is a finding.
Fix: F-31694r2_fix
Migrate /etc/passwd password hashes. For Trusted Mode: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to migrate from a non-SMSE Standard Mode to Trusted Mode. For SMSE Mode: Use the following command to create the shadow file. The command will then copy all encrypted passwords into the shadow file and replace the passwd file password entries with an “x”. # pwconv
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001475
- Vuln IDs
-
- V-22348
- Rule IDs
-
- SV-38341r1_rule
Checks: C-36359r1_chk
Check the /etc/group file for password hashes. # cat /etc/group | cut -f 2,2 -d ":" If the above command returns anything other than a blank or "*" character, this is a finding.
Fix: F-31696r1_fix
Edit /etc/group and change the password field to include an asterisk (*) as the first character to lock the group password.
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN001490
- Vuln IDs
-
- V-22350
- Rule IDs
-
- SV-38324r1_rule
Checks: C-36360r1_chk
Verify user home directories have no extended ACLs. # cat /etc/passwd | cut -f 6,6 -d ":" | xargs -n1 ls -lLd If the permissions include a "+", the file has an extended ACL and this is a finding.
Fix: F-31697r1_fix
Remove the optional ACL from the file. # chacl -z [user home directory with extended ACL]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001550
- Vuln IDs
-
- V-22351
- Rule IDs
-
- SV-35145r1_rule
Checks: C-36548r3_chk
Check the contents of user home directories for files group-owned by a group of which the home directory's owner is not a member: List the user accounts. # cat /etc/passwd | cut -f 1,1 -d ":" For each user account, get a list of GIDs for files in the user's home directory. # find ~<username> | xargs ls -ldn | tr '\011' ' ' | tr -s ' ' | awk '{print $4, $NF}' Obtain the list of GIDs associated with the user's account. # id <username> OR # id -G <username> OR # cat /etc/group | grep <username> Check the GID lists. If there are GIDs in the file list not present in the user list, this is a finding.
Fix: F-31914r1_fix
Change the group of a file not group-owned by a group of which the home directory's owner is a member. # chgrp [<username>'s primary group] [file with bad group ownership]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001570
- Vuln IDs
-
- V-22352
- Rule IDs
-
- SV-38325r1_rule
Checks: C-36361r1_chk
Check the contents of user home directories for files with extended ACLs. # cat /etc/passwd | cut -f 6,6 -d ":" | xargs -n1 -IDIR ls -alLR DIR If the permissions include a '+', the file has an extended ACL, this is a finding.
Fix: F-31698r1_fix
Remove the optional ACL from the file. # chacl -z [user file with extended ACL]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001590
- Vuln IDs
-
- V-22353
- Rule IDs
-
- SV-38342r1_rule
Checks: C-36362r2_chk
Check that run control scripts have no extended ACLs. # ls -lLa /sbin/init.d/[a-z,A-Z,0-9]* If the permissions include a '+' the file has an extended ACL, this is a finding.
Fix: F-31699r1_fix
Remove the optional ACL from the file. # chacl -z [run control script with extended ACL]
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001605
- Vuln IDs
-
- V-22354
- Rule IDs
-
- SV-38343r3_rule
Checks: C-36363r3_chk
Verify the run control scripts library search paths do not contain references to the current working directory or other relative paths that have not been authorized by the ISSO. # egrep "LD_LIBRARY_PATH|SHLIB_PATH" /sbin/init.d/[a-z,A-Z,0-9]* This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31700r2_fix
Edit the run control script and remove any relative or empty path entry from the library search path variable that has not been documented with the ISSO. Edit the run control script and remove any empty entry that is defined.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001610
- Vuln IDs
-
- V-22355
- Rule IDs
-
- SV-38344r3_rule
Checks: C-36383r3_chk
Verify the run control scripts library preload paths do not contain references to the current working directory or other relative paths in any script where the following library PATH variable(s) occurs that have not been authorized by the ISSO. # egrep "LD_PRELOAD" /sbin/init.d/[a-z,A-Z,0-9]* This variable is formatted as a colon-separated list of paths. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31721r2_fix
Edit the run control script and remove any relative entries from the library preload variables that have not been documented with the ISSO. Edit the run control script and remove any empty entry that is defined.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001730
- Vuln IDs
-
- V-22356
- Rule IDs
-
- SV-38345r1_rule
Checks: C-36384r1_chk
Check global initialization files for extended ACLs. # ls -lL /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/environment /etc/.login /etc/security/environ If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31723r1_fix
Remove the optional ACL from the file. # chacl -z [global initialization file with extended ACL]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001810
- Vuln IDs
-
- V-22357
- Rule IDs
-
- SV-38346r1_rule
Checks: C-36385r1_chk
Check skeleton files for extended ACLs. # ls -alL /etc/skel If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31724r1_fix
Remove the optional ACL from the file. # chacl -z [skeleton file with extended ACL]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001830
- Vuln IDs
-
- V-22358
- Rule IDs
-
- SV-38347r1_rule
Checks: C-36386r1_chk
Verify the skeleton files are group-owned by root, bin, sys, or other. # ls -alL /etc/skel If a skeleton file is not group-owned by root, bin, sys, or other, this is a finding
Fix: F-31725r1_fix
Change the group owner of the skeleton file to root, bin, sys, or other. # chgrp <group> /etc/skel/<skeleton file>
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001845
- Vuln IDs
-
- V-22359
- Rule IDs
-
- SV-38348r3_rule
Checks: C-36387r3_chk
Check the global initialization files' library search path. # egrep "LD_LIBRARY_PATH|SHLIB_PATH" /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/environment /etc/.login This variable is formatted as a colon-separated list of paths. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31727r2_fix
Edit the global initialization file and remove the relative path entries from the library search path variables that have not been documented with the ISSO. Edit the global initialization file and remove any empty entry that is defined.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001850
- Vuln IDs
-
- V-22360
- Rule IDs
-
- SV-38349r3_rule
Checks: C-36388r3_chk
Check the global initialization files' library preload list. # grep LD_PRELOAD /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/environment /etc/.login This variable is formatted as a colon-separated list of paths. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31728r2_fix
Edit the global initialization file and remove the relative path entry from the library preload list variables that have not been documented with the ISSO. Edit the global initialization file(s) and remove any empty entry that is defined for the library preload list.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001870
- Vuln IDs
-
- V-22361
- Rule IDs
-
- SV-34926r1_rule
Checks: C-36389r2_chk
Check user home directories for local initialization files group-owned by a group other than the user's primary group or root. 1. List user accounts and their primary GID. # cat /etc/passwd | cut -f 1,4 -d ":" 2. Check local initialization files for each user. Field #1 above is USER and Field #4 is the user's GID. # ls -alL ~USER/.login ~USER/.cshrc ~USER/.logout ~USER/.profile ~USER/.bash_profile ~USER/.bashrc ~USER/.bash_logout ~USER/.env ~USER/.dtprofile ~USER/.dispatch ~USER/.emacs ~USER/.exrc 3. If any file is not group-owned by root or the user's primary GID, this is a finding.
Fix: F-31730r1_fix
Change the group-owner of the local initialization file to the user's primary group or root. # chgrp [USER's primary GID] ~USER/[local initialization file]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN001890
- Vuln IDs
-
- V-22362
- Rule IDs
-
- SV-38350r1_rule
Checks: C-36390r3_chk
Check user home directories for local initialization files with extended ACLs. # ls `cat /etc/passwd | cut -f 6,6 -d ":" ` | grep "/home" | sort | uniq | xargs -n1 ls -alL 2>/dev/null | egrep "\.bash_logout|\.bash_profile|\.bashrc|\.cshrc|\.dispatch|\.dtprofile|\.emacs|\.env|\.exrc|\.login|\.logout|\.profile" NOTE that the above command assumes the "base" of the user's home directory is "/home". If the system being checked uses a different "base", that "base" must be substituted for what is used in the above example. If the permissions include a '+', the file has an extended ACL, this is a finding.
Fix: F-31731r1_fix
Remove the optional ACL from the file. # chacl -z [local initialization file with extended ACL]
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001901
- Vuln IDs
-
- V-22363
- Rule IDs
-
- SV-38351r3_rule
Checks: C-36391r3_chk
Verify that any PATH variable contained in a user's local initialization files uses only authorized paths. # cat /etc/passwd | cut -f 1,1 -d ":" | xargs -n1 -IUSER sh -c 'egrep -i "LD_LIBRARY_PATH|SHLIB_PATH" ~USER/.*' The PATH variable is a colon-delimited directory list. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31732r2_fix
Edit the user's local initialization file(s) and remove any relative path entry from the library search LIBRARY_PATH and/or SHLIB_PATH variable(s) that have not been documented with the ISSO. Edit the user’s local initialization file(s) and remove any empty entry that is defined for the “LIBRARY_PATH” and/or “SHLIB_PATH” variable(s).
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN001902
- Vuln IDs
-
- V-22364
- Rule IDs
-
- SV-34928r3_rule
Checks: C-36394r3_chk
Verify local initialization files have library preload list path containing only authorized paths. # cat /etc/passwd | cut -f 1,1 -d ":" | xargs -n1 -IUSER sh -c 'grep "LD_PRELOAD" ~USER/.*' The LD_PRELOAD variable is a colon-delimited directory list. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), or has not been documented with the ISSO, this is a finding.
Fix: F-31733r2_fix
Edit the local initialization file and remove any relative/empty path entry from the library LD_PRELOAD variable that has not been documented with the ISSO. Edit the local initialization file and remove any empty entry that is defined for the “LD_PRELOAD” variable.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002210
- Vuln IDs
-
- V-22365
- Rule IDs
-
- SV-38352r1_rule
Checks: C-36395r1_chk
If /etc/shells exists, check the group ownership of each shell referenced. Procedure: # cat /etc/shells | xargs -n1 ls -lL Otherwise, check any shells found on the system. Procedure: # find / -name "*sh" | xargs -n1 ls -lL If a shell is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31734r1_fix
Change the group owner of the shell to root, bin, sys, or other. Procedure: # chgrp root <shell>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002230
- Vuln IDs
-
- V-22366
- Rule IDs
-
- SV-38353r1_rule
Checks: C-36396r1_chk
If /etc/shells exists, check the permissions of each shell referenced. # cat /etc/shells | xargs -n1 ls -lL Otherwise, check any shells found on the system. # find / -name "*sh" | xargs -n1 ls -lL If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31735r1_fix
Remove the optional ACL from the file. # chacl -z [shell]
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002330
- Vuln IDs
-
- V-22367
- Rule IDs
-
- SV-38354r1_rule
Checks: C-36397r1_chk
Check the permissions of audio devices. Determine audio devices and class identifiers, i.e., audio should be listed as audio. # ioscan Determine audio/video device special files. # ioscan -fn -C <class ID from the above command output> Determine the device file mode. # ls -lL <device special file> If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31736r1_fix
Remove the optional ACL from the file. # chacl -z [device file]
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN002430
- Vuln IDs
-
- V-22368
- Rule IDs
-
- SV-29568r1_rule
Checks: C-36398r1_chk
Each file system line entry must contain a device specific file and may additionally contain all of the following fields, in the following order: mount directory, type, options, backup frequency, pass number (on parallel fsck) and comment. Check /etc/fstab and verify that the nodevs mount option is used on all NFS file systems. If an NFS file system is not using the nodevs option, this is a finding. # cat /etc/fstab | grep -v "^#" | grep nfs
Fix: F-31737r1_fix
Edit /etc/fstab and add the nodevs mount option to all entries for NFS file systems.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000163
- Version
- GEN002710
- Vuln IDs
-
- V-22369
- Rule IDs
-
- SV-38355r2_rule
Checks: C-36436r3_chk
Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following: PRI_AUDFILE=/var/.audit/file1 SEC_AUDFILE=/var/.audit/file2 # egrep “PRI_AUDFILE|SEC_AUDFILE” /etc/rc.config.d/auditing For each audit log directory/file, check the permissions. # ls -lLd <audit directory> # ls -lLa <audit file> If any audit log directory/file permissions include a “+”, this is a finding.
Fix: F-31775r2_fix
As root, remove the ACL. # chacl -z <audit directory> # chacl -z <audit file>
- RMF Control
- AU-9
- Severity
- Low
- CCI
- CCI-001493
- Version
- GEN002715
- Vuln IDs
-
- V-22370
- Rule IDs
-
- SV-26506r2_rule
Checks: C-36437r2_chk
Verify the audit tools are owned by root or bin (bin is the default owner). The list of files should minimally include the following: audevent - Change/display event/system call status. audfilter - Load/clear/display the audit filtering policy. auditdp - Selectively read/write and convert/format the audit data. audisp - Display audit records. audomon - Audit file monitoring and size parameter setpoints. audsys - Start/stop auditing; set/display the audit file or directory information. userdbset - Select user to be audited. # ls -lL /usr/sbin/aud* /usr/sbin/userdb* If any system audit tool is not owned by root or bin, this is a finding.
Fix: F-31776r2_fix
As root, change the file ownership. # chown root <audit_tool_filename>
- RMF Control
- AU-9
- Severity
- Low
- CCI
- CCI-001493
- Version
- GEN002716
- Vuln IDs
-
- V-22371
- Rule IDs
-
- SV-26509r2_rule
Checks: C-36438r2_chk
Verify the audit tools are group-owned by root, bin, sys, or other. The list of files should minimally include the following: audevent - Change/display event/system call status. audfilter - Load/clear/display the audit filtering policy. auditdp - Selectively read/write and convert/format the audit data. audisp - Display audit records. audomon - Audit file monitoring and size parameter setpoints. audsys - Start/stop auditing; set/display the audit file or directory information. userdbset - Select user to be audited. # ls -lL /usr/sbin/aud* /usr/sbin/userdb* If any system audit tool is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31777r2_fix
As root, change the file group ownership. # chgrp root <audit_tool_filename>
- RMF Control
- AU-9
- Severity
- Low
- CCI
- CCI-001493
- Version
- GEN002717
- Vuln IDs
-
- V-22372
- Rule IDs
-
- SV-26512r2_rule
Checks: C-36439r2_chk
Verify the audit tools file permissions. The list of files should minimally include the following: audevent - Change/display event/system call status. audfilter - Load/clear/display the audit filtering policy. auditdp - Selectively read/write and convert/format the audit data. audisp - Display audit records. audomon - Audit file monitoring and size parameter setpoints. audsys - Start/stop auditing; set/display the audit file or directory information. userdbset - Select user to be audited. # ls -lL /usr/sbin/aud* /usr/sbin/userdb* If any system audit tool has a file permissions greater than 0750, this is a finding.
Fix: F-31778r2_fix
As root, change the file permissions. # chmod 0750 <audit tool executable>
- RMF Control
- AU-9
- Severity
- Low
- CCI
- CCI-001493
- Version
- GEN002718
- Vuln IDs
-
- V-22373
- Rule IDs
-
- SV-26516r2_rule
Checks: C-36440r3_chk
Verify the audit tools file permissions. The list of files should minimally include the following: audevent - Change/display event/system call status. audfilter - Load/clear/display the audit filtering policy. auditdp - Selectively read/write and convert/format the audit data. audisp - Display audit records. audomon - Audit file monitoring and size parameter setpoints. audsys - Start/stop auditing; set/display the audit file or directory information. userdbset - Select user to be audited. # ls -lL /usr/sbin/aud* /usr/sbin/userdb* If any audit tool file permissions include a “+”, this is a finding.
Fix: F-31779r2_fix
As root, change the file permissions. # chacl -z <audit_tool_filename>
- RMF Control
- AU-5
- Severity
- Low
- CCI
- CCI-000139
- Version
- GEN002719
- Vuln IDs
-
- V-22374
- Rule IDs
-
- SV-38356r1_rule
Checks: C-36806r2_chk
"audomon" is spawned by /sbin/init.d/auditing when the system is booted with the parameter AUDITING is set to 1 in /etc/rc.config.d/auditing. audomon monitors the capacity of the current audit trail and the file system on which the audit trail is located. audomon prints out warning messages when either capacity is approaching full. audomon also checks the audit trail and the file system against two switch points: FileSpaceSwitch (FSS) and Audit-FileSwitch (AFS). If either switch point is reached, audit recording automatically switches to an alternative audit trail. audomon also takes action, such as sending an email at the switch point if there is a task specified with the -X option. Using the -o option, audomon specifies the file where warning messages are written. By default, warning messages are sent to the console. # cat /sbin/init.d/auditing | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep "audomon" If audomon has been invoked without the "-o <file>" option (at a minimum), this is a finding.
Fix: F-32183r2_fix
Configure the /sbin/init.d/auditing file to invoke audomon with (at a minimum) the "-o <file>" option. Then restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start
- RMF Control
- AU-5
- Severity
- Medium
- CCI
- CCI-000143
- Version
- GEN002730
- Vuln IDs
-
- V-22375
- Rule IDs
-
- SV-29653r1_rule
Checks: C-36441r1_chk
Determine if the audit system is configured to generate warnings when the audit storage volume approaches capacity. Procedure: # cat /etc/rc.config.d/auditing | grep AUDOMON_ARGS | grep "\-w" If the -w parameter does not exist, this is a finding. If the number following the -w parameter (which represents the threshold for percentage of capacity) is greater than 90, this is a finding.
Fix: F-31780r1_fix
Edit the AUDOMON_ARGS parameter of the /etc/rc.config.d/auditing file to include -w 90.
- RMF Control
- AC-2
- Severity
- Low
- CCI
- CCI-000018
- Version
- GEN002750
- Vuln IDs
-
- V-22376
- Rule IDs
-
- SV-29670r1_rule
Checks: C-36442r1_chk
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix: F-31782r1_fix
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AC-2
- Severity
- Low
- CCI
- CCI-001403
- Version
- GEN002751
- Vuln IDs
-
- V-22377
- Rule IDs
-
- SV-29675r1_rule
Checks: C-36443r1_chk
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix: F-31783r1_fix
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AC-2
- Severity
- Low
- CCI
- CCI-001404
- Version
- GEN002752
- Vuln IDs
-
- V-22378
- Rule IDs
-
- SV-29676r1_rule
Checks: C-36444r1_chk
Check the auditing configuration of the system. # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix: F-31784r1_fix
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AC-2
- Severity
- Low
- CCI
- CCI-001405
- Version
- GEN002753
- Vuln IDs
-
- V-22382
- Rule IDs
-
- SV-29679r1_rule
Checks: C-36446r1_chk
Check the auditing configuration of the system. Procedure: # grep -i audevent_args1 /etc/rc.config.d/auditing | grep admin If no results are returned, the system is not configured to audit administrative actions, this is a finding.
Fix: F-31785r1_fix
Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.
- RMF Control
- AU-2
- Severity
- Medium
- CCI
- CCI-000126
- Version
- GEN002825
- Vuln IDs
-
- V-22383
- Rule IDs
-
- SV-26525r2_rule
Checks: C-36447r2_chk
Check /etc/audit/audit_site.conf file to determine if syscalls handling kernel modules are audited. # egrep -i "admin|modload|moduload|modpath" /etc/audit/audit_site.conf All of the above syscalls must be defined in the file, otherwise this is a finding.
Fix: F-31786r2_fix
Edit /etc/audit/audit_site.conf and add the admin, modload, moduload, and modpath syscalls to the list of events to be audited.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN002990
- Vuln IDs
-
- V-22384
- Rule IDs
-
- SV-38357r1_rule
Checks: C-36448r1_chk
Check the permissions of the cron.allow file. # ls -lL /etc/cron.allow If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31787r1_fix
Remove the optional ACL from the file. # chacl -z /etc/cron.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003050
- Vuln IDs
-
- V-22385
- Rule IDs
-
- SV-38358r1_rule
Checks: C-36449r3_chk
Check the group ownership of the crontab files. # ls -lL /var/spool/cron/crontabs If the group-owner is not root sys (default), cron, or the crontab owner's primary group, this is a finding.
Fix: F-31788r1_fix
Change the group owner of the crontab file. # chgrp root <crontab file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003090
- Vuln IDs
-
- V-22386
- Rule IDs
-
- SV-38359r1_rule
Checks: C-36470r1_chk
Check the permissions of the crontab files. # ls -lL /var/spool/cron/crontabs If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31813r1_fix
Remove the optional ACL from the file. # chacl -z <crontab file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003110
- Vuln IDs
-
- V-22387
- Rule IDs
-
- SV-38360r1_rule
Checks: C-36471r1_chk
Check the permissions of the crontab directories. # ls -ld /var/spool/cron/crontabs If the permissions include a "+", the directory has an extended ACL, this is a finding.
Fix: F-31814r1_fix
Remove the optional ACL from the directory. # chacl -z <crontab directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003190
- Vuln IDs
-
- V-22388
- Rule IDs
-
- SV-38361r1_rule
Checks: C-36472r1_chk
Check the permissions of the file. # ls -lL /var/adm/cron/log If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31815r1_fix
Remove the optional ACL from the file. # chacl -z /var/adm/cron/log
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003210
- Vuln IDs
-
- V-22389
- Rule IDs
-
- SV-38362r1_rule
Checks: C-36473r1_chk
Check the permissions of the crontab files for an ACL. # ls -lL /var/adm/cron/cron.deny If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31816r1_fix
Remove the optional ACL from the file. # chacl -z /var/adm/cron/cron.deny
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003245
- Vuln IDs
-
- V-22390
- Rule IDs
-
- SV-38363r1_rule
Checks: C-36474r1_chk
Check the permissions of the file. # ls -lL /var/adm/cron/at.allow If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31817r1_fix
Remove the optional ACL from the file. # chacl -z /var/adm/cron/at.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003250
- Vuln IDs
-
- V-22391
- Rule IDs
-
- SV-34991r1_rule
Checks: C-36475r1_chk
Check the group ownership of the file. # ls -lL /var/adm/cron/cron.allow If the file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-31818r1_fix
Change the group ownership of the file. # chgrp root /var/adm/cron/cron.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003252
- Vuln IDs
-
- V-22392
- Rule IDs
-
- SV-26557r1_rule
Checks: C-36476r1_chk
Check the mode of the file. # ls -lL /var/adm/cron/at.deny If the file has a mode more permissive than 0600, this is a finding.
Fix: F-31819r1_fix
Change the mode of the file. # chmod 0600 /var/adm/cron/at.deny
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003255
- Vuln IDs
-
- V-22393
- Rule IDs
-
- SV-26561r1_rule
Checks: C-36477r1_chk
Check the permissions of the file. # ls -lL /var/adm/cron/at.deny If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31820r1_fix
Remove the optional ACL from the file. # chacl -z /var/adm/cron/at.deny
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003270
- Vuln IDs
-
- V-22394
- Rule IDs
-
- SV-34993r1_rule
Checks: C-36478r1_chk
Determine the cron.deny file's group owner. # ls -lL /var/adm/cron/cron.deny If the file is not group-owned by root, bin sys or other, this is a finding.
Fix: F-31821r1_fix
Change the group-owner of the cron.deny file. # chgrp root /var/adm/cron/cron.deny
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003410
- Vuln IDs
-
- V-22395
- Rule IDs
-
- SV-38364r1_rule
Checks: C-36479r1_chk
Check the permissions of the directory. # ls -lLd /var/spool/cron/atjobs If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31823r1_fix
Remove the optional ACL from the directory. # chacl -z /var/spool/cron/atjobs
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003430
- Vuln IDs
-
- V-22396
- Rule IDs
-
- SV-34995r1_rule
Checks: C-36481r1_chk
Check the group ownership of the file. Procedure: # ls -lLd /var/spool/cron/atjobs If the file is not group-owned by root, bin, sys or other this is a finding.
Fix: F-31829r1_fix
Change the group ownership of the file to root, bin, sys or other. # chgrp root /var/spool/cron/atjobs
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003470
- Vuln IDs
-
- V-22397
- Rule IDs
-
- SV-26571r1_rule
Checks: C-36484r1_chk
Check the group ownership of the file. Procedure: # ls -lL /usr/lib/cron/at.allow If the file is not group-owned by root, sys, bin or other, this is a finding.
Fix: F-31835r1_fix
Change the group ownership of the file. # chgrp root /usr/lib/cron/at.allow
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003490
- Vuln IDs
-
- V-22398
- Rule IDs
-
- SV-26574r1_rule
Checks: C-36486r1_chk
Check the group ownership of the file. Procedure: # ls -lL /usr/lib/cron/at.deny If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31838r1_fix
Change the group ownership of the at.deny file to root, bin, sys, or other. # chgrp root /usr/lib/cron/at.deny
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003501
- Vuln IDs
-
- V-22399
- Rule IDs
-
- SV-26577r1_rule
Checks: C-36488r2_chk
View all coreadm configuration settings. # coreadm Or View only if a directory is defined for process core dumps. If no information is returned, a directory has not been defined. # coreadm | tr '\011' ' ' | tr -s ' ' | egrep -i "global core file pattern|global core dumps" If the process core dump directory is undefined and core dumps are disabled, this is not applicable. If the process core dump directory is defined with a relative path (does not start with a slash "/") and core dumps are enabled, this is a finding.
Fix: F-31840r2_fix
Change the core file pattern. # coreadm -I /var/adm/crash/core.%f.%p Where: %f = Will be assigned the executable/program file name creating the core %p = Will be assigned the executable/program process ID creating the core Ensure that core dumps are enabled: # coreadm -e global
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003502
- Vuln IDs
-
- V-22400
- Rule IDs
-
- SV-26580r1_rule
Checks: C-36489r2_chk
View all coreadm configuration settings. # coreadm Or View only if a directory is defined for process core dumps. If no information is returned, a directory has not been defined. # coreadm | tr '\011' ' ' | tr -s ' ' | egrep -i "global core file pattern|global core dumps" If the process core dump directory is undefined and core dumps are disabled, this is not applicable. To check the ownership of the <core file directory>, substitute the global core file pattern from the above command into the next command. # ls -lLd `dirname <global core file pattern>` If the directory is not owned by root, this is a finding.
Fix: F-31841r3_fix
If the core file dump pattern is undefined, ensure that core dumps are disabled. # coreadm -d global If the core file dump pattern is defined and core dumps are enabled and the core file directory is not group-owned by root, bin, sys or other, change the owner of the core file directory. # chown root <core file directory>
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003503
- Vuln IDs
-
- V-22401
- Rule IDs
-
- SV-26583r1_rule
Checks: C-36490r2_chk
View all coreadm configuration settings. # coreadm Or View only if a directory is defined for process core dumps. If no information is returned, a directory has not been defined. # coreadm | tr '\011' ' ' | tr -s ' ' | egrep -i "global core file pattern|global core dumps" If the process core dump directory is undefined and core dumps are disabled, this is not applicable. Check the group ownership of the <core file directory> # ls -lLd `dirname "${CorePathFile}"` If the process core dump directory is defined and core dumps are enabled and the directory is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31842r1_fix
Change the group-owner of the core file directory. # chgrp root <core file directory>
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003504
- Vuln IDs
-
- V-22402
- Rule IDs
-
- SV-26598r1_rule
Checks: C-36491r3_chk
Check Content: View all coreadm configuration settings. # coreadm Or View only if a directory is defined for process core dumps. If no information is returned, a directory has not been defined. # coreadm | tr '\011' ' ' | tr -s ' ' | egrep -i "global core file pattern|global core dumps" If the process core dump directory is undefined and core dumps are disabled, this is not applicable. Check the permissions of the <core file directory> # ls -lLd `dirname <core dump directory>` If the core dump directory is more permissive than 0700, this is a finding.
Fix: F-31844r2_fix
If the core file dump pattern is undefined, ensure that core dumps are disabled. # coreadm -d global If the core file dump pattern is defined and core dumps are enabled and the core file directory mode is not 0700, change the mode of the core file directory. # chmod 0700 <core file directory>
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003505
- Vuln IDs
-
- V-22403
- Rule IDs
-
- SV-26603r1_rule
Checks: C-36492r2_chk
View all coreadm configuration settings. # coreadm Or View only if a directory is defined for process core dumps. If no information is returned, a directory has not been defined. # coreadm | tr '\011' ' ' | tr -s ' ' | egrep -i "global core file pattern|global core dumps" If the process core dump directory is undefined and core dumps are disabled, this is not applicable. If the process core dump directory is defined and core dumps are enabled, check the permissions of the <core file directory> # ls -lLd `dirname <core dump directory>` If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31845r2_fix
If the core file dump pattern is undefined, ensure that core dumps are disabled. # coreadm -d global If the core file dump pattern is defined and core dumps are enabled and the core file directory permissions include a "+" (ACL), remove the optional ACL from the file. # chacl -z <core file directory>
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN003510
- Vuln IDs
-
- V-22404
- Rule IDs
-
- SV-26607r1_rule
Checks: C-36493r2_chk
Verify crash dumps are disabled. # crashconf -v If the "included" list is not empty or fully disabled, this is a finding. # crashconf -v | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | cut -f 3,3 -d " " | \ egrep -c -i "yes," If the above command returns a value >0, this is a finding.
Fix: F-31846r1_fix
Disable crash dumps. # crashconf -e all Edit /etc/rc.config.d/crashconf and set CRASH_EXCLUDED_PAGES="all".
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003521
- Vuln IDs
-
- V-22405
- Rule IDs
-
- SV-26611r1_rule
Checks: C-36495r1_chk
Determine the kernel core dump data directory and check its ownership. # ls -lLd /var/adm/crash If the directory is not group-owned by root, bin, sys, or other this is a finding.
Fix: F-31849r1_fix
Change the group-owner of the kernel core dump data directory. # chgrp root /var/adm/crash
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003522
- Vuln IDs
-
- V-22406
- Rule IDs
-
- SV-26615r1_rule
Checks: C-36496r1_chk
Determine the kernel core dump data directory and check its permissions. # ls -lLd /var/adm/crash If the directory has a mode more permissive than 0700, this is a finding.
Fix: F-31850r1_fix
Change the group-owner of the kernel core dump data directory. # chmod 0700 /var/adm/crash
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN003523
- Vuln IDs
-
- V-22407
- Rule IDs
-
- SV-26619r1_rule
Checks: C-36497r1_chk
Determine the kernel core dump data directory and check its permissions. # ls -lLd /var/adm/crash If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31852r1_fix
Remove the optional ACL from the file. # chacl -z /var/adm/crash
- RMF Control
- AC-4
- Severity
- Low
- CCI
- CCI-001551
- Version
- GEN003602
- Vuln IDs
-
- V-22409
- Rule IDs
-
- SV-35022r1_rule
Checks: C-36502r1_chk
Verify the system does not respond to ICMP Timestamp requests. # ndd -get /dev/ip ip_respond_to_timestamp If the result is not 0, this is a finding.
Fix: F-31859r1_fix
Disable ICMP Timestamp responses on the system. # ndd -set /dev/ip ip_respond_to_timestamp 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_timestamp NDD_VALUE[x]=0
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003603
- Vuln IDs
-
- V-22410
- Rule IDs
-
- SV-35025r1_rule
Checks: C-36503r1_chk
Verify the system does not respond to ICMP ECHO_REQUESTs set to broadcast addresses. # ndd -get /dev/ip ip_respond_to_echo_broadcast If the result is not 0, this is a finding.
Fix: F-31860r1_fix
Configure the system to not respond to ICMP ECHO_REQUESTs sent to broadcast addresses. # ndd -set /dev/ip ip_respond_to_echo_broadcast 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_echo_broadcast NDD_VALUE[x]=0
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003604
- Vuln IDs
-
- V-22411
- Rule IDs
-
- SV-35026r1_rule
Checks: C-36504r1_chk
Verify the system does not respond to ICMP timestamp requests set to broadcast addresses. # ndd -get /dev/ip ip_respond_to_timestamp_broadcast If the result is greater than 0, this is a finding.
Fix: F-31861r1_fix
Configure the system to not respond to ICMP timestamp requests sent to broadcast addresses. # ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_timestamp_broadcast NDD_VALUE[x]=0
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003605
- Vuln IDs
-
- V-22412
- Rule IDs
-
- SV-35028r1_rule
Checks: C-36505r1_chk
Determine if the system is configured to forward source-routed IP packets. When correctly configured, if ip_forward_src_routed is disabled, the system is also configured to disable reverse source routing to TCP responses to source-routed packets. # ndd -get /dev/ip ip_forward_src_routed If the returned value is not '0', this feature is enabled and this is a finding.
Fix: F-31862r1_fix
Disable the IP source-routed forwarding feature. # ndd -set /dev/ip ip_forward_src_routed 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = ip NDD_NAME[x] = ip_forward_src_routed NDD_VALUE[x] = 0
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003606
- Vuln IDs
-
- V-22413
- Rule IDs
-
- SV-29707r2_rule
Checks: C-36508r2_chk
Check the system for an IP Filter (IPF) rule blocking outgoing source-routed packets. # ipfstat -o Examine the list for rules such as: block out log quick [all] | [from any to any] with opt lsrr block out log quick [all] | [from any to any] with opt ssrr If the listed rules do not block both lsrr and ssrr options, this is a finding.
Fix: F-31866r2_fix
Edit /etc/opt/ipf/ipf.conf and add rules to block outgoing source-routed packets, such as: block out log quick [all] | [from any to any] with opt lsrr block out log quick [all] | [from any to any] with opt ssrr Reload the IPF rules: # ipf -Fa -A -f /etc/opt/ipf/ipf.conf
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003607
- Vuln IDs
-
- V-22414
- Rule IDs
-
- SV-29713r2_rule
Checks: C-36509r2_chk
Check the system for an IP Filter (IPF) rule blocking incoming source-routed packets. # ipfstat -i Examine the list for rules such as: block in log quick [all] | [from any to any] with opt lsrr block in log quick [all] | [from any to any] with opt ssrr If the listed rules do not block incoming traffic with both lsrr and ssrr options, this is a finding.
Fix: F-31869r2_fix
Edit /etc/opt/ipf/ipf.conf and add rules to block incoming source-routed packets, such as: block in log quick [all] | [from any to any] with opt lsrr block in log quick [all] | [from any to any] with opt ssrr Reload the IPF rules. # ipf -Fa -A -f /etc/opt/ipf/ipf.conf
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003608
- Vuln IDs
-
- V-22415
- Rule IDs
-
- SV-29602r1_rule
Checks: C-36506r1_chk
Check the system for non-local published ARP entries. # arp -a[n] If any entries are listed as published, this is a finding.
Fix: F-31864r1_fix
Remove any non-local published ARP entries. # arp -d <host> Check system initialization scripts for any commands configuring published ARP entries (such as "arp -s <host> <addr> pub") and remove them. # grep -n "arp \-s" /sbin/init.d/*
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-001503
- Version
- GEN003609
- Vuln IDs
-
- V-22416
- Rule IDs
-
- SV-29719r1_rule
Checks: C-36510r1_chk
Determine if the system is configured to block inbound IPv4 ICMP redirect messages. # ipfstat -i Examine the list for a rule such as: block in quick proto icmp from any to any icmp-type redir If the listed rules do not block inbound IPv4 ICMP redirect messages, this is a finding.
Fix: F-31870r1_fix
Edit /etc/opt/ipf/ipf.conf and add rules to block incoming IPv4 ICMP redirect messages, such as: block in quick proto icmp from any to any icmp-type redir Reload the IPF rules. Flush the rules from your ruleset using the -Fa option. The -A option specifies the active rules list. The -f option specifies the rules configuration file to be used: # ipf -Fa -A -f /etc/opt/ipf/ipf.conf
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN003610
- Vuln IDs
-
- V-22417
- Rule IDs
-
- SV-35038r1_rule
Checks: C-36507r1_chk
Verify the system does not send IPv4 ICMP redirect messages. # ndd -get /dev/ip ip_send_redirects If the return value/result is not 0, this is a finding.
Fix: F-31865r1_fix
Configure the system to not send IPv4 ICMP redirect messages. # ndd -set /dev/ip ip_send_redirects 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_send_redirects NDD_VALUE[x]=0
- RMF Control
- AU-2
- Severity
- Low
- CCI
- CCI-000126
- Version
- GEN003611
- Vuln IDs
-
- V-22418
- Rule IDs
-
- SV-29772r1_rule
Checks: C-36511r2_chk
Determine if the system is configured to log martian packets. Examine the IPF rules on the system. # ipfstat -i There must be rules that log inbound traffic containing invalid source addresses, which minimally include the system's own addresses and broadcast addresses for attached subnets. For example, consider a system with a single network connection having IP address 192.168.1.10 with a local subnet broadcast address of 192.168.1.255. Packets with source addresses of 192.168.1.10 and 192.168.1.255 must be logged if received by the system from the network connection. The /etc/opt/ipf/ipf.conf file would appear as follows: block in log quick on lan0 from 192.168.1.10 to any block in log quick on lan0 from 192.168.1.255 to any If such rules do not exist, this is a finding.
Fix: F-31871r1_fix
Configure the system to log martian packets using IPF. Add rules that log inbound traffic containing invalid source addresses, which minimally include the system's own addresses and broadcast addresses for attached subnets. For example, consider a system with a single network connection having IP address 192.168.1.10 with a local subnet broadcast address of 192.168.1.255. Packets with source addresses of 192.168.1.10 and 192.168.1.255 must be logged if received by the system from the network connection. Edit /etc/opt/ipf/ipf.conf and add the following rules, substituting local addresses and interface names: block in log quick on lan0 from 192.168.1.10 to any block in log quick on lan0 from 192.168.1.255 to any Reload the IPF rules. Flush the rules from your ruleset using the -Fa option. The -A option specifies the active rules list. The -f option specifies the rules configuration file to be used: # ipf -Fa -A -f /etc/opt/ipf/ipf.conf
- RMF Control
- CP-10
- Severity
- Low
- CCI
- CCI-000553
- Version
- GEN003650
- Vuln IDs
-
- V-22422
- Rule IDs
-
- SV-26639r1_rule
Checks: C-36520r1_chk
Parse the /etc/fstab file for any mountable HFS file system entries: # cat /etc/fstab | grep -v "^#" | grep -v "/stand" | grep hfs If any /etc/fstab entries are displayed, this is a finding.
Fix: F-31880r1_fix
Convert any local HFS filesystems to use journaling, ensuring file system consistency.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003730
- Vuln IDs
-
- V-22423
- Rule IDs
-
- SV-35069r1_rule
Checks: C-36524r1_chk
Check the group ownership of the (x)inetd configuration file, its parent directory and any files identified by the configuration file includedir stanza.. # find / -type f -name inetd.conf -o -name xinetd.conf | xargs -n1 ls -lL # find / -type d -name xinetd.d | xargs -n1 ls -lLd # grep includedir <PATH>/xinetd.conf # ls -lL <includedir files from previous command> If a file or directory is not group-owned by root, bin, sys, or other this is a finding.
Fix: F-31884r1_fix
Change the group ownership of the inetd configuration file. # chgrp root <file or directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003745
- Vuln IDs
-
- V-22424
- Rule IDs
-
- SV-35073r1_rule
Checks: C-36526r2_chk
Check the permissions of the inetd configuration file. # find / -type f \( -name inetd.conf -o -name xinetd.conf \) | xargs -n1 ls -lL If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31887r1_fix
Remove the optional ACL from the file. # chacl -z <file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003750
- Vuln IDs
-
- V-22425
- Rule IDs
-
- SV-35074r1_rule
Checks: C-36527r1_chk
Check the (x)inetd.conf file for any included directories. # find / -type f -name xinetd.conf | xargs -n1 ls -lL # cat <PATH>/xinetd.conf | grep -v "^#" | grep includedir If (x)inetd.conf does not exist, or there is no includedir stanza, this is not a finding. Individually check the mode of any directories in the configuration file. # ls -lLd <included directories> If any of the included directories has a mode more permissive than 0755, this is a finding.
Fix: F-31888r1_fix
Change the mode of included xinetd configuration directories to 0755. # chmod 0755 <directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003755
- Vuln IDs
-
- V-22426
- Rule IDs
-
- SV-29790r1_rule
Checks: C-36528r1_chk
Check xinetd configuration directories for extended ACLs. Determine any xinetd configuration directories. # find / -type f -name xinetd.conf | xargs -n1 ls -lL # cat <PATH>/xinetd.conf | grep -v "^#" | grep includedir If xinetd.conf does not exist, or no includedir lines are returned, this is not applicable. Check the xinetd configuration directories for extended ACLs. # ls -lLd <included directories> If any of these directories contain a "+" in the permissions field, the directory has an extended ACL and this is a finding.
Fix: F-26901r1_fix
Remove the extended ACL from the xinetd configuration directories.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003770
- Vuln IDs
-
- V-22427
- Rule IDs
-
- SV-35080r1_rule
Checks: C-36531r1_chk
Check the group ownership of the services file. NOTE: The typical default group ownership for the services file is bin. # ls -lL /etc/services If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31893r1_fix
Change the group-owner of the services file. Procedure: # chgrp root /etc/services
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003790
- Vuln IDs
-
- V-22428
- Rule IDs
-
- SV-38366r1_rule
Checks: C-36532r1_chk
Check the permissions of the /etc/services file. # ls -lL /etc/services If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31894r1_fix
Remove the optional ACL from the file. # chacl -z /etc/services
- RMF Control
- AT-4
- Severity
- Medium
- CCI
- CCI-001336
- Version
- GEN003810
- Vuln IDs
-
- V-22429
- Rule IDs
-
- SV-26665r1_rule
Checks: C-36534r2_chk
Check if the rpcbind process is running. # ps -ef | grep -v grep | grep rpcbind If the system needs the portmap service to operate, this is not applicable. If a process is listed and not required, this is a finding.
Fix: F-31898r1_fix
Stop and disable the rpcbind service, then verify it has not been restarted. # kill rpcbind # chmod 0000 /usr/sbin/rpcbind # ps -ef | grep -v grep | grep rpcbind
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN003815
- Vuln IDs
-
- V-22430
- Rule IDs
-
- SV-35088r1_rule
Checks: C-36535r1_chk
If the system needs the portmap service to operate, this is not applicable. In order to inspect the HP-UX portmapper protocol: # rpcinfo -p If the service is running while supporting a required service, i.e., mountd/nfs(d), this is not a finding. If the portmap service is installed/running and not required to support any service(s), this is a finding.
Fix: F-31899r1_fix
If the portmap or rpcbind service is part of a removable package, consult vendor documentation for the procedure to remove the package. If the service cannot be removed, prevent service activation by removing all permissions from the executable. Procedure: # whereis rpcinfo # chmod 0000 <daemon path/filename from the above command>
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN003825
- Vuln IDs
-
- V-22431
- Rule IDs
-
- SV-35129r1_rule
Checks: C-36536r1_chk
Determine if remshd is installed/running: # cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ grep remshd If the above command returns any evidence of the remshd service, this is a finding.
Fix: F-31900r1_fix
Uninstall the remshd service from the system. # cat /etc/inetd.conf | grep -n remshd Edit the /etc/inetd.conf file and comment the line entry for remshd, then reconfigure inetd via: # inetd -c
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-000068
- Version
- GEN003830
- Vuln IDs
-
- V-22432
- Rule IDs
-
- SV-29697r1_rule
Checks: C-36538r1_chk
Determine if the rlogind service is running. # cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep rlogind If rlogind is found to be enabled, this is a finding.
Fix: F-31902r1_fix
Edit /etc/inetd.conf and comment out the rlogind service. Restart the inetd service via the following command: # inetd -c
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN003835
- Vuln IDs
-
- V-22433
- Rule IDs
-
- SV-35131r1_rule
Checks: C-36539r1_chk
Determine if the rlogind service is installed. # cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -c rlogind If rlogind is found to be installed, this is a finding.
Fix: F-31903r1_fix
Edit /etc/inetd.conf and comment out the rlogind service: # vi /etc/inetd.conf Restart the inetd service via the following command: # inetd -c Disable the rlogind binary: chmod 000 /usr/lbin/rlogind Additionally, the binary name may also be changed: mv /usr/lbin/rlogind /usr/lbin/<new_binary_name>
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN003845
- Vuln IDs
-
- V-22434
- Rule IDs
-
- SV-35133r1_rule
Checks: C-36541r2_chk
Determine if the rexecd service is installed. # cat /etc/inetd.conf | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' |grep -v "^#" | cut -f 6,7 -d " " | grep -c -i rexecd If rexecd is found to be installed, this is a finding.
Fix: F-31905r1_fix
Edit /etc/inetd.conf and comment out the rexecd service: # vi /etc/inetd.conf Restart the inetd service via the following command: # inetd -c Disable the binary: chmod 000 /usr/lbin/rexecd Additionally, the binary name may also be changed: mv /usr/lbin/rexecd /usr/lbin/<new_binary_name>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003930
- Vuln IDs
-
- V-22435
- Rule IDs
-
- SV-35144r1_rule
Checks: C-36547r1_chk
When rlpdaemon is started by inetd, access control is provided via the file /var/adm/inetd.sec to allow or prevent a host from making requests. When rlpdaemon is not started by inetd(1M), all requests must come from one of the machines listed in the file /etc/hosts.equiv or /var/spool/lp/.rhosts. When /var/spool/lp/.rhosts is used for access, the user name should be lp. Check the group ownership of the /etc/hosts.lpd (or equivalent) file(s). # ls -lL /var/spool/lp/.rhosts # ls -lL /var/adm/inetd.sec # ls -lL /etc/hosts.equiv If the file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31913r1_fix
Change the group-owner of the hosts.lpd (or equivalent) file(s). # chgrp root /etc/hosts.lpd
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN003950
- Vuln IDs
-
- V-22436
- Rule IDs
-
- SV-35150r1_rule
Checks: C-36550r1_chk
Locate any print service configuration file(s) on the system. HP vendor documentation identifies the following names and locations of print service configuration files on the system that can be checked via the following commands: # ls -lL /var/spool/lp/.rhosts # ls -lL /var/adm/inetd.sec # ls -lL /etc/hosts.equiv If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31916r1_fix
Remove the optional ACL from the file. # chacl -z <print service configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004010
- Vuln IDs
-
- V-22437
- Rule IDs
-
- SV-38370r1_rule
Checks: C-27705r2_chk
Check the permissions of the /usr/sbin/traceroute file. # ls -lL /usr/contrib/bin/traceroute If the permissions include a "+", the file has an extended ACL and this is a finding.
Fix: F-26286r2_fix
Remove the extended ACL from the traceroute file. # chacl -z /usr/contrib/bin/traceroute
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004370
- Vuln IDs
-
- V-22438
- Rule IDs
-
- SV-35163r1_rule
Checks: C-36557r1_chk
Check the group ownership of the /etc/mail/aliases file. # ls -lL /etc/mail/aliases If the file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-31924r1_fix
Change the group-owner of the /etc/mail/aliases file. # chgrp root /etc/mail/aliases
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004390
- Vuln IDs
-
- V-22439
- Rule IDs
-
- SV-38372r1_rule
Checks: C-36559r1_chk
Check the permissions of the /etc/mail/aliases file. # ls -lL /etc/mail/aliases If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31927r1_fix
Remove the optional ACL from the file. # chacl -z /etc/mail/aliases
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004410
- Vuln IDs
-
- V-22440
- Rule IDs
-
- SV-38373r1_rule
Checks: C-36561r1_chk
Examine the contents of the /etc/mail/aliases file. # cat /etc/mail/aliases | cut -f 2,2 -d ":" | grep "|" For each file referenced, check the group ownership of the file. # ls -lL <file referenced from aliases> If the group owner of any file is not root, bin, sys or other, this is a finding.
Fix: F-31929r1_fix
Change the group ownership of the file referenced from /etc/mail/aliases. # chgrp root <file referenced from aliases>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004430
- Vuln IDs
-
- V-22441
- Rule IDs
-
- SV-38369r1_rule
Checks: C-36563r1_chk
Examine the contents of the /etc/mail/aliases file. For each file referenced, check the permissions of the file. # ls -lL <file referenced from aliases> If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31931r1_fix
Remove the optional ACL from the file. # chacl -z <file referenced from aliases>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004510
- Vuln IDs
-
- V-22442
- Rule IDs
-
- SV-38368r1_rule
Checks: C-36568r1_chk
Examine /etc/syslog.conf and determine the log file(s) receiving logs for mail.crit, mail.debug, mail.*, or *.crit. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ egrep -i "mail.crit|mail.\*|\*.crit|mail.debug|\*.debug" | cut -f 2,2 -d " " | \ uniq | xargs -n1 ls -lL Check the permissions on these log files. # ls -lL <log file> If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31936r1_fix
Remove the optional ACL from the log file. # chacl -z <log file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004930
- Vuln IDs
-
- V-22444
- Rule IDs
-
- SV-35104r1_rule
Checks: C-36585r1_chk
Check the group ownership of the ftpusers file. # ls -lL /etc/ftpd/ftpusers If the file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-31953r1_fix
Change the group owner of the ftpusers file. # chgrp root /etc/ftpd/ftpusers
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN004950
- Vuln IDs
-
- V-22445
- Rule IDs
-
- SV-38367r1_rule
Checks: C-36587r1_chk
Check the permissions of the /etc/ftpusers file. # ls -lL /etc/ftpd/ftpusers If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31955r1_fix
Remove the optional ACL from the file. # chacl -z /etc/ftpd/ftpusers
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005190
- Vuln IDs
-
- V-22446
- Rule IDs
-
- SV-35167r1_rule
Checks: C-36600r2_chk
Get a list of (non-system account) users and the associated home directories. # cat /etc/passwd | cut -f 1,6 -d ":" Check the file permissions for the user .Xauthority files. # ls -lLa /<userhomedirectory>/.Xauthority If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31967r2_fix
Remove the optional ACL from the file. # chacl -z /<userhomedirectory>/.Xauthority
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001435
- Version
- GEN005305
- Vuln IDs
-
- V-22447
- Rule IDs
-
- SV-26716r1_rule
Checks: C-36607r1_chk
Verify the SNMP daemon is not configured to use community strings. # cat /etc/SnmpAgent.d/snmpd.conf |egrep -i "get-community-name|set-community-name" If any configuration is found, this is a finding.
Fix: F-31975r1_fix
Edit /etc/SnmpAgent.d/snmpd.conf and remove references to get-community-name and set-community-name. Restart the SNMP service. # /sbin/init.d/SnmpMaster The snmpd script (/usr/sbin/snmpd) will take care of starting the subagents. It if does not, check the options in /etc/rc.config.d/SnmpMaster that influence the startup behavior.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005350
- Vuln IDs
-
- V-22450
- Rule IDs
-
- SV-38374r1_rule
Checks: C-36614r1_chk
Check the file permissions for the MIB files. # find / -type f -name *.mib -exec ls -lL {} \; If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31980r1_fix
Remove the optional ACL from the file. # chacl -z <mib file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005365
- Vuln IDs
-
- V-22451
- Rule IDs
-
- SV-26734r1_rule
Checks: C-36616r1_chk
Check the group ownership of the SNMP configuration file. # ls -lL /etc/SnmpAgent.d/snmpd.conf If the file is not group-owned by root, sys, bin or other, this is a finding.
Fix: F-31982r1_fix
Change the group ownership of the SNMP configuration file. # chgrp root /etc/SnmpAgent.d/snmpd.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005375
- Vuln IDs
-
- V-22452
- Rule IDs
-
- SV-26738r1_rule
Checks: C-36617r1_chk
Check the permissions of the SNMP configuration file. # ls -lL /etc/SnmpAgent.d/snmpd.conf If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-31983r1_fix
Remove the optional ACL from the file. # chacl -z /etc/SnmpAgent.d/snmpd.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005390
- Vuln IDs
-
- V-22453
- Rule IDs
-
- SV-38376r1_rule
Checks: C-36619r1_chk
Check the permissions of the syslog configuration file. # ls -lL /etc/syslog.conf If the mode of the file is more permissive than 0640, this is a finding.
Fix: F-31985r1_fix
Change the permissions of the syslog configuration file. # chmod 0640 /etc/syslog.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005395
- Vuln IDs
-
- V-22454
- Rule IDs
-
- SV-38375r1_rule
Checks: C-36620r1_chk
Check the permissions of the syslog configuration file. # ls -lL /etc/syslog.conf If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-31987r1_fix
Remove the optional ACL from the file. # chacl -z /etc/syslog.conf
- RMF Control
- AU-3
- Severity
- Medium
- CCI
- CCI-000136
- Version
- GEN005450
- Vuln IDs
-
- V-22455
- Rule IDs
-
- SV-35189r1_rule
Checks: C-36624r1_chk
A typical entry listing the loghost server should look similar to the following: *.* @example.com Check the syslog configuration file for remote syslog servers. # cat /etc/syslog.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep "\@" If no line information is returned, this is a finding.
Fix: F-31991r1_fix
Edit the syslog configuration file and add an appropriate remote syslog server.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001436
- Version
- GEN005501
- Vuln IDs
-
- V-22456
- Rule IDs
-
- SV-35212r1_rule
Checks: C-36631r2_chk
Check the SSH client configuration for allowed protocol versions. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Protocol arg(s)=2 # cat /opt/ssh/etc/ssh_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "Protocol" If Protocol 2,1 (the default) or Protocol 1 are defined on a line without a leading comment, this is a finding.
Fix: F-31999r1_fix
Edit the client configuration file Protocol entry to look like: Protocol 2
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-000069
- Version
- GEN005504
- Vuln IDs
-
- V-22457
- Rule IDs
-
- SV-35214r1_rule
Checks: C-36632r2_chk
Ask the SA if any/all interfaces are authorized for management traffic. If all interfaces are authorized, this is not a finding. Check the SSH daemon configuration for listening network addresses. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=ListenAddress arg(s)=<site specific> Default arg values include: NA. The default action is for the daemon to listen on all local addresses. In this case, the ListenAddress line entry will not be found in the configuration file. Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> are not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "ListenAddress" If a returned 'ListenAddress' configuration entry contains addresses not designated for management traffic, this is a finding.
Fix: F-32001r2_fix
Edit the configuration file to specify listening for network addresses designated for management traffic only, or remove the ListenAddress line entry.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-000068
- Version
- GEN005505
- Vuln IDs
-
- V-22458
- Rule IDs
-
- SV-35216r1_rule
Checks: C-36633r1_chk
Check the SSH daemon configuration for allowed ciphers. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Ciphers arg(s)=<comma separated cipher(s) of the form 3des-ctr or aes-NNN-ctr, NNN=128, 192 or 256> Default values include: "aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour,arcfour128,arcfour256blowfish-cbc,cast128-cbc". For this check, all keyword values ending with the suffix "-cbc" are disallowed, IE: 3des-cbc. As the vendor does not currently support 3des-ctr, the only current allowed keyword values begin with the prefix "aes" and terminate with the suffix "-ctr". Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | egrep -i "ciphers" All ciphers present in the returned ciphers line entry must be prefixed by 3des or aes and end with the suffix "-ctr" or this is a finding.
Fix: F-32003r1_fix
Edit the configuration file and remove any ciphers that do not meet the following: 3des-ctr or aes-NNN-ctr (NNN=128, 192 or 256). If necessary, add the Ciphers entry with one or more of the above keyword values.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005506
- Vuln IDs
-
- V-22459
- Rule IDs
-
- SV-35218r1_rule
Checks: C-36634r1_chk
Check the SSH daemon configuration for allowed ciphers. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Ciphers arg(s)=<comma separated cipher(s)> Default values include: "aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour,arcfour128,arcfour256blowfish-cbc,cast128-cbc". For this check, the only allowed keyword values are those from the above list with the "aes" prefix and the "-ctr" suffix. Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "ciphers" If the returned ciphers list contains any cipher other than those with the "aes" prefix and the "-ctr" suffix, this is a finding.
Fix: F-32004r1_fix
Edit the configuration file and remove any ciphers other than those with the "aes" prefix and the "-ctr" suffix.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001453
- Version
- GEN005507
- Vuln IDs
-
- V-22460
- Rule IDs
-
- SV-35220r2_rule
Checks: C-36635r2_chk
Check the SSH daemon configuration for allowed MACs. Note that keywords are case-insensitive and arguments (args) are case-sensitive. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | egrep -i "macs" If no lines are returned, or the returned MACs list contains any MAC that is not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list, this is a finding.
Fix: F-32005r2_fix
Edit the SSH daemon configuration and remove any MACs that are not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list. If necessary, add a MACs line.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-000068
- Version
- GEN005510
- Vuln IDs
-
- V-22461
- Rule IDs
-
- SV-35188r1_rule
Checks: C-36636r1_chk
Check the SSH client configuration for allowed ciphers. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Ciphers arg(s)=<comma separated cipher(s) of the form 3des-ctr or aes-NNN-ctr, NNN=128, 192 or 256> Default values include: "aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour,arcfour128,arcfour256blowfish-cbc,cast128-cbc". For this check, all keyword values ending with the suffix "-cbc" are disallowed, IE: 3des-cbc. As the vendor does not currently support 3des-ctr, the only current allowed keyword values begin with the prefix "aes" and terminate with the suffix "-ctr". Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/ssh_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | egrep -i "ciphers" All ciphers present in the returned ciphers line entry must be prefixed by 3des or aes and end with the suffix "-ctr" or this is a finding.
Fix: F-32007r1_fix
Edit the configuration file and remove any ciphers that do not meet the following: 3des-ctr or aes-NNN-ctr (NNN=128, 192 or 256). If necessary, add the Ciphers entry with one or more of the above keyword values.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005511
- Vuln IDs
-
- V-22462
- Rule IDs
-
- SV-35193r1_rule
Checks: C-36637r1_chk
Check the SSH client configuration for allowed ciphers. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Ciphers arg(s)=<comma separated cipher(s)> Default values include: "aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour,arcfour128,arcfour256blowfish-cbc,cast128-cbc". For this check, the only allowed keyword values are those from the above list with the "aes" prefix and the "-ctr" suffix. Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/ssh_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "ciphers" If the returned ciphers list contains any cipher other than those with the "aes" prefix and the "-ctr" suffix, this is a finding.
Fix: F-32008r1_fix
Edit the configuration file and remove any ciphers other than those with the "aes" prefix and the "-ctr" suffix.
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001453
- Version
- GEN005512
- Vuln IDs
-
- V-22463
- Rule IDs
-
- SV-35210r3_rule
Checks: C-36638r3_chk
Check the SSH client configuration for allowed MACs. Note that keywords are case-insensitive and arguments (args) are case-sensitive. Examine the file. # cat /opt/ssh/etc/ssh_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | egrep -i "macs" If no lines are returned, or the returned MACs list contains any MAC that is not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list, this is a finding.
Fix: F-32009r2_fix
Edit the SSH client configuration and remove any MACs that are not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list. If necessary, add a MACs line.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005521
- Vuln IDs
-
- V-22470
- Rule IDs
-
- SV-35052r1_rule
Checks: C-34923r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword(s)=DenyUsers, AllowUsers, DenyGroups, AllowGroups (order of precedence, most to least). arg(s)=<site specific> Default values for users/groups include: "<valid, space-separated user and/or group names. UID's/GIDs are not allowed/valid>". Lack of keyword(s) in the configuration file will result in allowing ssh access to all users and all groups. A typical installation should either include an allow (users/groups) list or deny (users/groups) list depending on what the defined site security requirements are. Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | egrep -i "DenyUsers|AllowUsers|DenyGroups|AllowGroups" If keyword(s) with valid, space-separated user(s) and/or group(s) are not returned, this is a finding.
Fix: F-30228r1_fix
Edit the SSH daemon configuration and add the appropriate keyword directive(s) and space-separated user/group names. The keyword order of precedence is as follows: DenyUsers, AllowUsers, DenyGroups, AllowGroups
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005522
- Vuln IDs
-
- V-22471
- Rule IDs
-
- SV-35060r1_rule
Checks: C-34928r1_chk
Check the permissions for the SSH public host key files. # ls -lL /opt/ssh/etc/ssh_host_dsa_key.pub # ls -lL /opt/ssh/etc/ssh_host_rsa_key.pub If any file has a mode more permissive than 0644, this is a finding.
Fix: F-30234r1_fix
Change the permissions for the SSH public host key files. # chmod 0644 /opt/ssh/etc/*key.pub
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005523
- Vuln IDs
-
- V-22472
- Rule IDs
-
- SV-35063r1_rule
Checks: C-34930r1_chk
Check the permissions for SSH private host key files. ls -lL /opt/ssh/etc/ssh_host_dsa_key ls -lL /opt/ssh/etc/ssh_host_rsa_key If any file has a mode more permissive than 0600, this is a finding.
Fix: F-30236r1_fix
Change the permissions for the SSH private host key files. # chmod 0600 /opt/ssh/etc/*key
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN005524
- Vuln IDs
-
- V-22473
- Rule IDs
-
- SV-35066r1_rule
Checks: C-34932r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=GSSAPIAuthentication arg(s)=no Default values include: "no" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "GSSAPIAuthentication" If the return value is yes, this is a finding.
Fix: F-30238r1_fix
Edit the SSH daemon configuration and delete the keyword entry or modify the entry as follows: GSSAPIAuthentication no
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN005525
- Vuln IDs
-
- V-22474
- Rule IDs
-
- SV-35068r1_rule
Checks: C-34935r1_chk
Check the SSH client configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=GSSAPIAuthentication arg(s)=no Default values include: "no" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/ssh_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "GSSAPIAuthentication" If the return value is yes, this is a finding.
Fix: F-30241r1_fix
Edit the configuration file and set/add (if necessary) the GSSAPIAuthentication directive set to no.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN005526
- Vuln IDs
-
- V-22475
- Rule IDs
-
- SV-35075r1_rule
Checks: C-34939r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=KerberosAuthentication arg(s)=no Default values include: "no" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. If the system does not use Kerberos authentication, this is not applicable. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "KerberosAuthentication" If the return value is yes, this is a finding.
Fix: F-30245r1_fix
Edit the SSH daemon configuration and set (add if necessary) a KerberosAuthentication directive set to no.
- RMF Control
- AC-10
- Severity
- Low
- CCI
- CCI-000054
- Version
- GEN005533
- Vuln IDs
-
- V-22482
- Rule IDs
-
- SV-35135r1_rule
Checks: C-34993r2_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=MaxSessions arg(s)=1 Default values include: "10" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "MaxSessions" If configuration information is not returned or the return value is greater than one (1), this is a finding.
Fix: F-30287r2_fix
Edit the SSH daemon configuration and add or edit the MaxSessions setting value to 1.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005536
- Vuln IDs
-
- V-22485
- Rule IDs
-
- SV-35137r1_rule
Checks: C-34995r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=StrictModes arg(s)=yes Default values include: "yes" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "StrictModes" If the return value is no, this is a finding.
Fix: F-30289r1_fix
Edit the SSH daemon configuration and add or edit the StrictModes setting value to yes.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005537
- Vuln IDs
-
- V-22486
- Rule IDs
-
- SV-35139r1_rule
Checks: C-34999r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=UsePrivilegeSeparation arg(s)=yes Default values include: "yes" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "UsePrivilegeSeparation" If the return value is no, this is a finding.
Fix: F-30291r1_fix
Edit the SSH daemon configuration and add or edit the UsePrivilegeSeparation setting value to yes.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005538
- Vuln IDs
-
- V-22487
- Rule IDs
-
- SV-35142r1_rule
Checks: C-35000r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=RhostsRSAAuthentication arg(s)=no Default values include: "no" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "RhostsRSAAuthentication" This option currently applies only to Protocol Version 1. If using Protocol 1 or any variant of Protocol 1, IE: Protocol 1,2 OR Protocol 2,1 and configuration information is not returned or the return value is yes, this is a finding. If using Protocol 2, this is Not Applicable (NA).
Fix: F-30293r1_fix
Edit the SSH daemon configuration and add or edit the RhostsRSAAuthentication setting value to no. Note that the above guidance applies exclusively to Protocol(s) 1/1,2/2,1 only. If using Protocol 2 only, the check is not applicable and further action is not required.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005539
- Vuln IDs
-
- V-22488
- Rule IDs
-
- SV-35146r1_rule
Checks: C-35004r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Compression arg(s)="no" OR "delayed", IE: mutually exclusive arguments, should never occur together Default values include: "delayed" Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "Compression" If configuration information is not returned or the return value is yes, this is a finding.
Fix: F-30297r1_fix
Edit the SSH daemon configuration and add or edit the Compression setting value to no or delayed.
- RMF Control
- AC-8
- Severity
- Medium
- CCI
- CCI-000048
- Version
- GEN005550
- Vuln IDs
-
- V-22489
- Rule IDs
-
- SV-35152r1_rule
Checks: C-35009r1_chk
Check the SSH daemon configuration. Note that keywords are case-insensitive and arguments (args) are case-sensitive. keyword=Banner arg(s)=<Department of Defense (DoD) login banner file name> Default values include: <no keyword or banner file name entry> Note: When the default "arg" value exactly matches the required "arg" value (see above), the <keyword=arg> entry is not required to exist (commented or uncommented) in the ssh (client) or sshd (server) configuration file. While not required, it is recommended that the configuration file(s) be populated with all keywords and assigned arg values as a means to explicitly document the ssh(d) binary's expected behavior. Examine the file. # cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "Banner" Verify the contents of the banner file: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't." If configuration information is not returned or the return value does not contain the Department of Defense (DoD) login banner file name (with banner file content verified), this is a finding.
Fix: F-30303r1_fix
Edit the SSH daemon configuration and add or edit a banner setting referencing a file containing a login warning banner. If required, edit the sshd banner file and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't"
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005570
- Vuln IDs
-
- V-22490
- Rule IDs
-
- SV-26805r1_rule
Checks: C-27794r1_chk
Check for a default route for IPv6: # netstat -f inet6 -r | grep default If the system uses IPv6 and no results are returned, this is a finding.
Fix: F-24050r1_fix
Add a default route for IPv6. Edit /etc/rc.config.d/netconf-ipv6 Add an IPV6_GATEWAY[0]="<gateway>" Restart the system to apply the new default gateway setting.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005610
- Vuln IDs
-
- V-22491
- Rule IDs
-
- SV-26811r1_rule
Checks: C-27799r1_chk
Check if the system is configured for IPv6 forwarding. # ndd -get /dev/ip6 ip6_forwarding If ip6_forwarding is set to 1, this is a finding.
Fix: F-24054r1_fix
Disable IPv6 forwarding: # ndd -set /dev/ip6 ip6_forwarding 0 Edit /etc/rc.config.d/nddconf: TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_forwarding NDD_VALUE[index]=0 Where: index is the next available integer value of the nddconf file. n is a number: either 1 to turn the feature ON or 0 to turn it OFF.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005750
- Vuln IDs
-
- V-22492
- Rule IDs
-
- SV-35183r1_rule
Checks: C-38012r1_chk
Check the group ownership of the NFS share configuration file. # echo `ls -lL /etc/dfs/dfstab` | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | cut -f 4,4 -d " " If the file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-33251r1_fix
Change the group ownership of the NFS share configuration file. # chgrp root /etc/dfs/dfstab
- RMF Control
- AC-6
- Severity
- Low
- CCI
- CCI-000225
- Version
- GEN005770
- Vuln IDs
-
- V-22493
- Rule IDs
-
- SV-26817r1_rule
Checks: C-35032r2_chk
Check the mode of the NFS export configuration file. # echo `ls -lL /etc/dfs/dfstab` | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | cut -f 1,1 -d " " If the permissions include a + the file has an extended ACL, this is a finding.
Fix: F-24060r2_fix
Remove the optional ACL from the file. # chacl -z /etc/dfs/dfstab
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN005810
- Vuln IDs
-
- V-22496
- Rule IDs
-
- SV-35196r2_rule
Checks: C-35041r3_chk
List the shares. # cat /etc/dfs/sharetab | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | cut -f 1,1 -d " " Check the group ownership of each shared directory. # ls -lLd <exported directory> If the directory is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-30332r2_fix
Change the group owner of the share directory. # chgrp (root|bin|sys|other) <exported directory>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006150
- Vuln IDs
-
- V-22497
- Rule IDs
-
- SV-35223r1_rule
Checks: C-35067r1_chk
Check the group ownership of the Samba configuration file. # find / -type f -name smb.conf | xargs -n1 ls -lL If the permissions include a '+', the file has an extended ACL, this is a finding.
Fix: F-30354r1_fix
Remove the optional ACL from the file. # chacl -z <path>/smb.conf
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006210
- Vuln IDs
-
- V-22498
- Rule IDs
-
- SV-35105r1_rule
Checks: C-36703r1_chk
Check the group ownership of the Samba configuration file. # find / -name smbpasswd | xargs -n1 ls -lL If the permissions include a + the file has an extended ACL, this is a finding.
Fix: F-32078r1_fix
Remove the optional ACL from the file. # chacl -z <path>/smbpasswd
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006225
- Vuln IDs
-
- V-22499
- Rule IDs
-
- SV-35109r1_rule
Checks: C-36705r1_chk
Examine the smb.conf file for the share security setting.. # cat /etc/opt/samba/smb.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i "^security = share" If the share security setting is share, this is a finding.
Fix: F-32081r1_fix
Edit the /etc/smb.conf file and change the security setting to user or another valid setting other than share, for example: security = user
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006230
- Vuln IDs
-
- V-22500
- Rule IDs
-
- SV-35111r1_rule
Checks: C-36706r1_chk
Check the encryption setting in the Samba configuration file. # cat /etc/opt/samba/smb.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i "^encrypt passwords = yes" If the encrypt passwords setting is not set to "yes", this is a finding.
Fix: F-32083r1_fix
Edit the /etc/opt/samba/smb.conf file and change the encrypt passwords setting to yes, for example: encrypt passwords = yes
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006235
- Vuln IDs
-
- V-22501
- Rule IDs
-
- SV-35112r1_rule
Checks: C-36707r1_chk
Check the guest setting the Samba configuration. # cat /etc/opt/samba/smb.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i "^guest ok = yes" If the setting exists and is set to yes, this is a finding.
Fix: F-32084r1_fix
Edit the /etc/opt/samba/smb.conf file and change the guest ok setting to no, for example: guest ok = no
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006270
- Vuln IDs
-
- V-22502
- Rule IDs
-
- SV-35115r1_rule
Checks: C-34959r1_chk
Check the permissions of the file. # find / -type f -name hosts.nntp | xargs -n1 ls -lL If the permissions include a "+", the file has an extended ACL, this is a finding.
Fix: F-30263r1_fix
Remove the optional ACL from the file. # chacl -z <path>/hosts.nntp
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006290
- Vuln IDs
-
- V-22503
- Rule IDs
-
- SV-35117r1_rule
Checks: C-34962r1_chk
Check the permissions of the file. # find / -type f -name hosts.nntp.nolimit | xargs -n1 ls -lL If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-30265r1_fix
Remove the optional ACL from the file. # chacl -z <path>/hosts.nntp.nolimit
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006310
- Vuln IDs
-
- V-22504
- Rule IDs
-
- SV-35119r1_rule
Checks: C-36714r1_chk
Check the permissions of the file. # find / -type f -name nnrp.access | xargs -n1 ls -lL If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-32095r1_fix
Remove the optional ACL from the file. # chacl -z <path>/nnrp.access
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN006330
- Vuln IDs
-
- V-22505
- Rule IDs
-
- SV-35121r1_rule
Checks: C-34979r1_chk
Check the permissions of the file. # find / -type f -name passwd.nntp | xargs -n1 ls -lL If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-30273r1_fix
Remove the optional ACL from the file. # chacl -z <path>/passwd.nntp
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN006565
- Vuln IDs
-
- V-22506
- Rule IDs
-
- SV-35166r1_rule
Checks: C-35018r1_chk
Check the root crontab for a job invoking the system package management tool to verify the integrity of installed packages. If no such job exists, this is a finding. An example using HP's command line tool suite to list/verify installed local machine software bundles is: # swlist -l bundle # Initializing... # Contacting target "abc123"... # # Target: abc123:/ # 10GigEthr-00 B.11.31.0709 PCI-X 10 Gigabit Ethernet;Supptd Then run swverify, at the end of the output look for status of Verification succeeded. # swverify -v 10GigEthr-00
Fix: F-32107r1_fix
Add a job to the root crontab invoking the system package management tool to verify the integrity of installed packages.
- RMF Control
- SI-7
- Severity
- Low
- CCI
- CCI-001297
- Version
- GEN006570
- Vuln IDs
-
- V-22507
- Rule IDs
-
- SV-35185r1_rule
Checks: C-35029r1_chk
Ask the SA if the file integrity tool is configured to monitor directories and files for ACL settings. If using the Advanced Intrusion Detection Environment (AIDE) tool, verify the configuration file (aide.conf) contains the ACL option for all monitored files and directories. See the following example. # find / -type f -name aide.conf | xargs -n1 ls -lL # cat <path>/aide.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | \ egrep -i "^acl = |acl" If the option is not present, this is a finding. If using a different file integrity tool, check the configuration per tool the vendor's documentation.
Fix: F-30321r1_fix
If using AIDE, edit the configuration and add the ACL option for all monitored files and directories. If using a different file integrity tool, configure ACL checking per the tool vendor's documentation.
- RMF Control
- SI-7
- Severity
- Low
- CCI
- CCI-001297
- Version
- GEN006571
- Vuln IDs
-
- V-22508
- Rule IDs
-
- SV-35190r1_rule
Checks: C-35035r1_chk
Ask the SA if the file integrity tool is configured to monitor directories and files for xattrs settings. If using the Advanced Intrusion Detection Environment (AIDE) tool, verify the configuration file (aide.conf) contains the xattrs option for all monitored files and directories. See the following example. # find / -type f -name aide.conf | xargs -n1 ls -lL # cat <path>/aide.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | \ egrep -i "^xattrs = |xattrs" If the option is not present, this is a finding. If using a different file integrity tool, check the configuration per the tool vendor's documentation.
Fix: F-30326r1_fix
If using AIDE, edit the configuration and add the xattrs option for all monitored files and directories. If using a different file integrity tool, configure extended attributes checking per the tool's documentation.
- RMF Control
- SI-7
- Severity
- Low
- CCI
- CCI-001297
- Version
- GEN006575
- Vuln IDs
-
- V-22509
- Rule IDs
-
- SV-35194r1_rule
Checks: C-35039r1_chk
Ask the SA if the file integrity tool is configured to monitor directories and files for sha256 or sha512 settings. If using the Advanced Intrusion Detection Environment (AIDE) tool, verify the configuration file (aide.conf) contains the xattrs option for all monitored files and directories. See the following example. # find / -type f -name aide.conf | xargs -n1 ls -lL # cat <path>/aide.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | \ egrep -i "sha256|sha512" If one of these option is not present, this is a finding. If using a different file integrity tool, check the configuration per tool documentation.
Fix: F-30331r1_fix
If using AIDE, edit the configuration and add the sha512 option for all monitored files and directories. If using a different file integrity tool, configure FIPS 140-2 approved cryptographic hashes per the tool's documentation.
- RMF Control
- CM-7
- Severity
- Medium
- CCI
- CCI-000382
- Version
- GEN007020
- Vuln IDs
-
- V-22511
- Rule IDs
-
- SV-29988r1_rule
Checks: C-35070r1_chk
Check the system for an SCTP installation: # swlist | grep -i SCTP If SCTP is installed, this is a finding.
Fix: F-30357r1_fix
Configure the system to prevent the dynamic loading of the SCTP protocol handler. Preview the removal of SCTP: # swremove -p <SCTP software product> Remove: # swremove <SCTP software product>
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN007760
- Vuln IDs
-
- V-22544
- Rule IDs
-
- SV-29601r1_rule
Checks: C-35083r1_chk
Determine if any non-local published NDP entries exist on the system. # ndp -a If any NDP entries contain a flag of P, they are non-local published entries, and this is a finding.
Fix: F-32129r1_fix
Remove non-local published NDP entries from the system. # ndp -d <host> Check system startup scripts for commands publishing NDP entries (such as "ndp -s <int> <host> <hwaddr> pub") and remove them.
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN007820
- Vuln IDs
-
- V-22547
- Rule IDs
-
- SV-26928r1_rule
Checks: C-35086r1_chk
Examine the /etc/rc.config.d/netconf* files for any TUN_ configurations. # cat /etc/rc.config.d/netconf* | tr '\011' ' ' | tr -s ' ' | \ sed -e 's/^[ \t]*//' | grep -v "^#" |grep '^TUN_' If this configuration is found, this is a finding.
Fix: F-24172r1_fix
Edit the /etc/rc.config.d/netconf* files and remove the tunnel configurations.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN007840
- Vuln IDs
-
- V-22548
- Rule IDs
-
- SV-26932r1_rule
Checks: C-35087r1_chk
Check the DHCP_ENABLE setting in /etc/rc.config.d/netconf # /etc/rc.config.d/netconf| tr '\011' ' ' | tr -s ' ' | \ sed -e 's/^[ \t]*//' | grep -v "^#" |grep "DHCP_ENABLE" If the setting is set to 1, this is a finding.
Fix: F-24175r1_fix
Disable the DHCP client configuration. Edit /etc/rc.config.d/netconf and set the DHCP_ENABLE setting to 0.
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN007860
- Vuln IDs
-
- V-22550
- Rule IDs
-
- SV-35241r1_rule
Checks: C-35088r1_chk
Determine if the system blocks inbound IPv6 ICMP redirects. # ipfstat -6 -i Check for a rule such as: block in quick proto icmpv6 from any to any icmpv6-type 137 If a rule blocking inbound IPv6 ICMP redirects does not exist, this is a finding.
Fix: F-30359r1_fix
Add an IPF rule to block inbound IPv6 ICMP redirect packets. Edit /etc/opt/ipf/ipf6.conf and add a rule such as: block in quick proto icmpv6 from any to any icmpv6-type 137 Reload the IPF rules. # ipf -6 -Fa -A -f /etc/opt/ipf/ipf6.conf
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN007880
- Vuln IDs
-
- V-22551
- Rule IDs
-
- SV-26939r1_rule
Checks: C-27887r1_chk
Determine if the system is configured to not send IPv6 ICMP redirect messages. # ndd -get /dev/ip6 ip6_send_redirects If the command returns 1, this is a finding.
Fix: F-24184r1_fix
Configure the system to not send IPv6 ICMP redirect messages. # ndd -set /dev/ip6 ip6_send_redirects 0 Edit /etc/rc.config.d/nddconf: TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_send_redirects NDD_VALUE[index]=0 Where: index is the next available integer value of the nddconf file. n is a number: either 1 to turn the feature ON or 0 to turn it OFF.
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN007900
- Vuln IDs
-
- V-22552
- Rule IDs
-
- SV-42274r1_rule
Checks: C-40620r1_chk
If IPv6 is not used on the system, this is not applicable. Determine if the system is configured to use reverse-path filtering. Examine the IPF rules on the system. # ipfstat -6i All systems must block inbound traffic destined to the loopback address block from interfaces other than the loopback. This can be accomplished with an IPF rule such as: block in log quick on lan0 from 0::1 to any Additionally, if the system is multihomed and the attached networks are isolated or perform symmetric routing, traffic with source addresses expected on one interface must be blocked when received on another interface. If this filtering is not configured on the system, this is a finding.
Fix: F-35903r1_fix
Configure the system to use reverse-path filtering using IPF. Edit /etc/opt/ipf/ipf6.conf to add or edit IPv6 IPF rules. Add a rule to block traffic with loopback network source addresses from being received on interfaces other than the loopback, such as: block in log quick on lan0 from 0::1 to any If the system is multihomed and the attached networks are isolated or perform symmetric routing, add rules to block traffic with source addresses expected on one interface when received on another interface. For example, consider a system with two network interfaces, one attached to an isolated management network with address 2001:abc::1/64 and the other attached to a production network with address 2001:def::1/64 and a default route. Traffic with a source address on the 2001:abc::0/64 network must be the only traffic accepted on the management interface and must not be accepted on the production interface. This can be accomplished with IPF rules such as: pass in quick on mgmt0 from 2001:abc::0/64 to any block in quick on mgmt0 from any to any block in quick on prod0 from 2001:abc::0/64 to any Reload the IPF rules. Flush the rules from your ruleset using the -6Fa option. The -A option specifies the active rules list. The -f option specifies the rules configuration file to be used: # ipf -6Fa -A -f /etc/opt/ipf/ipf6.conf
- RMF Control
- AC-4
- Severity
- Medium
- CCI
- CCI-001551
- Version
- GEN007920
- Vuln IDs
-
- V-22553
- Rule IDs
-
- SV-38378r1_rule
Checks: C-36755r2_chk
Determine if the system is configured for packet forwarding. # ndd -get /dev/ip6 ip6_forwarding If the command returns 0 (disabled), this is not a finding. If the command returns 1 (enabled), ask the SA if the system is configured to act as a router, this is a finding.
Fix: F-32139r2_fix
Configure the system to not forward IPv6 source-routed packets. # ndd -set /dev/ip6 ip6_forwarding 0 This command should also be added to the ndd configuration file and/or to the system startup script /etc/rc.config.d/nddconf : TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_forwarding NDD_VALUE[index]=0
- RMF Control
- AC-17
- Severity
- Medium
- CCI
- CCI-001453
- Version
- GEN007980
- Vuln IDs
-
- V-22555
- Rule IDs
-
- SV-41996r1_rule
Checks: C-40430r3_chk
Determine if the system uses LDAP. If it does not, this is Not A Finding. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | \ grep -v "^#" | grep -i ldap If LDAP is installed, verify that TLS is enabled. # cat /etc/opt/ldapux/ldapux_client.conf | tr '\011' ' ' | tr -s ' ' | \ sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i "^enable_startTLS = 1" If TLS is not enabled, this is a finding. Verify the certificate database exists. # ls -alL /etc/opt/ldapux/cert* List the LDAP Directory Server certificate. # /opt/ldapux/contrib/bin/certutil -L -d /etc/opt/ldapux List the details when checking the Directory Server's certificate validity/attributes. Note: The format of the validity-time argument when specifying an explicit time is "YYMMDDHHMMSSZ". Specifying seconds (SS) is optional. # /opt/ldapux/contrib/bin/certutil -V -n <Directory Server nickname> -b <validity-time> [-e] -l -d /etc/opt/ldapux If the Directory Server's certificate cannot be verified, this is a finding. NOTE: The TLS protocol supports a variety of cryptographic ciphers for authenticating the server and client to each other, transmitting certificates and establishing session keys. When the LDAP-UX client connects to the LDAP Directory Server, the server selects the strongest cipher supported by both client and server. As LDAP-UX is the client side of the LDAP application, LDAP-UX has no control over this process. Unless it can be determined that the Directory Server is using FIPS 140-2 approved cryptographic algorithms for the TLS connection, this check will result in an OPEN Finding.
Fix: F-35635r2_fix
The Directory Server must support and be configured to use FIPS 140-2 approved cryptographic algorithms for the TLS connection. For the LDAPUX client: # vi /etc/opt/ldapux/ldapux_client.conf If commented, uncomment the "enable_startTLS" keyword line and ensure that the keyword value is set to 1 (to start TLS), IE: enable_startTLS = 1 Finally, use the following commands to reread the configuration file and restart ldapclientd.: # /opt/ldapux/bin/ldapclientd -k # nohup /opt/ldapux/bin/ldapclientd
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000185
- Version
- GEN008020
- Vuln IDs
-
- V-22557
- Rule IDs
-
- SV-38381r1_rule
Checks: C-36762r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If no lines are returned for either of the above commands, LDAP is not installed and this is not applicable. If the LDAP product is installed: # cat /etc/opt/ldapux/ldapux_client.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i peer_cert_policy If /etc/opt/ldapux/ldapux_client.conf setting is peer_cert_policy=WEAK, this is a finding.
Fix: F-32145r1_fix
Edit /etc/opt/ldapux/ldapux_client.conf and set # Perform the CERT check peer_cert_policy=CERT OR # Perform the CERT check PLUS peer_cert_policy=CNCERT
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000185
- Version
- GEN008040
- Vuln IDs
-
- V-22558
- Rule IDs
-
- SV-38382r1_rule
Checks: C-36763r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If no lines are returned for either of the above commands, this vulnerability is not applicable. Verify the LDAP client is configured to check certificates against a certificate revocation list. # cat /etc/ldap.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ grep -i "^tls_crlcheck" If the setting does not exist, or the value is not all, this is a finding.
Fix: F-32146r1_fix
Edit /etc/ldap.conf and add or set the tls_crlcheck setting to all.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008060
- Vuln IDs
-
- V-22559
- Rule IDs
-
- SV-38383r1_rule
Checks: C-36765r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. Check the permissions of the LDAP configuration file(s). ls -lL /etc/opt/ldapux/ldapux_client.conf /etc/opt/ldapux/ldapclientd.conf /etc/opt/ldapux/ldapug.conf If the mode of the file is more permissive than 0644, this is a finding.
Fix: F-32148r1_fix
Change the permissions of the file. # chmod 0644 <LDAP configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008080
- Vuln IDs
-
- V-22560
- Rule IDs
-
- SV-38384r1_rule
Checks: C-36767r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. Check the ownership of the LDAP configuration file(s). ls -lL /etc/opt/ldapux/ldapux_client.conf /etc/opt/ldapux/ldapclientd.conf /etc/opt/ldapux/ldapug.conf If any of the above files are not owned by root or bin, this is a finding.
Fix: F-32149r1_fix
Change the owner of the file. # chown root <LDAP configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008100
- Vuln IDs
-
- V-22561
- Rule IDs
-
- SV-38385r1_rule
Checks: C-36768r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. Check the group ownership of the LDAP configuration file(s). ls -lL /etc/opt/ldapux/ldapux_client.conf /etc/opt/ldapux/ldapclientd.conf /etc/opt/ldapux/ldapug.conf If any of the above files are not group owned by root, bin, sys, or other, this is a finding.
Fix: F-32150r1_fix
Change the group owner of the file to root, bin, sys, or other. # chgrp root <LDAP configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008120
- Vuln IDs
-
- V-22562
- Rule IDs
-
- SV-29569r1_rule
Checks: C-36769r4_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. Check the LDAP configuration file for the presence of an ACL. # ls -alL /etc/opt/ldapux/ldapux_client.conf If the permissions include a "+" the file has an extended ACL, this is a finding.
Fix: F-32151r1_fix
Remove the extended ACL from the file. # chacl -z <LDAP configuration file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008140
- Vuln IDs
-
- V-22563
- Rule IDs
-
- SV-38386r1_rule
Checks: C-36770r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the ownership of the LDAP cert file(s). ls -lLd /etc/opt/ldapux ls -lL /etc/opt/ldapux/cert8.db If the owner of any file or directory is not root or bin, this is a finding.
Fix: F-32152r1_fix
Change the ownership of the file and/or directory. # chown root <directory> # chown root <directory>/<file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008160
- Vuln IDs
-
- V-22564
- Rule IDs
-
- SV-38387r1_rule
Checks: C-36771r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the group ownership of the LDAP cert file(s). # ls -lLd /etc/opt/ldapux # ls -lLa /etc/opt/ldapux/cert8.db If a certificate file or directory is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-32153r1_fix
Change the group ownership of LDAP client certificate directory/files to root, bin, sys, or other. # chgrp root <directory> # chgrp root <directory>/<file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008180
- Vuln IDs
-
- V-22565
- Rule IDs
-
- SV-38388r1_rule
Checks: C-36772r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the mode of the LDAP cert file(s). # ls -lLd /etc/opt/ldapux # ls -lLa /etc/opt/ldapux/cert8.db If a certificate file or directory is more permissive than 0644 (or 0755 for directories), this is a finding.
Fix: F-32154r1_fix
Change the mode of the file and/or directory. # chmod 0755 <directory> # chmod 0644 <directory>/<file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008200
- Vuln IDs
-
- V-22566
- Rule IDs
-
- SV-38389r1_rule
Checks: C-36774r2_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the permissions of the LDAP cert file(s). # ls -lLd /etc/opt/ldapux # ls -lLa /etc/opt/ldapux/cert8.db If the permissions of the file or directory contains a "+", an extended ACL is present, this is a finding.
Fix: F-32156r2_fix
Remove the extended ACL from the certificate file. # chacl -z <directory> # chacl -z <directory>/<file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008220
- Vuln IDs
-
- V-22567
- Rule IDs
-
- SV-38390r1_rule
Checks: C-36775r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the ownership of the LDAP cert file(s). # ls -lLa /etc/opt/ldapux/cert8.db If the owner of the file is not root or bin, this is a finding.
Fix: F-32157r1_fix
Change the ownership of the file. # chown root <certfile>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008240
- Vuln IDs
-
- V-22568
- Rule IDs
-
- SV-38391r1_rule
Checks: C-36777r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the group ownership of the LDAP cert file(s). # ls -lLa /etc/opt/ldapux/cert8.db If the file is not group-owned by root, bin, sys or other, this is a finding.
Fix: F-32158r1_fix
Change the group ownership of the LDAP client certificate file. # chgrp root <cert file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008260
- Vuln IDs
-
- V-22569
- Rule IDs
-
- SV-38392r1_rule
Checks: C-36778r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the mode of the LDAP cert file(s). # ls -lLa /etc/opt/ldapux/cert8.db If the certificate file is more permissive than 0644, this is a finding.
Fix: F-32159r1_fix
Change the permissions of the LDAP client certificate file. # chmod 0644 <cert file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008280
- Vuln IDs
-
- V-22570
- Rule IDs
-
- SV-38393r1_rule
Checks: C-36780r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the mode of the LDAP cert file(s). # ls -lLa /etc/opt/ldapux/cert8.db If the permissions of the file contains a "+", an extended ACL is present, this is a finding.
Fix: F-32160r1_fix
Remove the extended ACL from the certificate file. # chacl -z <certfile>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008300
- Vuln IDs
-
- V-22571
- Rule IDs
-
- SV-38394r1_rule
Checks: C-36781r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the ownership of the key file. # ls -lLa /etc/opt/ldapux/key3.db If the owner of the file is not root or bin, this is a finding.
Fix: F-32161r1_fix
Change the ownership of the file. # chown root <key file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008320
- Vuln IDs
-
- V-22572
- Rule IDs
-
- SV-38395r1_rule
Checks: C-36782r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the group ownership of the key file. # ls -lLa /etc/opt/ldapux/key3.db If the file is not group owned by root, bin, sys, or other, this is a finding.
Fix: F-32162r1_fix
Change the group owner of the LDAP client key file. # chgrp root <key file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008340
- Vuln IDs
-
- V-22573
- Rule IDs
-
- SV-38396r1_rule
Checks: C-36783r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the mode of the key file. # ls -lLa /etc/opt/ldapux/key3.db If the file permission is more permissive than 0600, this is a finding.
Fix: F-32163r1_fix
Change the mode of the file. # chmod 0600 <key file>
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN008360
- Vuln IDs
-
- V-22574
- Rule IDs
-
- SV-38397r1_rule
Checks: C-36784r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If nothing is returned for either of the above commands, this is not applicable. If LDAP is installed, check the mode of the LDAP key file(s). # ls -lLa /etc/opt/ldapux/key3.db If the permissions of the file contains a "+", an extended ACL is present and this is a finding.
Fix: F-32164r1_fix
Remove the extended ACL from the key file. # chacl -z <key file>
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN008440
- Vuln IDs
-
- V-22577
- Rule IDs
-
- SV-38377r1_rule
Checks: C-36788r1_chk
Check /etc/rc.config.d/nfsconf for the AUTOFS automount setting. # cat /etc/rc.config.d/nfsconf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | \ grep -i "AUTOFS=1" If set to 1, this is a finding. After testing, if the autofs service is required, this vulnerability is not applicable.
Fix: F-32167r1_fix
Stop and disable the autofs service. Edit /etc/rc.config.d/nfsconf and set the AUTOFS setting to 0. Restart the nfs.client service. # /usr/sbin/init.d/nfs.client stop # /usr/sbin/init.d/nfs.client start
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN008460
- Vuln IDs
-
- V-22578
- Rule IDs
-
- SV-38400r1_rule
Checks: C-36789r1_chk
# ioscan -fnC usb If the system uses USB, this is not applicable. By default, HP-UX systems tend to use both a USB keyboard and mouse. The following sample is a section of a system ioscan output showing the discovered USB controllers and devices. Notice, there are 3 NEC USB controllers. The first 2 USB controllers are OHCI (Open Host Controller Interface) controllers for low and full speed USB 1.0 and 1.1 devices. The 3rd USB controller is an EHCI (Enhanced Host Controller Interface) controller for high speed USB 2.0 devices. The first OHCI USB controller has a keyboard, a mouse, and a mass storage device attached. The second OHCI USB controller has no devices attached. The third USB controller, EHCI, has 2 mass storage devices attached. Class I H/W Path Driver S/W State H/W Type Description ================================================================================================ Usb 0 0/0/2/0 hcd CLAIMED INTERFACE NEC OHCI Controller usbcomp 0 0/0/2/0.1 usbcomposite CLAIMED DEVICE USB Composite Device usbhid 0 0/0/2/0.1.0 hid CLAIMED DEVICE USB HID Kbd(0) usbhid 1 0/0/2/0.1.1 hid CLAIMED DEVICE USB HID Pointer(1) usbms 0 0/0/2/0.1.2 ms CLAIMED DEVICE USB Mass Storage [0] usb 1 0/0/2/1 hcd CLAIMED INTERFACE NEC OHCI Controller usb 2 0/0/2/2 ehci CLAIMED INTERFACE NEC EHCI Controller usbms 2 0/0/2/2.2 ms CLAIMED DEVICE USB Mass Storage [1] usbms 3 0/0/2/2.3 ms CLAIMED DEVICE USB Mass Storage [2] Determine if the system has USB enabled. If it does, this is a finding.
Fix: F-32168r1_fix
Disable USB on the system. In doing so, remember the keyboard and mouse will no longer work.
- RMF Control
- CM-6
- Severity
- Low
- CCI
- CCI-000366
- Version
- GEN008480
- Vuln IDs
-
- V-22579
- Rule IDs
-
- SV-38401r1_rule
Checks: C-36790r2_chk
On HP-UX systems with USB ports, the kernel module "usbd" is installed with the operating system. The "usbd" module enables and currently supports the use of a keyboard, a mouse and an optical drive. # /stand/system | grep -i usb # ioscan -fnC usb Ask the SA if the system requires USB mass storage. If the system requires the use of USB mass storage, this is not applicable. If the kernel module "usbd" is installed and the system does not require usb mass storage, this is a finding.
Fix: F-32169r2_fix
If usb mass storage is not required and the system does not use the system's usb interface for keyboard/mouse input, remove the "usbd" module from the kernel, remake the kernel and reboot the system. Document the change(s). # smh
- RMF Control
- SC-7
- Severity
- Medium
- CCI
- CCI-001118
- Version
- GEN008520
- Vuln IDs
-
- V-22582
- Rule IDs
-
- SV-38403r1_rule
Checks: C-36793r1_chk
Determine if the system is using a local firewall. # cat /etc/rc.config.d/ipfconf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | cut -f 3,3 -d " " | grep "IPF_START" If IPF_START is not set to 1, this is a finding.
Fix: F-32171r1_fix
Set IPF_START=1 in /etc/rc.config.d/ipfconf. Refresh/restart. # /sbin/init.d/ipfboot start
- RMF Control
- SC-7
- Severity
- Medium
- CCI
- CCI-001109
- Version
- GEN008540
- Vuln IDs
-
- V-22583
- Rule IDs
-
- SV-26977r1_rule
Checks: C-36794r2_chk
Check the firewall rules for a default deny rule. # ipfstat -i | sed -e 's/^[ \t]*//' | tr '\011' ' ' | tr -s ' ' | grep -v "^#" | grep "block" An example of a default deny rule: block in log quick on ne3 from any to any If there is no default deny rule, this is a finding.
Fix: F-32172r1_fix
Edit /etc/opt/ipf/ipf.conf and add a default deny rule and restart the ipfilter service. # /sbin/init.d/ipfboot stop # /sbin/init.d/ipfboot start
- RMF Control
- SI-2
- Severity
- Low
- CCI
- CCI-001233
- Version
- GEN008820
- Vuln IDs
-
- V-22589
- Rule IDs
-
- SV-38405r1_rule
Checks: C-36802r1_chk
Determine if the system package management tool is configured to automatically obtain updated packages. If it is, this is a finding. SWA runs as a client-side patch and security analysis tool. An HP supplied catalog file with known problems and fixes is downloaded from the HP IT Resource Center (ITRC) and compared to the software installed on the system. Depots used for full-system installation, such as the installation depot on an OE DVD, may also be analyzed. Systems are analyzed for patch warnings, critical defects, security bulletins, missing Quality Pack (QPK) patch bundles, and user-specified patches and supersession chains. SWA optimizes the automatic selection of patch dependencies by assessing the quality of the dependency, providing the best case scenario for the dependency, minimizing changes to the system, and assessing future patch dependency changes. List all crontabs on the system. # ls -lL /var/spool/cron/crontabs/* # ls -lL /var/spool/cron/atjobs/* Check all crontabs/atjobs on the system for swa entries. # cat /var/spool/cron/crontabs/* | grep "swa " # cat /var/spool/cron/atjobs/* | grep "swa " If SWA is not configured with cron or at, this is not a finding.
Fix: F-32179r1_fix
Configure the system package management tool to not automatically obtain updates.
- RMF Control
- AC-6
- Severity
- Medium
- CCI
- CCI-000225
- Version
- GEN000000-HPUX0110
- Vuln IDs
-
- V-22591
- Rule IDs
-
- SV-26994r1_rule
Checks: C-27937r1_chk
Check the permissions of the file. # ls -lLd /etc/securetty If the permissions of the file or directory contains a '+', an extended ACL is present, and this is a finding.
Fix: F-24260r1_fix
Remove the optional ACL from the file. # chacl -z /etc/securetty
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN005590
- Vuln IDs
-
- V-22665
- Rule IDs
-
- SV-35164r1_rule
Checks: C-35016r1_chk
Check for any running routing protocol daemons. # ps -ef | grep -v grep | egrep -i "route|ospf|bgp|zebra|quagga|ripng|ramd" If any routing protocol daemons are listed, this is a finding.
Fix: F-30310r1_fix
Disable any routing protocol daemons.
- RMF Control
- AU-9
- Severity
- Medium
- CCI
- CCI-000162
- Version
- GEN002690
- Vuln IDs
-
- V-22702
- Rule IDs
-
- SV-38406r2_rule
Checks: C-36450r2_chk
Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following: PRI_AUDFILE=/var/.audit/file1 SEC_AUDFILE=/var/.audit/file2 # egrep “PRI_AUDFILE|SEC_AUDFILE” /etc/rc.config.d/auditing For each audit log directory/file, check the group ownership. # ls -lLd <audit directory> # ls -lLa <audit file> If any audit log directory/file is not group-owned by root, bin, sys, or other, this is a finding.
Fix: F-31789r2_fix
As root, change the group ownership. # chgrp root <audit directory> # chgrp root <audit file>
- RMF Control
- AC-8
- Severity
- Medium
- CCI
- CCI-000048
- Version
- GEN000410
- Vuln IDs
-
- V-23732
- Rule IDs
-
- SV-38407r1_rule
Checks: C-36267r1_chk
FTP to the system. # ftp localhost Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. If the system does not run the FTP service, this is not applicable. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
Fix: F-31524r1_fix
Edit /etc/inetd.conf and add the -a /etc/ftpd/ftpaccess option to the ftp line, if it is not present. If the /etc/ftpd/ftpaccess does not exist, create it by copying the example configuration file. Edit the ftpaccess file and add or set the banner setting to a banner file, such as /etc/ftpd/banner_msg. Create the banner file and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
- RMF Control
- SC-32
- Severity
- Low
- CCI
- CCI-001208
- Version
- GEN003621
- Vuln IDs
-
- V-23736
- Rule IDs
-
- SV-35050r1_rule
Checks: C-34922r1_chk
Determine if the /var path is a separate filesystem. # cat /etc/fstab | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | \ grep -v "^#" | cut -f 2,2 -d " " | grep "^/var" | grep -v "/var/" If the above command returns nothing, /var is not on a separate filesystem and this is a finding.
Fix: F-30227r1_fix
Migrate the /var path onto a separate file system.
- RMF Control
- SC-32
- Severity
- Low
- CCI
- CCI-001208
- Version
- GEN003623
- Vuln IDs
-
- V-23738
- Rule IDs
-
- SV-35054r1_rule
Checks: C-34924r3_chk
Determine if the /var/.audit path exists. # ls -alLd /var /var/.audit If the above paths do not exist, this is not a finding. If the above /var/.audit path exists, determine if /var/.audit is a separate filesystem. # cat /etc/fstab | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | \ grep -v "^#" | cut -f 2,2 -d " " | grep "^/var/.audit" | \ grep -v "/var/.audit/" If the above command returns nothing, /var/.audit is not on a separate filesystem and this is a finding.
Fix: F-30229r2_fix
Migrate the audit log path onto a separate filesystem. The following assumes that /var exists and that the new audit log mount point will be /var/.audit. Verify if auditing is running: # ps -ef | grep audomon | grep -v grep If auditing is running, issue the stop command: # /sbin/init.d/auditing stop Use SAM/SMH to: - Create a new Logical Volume (size to be determined based on local site requirements). - Create a VxFS file system on the new logical volume, paying special attention to site requirements such as Access Permissions, Allocation Policies, Mirroring considerations, large/no-large files and mount options such as suid/nosuid and ro/rw. Verify the /etc/fstab /var/.audit entry # more /etc/fstab Verify the current mounts: # mount Mount /var/.audit if not yet mounted: # mount -a Re-start the auditing subsystem: # /sbin/init.d/auditing start Verify that auditing is now running: # ps -ef | grep audomon | grep -v grep
- RMF Control
- SC-32
- Severity
- Low
- CCI
- CCI-001208
- Version
- GEN003624
- Vuln IDs
-
- V-23739
- Rule IDs
-
- SV-35055r1_rule
Checks: C-34925r1_chk
Determine if the /tmp path is a separate filesystem. # cat /etc/fstab | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | \ grep -v "^#" | cut -f 2,2 -d " " | grep "^/tmp" | grep -v "/tmp/" If the above command returns nothing, /tmp is not on a separate filesystem and this is a finding.
Fix: F-30230r1_fix
Migrate the /tmp path onto a separate file system.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN003601
- Vuln IDs
-
- V-23741
- Rule IDs
-
- SV-29690r1_rule
Checks: C-30047r1_chk
Check the value of the tcp_syn_rcvd_max parameter. # ndd -get /dev/tcp tcp_syn_rcvd_max If the returned value is less than 1280, this is a finding.
Fix: F-26884r1_fix
Set the tcp_syn_rcvd_max parameter to 1280. # ndd -set /dev/tcp tcp_syn_rcvd_max 1280 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = tcp NDD_NAME[x] = tcp_syn_rcvd_max NDD_VALUE[x] = 1280
- RMF Control
- SI-8
- Severity
- Medium
- CCI
- CCI-001305
- Version
- GEN004710
- Vuln IDs
-
- V-23952
- Rule IDs
-
- SV-38410r1_rule
Checks: C-36578r2_chk
Ask the SA if the system is a documented mail relay, and if it is, this is not applicable. If the system uses Sendmail, determine if Sendmail only binds to loopback addresses by examining the "DaemonPortOptions" configuration options. # grep -i "O DaemonPortOptions" /etc/mail/sendmail.cf If there are uncommented DaemonPortOptions lines, and all such lines specify system loopback addresses, this is not a finding. Otherwise, determine if Sendmail is configured to allow open relay operation. # find / -name sendmail.mc # grep -i promiscuous_relay </path/to/sendmail.mc> If the promiscuous relay feature is enabled, this is a finding. If the system uses Postfix, locate the main.cf file. Procedure: # find / -name main.cf Determine if Postfix only binds to loopback addresses by examining the inet_interfaces line. Procedure: # grep inet_interfaces </path/to/main.cf> If inet_interfaces is set to loopback-only or contains only loopback addresses such as 127.0.0.1 and [::1], Postfix is not listening on external network interfaces, this is not a finding. Otherwise, determine if Postfix is configured to restrict clients permitted to relay mail by examining the smtpd_client_restrictions line. # grep smtpd_client_restrictions </path/to/main.cf> If the smtpd_client_restrictions line is missing, or does not contain reject, this is a finding. If the line contains permit before reject, this is a finding. If the system is using other SMTP software, consult the software's documentation for procedures to verify mail relaying is restricted.
Fix: F-31946r1_fix
If the system uses Sendmail, edit the sendmail.mc file and remove the promiscuous_relay configuration. Rebuild the sendmail.cf file from the modified sendmail.mc and restart the service. If the system does not need to receive mail from external hosts, add one or more DaemonPortOptions lines referencing system loopback addresses (such as "O DaemonPortOptions=Addr=127.0.0.1,Port=smtp,Name=MTA") and remove lines containing non-loopback addresses. Restart the service. If the system uses Postfix, edit the main.cf file then add or edit the smtpd_client_restrictions line to have contents permit mynetworks, reject or a similarly restrictive rule. If the system does not need to receive mail from external hosts, add or edit the inet_interfaces line to have contents loopback-only or a set of loopback addresses for the system. Restart the service. If the system is using other SMTP software, consult the software's documentation for procedures to restrict mail relaying.
- RMF Control
- CM-2
- Severity
- Medium
- CCI
- CCI-000305
- Version
- GEN007960
- Vuln IDs
-
- V-23953
- Rule IDs
-
- SV-29540r1_rule
Checks: C-30036r1_chk
Determine if the system's ldd executable exists and is executable. # ls -lL /usr/ccs/bin/ldd If the file exists and has any execute permissions, this is a finding.
Fix: F-26870r1_fix
Remove the execute permissions from the ldd executable. # chmod a-x /usr/ccs/bin/ldd
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN007950
- Vuln IDs
-
- V-23972
- Rule IDs
-
- SV-29786r1_rule
Checks: C-36757r1_chk
Determine if the system blocks inbound IPv6 ICMP echo-requests sent to the all-hosts multicast address. Procedure: # ipfstat -6 -i Check for a rule such as: block in quick proto icmpv6 from any to ff02::1 icmpv6-type 128 If a rule blocking inbound IPv6 ICMP echo-requests sent to the all-hosts multicast address does not exist, this is a finding.
Fix: F-32141r1_fix
Add an IPF rule to block inbound IPv6 ICMP ECHO_REQUEST packets sent to the all-hosts multicast address. Edit /etc/opt/ipf/ipf6.conf and add a rule such as: block in quick proto icmpv6 from any to ff02::1 icmpv6-type 128 Reload the IPF rules. # ipf -6 -Fa -A -f /etc/opt/ipf/ipf6.conf
- RMF Control
- AC-8
- Severity
- Medium
- CCI
- CCI-000048
- Version
- GEN000402
- Vuln IDs
-
- V-24331
- Rule IDs
-
- SV-38411r1_rule
Checks: C-36269r1_chk
NOTE: This will virtually always require a manual review. Access the graphical desktop environment(s) provided by the system and attempt a login. Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
Fix: F-31526r1_fix
Configure the system to display one of the DoD login banners (based on the character limitations imposed by the system) prior to, or as part of, the graphical desktop environment login process. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
- RMF Control
- IA-2
- Severity
- Medium
- CCI
- CCI-000768
- Version
- GEN009120
- Vuln IDs
-
- V-24347
- Rule IDs
-
- SV-38412r2_rule
Checks: C-36803r1_chk
Example: Reflection PKI Services Manager is a separate add-on providing X.509 certificate authentication services for the following Attachmate products: Reflection for Secure IT UNIX Server (7.1 or higher), and Reflection for Secure IT UNIX Client (7.1 or higher). The following HP-UX systems are supported by Reflection PKI Services Manager 1.0 or higher: HP-UX 11i v3 (Itanium) HP-UX 11i v2 (Itanium) HP-UX 11i v2 (PA-RISC) HP-UX 11i v1 (PA-RISC) To determine if the system is capable of CAC authentication, ask the SA if the system uses the Reflection PKI Services Manager for the Attachmate product (or similar). If it is not, this is not applicable. Additionally, ask the SA to determine if all accounts not exempted by policy are using CAC authentication. If non-exempt accounts are not using CAC authentication, this is a finding.
Fix: F-32181r1_fix
Consult vendor and/or 3rd party documentation to determine the procedures necessary for configuring CAC authentication. Configure all accounts required by policy to use CAC authentication to use CAC authentication.
- RMF Control
- AU-3
- Severity
- Low
- CCI
- CCI-000136
- Version
- GEN002870
- Vuln IDs
-
- V-24357
- Rule IDs
-
- SV-38413r1_rule
Checks: C-36807r2_chk
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. The vendor (HP) recommends that a script be written to implement a long term strategy for data storage and pass it to the audomon daemon using the "-X <command>" option. <command> is executed each time audomon switches the audit trail. The means used to implement audit log transfer to a remote system will be site specific and therefore always require a manual review. ASK the SA if audomon is configured per the vendor's (HP) guidance to implement a long term, remote data storage strategy.
Fix: F-32184r2_fix
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. Create a <command> script to implement the vendor-recommended, long term data storage strategy and pass it to the audomon daemon using the "-X <command>" option. The <command> must be executed each time audomon switches the audit trail. A manual review of the <command> script is required.
- RMF Control
- IA-5
- Severity
- Medium
- CCI
- CCI-000196
- Version
- GEN008050
- Vuln IDs
-
- V-24384
- Rule IDs
-
- SV-38414r1_rule
Checks: C-36764r1_chk
Determine if the system uses LDAP. If it does not, this is not applicable. # swlist | grep LDAP OR # cat /etc/nsswitch.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" | grep -i ldap If the product is installed: ls -lL /etc/opt/ldapux/acred /etc/opt/ldapux/pcred The user credentials are stored in the pcred and acred files, including the password. While these credentials are not visible as plain text, the pcred and acred files are not encrypted. If either of the above unencrypted files exists, this is a finding.
Fix: F-32147r1_fix
Consult vendor documentation for the procedures for configuring LDAP for authentication and account information. Remove any passwords from unencrypted LDAP configuration files.
- RMF Control
- IA-5
- Severity
- High
- CCI
- CCI-000197
- Version
- GEN003850
- Vuln IDs
-
- V-24386
- Rule IDs
-
- SV-35134r1_rule
Checks: C-34992r1_chk
Consult vendor documentation to determine the method for determining if the telnet daemon is running. If the system uses inetd, use the following procedure: # cat /etc/inetd.conf | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' |grep -v "^#" | \ cut -f 6,7 -d " " | grep -c -i telnetd If the above command returns a number greater than 0, the telnet daemon is running. If the telnet daemon is running, this is a finding.
Fix: F-30286r1_fix
Consult vendor documentation to determine the procedure to disable the telnet daemon. If the system uses inetd, edit /etc/inetd.conf and comment out the telnetd line. Restart the inetd service via the following command: # inetd -c
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0200
- Vuln IDs
-
- V-40350
- Rule IDs
-
- SV-52330r1_rule
Checks: C-46983r1_chk
If the system is operating in Trusted Mode, this check is not applicable. For SMSE: Check the /var/adm/userdb database for individual user settings: # /usr/sbin/userdbget -a If the “userdb” database is used exclusively to enhance/tighten the security requirements as defined in the /etc/default/security file (see the following example), this is not a finding. Example: /etc/default/security requires a MIN_PASSWORD_LENGTH attribute setting of N=14 and specific per user attribute values in /var/adm/userdb are set to 15. If any user information is returned that is greater than the required attribute setpoint in the/etc/default/security file (see the following example), this is a finding. Example: /etc/default/security requires a MIN_PASSWORD_LENGTH attribute setting of N=14 and specific per user attribute values in /var/adm/userdb are set to 13.
Fix: F-45321r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Delete any configured users from the /var/adm/userdb database: # /usr/sbin/userdbset -d -u <user> Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0210
- Vuln IDs
-
- V-40355
- Rule IDs
-
- SV-52335r1_rule
Checks: C-46984r1_chk
If the system is operating in Trusted Mode, this check is not applicable. For SMSE: The “UsePAM” attribute in the /opt/ssh/etc/sshd_config configuration file controls whether an account is locked after too many consecutive SSH authentication failures. The default “UsePAM” attribute setting is “no”. Verify the global setting for “UsePAM” is set to “yes”. # cat /opt/ssh/etc/sshd_config | sed -e 's/^[ \t]*//' grep -v “#” | grep “^UsePAM” If the /opt/ssh/etc/sshd_config configuration file attribute “UsePAM” is not set to “yes”, this is a finding.
Fix: F-45323r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE only: Edit the /opt/ssh/etc/sshd_config file and add/uncomment/update the “UsePAM” attribute. See the below example: UsePAM yes Save any change(s) before exiting the editor.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0220
- Vuln IDs
-
- V-40445
- Rule IDs
-
- SV-52432r2_rule
Checks: C-47005r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For Standard Mode with Security Extensions (SMSE): Check the /etc/default/security file for the following attribute(s) and attribute values: LOGIN_POLICY_STRICT=1 # grep “LOGIN_POLICY_STRICT” /etc/default/security If LOGIN_POLICY_STRICT=0, then the root user is not subject to the same login restrictions as non-root users. If no organizational exceptions for root are documented and LOGIN_POLICY_STRICT=0, then this is a finding.
Fix: F-45394r2_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Edit the /etc/default/security file and add/modify the following attribute(s) and attribute values: LOGIN_POLICY_STRICT=1 Save the file before exiting the editor.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0230
- Vuln IDs
-
- V-40446
- Rule IDs
-
- SV-52433r1_rule
Checks: C-47006r1_chk
For Trusted Mode: Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Next check that only root is authorized to boot into single user mode. # grep “:u_bootauth:” /tcb/files/auth/[a-z,A-Z]/* If any non-root users have been granted single user boot privileges, this is a finding. For SMSE: Check the /etc/default/security file for the following attribute(s) and attribute values: BOOT_USERS=root (Note: BOOT_USERS attribute values are comma delimited strings). # grep “BOOT_USERS” /etc/default/security /var/adm/userdb/* If the BOOT_USERS attribute contains any username other than root, this is a finding.
Fix: F-45395r1_fix
For Trusted Mode: If single user boot authentication is disabled, use the System Administration Manager (SAM) or the System Management Homepage (SMH) to allow single user boot for root only. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute. See the below example: BOOT_USERS=root Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0240
- Vuln IDs
-
- V-40447
- Rule IDs
-
- SV-52434r1_rule
Checks: C-47007r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the directory is owned by root. # ls -lL /var/adm/userdb If the directory is not owned by root, this is a finding.
Fix: F-45396r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file ownership. # chown root /var/adm/userdb
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0250
- Vuln IDs
-
- V-40448
- Rule IDs
-
- SV-52435r1_rule
Checks: C-47008r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the directory is group-owned by sys. # ls -lL /var/adm/userdb If the directory is not group-owned by sys, this is a finding.
Fix: F-45397r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file group ownership. # chgrp sys /var/adm/userdb
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0260
- Vuln IDs
-
- V-40449
- Rule IDs
-
- SV-52436r1_rule
Checks: C-47009r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the directory mode. # ls -lL /var/adm/userdb If the directory mode is more permissive than 0700, this is a finding.
Fix: F-45398r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file mode to 0700 or less permissive. # chmod 0700 /var/adm/userdb
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0270
- Vuln IDs
-
- V-40450
- Rule IDs
-
- SV-52437r1_rule
Checks: C-47010r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the directory has no extended ACL. # ls -lL /var/adm/userdb If the permissions include a “+”, the directory has an extended ACL, this is a finding.
Fix: F-45399r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Remove the optional ACL from the file. # chacl -z /var/adm/userdb
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0280
- Vuln IDs
-
- V-40451
- Rule IDs
-
- SV-52438r1_rule
Checks: C-47011r3_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: If the userdb is required, this check is not applicable. Verify the file is owned by root. # ls -lL /var/adm/userdb/USERDB.DISABLED If the file is not owned by root, this is a finding.
Fix: F-45400r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file ownership. # chown root /var/adm/userdb/USERDB.DISABLED
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0290
- Vuln IDs
-
- V-40452
- Rule IDs
-
- SV-52439r1_rule
Checks: C-47012r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: If the userdb is required, this check is not applicable. Verify the file is group-owned by sys. # ls -lL /var/adm/userdb/USERDB.DISABLED If the file is not group-owned by sys, this is a finding.
Fix: F-45401r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file group ownership. # chgrp sys /var/adm/userdb/USERDB.DISABLED
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0300
- Vuln IDs
-
- V-40453
- Rule IDs
-
- SV-52440r1_rule
Checks: C-47013r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: If the userdb is required, this check is not applicable. Verify the file mode. # ls -lL /var/adm/userdb/USERDB.DISABLED If the file mode is more permissive than 0444, this is a finding.
Fix: F-45402r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file mode to 0444 or less permissive. # chmod 0444 /var/adm/userdb/USERDB.DISABLED
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0310
- Vuln IDs
-
- V-40454
- Rule IDs
-
- SV-52441r1_rule
Checks: C-47014r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: If the userdb is required, this check is not applicable. Verify the file has no extended ACL. # ls -lL /var/adm/userdb/USERDB.DISABLED If the permissions include a “+”, the file has an extended ACL, this is a finding.
Fix: F-45405r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Remove the optional ACL from the file. # chacl -z /var/adm/userdb/USERDB.DISABLED
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0320
- Vuln IDs
-
- V-40466
- Rule IDs
-
- SV-52454r1_rule
Checks: C-47015r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file is owned by root. # ls -lL /etc/security.dsc If the file is not owned by root, this is a finding.
Fix: F-45416r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file ownership. # chown root /etc/security.dsc
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0330
- Vuln IDs
-
- V-40467
- Rule IDs
-
- SV-52455r1_rule
Checks: C-47016r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file is group-owned by sys. # ls -lL /etc/security.dsc If the file is not group-owned by sys, this is a finding.
Fix: F-45417r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file group ownership. # chgrp sys /etc/security.dsc
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0340
- Vuln IDs
-
- V-40468
- Rule IDs
-
- SV-52456r1_rule
Checks: C-47017r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file mode. # ls -lL /etc/security.dsc If the file mode is more permissive than 0444, this is a finding.
Fix: F-45418r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file mode to 0444 or less permissive. # chmod 0444 /etc/security.dsc
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0350
- Vuln IDs
-
- V-40470
- Rule IDs
-
- SV-52458r1_rule
Checks: C-47018r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file has no extended ACL. # ls -lL /etc/security.dsc If the permissions include a “+”, the file has an extended ACL, this is a finding.
Fix: F-45420r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Remove the optional ACL from the file. # chacl -z /etc/security.dsc
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0360
- Vuln IDs
-
- V-40473
- Rule IDs
-
- SV-52461r1_rule
Checks: C-47019r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file is owned by root. # ls -lL /etc/pam.conf If the file is not owned by root, this is a finding.
Fix: F-45423r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file ownership. # chown root /etc/pam.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0370
- Vuln IDs
-
- V-40476
- Rule IDs
-
- SV-52464r1_rule
Checks: C-47020r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file is group-owned by sys. # ls -lL /etc/pam.conf If the file is not group-owned by sys, this is a finding.
Fix: F-45426r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file group ownership. # chgrp sys /etc/pam.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0380
- Vuln IDs
-
- V-40478
- Rule IDs
-
- SV-52466r1_rule
Checks: C-47021r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file mode. # ls -lL /etc/pam.conf If the file mode is more permissive than 0444, this is a finding.
Fix: F-45428r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file mode to 0444 or less permissive. # chmod 0444 /etc/pam.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0390
- Vuln IDs
-
- V-40482
- Rule IDs
-
- SV-52471r1_rule
Checks: C-47022r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file has no extended ACL. # ls -lL /etc/pam.conf If the permissions include a “+”, the file has an extended ACL, this is a finding.
Fix: F-45431r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Remove the optional ACL from the file. # chacl -z /etc/pam.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0400
- Vuln IDs
-
- V-40483
- Rule IDs
-
- SV-52472r1_rule
Checks: C-47023r1_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Check the system for the existence of the /etc/pam_user.conf file. # ls -lL /etc/pam_user.conf If the file does not exist, this is a finding. If the file exists, examine the file. # cat /etc/pam_user.conf Attempt to determine the reason (ask the SA for an explanation) for options being passed to the PAM service modules for the listed users. If the SA cannot provide an explanation for the listed users and PAM module options, this is a finding.
Fix: F-45432r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: If the SA cannot provide a reasonable explanation for user entries in the /etc/pam_user.conf file, take one or more of the following actions: remove the file, remove/comment all user entries, remove/comment individual user entries. Document all changes.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0410
- Vuln IDs
-
- V-40484
- Rule IDs
-
- SV-52473r1_rule
Checks: C-47024r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file is owned by root. # ls -lL /etc/pam_user.conf If the file is not owned by root, this is a finding.
Fix: F-45433r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file ownership. # chown root /etc/pam_user.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0420
- Vuln IDs
-
- V-40485
- Rule IDs
-
- SV-52474r1_rule
Checks: C-47025r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file is group-owned by sys. # ls -lL /etc/pam_user.conf If the file is not group-owned by sys, this is a finding.
Fix: F-45434r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file group ownership. # chgrp sys /etc/pam_user.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0430
- Vuln IDs
-
- V-40486
- Rule IDs
-
- SV-52475r1_rule
Checks: C-47026r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file mode. # ls -lL /etc/pam_user.conf If the file mode is more permissive than 0444, this is a finding.
Fix: F-45435r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: As root, change the file mode to 0444 or less permissive. # chmod 0444 /etc/pam_user.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0440
- Vuln IDs
-
- V-40487
- Rule IDs
-
- SV-52476r1_rule
Checks: C-47027r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For SMSE: Verify the file has no extended ACL. # ls -lL /etc/pam_user.conf If the permissions include a “+”, the file has an extended ACL, this is a finding.
Fix: F-45436r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Remove the optional ACL from the file. # chacl -z /etc/pam_user.conf
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0450
- Vuln IDs
-
- V-40492
- Rule IDs
-
- SV-52481r1_rule
Checks: C-47028r1_chk
For Trusted Mode: If the system is operating in Trusted Mode, this check is not applicable. For SMSE: Check the OVERRIDE_SYSDEF_PWAGE attribute setting. # grep OVERRIDE_SYSDEF_PWAGE /etc/default/security If the OVERRIDE_SYSDEF_PWAGE attribute is missing or not set to 0, this is a finding.
Fix: F-45441r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) to update the OVERRIDE_SYSDEF_PWAGE attribute. See the below example: OVERRIDE_SYSDEF_PWAGE=0 Note: If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0460
- Vuln IDs
-
- V-40493
- Rule IDs
-
- SV-52482r3_rule
Checks: C-47029r3_chk
Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User profiles are stored in these directories based on the first letter of the user account name. Check the user attributes for the time and source of the last (successful and unsuccessful) login. This information is presented during login. All attributes are generated by the system in an integer format (system time). See the example commands below: For successful logins: # egrep "u_succhg#[0-9]+:" /tcb/files/auth/[a-z,A-Z]/* For unsuccessful login attempts: # egrep "u_unsucchg#[0-9]+:" /tcb/files/auth/[a-z,A-Z]/* If any users are missing the above attributes or attribute integer data, this is a finding. For SMSE: Check for the following attribute and attribute value: DISPLAY_LAST_LOGIN=1 # grep "DISPLAY_LAST_LOGIN" /etc/default/security /var/adm/userdb/* If the DISPLAY_LAST_LOGIN attribute is set to 0, this is a finding.
Fix: F-45442r1_fix
For Trusted Mode: Use the SAM/SMH interface to ensure the attributes are added to all user /tcb profiles. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update attribute. See the below example: DISPLAY_LAST_LOGIN=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0470
- Vuln IDs
-
- V-40494
- Rule IDs
-
- SV-52483r1_rule
Checks: C-47030r1_chk
For Trusted Mode: Check the attribute setting. # grep UMASK /etc/default/security If UMASK is not set to 0077, this is a finding. For SMSE: Check the attribute setting. # grep UMASK /etc/default/security /var/adm/userdb/* If UMASK is not set to 0077, this is a finding.
Fix: F-45443r1_fix
For Trusted Mode: Use the SAM/SMH interface (/etc/default/security file) to update attribute. See the below example: UMASK=0077 For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update attribute. See the below example: UMASK=0077 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
- RMF Control
- CM-6
- Severity
- Medium
- CCI
- CCI-000366
- Version
- GEN000000-HPUX0225
- Vuln IDs
-
- V-50999
- Rule IDs
-
- SV-65205r2_rule
Checks: C-53445r2_chk
If the system is configured for Trusted Mode, this check is not applicable. For Standard Mode with Security Extensions (SMSE): Check the /etc/default/security file for the following attribute(s) and attribute values: PASSWORD_POLICY_STRICT=1 # grep "PASSWORD_POLICY_STRICT" /etc/default/security If PASSWORD_POLICY_STRICT=0, then the root user is not subject to the same password restrictions as non-root users, and this is a finding.
Fix: F-55807r1_fix
If the system is operating in Trusted Mode, no fix is required. For SMSE: Edit the /etc/default/security file and add/modify the following attribute(s) and attribute values: PASSWORD_POLICY_STRICT=1 Save the file before exiting the editor.
- RMF Control
- AC-18
- Severity
- Medium
- CCI
- CCI-001443
- Version
- GEN007841
- Vuln IDs
-
- V-72819
- Rule IDs
-
- SV-87463r1_rule
Checks: C-72935r1_chk
This is N/A for systems that do not have wireless network adapters. Verify that there are no wireless interfaces configured on the system: # nwmgr Note: This command will produce a list of interfaces that are configured on the host. With the assistance of the System Administrator, identify any wireless interfaces listed in the output of the above command. If a wireless interface is configured, it must be documented and approved by the local Authorizing Official. If a wireless interface is configured and has not been documented and approved, this is a finding.
Fix: F-79241r1_fix
Configure the system to disable all wireless network interfaces.
- RMF Control
- SI-3
- Severity
- Medium
- CCI
- CCI-001668
- Version
- GEN006650
- Vuln IDs
-
- V-81451
- Rule IDs
-
- SV-96165r1_rule
Checks: C-81191r1_chk
Verify an antivirus solution is installed on the system. The antivirus solution may be bundled with an approved host-based security solution. If there is no antivirus solution installed on the system, this is a finding.
Fix: F-88269r1_fix
Install an antivirus solution on the system.