HP-UX 11.31 V1R16 (SCAP)

b

The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: GEN000400
Vuln IDs: V-763
Rule IDs: SV-38444r1_rule

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.System AdministratorECWM-1

Fix: F-31504r1_fix

Edit /etc/issue and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."

b

The system must disable accounts after three consecutive unsuccessful login attempts.

RMF Control: AC-7
Severity: M
CCI: CCI-000044
Version: GEN000460
Vuln IDs: V-766
Rule IDs: SV-38445r2_rule

Disabling accounts after a limited number of unsuccessful login attempts improves protection against password guessing attacks.System AdministratorECLO-1, ECLO-2

Fix: F-31506r2_fix

For Trusted Mode: Use the SAM/SMH interface or edit the /tcb/files/auth/system/default file and update the u_maxtries attribute. See the below example: :u_maxtries#3: If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute. See the below example: AUTH_MAXTRIES=2 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

b

The delay between login prompts following a failed login attempt must be at least 4 seconds.

RMF Control: AC-7
Severity: M
CCI: CCI-002238
Version: GEN000480
Vuln IDs: V-768
Rule IDs: SV-38446r3_rule

Enforcing a delay between consecutive failed login attempts increases protection against automated password guessing attacks.GEN000480Attack mitigations to minimize risk: 1. Ensure that the “nodelay” parameter is not found in the /etc/pam.conf file. 2. In the file /opt/ssh/etc/sshd_config, the “MaxAuthTries” attribute must be explicitly set to “1”. This attribute controls the maximum number of authentication attempts permitted per SSH daemon connection. 3. In the file /opt/ssh/etc/sshd_config, the “MaxStartups” attribute must be explicitly set to an organization defined value of “10” (the default) or less. This attribute controls the maximum number of unauthenticated connections to the SSH daemon. 4. IPFilter DCA mode is disabled by default, and must be explicitly enabled. Set the following attribute in the /etc/rc.config.d/ipfconf file: DCA_START=1 The below /etc/opt/ipf/ipf.conf file rule specifies a connection limit of ““ for all hosts when attempting to connect to port ““. The ““ and ““ must be set to organization defined values. Per vendor documentation, this rule must be the next-to-last rule in /etc/opt/ipf/ipf.conf. The final rule in the file must define the default connection limit. See the below example for the last 2 line entries in /etc/opt/ipf/ipf.conf (note that the double quotes are for emphasis only): “pass in proto tcp from any to any port = keep limit “ “block in from any to any” Save the file before exiting the editor. The system should not require restarting for the new rule(s) to take effect. System Administrator

Fix: F-31507r2_fix

For Trusted Mode: Use the SAM/SMH interface to ensure that the t_logdelay setting is 4. For SMSE: There is no fix, however, there are attack mitigations to minimize risk (see mitigations).

c

The system must not have accounts configured with blank or null passwords.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: GEN000560
Vuln IDs: V-770
Rule IDs: SV-38448r2_rule

If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. If the root user is configured without a password, the entire system may be compromised. For user accounts not using password authentication, the account must be configured with a password lock value instead of a blank or null value. System AdministratorIAIA-1, IAIA-2

Fix: F-31509r2_fix

For Trusted Mode: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to disable null passwords and immediately expire the password for any account with a null password, forcing the user to create a password on the very next login. Alternatively, the account may also be disabled. Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Verify that SAM/SMH has now disabled null passwords for all accounts. # grep “:u_nullpw@:” /tcb/files/auth/[a-z,A-Z] For SMSE: Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute(s). See the below example: LOGIN_POLICY_STRICT=1 ALLOW_NULL_PASSWORD=0 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor. Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to immediately expire the password for any account with a null password, forcing the user to create a password on the very next login. Alternatively, the account may also be disabled.

b

The root account must be the only account having an UID of 0.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN000880
Vuln IDs: V-773
Rule IDs: SV-38449r1_rule

If an account has an UID of 0, it has root authority. Multiple accounts with an UID of 0 afford more opportunity for potential intruders to compromise a privileged account.System AdministratorECLP-1

Fix: F-31528r1_fix

Remove or change the UID of accounts other than root that have UID 0.

a

The root user's home directory must not be the root directory (/).

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN000900
Vuln IDs: V-774
Rule IDs: SV-34829r1_rule

Changing the root home directory to something other than / and assigning it a 0700 protection makes it more difficult for intruders to manipulate the system by reading the files root places in its default directory. It also gives root the same discretionary access control for root's home directory as for the other plain user home directories.System AdministratorECCD-1, ECCD-2

Fix: F-31529r1_fix

The root home directory should be something other than / (such as /roothome). # mkdir /rootdir # chown root /rootdir # chgrp root /rootdir # chmod 700 /rootdir # cp -r /.??* /rootdir/. Edit the passwd file and change the root home directory to /rootdir. The cp -r /.??* command copies all files and subdirectories of file names that begin with "." into the new root directory, which preserves the previous root environment. Ensure you are in the "/" directory when executing the "cp" command.

b

The root account's home directory (other than /) must have mode 0700.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000920
Vuln IDs: V-775
Rule IDs: SV-38450r1_rule

Permissions greater than 0700 could allow unauthorized users access to the root home directory.System AdministratorECCD-1, ECCD-2

Fix: F-31530r1_fix

The root home directory will have permissions of 0700. Do not change the protections of the / directory. Use the following command to change protections for the root home directory: # chmod 0700 /rootdir.

b

The root accounts executable search path must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN000940
Vuln IDs: V-776
Rule IDs: SV-38451r3_rule

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Entries starting with a slash (/) are absolute paths.System Administrator

Fix: F-31531r2_fix

Edit the root user's local initialization files and remove any relative path entries that have not been documented with the ISSO. Edit the root user’s local initialization files and remove any empty entry that is defined.

b

The root account must not have world-writable directories in its executable search path.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN000960
Vuln IDs: V-777
Rule IDs: SV-38452r1_rule

If the root search path contains a world-writable directory, malicious software could be placed in the path by intruders and/or malicious users and inadvertently run by root with all of root's privileges. System AdministratorECCD-1, ECCD-2

Fix: F-31532r1_fix

For each world-writable path in root's executable search path, do one of the following: 1. Remove the world-writable permission on the directory. Procedure: # chmod o-w <path> 2. Remove the world-writable directory from the executable search path. Procedure: Identify and edit the initialization file referencing the world-writable directory and remove it from the PATH variable.

b

The system must prevent the root account from directly logging in except from the system console.

RMF Control: IA-2
Severity: M
CCI: CCI-000770
Version: GEN000980
Vuln IDs: V-778
Rule IDs: SV-38453r2_rule

Limiting the root account direct logins to only system consoles protects the root account from direct unauthorized access from a non-console device.System Administrator

Fix: F-31533r3_fix

If the /etc/securetty file does not exist, create the file containing only the word console and ensure correct file properties. # echo “console” > /etc/securetty

a

All GIDs referenced in the /etc/passwd file must be defined in the /etc/group file.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN000380
Vuln IDs: V-781
Rule IDs: SV-38455r1_rule

If a user is assigned the GID of a group not existing on the system, and a group with that GID is subsequently created, the user may have unintended rights to the group.System AdministratorECSC-1

Fix: F-31511r2_fix

Add a group to the system (edit /etc/group) for each GID referenced without a corresponding group.

b

All network services daemon files must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001180
Vuln IDs: V-786
Rule IDs: SV-38458r1_rule

Restricting permission on daemons will protect them from unauthorized modification and possible system compromise.System AdministratorECLP-1

Fix: F-31556r1_fix

Change the mode of the network services daemon. # chmod 0755 <path>/<daemon>

b

All skeleton files (typically those in /etc/skel) must have mode 0444 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001800
Vuln IDs: V-788
Rule IDs: SV-38459r1_rule

If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files. System AdministratorECLP-1

Fix: F-31701r1_fix

Change the mode of skeleton files with incorrect mode. # chmod 0444 <skeleton file>

b

NIS/NIS+/yp files must be owned by root, sys, or bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001320
Vuln IDs: V-789
Rule IDs: SV-38460r1_rule

NIS/NIS+/yp files are part of the system's identification and authentication processes and are, therefore, critical to system security. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31558r1_fix

Change the ownership of NIS/NIS+/yp files to root, sys, or bin. Consult vendor documentation to determine the location of the files. Procedure (example): # chown root <filename>

b

The NIS/NIS+/yp command files must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001360
Vuln IDs: V-791
Rule IDs: SV-38462r1_rule

NIS/NIS+/yp files are part of the system's identification and authentication processes and are, therefore, critical to system security. Unauthorized modification of these files could compromise these processes and the system.System AdministratorECLP-1

Fix: F-31560r1_fix

Change the mode of NIS/NIS+/yp command files to 0755 or less permissive. Procedure (example): # chmod 0755 <filename>

b

All system files, programs, and directories must be owned by a system account.

RMF Control: CM-5
Severity: M
CCI: CCI-001499
Version: GEN001220
Vuln IDs: V-795
Rule IDs: SV-38466r1_rule

Restricting permissions will protect the files from unauthorized modification.System AdministratorECLP-1

Fix: F-31564r1_fix

Change the owner of system files, programs, and directories to a system account. Procedure: # chown root <path>/<system file> (A different system user may be used in place of root.)

b

System files, programs, and directories must be group-owned by a system group.

RMF Control: CM-5
Severity: M
CCI: CCI-001499
Version: GEN001240
Vuln IDs: V-796
Rule IDs: SV-38467r1_rule

Restricting permissions will protect the files from unauthorized modification.System AdministratorECLP-1

Fix: F-31565r1_fix

Change the group owner of system files to a system group. Procedure: # chgrp root <path>/<system file> (System groups other than root may be used.)

b

The /etc/shadow (or equivalent) file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001400
Vuln IDs: V-797
Rule IDs: SV-38468r2_rule

The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System Administrator

Fix: F-31585r2_fix

For Trusted Mode: # chown root /tcb # chown root /tcb/files /tcb/files/auth # chown root /tcb/files/auth/[a-z]/* For SMSE: # chown root /etc/shadow

b

The /etc/passwd file must have mode 0444 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001380
Vuln IDs: V-798
Rule IDs: SV-38469r1_rule

If the passwd file is writable by a group owner or the world, the risk of passwd file compromise is increased. The passwd file contains the list of accounts on the system and associated information.System AdministratorECLP-1

Fix: F-31586r1_fix

Change the mode of the passwd file to 0444. # chmod 0444 /etc/passwd Document all changes.

b

The /etc/shadow (or equivalent) file must have mode 0400.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001420
Vuln IDs: V-800
Rule IDs: SV-38470r2_rule

The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. The file also contains password hashes which must not be accessible to users other than root. The Trusted Mode /tcb tree requires modes more permissive than the shadow file.System Administrator

Fix: F-31587r3_fix

For Trusted Mode: # chmod 0555 /tcb # chmod 0771 /tcb/files /tcb/files/auth # chmod 0664 /tcb/files/auth/[a-z]/* For SMSE: # chmod 0400 /etc/shadow

b

The system and user default umask must be 077.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN002560
Vuln IDs: V-808
Rule IDs: SV-38475r1_rule

The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a 4-digit number, the first digit representing special access modes is typically ignored or required to be 0. This requirement applies to the globally configured system defaults and the user defaults for each account on the system.trueIf the default umask is 000 or does not restrict the world-writable permission, this becomes a CAT I finding.System AdministratorECCD-1, ECCD-2

Fix: F-31745r1_fix

Edit local and global initialization files containing umask and change them to use 077 instead of the current value.

b

Default system accounts must be disabled or removed.

RMF Control: IA-5
Severity: M
CCI: CCI-000178
Version: GEN002640
Vuln IDs: V-810
Rule IDs: SV-27264r2_rule

Vendor accounts and software may contain backdoors that will allow unauthorized access to the system. These backdoors are common knowledge and present a threat to system security if the account is not disabled.System AdministratorIAAC-1

Fix: F-31746r2_fix

For Trusted Mode and SMSE: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to lock/disable or remove any enabled default system accounts.

b

The audit system must be configured to audit failed attempts to access files and programs.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN002720
Vuln IDs: V-814
Rule IDs: SV-38479r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31765r1_fix

Edit /etc/rc.config.d/auditing and add -e open to the end of the AUDEVENT_ARGS1 parameter.

b

The audit system must be configured to audit file deletions.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN002740
Vuln IDs: V-815
Rule IDs: SV-38480r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31766r1_fix

Edit /etc/rc.config.d/auditing and add -e delete to the end of the AUDEVENT_ARGS1 parameter.

b

The audit system must be configured to audit all administrative, privileged, and security actions.

RMF Control: CM-5
Severity: M
CCI: CCI-000347
Version: GEN002760
Vuln IDs: V-816
Rule IDs: SV-38481r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31767r1_fix

Edit /etc/rc.config.d/auditing and add -e admin and -e removable to the end of the AUDEVENT_ARGS1 parameter.

b

The audit system must be configured to audit login, logout, and session initiation.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN002800
Vuln IDs: V-818
Rule IDs: SV-38482r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31768r1_fix

Edit /etc/rc.config.d/auditing and add -e login to the end of the AUDEVENT_ARGS1 parameter.

b

The audit system must be configured to audit all discretionary access control permission modifications.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN002820
Vuln IDs: V-819
Rule IDs: SV-38483r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31769r1_fix

Edit /etc/rc.config.d/auditing and add -e moddac to the end of the AUDEVENT_ARGS1 parameter.

b

The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be owned by root or bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003720
Vuln IDs: V-821
Rule IDs: SV-35067r1_rule

Failure to give ownership of sensitive files or utilities to root provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-30239r1_fix

Change the ownership of the inetd.conf file to root or bin. # chown root <file or directory>

b

The inetd.conf and xinetd.conf files must have mode 0440 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003740
Vuln IDs: V-822
Rule IDs: SV-35072r1_rule

The Internet service daemon configuration files must be protected as malicious modification could cause Denial of Service or increase the attack surface of the system.System AdministratorECLP-1

Fix: F-30242r1_fix

Change the mode of the (x)inetd.conf file. # chmod 0440 <file>

b

The services file must be owned by root or bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003760
Vuln IDs: V-823
Rule IDs: SV-35077r1_rule

Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-30246r1_fix

Change the ownership of the services file to root or bin. # chown root /etc/services

b

The services file must have mode 0444 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003780
Vuln IDs: V-824
Rule IDs: SV-35078r1_rule

The services file is critical to the proper operation of network services and must be protected from unauthorized modification. Unauthorized modification could result in the failure of network services.System AdministratorECLP-1

Fix: F-30247r1_fix

Change the mode of the services file to 0444 or less permissive. # chmod 0444 /etc/services

a

Global initialization files must contain the mesg -n or mesg n commands.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN001780
Vuln IDs: V-825
Rule IDs: SV-38484r1_rule

If the mesg -n or mesg n command is not placed into the system profile, messaging can be used to cause a Denial of Service attack.System AdministratorECSC-1

Fix: F-31702r1_fix

Edit /etc/profile or another global initialization script, and add the mesg -n command.

b

The hosts.lpd file (or equivalent) must not contain a "+" character.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN003900
Vuln IDs: V-827
Rule IDs: SV-35140r1_rule

Having the "+" character in the hosts.lpd (or equivalent) file allows all hosts to use local system print resources.System AdministratorECCD-1, ECCD-2

Fix: F-30292r1_fix

Remove the "+" entries from the hosts.lpd (or equivalent) file.

b

The hosts.lpd (or equivalent) file must be owned by root, bin, sys, or lp.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003920
Vuln IDs: V-828
Rule IDs: SV-35143r1_rule

Failure to give ownership of the hosts.lpd file to root, bin, sys, or lp provides the designated owner, and possible unauthorized users, with the potential to modify the hosts.lpd file. Unauthorized modifications could disrupt access to local printers from authorized remote hosts or permit unauthorized remote access to local printers.System AdministratorECLP-1

Fix: F-30294r1_fix

Change the owner of the /etc/hosts.lpd file (or equivalent) to root, lp, or another privileged UID. # chown root <print service configuration file>

b

The hosts.lpd (or equivalent) must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003940
Vuln IDs: V-829
Rule IDs: SV-35148r1_rule

Excessive permissions on the hosts.lpd (or equivalent) file may permit unauthorized modification. Unauthorized modifications could disrupt access to local printers from authorized remote hosts or permit unauthorized remote access to local printers.System AdministratorECLP-1

Fix: F-30299r1_fix

Change the mode of the /etc/hosts.lpd file (or equivalent) to 0644 or less permissive. Procedure: # chmod 0644 <print service configuration file>

b

The alias file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004360
Vuln IDs: V-831
Rule IDs: SV-35161r1_rule

If the aliases file is not owned by root, an unauthorized user may modify the file to add aliases to run malicious code or redirect e-mail.System AdministratorECLP-1

Fix: F-30308r1_fix

Change the owner of the /etc/mail/aliases file (or equivalent) to root. # chown root /etc/mail/aliases

b

The alias file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004380
Vuln IDs: V-832
Rule IDs: SV-35165r1_rule

Excessive permissions on the aliases file may permit unauthorized modification. If the alias file is modified by an unauthorized user, they may modify the file to run malicious code or redirect e-mail.System AdministratorECLP-1

Fix: F-30311r1_fix

Change the mode of the aliases file (or equivalent) to 0644. # chmod 0644 /etc/mail/aliases

c

Files executed through a mail aliases file must be owned by root and must reside within a directory owned and writable only by root.

RMF Control: AC-6
Severity: H
CCI: CCI-000225
Version: GEN004400
Vuln IDs: V-833
Rule IDs: SV-35169r1_rule

If a file executed through a mail aliases file is not owned and writable only by root, it may be subject to unauthorized modification. Unauthorized modification of files executed through aliases may allow unauthorized users to attain root privileges.System AdministratorECLP-1

Fix: F-30312r1_fix

Edit the /etc/mail/aliases file Locate the entries executing a program. They will appear similar to the following line: alias: "|/usr/local/bin/ls" (or some other program name) Ensure root owns the programs and the directory(ies) they reside in by using the chown command to change owner to root. For a directory entry: # chown root <entry> For a file entry (change BOTH the directory and file, where/as necessary: # chown root <entry> # chown root `dirname <entry>`

b

Files executed through a mail aliases file must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004420
Vuln IDs: V-834
Rule IDs: SV-35043r1_rule

If a file executed through a mail alias file has permissions greater than 0755, it can be modified by an unauthorized user and may contain malicious code or instructions possibly compromising the system.System AdministratorECLP-1

Fix: F-31930r1_fix

Use the chmod command to change the access permissions for files executed from the aliases file. For example: # chmod 0755 <path/file>

a

Sendmail logging must not be set to less than 9 in the sendmail.cf file.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN004440
Vuln IDs: V-835
Rule IDs: SV-35047r1_rule

If Sendmail is not configured to log at level 9, system logs may not contain the information necessary for tracking unauthorized use of the sendmail service.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31932r1_fix

Edit the sendmail.cf file, locate the entry (and where necessary uncomment it and/or create it) and modify/set it to 9.

b

The system syslog service must log informational and more severe SMTP service messages.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN004460
Vuln IDs: V-836
Rule IDs: SV-35051r1_rule

If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.System AdministratorECSC-1

Fix: F-31933r1_fix

Edit the syslog.conf file and add a configuration line specifying an appropriate destination for critical "mail" syslogs, for example: mail.crit /var/adm/messages mail.* /var/adm/messages *.* /var/adm/messages *.crit /var/adm/messages

b

The SMTP service log file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004480
Vuln IDs: V-837
Rule IDs: SV-35053r1_rule

If the SMTP service log file is not owned by root, then unauthorized personnel may modify or delete the file to hide a system compromise.System AdministratorECLP-1

Fix: F-31934r1_fix

Change the ownership of the sendmail log file. # chown root <sendmail log file>

b

The SMTP service log file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004500
Vuln IDs: V-838
Rule IDs: SV-35058r1_rule

If the SMTP service log file is more permissive than 0644, unauthorized users may be allowed to change the log file.System AdministratorECLP-1

Fix: F-31935r1_fix

Change the mode of the SMTP service log file. # chmod 0644 <sendmail log file>

b

The ftpusers file must exist.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004880
Vuln IDs: V-840
Rule IDs: SV-35102r1_rule

The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If this file does not exist, then unauthorized accounts can utilize FTP.System AdministratorECCD-1, ECCD-2

Fix: F-31950r1_fix

Create a /etc/ftpd/ftpusers (or equivalent) file containing a list of /etc/passwd accounts not authorized for FTP.

b

The ftpusers file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004920
Vuln IDs: V-842
Rule IDs: SV-38485r1_rule

If the file ftpusers is not owned by root, an unauthorized user may modify the file to allow unauthorized accounts to use FTP.System AdministratorECLP-1

Fix: F-31952r1_fix

Change the owner of the ftpusers file to root. # chown root /etc/ftpd/ftpusers

b

The ftpusers file must have mode 0640 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004940
Vuln IDs: V-843
Rule IDs: SV-38486r1_rule

Excessive permissions on the ftpusers file could permit unauthorized modification. Unauthorized modification could result in Denial of Service to authorized FTP users or permit unauthorized users to access the FTP service.System AdministratorECLP-1

Fix: F-31954r1_fix

Change the mode of the ftpusers file to 0640. # chmod 0640 /etc/ftpd/ftpusers

c

The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: GEN005080
Vuln IDs: V-847
Rule IDs: SV-35110r1_rule

Secure mode limits TFTP requests to a specific directory. If TFTP is not running in secure mode, it may be able to write to any file or directory and may seriously impair system integrity, confidentiality, and availability.System AdministratorECSC-1

Fix: F-31960r1_fix

Edit /etc/inetd.conf and add one path argument, representing the TFTP root directory, to the tftpd command.

c

The TFTP daemon must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: H
CCI: CCI-000225
Version: GEN005100
Vuln IDs: V-848
Rule IDs: SV-35155r1_rule

If TFTP runs with the setuid or setgid bit set, it may be able to write to any file or directory and may seriously impair system integrity, confidentiality, and availability.System AdministratorECPA-1

Fix: F-31961r1_fix

Change the mode of the TFTP daemon. # chmod 0755 /usr/lbin/tftpd

b

The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005120
Vuln IDs: V-849
Rule IDs: SV-35157r1_rule

If TFTP has a valid shell, it increases the likelihood that someone could logon to the TFTP account and compromise the system.System AdministratorECSC-1

Fix: F-31962r1_fix

Create a tftp user account if none exists. Assign a non-login shell to the tftp user account, such as /usr/bin/false. Assign/create the tftp user account home directory where/as necessary. Ensure the home directory is owned by the tftp user.

b

The Network Information System (NIS) protocol must not be used.

RMF Control: AC-17
Severity: M
CCI: CCI-001435
Version: GEN006400
Vuln IDs: V-867
Rule IDs: SV-38487r1_rule

Due to numerous security vulnerabilities existing within NIS, it must not be used. Possible alternative directory services are NIS+ and LDAP.System AdministratorInformation Assurance OfficerECSC-1

Fix: F-32102r1_fix

Disable the use of NIS. Possible replacements are NIS+ and LDAP-UX.

a

All interactive users must be assigned a home directory in the /etc/passwd file.

RMF Control: AC-6
Severity: L
CCI: CCI-000225
Version: GEN001440
Vuln IDs: V-899
Rule IDs: SV-38488r2_rule

If users do not have a valid home directory, there is no place for the storage and control of files they own.System AdministratorECSC-1

Fix: F-31588r2_fix

For Trusted Mode: Determine why the user is not assigned a home directory. Possible actions include: account deletion or disablement. If the account is determined to be valid, manually create the home directory if required (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) and assign to the user in the /etc/passwd file or take corrective action via the HP SMH/SAM utility. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Determine why the user is not assigned a home directory. Possible actions include: account deletion or disablement. If the account is determined to be valid, manually create the home directory if required (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) and assign to the user in the /etc/passwd file or take corrective action via the HP SMH/SAM utility. Additionally, use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the ABORT_LOGIN_ON_MISSING_HOMEDIR attribute. See the below example: ABORT_LOGIN_ON_MISSING_HOMEDIR=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

a

All interactive user home directories defined in the /etc/passwd file must exist.

RMF Control: AC-6
Severity: L
CCI: CCI-000225
Version: GEN001460
Vuln IDs: V-900
Rule IDs: SV-38489r2_rule

If a user has a home directory defined that does not exist, the user may be given the / directory, by default, as the current working directory upon logon. This could create a Denial of Service because the user would not be able to perform useful tasks in this location.System AdministratorECSC-1

Fix: F-31589r2_fix

Determine why the user home directory does not exist. Possible actions include: account deletion or disablement. If the account is determined to be valid, create the home directory either manually (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) or via the HP SMH/SAM utility.

b

All local initialization files must have mode 0740 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001880
Vuln IDs: V-905
Rule IDs: SV-38493r1_rule

Local initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.System AdministratorECLP-1

Fix: F-31704r1_fix

Ensure user startup files have permissions of 0740 or more restrictive. Examine each user's home directory and verify all file names beginning with "." have access permissions of 0740 or more restrictive. If they do not, use the chmod command to correct the vulnerability. Procedure: # chmod 0740 .filename NOTE: The period is part of the file name and is required.

b

Run control scripts executable search paths must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001600
Vuln IDs: V-907
Rule IDs: SV-38495r3_rule

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths. System Administrator

Fix: F-31594r2_fix

Edit the run control script and remove the relative path entries from the executable search path variable that are not documented with the ISSO. Edit the run control script and remove any empty entry that is defined.

b

There must be no .netrc files on the system.

RMF Control: IA-5
Severity: M
CCI: CCI-000196
Version: GEN002000
Vuln IDs: V-913
Rule IDs: SV-38499r1_rule

Unencrypted passwords for remote FTP servers may be stored in .netrc files. Policy requires passwords to be encrypted in storage and not used in access scripts.System AdministratorIAIA-1, IAIA-2

Fix: F-31706r1_fix

Remove the .netrc file(s). Procedure: # rm .netrc

b

The /etc/shells (or equivalent) file must exist.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN002120
Vuln IDs: V-916
Rule IDs: SV-34952r1_rule

The shells file (or equivalent) lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized, unsecure shell.System AdministratorECSC-1

Fix: F-31748r1_fix

Create /etc/shells file containing a list of valid system shells. Consult vendor documentation for an appropriate list of system shells. Procedure: Typical installed shells include: /sbin/sh /usr/bin/sh /usr/bin/rsh /usr/bin/ksh /usr/bin/rksh /usr/bin/csh /usr/bin/keysh # echo "/sbin/sh" >> /etc/shells (Repeat as necessary for all existing shell programs.)

b

All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN002140
Vuln IDs: V-917
Rule IDs: SV-34953r1_rule

The shells file lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized, unsecure shell.System AdministratorECSC-1

Fix: F-31749r1_fix

Use the chsh utility or edit the /etc/passwd file and correct the error by changing the default shell of the account in error to an acceptable shell name contained in the /etc/shells file. Alternatively, use the HP SMH to change the /etc/passwd shell entry.

b

All shell files must be owned by root or bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN002200
Vuln IDs: V-921
Rule IDs: SV-38501r1_rule

If shell files are owned by users other than root or bin, they could be modified by intruders or malicious users to perform unauthorized actions.System AdministratorECLP-1

Fix: F-31750r1_fix

Change the ownership of any system shell not owned by root or bin: # chown root <path/shell>

c

All shell files must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: H
CCI: CCI-000225
Version: GEN002220
Vuln IDs: V-922
Rule IDs: SV-38502r1_rule

Shells with world/group-write permissions give the ability to maliciously modify the shell to obtain unauthorized access.System AdministratorECLP-1

Fix: F-31751r1_fix

Change the mode of the shell. # chmod 0755 <shell>

b

Device files and directories must only be writable by users with a system account or as configured by the vendor.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN002280
Vuln IDs: V-924
Rule IDs: SV-38505r2_rule

System device files in writable directories could be modified, removed, or used by an unprivileged user to control system hardware.System Administrator

Fix: F-31753r1_fix

Remove the world-writable permission from the device file(s). # chmod o-w <device file> Document all changes.

a

The Network File System (NFS) share configuration file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: L
CCI: CCI-000225
Version: GEN005760
Vuln IDs: V-929
Rule IDs: SV-35184r1_rule

Excessive permissions on the NFS share configuration file could allow unauthorized modification of the file, which could result in Denial-of-Service to authorized NFS shares and the creation of additional unauthorized shares.System AdministratorECCD-1, ECCD-2, ECLP-1

Fix: F-33232r1_fix

# chmod 0644 /etc/dfs/dfstab

b

The Network File System (NFS) anonymous UID and GID must be configured to values that have no permissions.

RMF Control: AC-14
Severity: M
CCI: CCI-000062
Version: GEN005820
Vuln IDs: V-932
Rule IDs: SV-35199r1_rule

When an NFS server is configured to deny remote root access, a selected UID and GID are used to handle requests from the remote root user. The UID and GID should be chosen from the system to provide the appropriate level of non-privileged access.System AdministratorECSC-1

Fix: F-33237r1_fix

Edit /etc/dfs/sharetab and set the anon=-1 option for shares without it. Re-export the file systems.

b

The Network File System (NFS) server must be configured to restrict file system access to local hosts.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005840
Vuln IDs: V-933
Rule IDs: SV-35201r1_rule

The NFS access option limits user access to the specified level. This assists in protecting shared file systems. If access is not restricted, unauthorized hosts may be able to access the system's NFS shares.System AdministratorECSC-1

Fix: F-33239r1_fix

Edit /etc/dfs/dfstab and add ro and/or rw options (as appropriate) that specify a list of hosts or networks which are permitted access. Re-share the file systems via the following commands: # unshare <the file system entry that was modified> # share <the file system entry that was modified>

b

The NFS server must not allow remote root access.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005880
Vuln IDs: V-935
Rule IDs: SV-35202r1_rule

If the NFS server allows root access to local file systems from remote hosts, this access could be used to compromise the system.System AdministratorInformation Assurance ManagerInformation Assurance OfficerEBRP-1

Fix: F-33243r1_fix

Edit /etc/dfs/dfstab and remove the root= option for all shares. Re-share the file systems.

b

The nosuid option must be enabled on all NFS client mounts.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005900
Vuln IDs: V-936
Rule IDs: SV-35204r1_rule

Enabling the nosuid mount option prevents the system from granting owner or group-owner privileges to programs with the suid or sgid bit set. If the system does not restrict this access, users with unprivileged access to the local system may be able to acquire privileged access by executing suid or sgid files located on the mounted NFS file system.System AdministratorInformation Assurance ManagerInformation Assurance OfficerECPA-1

Fix: F-30338r1_fix

Edit /etc/fstab and add the nosuid option for all NFS file systems. Remount the NFS file systems to make the change take effect.

b

The system must use an access control program.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN006580
Vuln IDs: V-940
Rule IDs: SV-35198r1_rule

Access control programs (such as TCP_WRAPPERS) provide the ability to enhance system security posture.System AdministratorEBRU-1

Fix: F-30334r1_fix

Edit /etc/inetd.conf and use tcpd to wrap active services.

b

The system's access control program must log each system’s access attempt.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN006600
Vuln IDs: V-941
Rule IDs: SV-35206r2_rule

If access attempts are not logged, then multiple attempts to log on to the system by an unauthorized user may go undetected.System AdministratorECAR-2, ECAR-3

Fix: F-32112r1_fix

Configure the access restriction program to log every access attempt. Ensure the implementation instructions for TCP_WRAPPERS are followed so logging of system access attempts is logged into the system log files. If an alternate application is used, it must support this function.

b

The system must be configured to operate in a security mode.

RMF Control: CM-2
Severity: M
CCI: CCI-000293
Version: GEN000000-HPUX0020
Vuln IDs: V-960
Rule IDs: SV-38681r2_rule

When operating in standard mode, account passwords are stored in the /etc/passwd file, which is world readable. By operating in either Trusted Mode or Standard Mode with Security Extensions, the system security posture is enhanced thru the addition of a secure, non-world readable password container other than /etc/passwd.System AdministratorDCSW-1

Fix: F-33047r2_fix

SAM/SMH must be used to convert standard mode HP-UX to Trusted Mode (optional for SMSE). For Trusted Mode only: The following command may be used to “manually” convert from Standard Mode to Trusted Mode (note that its use is not vendor supported): # tsconvert -c For SMSE only: The following command may be used to “manually” create the /etc/shadow file with information from the /etc/passwd file (use of this commend is vendor supported). # pwconv Note that additional software bundles and/or patches may be required in order to completely convert a standard mode system to SMSE.

b

The HP-UX /etc/securetty must be group-owned by root, sys, or bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000000-HPUX0080
Vuln IDs: V-965
Rule IDs: SV-965r2_rule

Root, sys, and bin are the most privileged group accounts, by default, for most UNIX systems. If a file as sensitive as /etc/securetty is not group-owned by a privileged group, it could lead to system compromise.System AdministratorECLP-1

Fix: F-1119r2_fix

Change the group-owner of the /etc/securetty to root, bin, or sys. Example: # chgrp root /etc/securetty

b

The /etc/securetty file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000000-HPUX0060
Vuln IDs: V-966
Rule IDs: SV-38682r1_rule

Failure to make root the owner of sensitive files and utilities may provide unauthorized owners the potential to access and/or change sensitive information or system configurations, thus weakening the overall security posture of a site.System AdministratorECLP-1

Fix: F-1120r2_fix

Change the owner of the /etc/securetty file to root. # chown root /etc/securetty

b

The /etc/securetty file must have mode 0640 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000000-HPUX0100
Vuln IDs: V-967
Rule IDs: SV-967r2_rule

Excessive permissions on the /etc/securetty file could result in unauthorized modification of the file. Changes to the file could reduce the system's security by specifying additional terminals permitted to accept root logins, or deny service by preventing root logins on authorized terminals.System AdministratorECCD-1, ECCD-2, ECLP-1

Fix: F-1121r2_fix

Change the mode of the /etc/securetty file to 0640. Example: # chmod 0640 /etc/securetty

b

Access to the cron utility must be controlled using the cron.allow and/or cron.deny file(s).

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN002960
Vuln IDs: V-974
Rule IDs: SV-38541r1_rule

The cron facility allows users to execute recurring jobs on a regular and unattended basis. The cron.allow file designates accounts allowed to enter and execute jobs using the cron facility. If neither cron.allow nor cron.deny exists, then any account may use the cron facility. This may open the facility up for abuse by system intruders and malicious users.System AdministratorECLP-1

Fix: F-31770r1_fix

Create /var/adm/cron/cron.allow and/or /var/adm/cron/cron.deny with appropriate local content.

b

The cron.allow file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN002980
Vuln IDs: V-975
Rule IDs: SV-38542r1_rule

A cron.allow file, readable and/or writable by other than root, could allow potential intruders and malicious users to use the file contents to help discern information, such as who is allowed to execute cron programs, which could be harmful to overall system and network security.System AdministratorECLP-1

Fix: F-31771r1_fix

Change the mode of the cron.allow file to 0600. Procedure: # chmod 0600 /var/adm/cron/cron.allow

b

Crontab files must have mode 0600 or less permissive, and files in cron script directories must have mode 0700 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003080
Vuln IDs: V-978
Rule IDs: SV-38545r1_rule

To protect the integrity of scheduled system jobs and prevent malicious modification to these jobs, crontab files must be secured.System AdministratorECLP-1

Fix: F-31790r1_fix

Change the mode of the crontab files. # chmod 0600 /var/spool/cron/crontabs/*

b

Cron and crontab directories must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003100
Vuln IDs: V-979
Rule IDs: SV-38546r1_rule

To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured.System AdministratorECLP-1

Fix: F-1133r2_fix

Change the mode of crontab directories to 0755.

b

Cron and crontab directories must be owned by root or bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003120
Vuln IDs: V-980
Rule IDs: SV-38547r1_rule

Incorrect ownership of the cron or crontab directories could permit unauthorized users the ability to alter cron jobs and run automated jobs as privileged users. Failure to give ownership of cron or crontab directories to root or to bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31792r1_fix

Change the mode of the crontab directory. # chown root /var/spool/cron/crontabs

b

Cron and crontab directories must be group-owned by root, sys, bin or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003140
Vuln IDs: V-981
Rule IDs: SV-38548r1_rule

To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured. Failure to give group-ownership of cron or crontab directories to a system group provides the designated group and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31793r1_fix

Change the group owner of the crontab directories to root, sys, bin or other. # chown root /var/spool/cron/crontabs

b

Cron logging must be implemented.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN003160
Vuln IDs: V-982
Rule IDs: SV-38549r1_rule

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31794r1_fix

Enable cron/logging on the system via: # /sbin/init.d/cron stop # mv <current cron log> <to a new location and new name> # /sbin/init.d/cron start # more /var/adm/cron/log Cron automatically handles its own logging function and (at least) the Start Time should be visible at the beginning of the new log file /var/adm/cron/log.

b

The cronlog file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003180
Vuln IDs: V-983
Rule IDs: SV-38550r1_rule

Cron logs contain reports of scheduled system activities and must be protected from unauthorized access or manipulation.System AdministratorECLP-1, ECTP-1

Fix: F-31795r1_fix

Change the mode of the cron log file. # chmod 0600 /var/adm/cron/log

b

Access to the at utility must be controlled via the at.allow and/or at.deny file(s).

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003280
Vuln IDs: V-984
Rule IDs: SV-35033r1_rule

The at facility selectively allows users to execute jobs at deferred times. It is usually used for one-time jobs. The at.allow file selectively allows access to the at facility. If there is no at.allow file, there is no ready documentation of who is allowed to submit at jobs.System AdministratorECLP-1

Fix: F-31796r1_fix

Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the at facility supported by the cron daemon.

b

The at.deny file must not be empty if it exists.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003300
Vuln IDs: V-985
Rule IDs: SV-38551r1_rule

On some systems, if there is no at.allow file and there is an empty at.deny file, then the system assumes everyone has permission to use the at facility. This could create an insecure setting in the case of malicious users or system intruders.trueInformation Assurance OfficerSystem AdministratorECLP-1

Fix: F-31797r1_fix

Add appropriate users to the at.deny file, or remove the empty at.deny file if an at.allow file exists.

b

Default system accounts (with the exception of root) must not be listed in the at.allow file or must be included in the at.deny file if the at.allow file does not exist.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003320
Vuln IDs: V-986
Rule IDs: SV-38552r1_rule

Default accounts, such as bin, sys, adm, uucp, daemon, and others, should never have access to the at facility. This would create a possible vulnerability open to intruders or malicious users.System AdministratorECPA-1

Fix: F-31799r1_fix

Remove the default accounts (such as bin, sys, adm, and others) from the at.allow file.

b

The at.allow file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003340
Vuln IDs: V-987
Rule IDs: SV-38553r1_rule

Permissions more permissive than 0600 (i.e. read, write and execute for the owner) may allow unauthorized or malicious access to the at.allow and/or at.deny files.System AdministratorECLP-1

Fix: F-31800r1_fix

Change the mode of the at.allow file. # chmod 0600 /var/adm/cron/at.allow

b

The snmpd.conf file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005320
Vuln IDs: V-994
Rule IDs: SV-35176r1_rule

The snmpd.conf file contains authenticators and must be protected from unauthorized access and modification.System AdministratorECLP-1

Fix: F-31978r1_fix

Change the mode of the SNMP daemon configuration file to 0600. # chmod 0600 /etc/SnmpAgent.d/snmpd.conf

b

Management Information Base (MIB) files must have mode 0640 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005340
Vuln IDs: V-995
Rule IDs: SV-35178r1_rule

The ability to read the MIB file could impart special knowledge to an intruder or malicious user about the ability to extract compromising information about the system or network.System AdministratorECLP-1

Fix: F-31979r1_fix

Change the mode of MIB files to 0640. # chmod 0640 <mib file>

b

The system must not run an Internet Network News (INN) server.

RMF Control: CM-7
Severity: M
CCI: CCI-000381
Version: GEN006240
Vuln IDs: V-1023
Rule IDs: SV-38236r1_rule

INN servers access Usenet newsfeeds and store newsgroup articles. INN servers use the Network News Transfer Protocol (NNTP) to transfer information from the Usenet to the server and from the server to authorized remote hosts. If this function is necessary to support a valid mission requirement, its use must be authorized and approved in the system accreditation package.System AdministratorInformation Assurance OfficerECSC-1

Fix: F-32085r1_fix

Disable the INN server.

b

The /etc/smb.conf file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN006100
Vuln IDs: V-1027
Rule IDs: SV-35213r1_rule

The /etc/smb.conf file allows access to other machines on the network and grants permissions to certain users. If it is owned by another user, the file may be maliciously modified and the Samba configuration could be compromised.System AdministratorECLP-1

Fix: F-32069r1_fix

Change the ownership of the smb.conf file. # chown root /etc/opt/samba/smb.conf

b

The /etc/opt/samba/smb.conf file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN006140
Vuln IDs: V-1028
Rule IDs: SV-35221r1_rule

If the smb.conf file has excessive permissions, the file may be maliciously modified and the Samba configuration could be compromised.System AdministratorECLP-1

Fix: F-32071r1_fix

Change the mode of the smb.conf file to 0644 or less permissive. # chmod 0644 /etc/opt/samba/smb.conf

b

The smb.conf file must use the hosts option to restrict access to Samba.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN006220
Vuln IDs: V-1030
Rule IDs: SV-35107r1_rule

Samba increases the attack surface of the system and must be restricted to communicate only with systems requiring access.System AdministratorECSC-1

Fix: F-32079r1_fix

Edit the smb.conf file and set the hosts option to permit only authorized hosts access Samba. An example might be: hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 hosts deny = 0.0.0.0/0 The above will only allow SMB connections from the localhost and from the two private networks 192.168.2 and 192.168.3. All other connections will be refused as soon as the client sends its first packet.

b

The system must not permit root logins using remote access programs such as SSH.

RMF Control: IA-2
Severity: M
CCI: CCI-000770
Version: GEN001120
Vuln IDs: V-1047
Rule IDs: SV-38207r1_rule

Even though communications are encrypted, an additional layer of security may be gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account preserves the audit trail.System AdministratorECPA-1

Fix: F-24426r1_fix

Edit the configuration file and set the PermitRootLogin option to no.

b

The /etc/smb.conf file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN006120
Vuln IDs: V-1056
Rule IDs: SV-35219r1_rule

If the group-owner of the smb.conf file is not root or a system group, the file may be maliciously modified and the Samba configuration could be compromised.System AdministratorECLP-1

Fix: F-30350r1_fix

Change the group owner of the "smb.conf" file. # chgrp root /etc/samba/smb.conf

a

The root shell must be located in the / file system.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN001080
Vuln IDs: V-1062
Rule IDs: SV-38208r1_rule

To ensure the root shell is available in repair and administrative modes, the root shell must be located in the / file system.System AdministratorECSC-1

Fix: F-31538r1_fix

Change the root account's shell to one present on the / file system.

b

Graphical desktop environments provided by the system must automatically lock after 15 minutes of inactivity and must require users to re-authenticate to unlock the environment.

RMF Control: AC-11
Severity: M
CCI: CCI-000057
Version: GEN000500
Vuln IDs: V-4083
Rule IDs: SV-38416r2_rule

If graphical desktop sessions do not lock the session after 15 minutes of inactivity, requiring re-authentication to resume operations, the system or individual data could be compromised by an alert intruder who could exploit the oversight. This requirement applies to graphical desktop environments provided by the system to locally attached displays and input devices as well as to graphical desktop environments provided to remote systems, including thin clients.System Administrator

Fix: F-31513r2_fix

Configure the CDE lock manager to lock your screen after a certain amount of inactive time. To configure the CDE lock manager to lock the screen after 15 minutes of inactive time, enter the following commands (ensure to NOT overwrite an existing file): # cp /usr/dt/config/C/sys.resources /etc/dt/config/C/sys.resources # vi /etc/dt/config/C/sys.resources Locate and add/uncomment/change the line to N=15 dtsession*lockTimeout: <N> dtsession*lockTimeout: 15 Log out of CDE and log back in to verify the timeout is in effect.

b

The system must prohibit the reuse of passwords within five iterations.

RMF Control: IA-5
Severity: M
CCI: CCI-000200
Version: GEN000800
Vuln IDs: V-4084
Rule IDs: SV-38417r2_rule

If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it, this would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.System AdministratorIAIA-1, IAIA-2

Fix: F-31540r2_fix

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

b

The HP-UX AUDOMON_ARGS attribute must be explicitly initialized.

RMF Control: AU-2
Severity: M
CCI: CCI-000126
Version: GEN000000-HPUX0040
Vuln IDs: V-4290
Rule IDs: SV-38429r2_rule

The minimal set of auditing requirements necessary to collect useful forensics data and provide user help when violations are detected must be configured.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-31485r2_fix

Edit the /etc/rc.config.d/auditing file and insert the following line: AUDOMON_ARGS=“-p 20, -t 1, -w 90” Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start

c

The SSH daemon must be configured to only use the SSHv2 protocol.

RMF Control: AC-17
Severity: H
CCI: CCI-001436
Version: GEN005500
Vuln IDs: V-4295
Rule IDs: SV-35209r1_rule

SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.System AdministratorDCPP-1

Fix: F-30340r1_fix

Edit the configuration file and modify the Protocol line entry to appear as follows: Protocol 2

b

The root file system must employ journaling or another mechanism ensuring file system consistency.

RMF Control: CP-10
Severity: M
CCI: CCI-000553
Version: GEN003640
Vuln IDs: V-4304
Rule IDs: SV-35057r1_rule

File system journaling, or logging, can allow reconstruction of file system data after a system crash, thus, preserving the integrity of data that may have otherwise been lost. Journaling file systems typically do not require consistency checks upon booting after a crash, which can improve system availability. Some file systems employ other mechanisms to ensure consistency which also satisfy this requirement.System AdministratorECAR-1, ECAR-2, ECAR-3

Fix: F-30232r1_fix

Implement file system journaling for the root file system, or use a file system that uses other mechanisms to ensure file system consistency. If the root file system supports journaling, enable it. If the file system does not support journaling or another mechanism to ensure file system consistency, a migration to a different file system will be necessary.

b

The system must not run Samba unless needed.

RMF Control: AC-17
Severity: M
CCI: CCI-001436
Version: GEN006060
Vuln IDs: V-4321
Rule IDs: SV-35208r1_rule

Samba is a tool used for the sharing of files and printers between Windows and UNIX operating systems. It provides access to sensitive files and, therefore, poses a security risk if compromised.System AdministratorECSC-1

Fix: F-32067r1_fix

If there is no functional need for Samba and the daemon is running, disable the daemon by killing the process ID as noted from the output of ps -ef |grep smbd. The utility should also be removed or not installed if there is no functional requirement.

b

The cron.deny file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003200
Vuln IDs: V-4358
Rule IDs: SV-38430r1_rule

If file permissions for cron.deny are more permissive than 0600, sensitive information could be viewed or edited by unauthorized users.System AdministratorECLP-1

Fix: F-31803r1_fix

Change the mode of the cron.deny file. # chmod 0600 /var/adm/cron/cron.deny

b

The cron.allow file must be owned by root, bin, or sys.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003240
Vuln IDs: V-4361
Rule IDs: SV-38432r1_rule

If the owner of the cron.allow file is not set to root, bin, or sys, the possibility exists for an unauthorized user to view or to edit sensitive information.System AdministratorECLP-1

Fix: F-31807r1_fix

# chown root /var/adm/cron/cron.allow

b

The at directory must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003400
Vuln IDs: V-4364
Rule IDs: SV-38433r1_rule

If the at directory has a mode more permissive than 0755, unauthorized users could be allowed to view or to edit files containing sensitive information within the at directory. Unauthorized modifications could result in Denial of Service to authorized at jobs.System AdministratorECLP-1

Fix: F-31808r1_fix

Change the mode of the at directory to 0755. # chmod 0755 <at directory>

b

The at directory must be owned by root, bin, or sys.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003420
Vuln IDs: V-4365
Rule IDs: SV-38434r1_rule

If the owner of the at directory is not root, bin, or sys, unauthorized users could be allowed to view or edit files containing sensitive information within the directory.System AdministratorECLP-1

Fix: F-31809r1_fix

Change the owner of the existing at directory to root, bin, or sys. # chown root <at directory> (Replace root with another system group and/or <at directory> with a different at directory as necessary.)

b

The at.allow file must be owned by root, bin, or sys.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003460
Vuln IDs: V-4367
Rule IDs: SV-34997r1_rule

If the owner of the at.allow file is not set to root, sys, or bin, unauthorized users could be allowed to view or edit sensitive information contained within the file.System AdministratorECLP-1

Fix: F-30202r1_fix

Change the owner of the at.allow file. # chown root /var/adm/cron/at.allow

b

The at.deny file must be owned by root, bin, or sys.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003480
Vuln IDs: V-4368
Rule IDs: SV-34998r1_rule

If the owner of the at.deny file is not set to root, bin, or sys, unauthorized users could be allowed to view or edit sensitive information contained within the file.System AdministratorECLP-1

Fix: F-30203r1_fix

Change the owner of the at.deny file. # chown root /usr/lib/cron/at.deny

b

The traceroute command must be group-owned by sys, bin, root, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003980
Vuln IDs: V-4370
Rule IDs: SV-35154r1_rule

If the group owner of the traceroute command has not been set to a system group, unauthorized users could have access to the command and use it to gain information regarding a network's topology inside of the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.System AdministratorECLP-1

Fix: F-30305r1_fix

Change the group-owner of the traceroute command to root. See the following example: # chgrp root /usr/contrib/bin/traceroute

b

The traceroute file must have mode 0700 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004000
Vuln IDs: V-4371
Rule IDs: SV-38435r1_rule

If the mode of the traceroute executable is more permissive than 0700, malicious code could be inserted by an attacker and triggered whenever the traceroute command is executed by authorized users. Additionally, if an unauthorized user is granted executable permissions to the traceroute command, it could be used to gain information about the network topology behind the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.System AdministratorECLP-1

Fix: F-31919r1_fix

Change the mode of the traceroute command. # chmod 0700 /usr/contrib/bin/traceroute

a

The SMTP service's SMTP greeting must not provide version information.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN004560
Vuln IDs: V-4384
Rule IDs: SV-38436r1_rule

The version of the SMTP service can be used by attackers to plan an attack based on vulnerabilities present in the specific version.System AdministratorECSC-1

Fix: F-31938r1_fix

Ensure Sendmail or its equivalent has been configured to mask the version information. If necessary, change the O SmtpGreetingMessage line in the /etc/sendmail.cf file as noted below: O SmtpGreetingMessage=$j Sendmail $v/$Z; $b change it to: O SmtpGreetingMessage= Mail Server Ready ; $b Then restart the Sendmail service.

b

The system must not use .forward files.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN004580
Vuln IDs: V-4385
Rule IDs: SV-35061r1_rule

The .forward file allows users to automatically forward mail to another system. Use of .forward files could allow the unauthorized forwarding of mail and could potentially create mail loops which could degrade system performance.System AdministratorECSC-1

Fix: F-31939r1_fix

Remove .forward files from the system.

c

Anonymous FTP accounts must not have a functional shell.

RMF Control: AC-6
Severity: H
CCI: CCI-000225
Version: GEN005000
Vuln IDs: V-4387
Rule IDs: SV-35106r1_rule

If an anonymous FTP account has been configured to use a functional shell, attackers could gain access to the shell if the account is compromised.System AdministratorECCD-1, ECCD-2

Fix: F-31956r1_fix

Configure anonymous FTP accounts to use a non-functional shell. If necessary, edit the /etc/passwd file to remove any functioning shells associated with the FTP account and replace them with non-functioning shells, such as /dev/null.

b

The /etc/syslog.conf file must be owned by bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005400
Vuln IDs: V-4393
Rule IDs: SV-38437r1_rule

If the /etc/syslog.conf file is not owned by bin, unauthorized users could be allowed to view, edit, or delete important system messages handled by the syslog facility.System AdministratorECLP-1

Fix: F-31988r1_fix

Use the chown command to set the owner to bin. # chown bin /etc/syslog.conf

b

The /etc/syslog.conf file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005420
Vuln IDs: V-4394
Rule IDs: SV-35186r1_rule

If the group owner of /etc/syslog.conf is not root, bin, or sys, unauthorized users could be permitted to view, edit, or delete important system messages handled by the syslog facility.System AdministratorECLP-1

Fix: F-30322r1_fix

Change the group owner of the /etc/syslog.conf file to root, bin, sys, or other. # chgrp root /etc/syslog.conf

b

The cron.deny file must be owned by root, bin, or sys.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003260
Vuln IDs: V-4430
Rule IDs: SV-38439r1_rule

Cron daemon control files restrict the scheduling of automated tasks and must be protected.System AdministratorECLP-1

Fix: F-31810r1_fix

# chown root /var/adm/cron/cron.deny

c

The remsh daemon must not be running.

RMF Control: AC-17
Severity: H
CCI: CCI-000068
Version: GEN003820
Vuln IDs: V-4687
Rule IDs: SV-35130r1_rule

The remshd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.System AdministratorEBRU-1

Fix: F-30282r1_fix

Edit /etc/inetd.conf and comment out the remshd service. Refresh the inetd service. # inetd -c

c

The rexec daemon must not be running.

RMF Control: AC-17
Severity: H
CCI: CCI-001435
Version: GEN003840
Vuln IDs: V-4688
Rule IDs: SV-35132r2_rule

The rexecd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.trueInformation Assurance OfficerSystem Administrator

Fix: F-30284r1_fix

Edit /etc/inetd.conf and comment out the line for the rexec daemon service. Restart the inetd service via the following command: # inetd -c

a

The SMTP service must not have the EXPN feature active.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN004660
Vuln IDs: V-4692
Rule IDs: SV-35076r1_rule

The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners.False positives may occur with the SMTP EXPN check. According to RFC821, it is acceptable for a server to respond with a 250 (success) or 550 (failure) when the server supports the EXPN command. For example, some servers return "550 EXPN command not available," meaning the command is not supported and the machine is not vulnerable. However, a result of "550 That is a mailing list, not a user" would be a failure code, but not an indication of an error, and the machine would be vulnerable. If a false positive is suspected, check your log file for the response from the server.System AdministratorECSC-1

Fix: F-31943r1_fix

Edit the /etc/mail/sendmail.cf file and add or edit the following line: O PrivacyOptions=goaway Then restart the Sendmail service.

a

The SMTP service must not have the VRFY feature active.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN004680
Vuln IDs: V-4693
Rule IDs: SV-35083r1_rule

The VRFY (Verify) command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY may provide additional information about users on the system, such as the full names of account owners.System AdministratorECSC-1

Fix: F-31944r1_fix

If running Sendmail, add the line Opnovrfy to the Sendmail configuration file, usually located in /etc/mail/sendmail.cf. For other mail servers, contact the vendor for information on how to disable the verify command. Newer versions of Sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail. Edit the /etc/mail/sendmail.cf file and add or edit (one of) the following line(s): O PrivacyOptions=novrfy O PrivacyOptions=goaway Then restart the Sendmail service.

b

The system must not have the UUCP service active.

RMF Control: AC-17
Severity: M
CCI: CCI-001436
Version: GEN005280
Vuln IDs: V-4696
Rule IDs: SV-35171r1_rule

The UUCP utility is designed to assist in transferring files, executing remote commands, and sending e-mail between UNIX systems over phone lines and direct connections between systems. The UUCP utility is a primitive and arcane system with many security issues. There are alternate data transfer utilities/products that can be configured to more securely transfer data by providing for authentication as well as encryption.System AdministratorECSC-1

Fix: F-31973r1_fix

Edit /etc/inetd.conf and comment the uucp service entry. Restart the inetd service. # inetd -c

a

The system must not have the finger service active.

RMF Control: AC-4
Severity: L
CCI: CCI-001551
Version: GEN003860
Vuln IDs: V-4701
Rule IDs: SV-35136r1_rule

The finger service provides information about the system's users to network clients. This could expose information that could be used in subsequent attacks.System AdministratorDCPP-1

Fix: F-30288r1_fix

Edit /etc/inetd.conf and comment out the fingerd line. Restart the inetd service via the following command: # inetd -c

b

The system must require that passwords contain a minimum of 15 characters.

RMF Control: IA-5
Severity: M
CCI: CCI-000205
Version: GEN000580
Vuln IDs: V-11947
Rule IDs: SV-27111r4_rule

The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.System Administrator

Fix: F-24374r5_fix

For Trusted Mode: Use the SAM/SMH interface to set the system password length attribute “MIN_PASSWORD_LENGTH” to 15 or greater. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Install the additional LongPassword11i3 and PHI11i3 product bundles where/as required. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute(s). See the below example(s): CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 LONG_PASSWORD=1 MIN_PASSWORD_LENGTH=15 Note: The MIN_PASSWORD_LENGTH attribute must be set equal to or greater than 15. If the "vi" editor was used to update the /etc/default/security file, save the file before exiting the editor.

b

The system must require passwords contain at least one uppercase alphabetic character.

RMF Control: IA-5
Severity: M
CCI: CCI-000192
Version: GEN000600
Vuln IDs: V-11948
Rule IDs: SV-38244r2_rule

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.System AdministratorIAIA-1, IAIA-2

Fix: F-31541r2_fix

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_UPPER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_UPPER_CASE_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_UPPER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_UPPER_CASE_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

b

The system must require passwords contain at least one numeric character.

RMF Control: IA-5
Severity: M
CCI: CCI-000194
Version: GEN000620
Vuln IDs: V-11972
Rule IDs: SV-38245r2_rule

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.System AdministratorIAIA-1, IAIA-2

Fix: F-31542r2_fix

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_DIGIT_CHARS attribute. See the below example: PASSWORD_MIN_DIGIT_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_DIGIT_CHARS attribute. See the below example: PASSWORD_MIN_DIGIT_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

b

The system must require passwords contain at least one special character.

RMF Control: IA-5
Severity: M
CCI: CCI-001619
Version: GEN000640
Vuln IDs: V-11973
Rule IDs: SV-38246r2_rule

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.System AdministratorIAIA-1, IAIA-2

Fix: F-31543r2_fix

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_SPECIAL_CHARS attribute. See the below example: PASSWORD_MIN_SPECIAL_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_SPECIAL_CHARS attribute. See the below example: PASSWORD_MIN_SPECIAL_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

b

All global initialization files must have mode 0444 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001720
Vuln IDs: V-11981
Rule IDs: SV-38266r1_rule

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.System AdministratorECLP-1

Fix: F-31714r1_fix

Change the mode of the global initialization file(s) to 0444. # chmod 0444 <global initialization file>

b

All global initialization files must be owned by bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001740
Vuln IDs: V-11982
Rule IDs: SV-38267r1_rule

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31715r1_fix

Change the ownership of global initialization files with incorrect ownership. # chown bin <global initialization files>

b

All global initialization files must be group-owned by root, sys, bin, other system, or the system default.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001760
Vuln IDs: V-11983
Rule IDs: SV-38268r1_rule

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31716r1_fix

Change the group ownership of the global initialization file(s) with incorrect group ownership. # chgrp root <global initialization file>

b

All skeleton files and directories (typically in /etc/skel) must be owned by bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001820
Vuln IDs: V-11984
Rule IDs: SV-38269r1_rule

If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files. Failure to give ownership of sensitive files or utilities to bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31717r1_fix

Change the ownership of skeleton files with incorrect mode. # chown bin <skeleton file>

b

All global initialization files executable search paths must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001840
Vuln IDs: V-11985
Rule IDs: SV-38270r3_rule

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31718r2_fix

Edit the global initialization file(s) with PATH variables containing relative paths and remove any relative path form the PATH variables that have not been documented with the ISSO. Edit the global initialization file(s) and remove any empty entry that is defined.

b

All local initialization files executable search paths must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001900
Vuln IDs: V-11986
Rule IDs: SV-34915r3_rule

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-32917r2_fix

Edit the local initialization file and remove the relative path entries from the PATH variable that have not been documented with the ISSO. Edit the local initialization file and remove any empty entry that is defined.

c

There must be no .rhosts, .shosts, hosts.equiv, or shosts.equiv files on the system.

RMF Control: CM-6
Severity: H
CCI: CCI-000366
Version: GEN002040
Vuln IDs: V-11988
Rule IDs: SV-38249r1_rule

The .rhosts, .shosts, hosts.equiv, and shosts.equiv files are used to configure host-based authentication for individual users or the system. Host-based authentication is not sufficient for preventing unauthorized access to the system.Information Assurance OfficerSystem AdministratorECCD-1, ECCD-2

Fix: F-31760r1_fix

Remove the .rhosts, .shosts, hosts.equiv, and/or shosts.equiv files.

b

The .rhosts file must not be supported in PAM.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN002100
Vuln IDs: V-11989
Rule IDs: SV-38264r2_rule

.rhosts files are used to specify a list of hosts permitted remote access to a particular account without authenticating. The use of such a mechanism defeats strong identification and authentication requirements.Information Assurance OfficerSystem Administrator

Fix: F-31761r1_fix

Edit /etc/pam.conf and comment/remove the "rcomds" line(s).

b

Default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003060
Vuln IDs: V-11995
Rule IDs: SV-38251r1_rule

To centralize the management of privileged account crontabs, of the default system accounts, only root may have a crontab.System AdministratorECPA-1

Fix: F-31812r1_fix

Remove default system accounts (such as bin, sys, adm, or others) from the cron.allow file if it exists, or add those accounts to the cron.deny file.

a

Process core dumps must be disabled unless needed.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN003500
Vuln IDs: V-11996
Rule IDs: SV-35008r1_rule

Process core dumps contain the memory in use by the process when it crashed. Process core dump files can be of significant size and their use can result in file systems filling to capacity, which may result in Denial of Service. Process core dumps can be useful for software debugging. System AdministratorECCD-1, ECCD-2

Fix: F-31839r1_fix

Edit /etc/profile, ensure the ulimit command is present with the -c argument of the ulimit command set to 0.

b

The system must implement non-executable program stacks.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN003540
Vuln IDs: V-11999
Rule IDs: SV-35009r1_rule

A common type of exploit is the stack buffer overflow. An application receives, from an attacker, more data than it is prepared for and stores this information on its stack, writing beyond the space reserved for it. This can be designed to cause execution of the data written on the stack. One mechanism to mitigate this vulnerability is for the system to not allow the execution of instructions in sections of memory identified as part of the stack.System AdministratorECSC-1

Fix: F-31853r1_fix

# kctune executable_stack=0 The system will require a restart/reboot for the setting to take effect.

b

The system must not forward IPv4 source-routed packets.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003600
Vuln IDs: V-12002
Rule IDs: SV-38259r1_rule

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.System AdministratorECSC-1

Fix: F-31855r1_fix

Disable the IP source-routed forwarding feature. # ndd -set /dev/ip ip_forward_src_routed 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = ip NDD_NAME[x] = ip_forward_src_routed NDD_VALUE[x] = 0

a

A separate file system must be used for user home directories (such as /home or equivalent).

RMF Control: SC-32
Severity: L
CCI: CCI-001208
Version: GEN003620
Vuln IDs: V-12003
Rule IDs: SV-35048r1_rule

The use of separate file systems for different paths can protect the system from failures resulting from the / file system becoming full or failing.trueSystem AdministratorECSC-1

Fix: F-31874r1_fix

Migrate the /home (or equivalent) path onto a separate file system.

b

Inetd and xinetd must be disabled or removed if no network services utilizing them are enabled.

RMF Control: CM-2
Severity: M
CCI: CCI-000305
Version: GEN003700
Vuln IDs: V-12005
Rule IDs: SV-35064r1_rule

Unnecessary services should be disabled to decrease the attack surface of the system.System AdministratorECSC-1

Fix: F-31882r1_fix

Remove or disable the inetd startup scripts and kill the service.

b

The SMTP service HELP command must not be enabled.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN004540
Vuln IDs: V-12006
Rule IDs: SV-35059r2_rule

The HELP command should be disabled to mask version information. The version of the SMTP service software could be used by attackers to target vulnerabilities present in specific software versions.System Administrator

Fix: F-11266r3_fix

To disable the SMTP HELP command, remove or empty the Sendmail help file: /etc/mail/helpfile.

b

All FTP users must have a default umask of 077.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005040
Vuln IDs: V-12011
Rule IDs: SV-38263r1_rule

The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask is stored as a 4-digit number, the first digit representing special access modes is typically ignored or required to be zero.System AdministratorECCD-1, ECCD-2

Fix: F-31958r1_fix

Edit the initialization files for the ftp user and set the umask to 077.

b

All .Xauthority files must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005180
Vuln IDs: V-12014
Rule IDs: SV-35162r1_rule

.Xauthority files ensure the user is authorized to access the specific X Windows host. Excessive permissions may permit unauthorized modification of these files, which could lead to Denial of Service to authorized access or allow unauthorized access to be obtained.System AdministratorECLP-1

Fix: F-31965r1_fix

Change the mode of the .Xauthority files. # chmod 0600 .Xauthority

b

The snmpd.conf file must be owned by bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005360
Vuln IDs: V-12019
Rule IDs: SV-35203r1_rule

The snmpd.conf file contains authenticators and must be protected from unauthorized access and modification. If the file is not owned by bin, it may be subject to access and modification from unauthorized users.System AdministratorECLP-1

Fix: F-31981r2_fix

Change the owner of the snmpd.conf file to bin. # chown bin /etc/SnmpAgent.d/snmpd.conf

b

The syslog daemon must not accept remote messages unless it is a syslog server documented using site-defined procedures.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005480
Vuln IDs: V-12021
Rule IDs: SV-35195r1_rule

Unintentionally running a syslog server accepting remote messages puts the system at increased risk. Malicious syslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of Service.System AdministratorECSC-1

Fix: F-31993r1_fix

Edit the /etc/rc.config.d/syslogd configuration startup script and add the -N option to the syslogd command. Restart the syslogd service via the following command(s): # /sbin/init.d/syslogd stop # /sbin/init.d/syslogd start

b

The SSH daemon must be configured for IP filtering.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005540
Vuln IDs: V-12022
Rule IDs: SV-35149r1_rule

The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses.System AdministratorECSC-1

Fix: F-32040r1_fix

Add appropriate IP restrictions for SSH to the /etc/hosts.deny and/or /etc/hosts.allow files.

b

IP forwarding for IPv4 must not be enabled, unless the system is a router.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005600
Vuln IDs: V-12023
Rule IDs: SV-35177r1_rule

If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.System AdministratorECSC-1

Fix: F-32046r1_fix

Edit /etc/rc.config.d/nddconf and set the ip_forwarding option to 0.

b

The system's access control program must be configured to grant or deny system access to specific hosts.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN006620
Vuln IDs: V-12030
Rule IDs: SV-35222r1_rule

If the system's access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.System AdministratorECSC-1

Fix: F-32114r1_fix

Edit the <path>/hosts.allow and <path/hosts.deny files to configure access restrictions.

b

Network analysis tools must not be installed.

RMF Control: CM-2
Severity: M
CCI: CCI-000305
Version: GEN003865
Vuln IDs: V-12049
Rule IDs: SV-35138r2_rule

Network analysis tools allow for the capture of network traffic visible to the system.System Administrator

Fix: F-31909r1_fix

Remove the network analysis tool binary from the system. Consult vendor documentation for removing packaged software, or remove the binary directly via the following example: # rm -i <binary>

b

The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000250
Vuln IDs: V-22294
Rule IDs: SV-38272r1_rule

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not owned by a system account, unauthorized modifications could result in the failure of time synchronization.System AdministratorECLP-1

Fix: F-31497r1_fix

Change the owner of the NTP configuration file. # chown root /etc/ntp.conf

b

The time synchronization configuration file (such as /etc/ntp.conf) must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000251
Vuln IDs: V-22295
Rule IDs: SV-38273r1_rule

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not owned by a system group, unauthorized modifications could result in the failure of time synchronization.System AdministratorECLP-1

Fix: F-31498r1_fix

Change the group-owner of the NTP configuration file. Procedure: # chgrp root /etc/ntp.conf

b

The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN000252
Vuln IDs: V-22296
Rule IDs: SV-38274r1_rule

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not protected, unauthorized modifications could result in the failure of time synchronization.System AdministratorECLP-1

Fix: F-31499r1_fix

Change the mode of the NTP configuration file to 0640 or less permissive. # chmod 0640 /etc/ntp.conf

a

The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.

RMF Control: AC-10
Severity: L
CCI: CCI-000054
Version: GEN000450
Vuln IDs: V-22298
Rule IDs: SV-26319r2_rule

Limiting simultaneous user logins can insulate the system from Denial of Service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions. If the defined value of 10 logins does not meet operational requirements, the site may define the permitted number of simultaneous login sessions based on operational requirements. This limit is for the number of simultaneous login sessions for EACH user account. This is NOT a limit on the total number of simultaneous login sessions on the system.trueSystem AdministratorECSC-1

Fix: F-31517r2_fix

For Trusted Mode: Use the SAM/SMH interface (/etc/default/security file) to update attribute. See the below example: NUMBER_OF_LOGINS_ALLOWED=10 For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update attribute. See the below example: NUMBER_OF_LOGINS_ALLOWED=10 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

a

The system must display the date and time of the last successful account login upon login.

RMF Control: AC-9
Severity: L
CCI: CCI-000052
Version: GEN000452
Vuln IDs: V-22299
Rule IDs: SV-38302r1_rule

Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use. System AdministratorECSC-1

Fix: F-31518r1_fix

Edit the configuration file and modify the PrintLastLog line entry as follows: PrintLastLog yes

b

The system must require passwords contain at least one lowercase alphabetic character.

RMF Control: IA-5
Severity: M
CCI: CCI-000193
Version: GEN000610
Vuln IDs: V-22305
Rule IDs: SV-38304r2_rule

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.System AdministratorIAIA-1, IAIA-2

Fix: F-31549r2_fix

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_LOWER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_LOWER_CASE_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_LOWER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_LOWER_CASE_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

a

The system must restrict the ability to switch to the root user to members of a defined group.

RMF Control: AC-2
Severity: L
CCI: CCI-000009
Version: GEN000850
Vuln IDs: V-22308
Rule IDs: SV-26349r1_rule

Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing the root account, even with knowledge of the root credentials.System AdministratorECLP-1

Fix: F-31552r1_fix

Edit /etc/default/security and uncomment, set, or add the SU_ROOT_GROUP setting with a value of wheel or equivalent. If necessary, create a wheel group and add administrative users to the group.

b

The root account's library search path must be the system default and must contain only absolute paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN000945
Vuln IDs: V-22310
Rule IDs: SV-38307r1_rule

The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. Entries starting with a slash (/) are absolute paths.System AdministratorECSC-1

Fix: F-31554r1_fix

Edit the root user initialization files and remove any definition of LD_LIBRARY_PATH and SHLIB_PATH.

b

The root account's list of preloaded libraries must be empty.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN000950
Vuln IDs: V-22311
Rule IDs: SV-38308r1_rule

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries relative to the current working directory, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with (/) are absolute paths.System AdministratorECSC-1

Fix: F-31555r1_fix

Edit the root user initialization files and remove any definition of LD_PRELOAD.

b

The /etc/resolv.conf file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001362
Vuln IDs: V-22319
Rule IDs: SV-38310r1_rule

The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions such as time synchronization, centralized authentication, and remote system logging. System AdministratorECLP-1

Fix: F-31573r1_fix

As root, change the owner of the /etc/resolv.conf file to root. # chown root /etc/resolv.conf

b

The /etc/resolv.conf file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001363
Vuln IDs: V-22320
Rule IDs: SV-38311r1_rule

The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions such as time synchronization, centralized authentication, and remote system logging.System AdministratorECLP-1

Fix: F-31574r1_fix

Change the group owner of the /etc/resolv.conf file to root, bin, sys, or other. Procedure: # chgrp root /etc/resolv.conf

b

The /etc/resolv.conf file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001364
Vuln IDs: V-22321
Rule IDs: SV-38312r1_rule

The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions such as time synchronization, centralized authentication, and remote system logging.System AdministratorECLP-1

Fix: F-31575r1_fix

Change the mode of the /etc/resolv.conf file to 0644 or less permissive. # chmod 0644 /etc/resolv.conf

b

The /etc/hosts file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001366
Vuln IDs: V-22323
Rule IDs: SV-38313r1_rule

The /etc/hosts file (or equivalent) configures local host name to IP address mappings that typically take precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.System AdministratorECLP-1

Fix: F-31577r1_fix

Change the owner of the /etc/hosts file to root. # chown root /etc/hosts

b

The /etc/hosts file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001367
Vuln IDs: V-22324
Rule IDs: SV-38314r1_rule

The /etc/hosts file (or equivalent) configures local host name to IP address mappings that typically take precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.System AdministratorECLP-1

Fix: F-31578r1_fix

Change the group owner of the /etc/hosts file to root, sys, bin, or other. Procedure: # chgrp root /etc/hosts

b

The /etc/hosts file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001368
Vuln IDs: V-22325
Rule IDs: SV-38315r1_rule

The /etc/hosts file (or equivalent) configures local host name to IP address mappings typically take precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.System AdministratorECLP-1

Fix: F-31579r1_fix

Change the mode of the /etc/hosts file to 0644 or less permissive. # chmod 0644 /etc/hosts

b

The /etc/nsswitch.conf file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001371
Vuln IDs: V-22327
Rule IDs: SV-38316r1_rule

The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.System AdministratorECLP-1

Fix: F-31581r1_fix

Change the owner of the /etc/nsswitch.conf file to root. # chown root /etc/nsswitch.conf

b

The /etc/nsswitch.conf file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001372
Vuln IDs: V-22328
Rule IDs: SV-38317r1_rule

The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.System AdministratorECLP-1

Fix: F-31582r1_fix

Change the group-owner of the /etc/nsswitch.conf file to root, bin, sys, or other. Procedure: # chgrp root /etc/nsswitch.conf

b

The /etc/nsswitch.conf file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001373
Vuln IDs: V-22329
Rule IDs: SV-38319r1_rule

The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.System AdministratorECLP-1

Fix: F-31583r1_fix

Change the mode of the /etc/nsswitch.conf file to 0644 or less permissive. # chmod 0644 /etc/nsswitch.conf

b

The /etc/passwd file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001378
Vuln IDs: V-22332
Rule IDs: SV-38335r1_rule

The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-31602r1_fix

Change the owner of the /etc/passwd file to root. # chown root /etc/passwd

b

The /etc/passwd file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001379
Vuln IDs: V-22333
Rule IDs: SV-38336r1_rule

The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-31603r1_fix

Change the group owner of the /etc/passwd file to root, bin, sys, or other. Procedure: # chgrp root /etc/passwd

b

The /etc/group file must be owned by bin.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001391
Vuln IDs: V-22335
Rule IDs: SV-38337r1_rule

The /etc/group file is critical to system security and must be owned by a privileged user. The group file contains a list of system groups and associated information.System AdministratorECLP-1

Fix: F-31601r1_fix

Change the owner of the /etc/group file to bin. # chown bin /etc/group

b

The /etc/group file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001392
Vuln IDs: V-22336
Rule IDs: SV-38338r1_rule

The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.System AdministratorECLP-1

Fix: F-31652r1_fix

Change the group owner of the /etc/group file. Procedure: # chgrp root /etc/group

b

The /etc/group file must have mode 0444 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001393
Vuln IDs: V-22337
Rule IDs: SV-38339r1_rule

The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.System AdministratorECLP-1

Fix: F-31653r1_fix

Change the mode of the /etc/group file to 0444 or less permissive. # chmod 0444 /etc/group

b

The /etc/shadow file (or equivalent) must be group-owned by root, bin, sys or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001410
Vuln IDs: V-22339
Rule IDs: SV-38340r2_rule

The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. The file also contains password hashes which must not be accessible to users other than root.System AdministratorECLP-1

Fix: F-31655r2_fix

For Trusted Mode: # chgrp root /tcb #chgrp root /tcb/files /tcb/files/auth # chgrp root /tcb/files/auth/[a-z]/* For SMSE: # chgrp root /etc/shadow

b

The /etc/passwd file must not contain password hashes.

RMF Control: IA-5
Severity: M
CCI: CCI-000201
Version: GEN001470
Vuln IDs: V-22347
Rule IDs: SV-38323r2_rule

If password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.System AdministratorECLP-1

Fix: F-31694r2_fix

Migrate /etc/passwd password hashes. For Trusted Mode: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to migrate from a non-SMSE Standard Mode to Trusted Mode. For SMSE Mode: Use the following command to create the shadow file. The command will then copy all encrypted passwords into the shadow file and replace the passwd file password entries with an “x”. # pwconv

b

The /etc/group file must not contain any group password hashes.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001475
Vuln IDs: V-22348
Rule IDs: SV-38341r1_rule

Group passwords are typically shared and should not be used. Additionally, if password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.System AdministratorECLP-1

Fix: F-31696r1_fix

Edit /etc/group and change the password field to include an asterisk (*) as the first character to lock the group password.

b

Run control scripts library search paths must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001605
Vuln IDs: V-22354
Rule IDs: SV-38343r3_rule

The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory.. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31700r2_fix

Edit the run control script and remove any relative or empty path entry from the library search path variable that has not been documented with the ISSO. Edit the run control script and remove any empty entry that is defined.

b

Run control scripts lists of preloaded libraries must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001610
Vuln IDs: V-22355
Rule IDs: SV-38344r3_rule

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries to the current working directory that have not been authorized, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31721r2_fix

Edit the run control script and remove any relative entries from the library preload variables that have not been documented with the ISSO. Edit the run control script and remove any empty entry that is defined.

b

All skeleton files (typically in /etc/skel) must be group-owned by root, bin, sys, system, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN001830
Vuln IDs: V-22358
Rule IDs: SV-38347r1_rule

If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files.System AdministratorECLP-1

Fix: F-31725r1_fix

Change the group owner of the skeleton file to root, bin, sys, or other. # chgrp <group> /etc/skel/<skeleton file>

b

Global initialization files library search paths must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001845
Vuln IDs: V-22359
Rule IDs: SV-38348r3_rule

The library search path environment variable(s) contains a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31727r2_fix

Edit the global initialization file and remove the relative path entries from the library search path variables that have not been documented with the ISSO. Edit the global initialization file and remove any empty entry that is defined.

b

Global initialization files lists of preloaded libraries must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001850
Vuln IDs: V-22360
Rule IDs: SV-38349r3_rule

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries to the current working directory that have not been authorized, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31728r2_fix

Edit the global initialization file and remove the relative path entry from the library preload list variables that have not been documented with the ISSO. Edit the global initialization file(s) and remove any empty entry that is defined for the library preload list.

b

Local initialization files library search paths must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001901
Vuln IDs: V-22363
Rule IDs: SV-38351r3_rule

The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31732r2_fix

Edit the user's local initialization file(s) and remove any relative path entry from the library search LIBRARY_PATH and/or SHLIB_PATH variable(s) that have not been documented with the ISSO. Edit the user’s local initialization file(s) and remove any empty entry that is defined for the “LIBRARY_PATH” and/or “SHLIB_PATH” variable(s).

b

Local initialization files lists of preloaded libraries must contain only authorized paths.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN001902
Vuln IDs: V-22364
Rule IDs: SV-34928r3_rule

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries to the current working directory that have not been authorized, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with a slash (/) are absolute paths.System Administrator

Fix: F-31733r2_fix

Edit the local initialization file and remove any relative/empty path entry from the library LD_PRELOAD variable that has not been documented with the ISSO. Edit the local initialization file and remove any empty entry that is defined for the “LD_PRELOAD” variable.

b

All shell files must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN002210
Vuln IDs: V-22365
Rule IDs: SV-38352r1_rule

If shell files are group-owned by users other than root or a system group, they could be modified by intruders or malicious users to perform unauthorized actions.System AdministratorECLP-1

Fix: F-31734r1_fix

Change the group owner of the shell to root, bin, sys, or other. Procedure: # chgrp root <shell>

a

System audit tool executables must be owned by root.

RMF Control: AU-9
Severity: L
CCI: CCI-001493
Version: GEN002715
Vuln IDs: V-22370
Rule IDs: SV-26506r2_rule

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.System AdministratorECLP-1

Fix: F-31776r2_fix

As root, change the file ownership. # chown root <audit_tool_filename>

a

System audit tool executables must be group-owned by root, bin, sys, or other.

RMF Control: AU-9
Severity: L
CCI: CCI-001493
Version: GEN002716
Vuln IDs: V-22371
Rule IDs: SV-26509r2_rule

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.System AdministratorECLP-1

Fix: F-31777r2_fix

As root, change the file group ownership. # chgrp root <audit_tool_filename>

a

System audit tool executables must have mode 0750 or less permissive.

RMF Control: AU-9
Severity: L
CCI: CCI-001493
Version: GEN002717
Vuln IDs: V-22372
Rule IDs: SV-26512r2_rule

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.System AdministratorECLP-1

Fix: F-31778r2_fix

As root, change the file permissions. # chmod 0750 <audit tool executable>

b

The audit system must alert the SA when the audit storage volume approaches its capacity.

RMF Control: AU-5
Severity: M
CCI: CCI-000143
Version: GEN002730
Vuln IDs: V-22375
Rule IDs: SV-29653r1_rule

An accurate and current audit trail is essential for maintaining a record of system activity. If the system fails, the SA must be notified and must take prompt action to correct the problem. Minimally, the system must log this event and the SA will receive this notification during the daily system log review. If feasible, active alerting (such as e-mail or paging) should be employed consistent with the site’s established operations management systems and procedures.System AdministratorECSC-1

Fix: F-31780r1_fix

Edit the AUDOMON_ARGS parameter of the /etc/rc.config.d/auditing file to include -w 90.

a

The audit system must be configured to audit account creation.

RMF Control: AC-2
Severity: L
CCI: CCI-000018
Version: GEN002750
Vuln IDs: V-22376
Rule IDs: SV-29670r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises, and damages incurred during a system compromise.System AdministratorECAT-1

Fix: F-31782r1_fix

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

a

The audit system must be configured to audit account modification.

RMF Control: AC-2
Severity: L
CCI: CCI-001403
Version: GEN002751
Vuln IDs: V-22377
Rule IDs: SV-29675r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAT-1

Fix: F-31783r1_fix

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

a

The audit system must be configured to audit account disabling.

RMF Control: AC-2
Severity: L
CCI: CCI-001404
Version: GEN002752
Vuln IDs: V-22378
Rule IDs: SV-29676r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAT-1

Fix: F-31784r1_fix

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

a

The audit system must be configured to audit account termination.

RMF Control: AC-2
Severity: L
CCI: CCI-001405
Version: GEN002753
Vuln IDs: V-22382
Rule IDs: SV-29679r1_rule

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.System AdministratorECAT-1

Fix: F-31785r1_fix

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

b

The cron.allow file must be group-owned by root, bin, sys or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003250
Vuln IDs: V-22391
Rule IDs: SV-34991r1_rule

If the group of the cron.allow is not set to root, bin, sys or other, the possibility exists for an unauthorized user to view or edit the list of users permitted to use cron. Unauthorized modification of this file could cause Denial of Service to authorized cron users or provide unauthorized users with the ability to run cron jobs.System AdministratorECLP-1

Fix: F-31818r1_fix

Change the group ownership of the file. # chgrp root /var/adm/cron/cron.allow

b

The at.deny file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003252
Vuln IDs: V-22392
Rule IDs: SV-26557r1_rule

The at daemon control files restrict access to scheduled job manipulation and must be protected. Unauthorized modification of the at.deny file could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.System AdministratorECLP-1

Fix: F-31819r1_fix

Change the mode of the file. # chmod 0600 /var/adm/cron/at.deny

b

The cron.deny file must be group-owned by root, bin, sys or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003270
Vuln IDs: V-22394
Rule IDs: SV-34993r1_rule

Cron daemon control files restrict the scheduling of automated tasks and must be protected. Unauthorized modification of the cron.deny file could result in Denial of Service to authorized cron users or could provide unauthorized users with the ability to run cron jobs.System AdministratorECLP-1

Fix: F-31821r1_fix

Change the group-owner of the cron.deny file. # chgrp root /var/adm/cron/cron.deny

b

The at directory must be group-owned by root, bin, sys or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003430
Vuln IDs: V-22396
Rule IDs: SV-34995r1_rule

If the group of the at directory is not root, bin, sys or other, unauthorized users could be allowed to view or edit files containing sensitive information within the directory. System AdministratorECLP-1

Fix: F-31829r1_fix

Change the group ownership of the file to root, bin, sys or other. # chgrp root /var/spool/cron/atjobs

b

The at.allow file must be group-owned by root, sys, bin or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003470
Vuln IDs: V-22397
Rule IDs: SV-26571r1_rule

If the group-owner of the at.allow file is not set to root, sys, bin or other, unauthorized users could be allowed to view or edit the list of users permitted to run at jobs. Unauthorized modification could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.System AdministratorECLP-1

Fix: F-31835r1_fix

Change the group ownership of the file. # chgrp root /usr/lib/cron/at.allow

b

The at.deny file must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003490
Vuln IDs: V-22398
Rule IDs: SV-26574r1_rule

If the group-owner of the at.deny file is not set to root, bin, sys, other, or cron, unauthorized users could be allowed to view or edit sensitive information contained within the file. Unauthorized modification could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.System AdministratorECLP-1

Fix: F-31838r1_fix

Change the group ownership of the at.deny file to root, bin, sys, or other. # chgrp root /usr/lib/cron/at.deny

a

The kernel core dump data directory must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: L
CCI: CCI-000225
Version: GEN003521
Vuln IDs: V-22405
Rule IDs: SV-26611r1_rule

Kernel core dumps may contain the full contents of system memory at the time of the crash. As the system memory may contain sensitive information, it must be protected accordingly. If the kernel core dump data directory is not group-owned by a system group, the core dumps contained in the directory may be subject to unauthorized access.System AdministratorECLP-1

Fix: F-31849r1_fix

Change the group-owner of the kernel core dump data directory. # chgrp root /var/adm/crash

a

The kernel core dump data directory must have mode 0700 or less permissive.

RMF Control: AC-6
Severity: L
CCI: CCI-000225
Version: GEN003522
Vuln IDs: V-22406
Rule IDs: SV-26615r1_rule

Kernel core dumps may contain the full contents of system memory at the time of the crash. As the system memory may contain sensitive information, it must be protected accordingly. If the mode of the kernel core dump data directory is more permissive than 0700, unauthorized users may be able to view or to modify kernel core dump data files.System AdministratorECLP-1

Fix: F-31850r1_fix

Change the group-owner of the kernel core dump data directory. # chmod 0700 /var/adm/crash

a

The system must not process Internet Control Message Protocol (ICMP) timestamp requests.

RMF Control: AC-4
Severity: L
CCI: CCI-001551
Version: GEN003602
Vuln IDs: V-22409
Rule IDs: SV-35022r1_rule

The processing of ICMP timestamp requests increases the attack surface of the system.System AdministratorECSC-1

Fix: F-31859r1_fix

Disable ICMP Timestamp responses on the system. # ndd -set /dev/ip ip_respond_to_timestamp 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_timestamp NDD_VALUE[x]=0

b

The system must not respond to ICMPv4 echoes sent to a broadcast address.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003603
Vuln IDs: V-22410
Rule IDs: SV-35025r1_rule

Responding to broadcast Internet Control Message Protocol (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.System AdministratorECSC-1

Fix: F-31860r1_fix

Configure the system to not respond to ICMP ECHO_REQUESTs sent to broadcast addresses. # ndd -set /dev/ip ip_respond_to_echo_broadcast 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_echo_broadcast NDD_VALUE[x]=0

b

The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003604
Vuln IDs: V-22411
Rule IDs: SV-35026r1_rule

The processing of ICMP timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.System AdministratorECSC-1

Fix: F-31861r1_fix

Configure the system to not respond to ICMP timestamp requests sent to broadcast addresses. # ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_timestamp_broadcast NDD_VALUE[x]=0

b

The system must not apply reversed source routing to TCP responses.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003605
Vuln IDs: V-22412
Rule IDs: SV-35028r1_rule

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. System AdministratorECSC-1

Fix: F-31862r1_fix

Disable the IP source-routed forwarding feature. # ndd -set /dev/ip ip_forward_src_routed 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = ip NDD_NAME[x] = ip_forward_src_routed NDD_VALUE[x] = 0

b

The system must prevent local applications from generating source-routed packets.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003606
Vuln IDs: V-22413
Rule IDs: SV-29707r2_rule

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.System Administrator

Fix: F-31866r2_fix

Edit /etc/opt/ipf/ipf.conf and add rules to block outgoing source-routed packets, such as: block out log quick [all] | [from any to any] with opt lsrr block out log quick [all] | [from any to any] with opt ssrr Reload the IPF rules: # ipf -Fa -A -f /etc/opt/ipf/ipf.conf

b

The system must not accept source-routed IPv4 packets.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003607
Vuln IDs: V-22414
Rule IDs: SV-29713r2_rule

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the handling of source-routed traffic destined to the system itself, not to traffic forwarded by the system to another, such as when IPv4 forwarding is enabled and the system is functioning as a router.System Administrator

Fix: F-31869r2_fix

Edit /etc/opt/ipf/ipf.conf and add rules to block incoming source-routed packets, such as: block in log quick [all] | [from any to any] with opt lsrr block in log quick [all] | [from any to any] with opt ssrr Reload the IPF rules. # ipf -Fa -A -f /etc/opt/ipf/ipf.conf

b

The system must ignore IPv4 ICMP redirect messages.

RMF Control: CM-6
Severity: M
CCI: CCI-001503
Version: GEN003609
Vuln IDs: V-22416
Rule IDs: SV-29719r1_rule

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.System AdministratorECSC-1

Fix: F-31870r1_fix

Edit /etc/opt/ipf/ipf.conf and add rules to block incoming IPv4 ICMP redirect messages, such as: block in quick proto icmp from any to any icmp-type redir Reload the IPF rules. Flush the rules from your ruleset using the -Fa option. The -A option specifies the active rules list. The -f option specifies the rules configuration file to be used: # ipf -Fa -A -f /etc/opt/ipf/ipf.conf

b

The system must not send IPv4 ICMP redirects.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN003610
Vuln IDs: V-22417
Rule IDs: SV-35038r1_rule

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.System AdministratorECSC-1

Fix: F-31865r1_fix

Configure the system to not send IPv4 ICMP redirect messages. # ndd -set /dev/ip ip_send_redirects 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_send_redirects NDD_VALUE[x]=0

b

The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003730
Vuln IDs: V-22423
Rule IDs: SV-35069r1_rule

Failure to give ownership of sensitive files or utilities to system groups may provide unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31884r1_fix

Change the group ownership of the inetd configuration file. # chgrp root <file or directory>

b

The xinetd.d directory must have mode 0755 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003750
Vuln IDs: V-22425
Rule IDs: SV-35074r1_rule

The Internet service daemon configuration files must be protected as malicious modification could cause Denial of Service or increase the attack surface of the system.System AdministratorECLP-1

Fix: F-31888r1_fix

Change the mode of included xinetd configuration directories to 0755. # chmod 0755 <directory>

b

The services file must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003770
Vuln IDs: V-22427
Rule IDs: SV-35080r1_rule

Failure to give ownership of system configuration files to root or a system group provides the designated owner and unauthorized users with the potential to change the system configuration which could weaken the system's security posture.System AdministratorECLP-1

Fix: F-31893r1_fix

Change the group-owner of the services file. Procedure: # chgrp root /etc/services

b

The remshd service must not be installed.

RMF Control: CM-2
Severity: M
CCI: CCI-000305
Version: GEN003825
Vuln IDs: V-22431
Rule IDs: SV-35129r1_rule

The remshd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.System AdministratorDCPP-1

Fix: F-31900r1_fix

Uninstall the remshd service from the system. # cat /etc/inetd.conf | grep -n remshd Edit the /etc/inetd.conf file and comment the line entry for remshd, then reconfigure inetd via: # inetd -c

b

The rlogind service must not be running.

RMF Control: AC-17
Severity: M
CCI: CCI-000068
Version: GEN003830
Vuln IDs: V-22432
Rule IDs: SV-29697r1_rule

The rlogind process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.System AdministratorDCPP-1

Fix: F-31902r1_fix

Edit /etc/inetd.conf and comment out the rlogind service. Restart the inetd service via the following command: # inetd -c

b

The hosts.lpd (or equivalent) file must be group-owned by root, bin, sys, or system.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN003930
Vuln IDs: V-22435
Rule IDs: SV-35144r1_rule

Failure to give group-ownership of the hosts.lpd file to root, bin, sys, or system provides the members of the owning group and possible unauthorized users, with the potential to modify the hosts.lpd file. Unauthorized modifications could disrupt access to local printers from authorized remote hosts or permit unauthorized remote access to local printers.System AdministratorECLP-1

Fix: F-31913r1_fix

Change the group-owner of the hosts.lpd (or equivalent) file(s). # chgrp root /etc/hosts.lpd

b

The aliases file must be group-owned by root, sys, bin, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004370
Vuln IDs: V-22438
Rule IDs: SV-35163r1_rule

If the alias file is not group-owned by root, bin, sys or other, an unauthorized user may modify the file to add aliases to run malicious code or redirect e-mail.System AdministratorECLP-1

Fix: F-31924r1_fix

Change the group-owner of the /etc/mail/aliases file. # chgrp root /etc/mail/aliases

b

Files executed through a mail aliases file must be group-owned by root, bin, sys, or other, and must reside within a directory group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004410
Vuln IDs: V-22440
Rule IDs: SV-38373r1_rule

If a file executed through a mail aliases file is not group-owned by root or a system group, it may be subject to unauthorized modification. Unauthorized modification of files executed through aliases may allow unauthorized users to attain root privileges.System AdministratorECLP-1

Fix: F-31929r1_fix

Change the group ownership of the file referenced from /etc/mail/aliases. # chgrp root <file referenced from aliases>

b

The ftpusers file must be group-owned by root, bin, sys or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN004930
Vuln IDs: V-22444
Rule IDs: SV-35104r1_rule

If the ftpusers file is not group-owned by root or a system group, an unauthorized user may modify the file to allow unauthorized accounts to use FTP.System AdministratorECLP-1

Fix: F-31953r1_fix

Change the group owner of the ftpusers file. # chgrp root /etc/ftpd/ftpusers

b

The snmpd.conf file must be group-owned by root, sys, bin or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005365
Vuln IDs: V-22451
Rule IDs: SV-26734r1_rule

The snmpd.conf file contains authenticators and must be protected from unauthorized access and modification. If the file is not group-owned by root or a system group, it may be subject to access and modification from unauthorized users.System AdministratorECLP-1

Fix: F-31982r1_fix

Change the group ownership of the SNMP configuration file. # chgrp root /etc/SnmpAgent.d/snmpd.conf

b

The /etc/syslog.conf file must have mode 0640 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005390
Vuln IDs: V-22453
Rule IDs: SV-38376r1_rule

Unauthorized users must not be allowed to access or modify the /etc/syslog.conf file.System AdministratorECLP-1

Fix: F-31985r1_fix

Change the permissions of the syslog configuration file. # chmod 0640 /etc/syslog.conf

b

The system must use a remote syslog server (loghost).

RMF Control: AU-3
Severity: M
CCI: CCI-000136
Version: GEN005450
Vuln IDs: V-22455
Rule IDs: SV-35189r1_rule

A syslog server (loghost) receives syslog messages from one or more systems. This data can be used as an authoritative log source in the event a system is compromised and its local logs are suspect.System AdministratorECAT-1

Fix: F-31991r1_fix

Edit the syslog configuration file and add an appropriate remote syslog server.

b

The SSH client must be configured to only use FIPS 140-2 approved ciphers.

RMF Control: AC-17
Severity: M
CCI: CCI-000068
Version: GEN005510
Vuln IDs: V-22461
Rule IDs: SV-35188r1_rule

DoD information systems are required to use FIPS 140-2 approved ciphers. SSHv2 ciphers meeting this requirement are 3DES and AES.System AdministratorDCNR-1

Fix: F-32007r1_fix

Edit the configuration file and remove any ciphers that do not meet the following: 3des-ctr or aes-NNN-ctr (NNN=128, 192 or 256). If necessary, add the Ciphers entry with one or more of the above keyword values.

b

The SSH client must be configured to not use Cipher-Block Chaining (CBC) based ciphers.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005511
Vuln IDs: V-22462
Rule IDs: SV-35193r1_rule

The CBC mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plaintext attacks and must not be used.System AdministratorECSC-1

Fix: F-32008r1_fix

Edit the configuration file and remove any ciphers other than those with the "aes" prefix and the "-ctr" suffix.

b

The SSH client must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

RMF Control: AC-17
Severity: M
CCI: CCI-001453
Version: GEN005512
Vuln IDs: V-22463
Rule IDs: SV-35210r3_rule

DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.System Administrator

Fix: F-32009r2_fix

Edit the SSH client configuration and remove any MACs that are not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list. If necessary, add a MACs line.

b

The SSH daemon must restrict login ability to specific users and/or groups.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005521
Vuln IDs: V-22470
Rule IDs: SV-35052r1_rule

Restricting SSH logins to a limited group of users, such as system administrators, prevents password guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access.System AdministratorECLP-1

Fix: F-30228r1_fix

Edit the SSH daemon configuration and add the appropriate keyword directive(s) and space-separated user/group names. The keyword order of precedence is as follows: DenyUsers, AllowUsers, DenyGroups, AllowGroups

b

The SSH public host key files must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005522
Vuln IDs: V-22471
Rule IDs: SV-35060r1_rule

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.System AdministratorECLP-1

Fix: F-30234r1_fix

Change the permissions for the SSH public host key files. # chmod 0644 /opt/ssh/etc/*key.pub

b

The SSH private host key files must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005523
Vuln IDs: V-22472
Rule IDs: SV-35063r1_rule

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.System AdministratorECLP-1

Fix: F-30236r1_fix

Change the permissions for the SSH private host key files. # chmod 0600 /opt/ssh/etc/*key

a

The SSH daemon must not permit GSSAPI authentication unless needed.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN005524
Vuln IDs: V-22473
Rule IDs: SV-35066r1_rule

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.System AdministratorECSC-1

Fix: F-30238r1_fix

Edit the SSH daemon configuration and delete the keyword entry or modify the entry as follows: GSSAPIAuthentication no

a

The SSH client must not permit GSSAPI authentication unless needed.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN005525
Vuln IDs: V-22474
Rule IDs: SV-35068r1_rule

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.System AdministratorECSC-1

Fix: F-30241r1_fix

Edit the configuration file and set/add (if necessary) the GSSAPIAuthentication directive set to no.

a

The SSH daemon must not permit Kerberos authentication unless needed.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN005526
Vuln IDs: V-22475
Rule IDs: SV-35075r1_rule

Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability. System AdministratorECSC-1

Fix: F-30245r1_fix

Edit the SSH daemon configuration and set (add if necessary) a KerberosAuthentication directive set to no.

b

The SSH daemon must perform strict mode checking of home directory configuration files.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005536
Vuln IDs: V-22485
Rule IDs: SV-35137r1_rule

If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.System AdministratorECLP-1

Fix: F-30289r1_fix

Edit the SSH daemon configuration and add or edit the StrictModes setting value to yes.

b

The SSH daemon must use privilege separation.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005537
Vuln IDs: V-22486
Rule IDs: SV-35139r1_rule

SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.System AdministratorECLP-1

Fix: F-30291r1_fix

Edit the SSH daemon configuration and add or edit the UsePrivilegeSeparation setting value to yes.

b

The SSH daemon must not allow rhosts RSA authentication.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005538
Vuln IDs: V-22487
Rule IDs: SV-35142r1_rule

If SSH permits rhosts RSA authentication, a user may be able to login based on the keys of the host originating the request and not any user-specific authentication..System AdministratorECSC-1

Fix: F-30293r1_fix

Edit the SSH daemon configuration and add or edit the RhostsRSAAuthentication setting value to no. Note that the above guidance applies exclusively to Protocol(s) 1/1,2/2,1 only. If using Protocol 2 only, the check is not applicable and further action is not required.

b

The SSH daemon must not allow compression or must only allow compression after successful authentication.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005539
Vuln IDs: V-22488
Rule IDs: SV-35146r1_rule

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.System AdministratorECSC-1

Fix: F-30297r1_fix

Edit the SSH daemon configuration and add or edit the Compression setting value to no or delayed.

b

The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN005610
Vuln IDs: V-22491
Rule IDs: SV-26811r1_rule

If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.System AdministratorECSC-1

Fix: F-24054r1_fix

Disable IPv6 forwarding: # ndd -set /dev/ip6 ip6_forwarding 0 Edit /etc/rc.config.d/nddconf: TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_forwarding NDD_VALUE[index]=0 Where: index is the next available integer value of the nddconf file. n is a number: either 1 to turn the feature ON or 0 to turn it OFF.

b

All Network File System (NFS) shared system files and system directories must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN005810
Vuln IDs: V-22496
Rule IDs: SV-35196r2_rule

Failure to give group-ownership of sensitive files or directories to root provides the members of the owning group with the potential to access sensitive information or change system configuration which could weaken the system's security posture.System Administrator

Fix: F-30332r2_fix

Change the group owner of the share directory. # chgrp (root|bin|sys|other) <exported directory>

b

Samba must be configured to use an authentication mechanism other than share.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN006225
Vuln IDs: V-22499
Rule IDs: SV-35109r1_rule

Samba share authentication does not provide for individual user identification and must not be used.System AdministratorECSC-1

Fix: F-32081r1_fix

Edit the /etc/smb.conf file and change the security setting to user or another valid setting other than share, for example: security = user

b

Samba must be configured to use encrypted passwords.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN006230
Vuln IDs: V-22500
Rule IDs: SV-35111r1_rule

Samba must be configured to protect authenticators. If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file.System AdministratorIAIA-1, IAIA-2

Fix: F-32083r1_fix

Edit the /etc/opt/samba/smb.conf file and change the encrypt passwords setting to yes, for example: encrypt passwords = yes

b

Samba must be configured to not allow guest access to shares.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN006235
Vuln IDs: V-22501
Rule IDs: SV-35112r1_rule

Guest access to shares permits anonymous access and is not permitted.System AdministratorECSC-1

Fix: F-32084r1_fix

Edit the /etc/opt/samba/smb.conf file and change the guest ok setting to no, for example: guest ok = no

b

The Stream Control Transmission Protocol (SCTP) must be disabled unless required.

RMF Control: CM-7
Severity: M
CCI: CCI-000382
Version: GEN007020
Vuln IDs: V-22511
Rule IDs: SV-29988r1_rule

The SCTP is an IETF-standardized transport layer protocol. This protocol is not yet widely used. Binding this protocol to the network stack increases the attack surface of the host. Unprivileged local processes may be able to cause the kernel to dynamically load a protocol handler by opening a socket using the protocol.System AdministratorECSC-1

Fix: F-30357r1_fix

Configure the system to prevent the dynamic loading of the SCTP protocol handler. Preview the removal of SCTP: # swremove -p <SCTP software product> Remove: # swremove <SCTP software product>

b

The system must not have IP tunnels configured.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN007820
Vuln IDs: V-22547
Rule IDs: SV-26928r1_rule

IP tunneling mechanisms can be used to bypass network filtering.System AdministratorECSC-1

Fix: F-24172r1_fix

Edit the /etc/rc.config.d/netconf* files and remove the tunnel configurations.

b

The DHCP client must be disabled if not needed.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN007840
Vuln IDs: V-22548
Rule IDs: SV-26932r1_rule

DHCP allows for the unauthenticated configuration of network parameters on the system by exchanging information with a DHCP server.System AdministratorECSC-1

Fix: F-24175r1_fix

Disable the DHCP client configuration. Edit /etc/rc.config.d/netconf and set the DHCP_ENABLE setting to 0.

b

The system must ignore IPv6 Internet Control Message Protocol (ICMP ) redirect messages.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN007860
Vuln IDs: V-22550
Rule IDs: SV-35241r1_rule

ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.System AdministratorECSC-1

Fix: F-30359r1_fix

Add an IPF rule to block inbound IPv6 ICMP redirect packets. Edit /etc/opt/ipf/ipf6.conf and add a rule such as: block in quick proto icmpv6 from any to any icmpv6-type 137 Reload the IPF rules. # ipf -6 -Fa -A -f /etc/opt/ipf/ipf6.conf

b

The system must not send IPv6 ICMP redirects.

RMF Control: AC-4
Severity: M
CCI: CCI-001551
Version: GEN007880
Vuln IDs: V-22551
Rule IDs: SV-26939r1_rule

ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.System AdministratorECSC-1

Fix: F-24184r1_fix

Configure the system to not send IPv6 ICMP redirect messages. # ndd -set /dev/ip6 ip6_send_redirects 0 Edit /etc/rc.config.d/nddconf: TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_send_redirects NDD_VALUE[index]=0 Where: index is the next available integer value of the nddconf file. n is a number: either 1 to turn the feature ON or 0 to turn it OFF.

b

If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate and this certificate has a valid trust path to a trusted CA.

RMF Control: IA-5
Severity: M
CCI: CCI-000185
Version: GEN008020
Vuln IDs: V-22557
Rule IDs: SV-38381r1_rule

The NSS LDAP service provides user mappings which are a vital component of system security. Communication between an LDAP server and a host using LDAP for NSS require authentication.System AdministratorDCNR-1

Fix: F-32145r1_fix

Edit /etc/opt/ldapux/ldapux_client.conf and set # Perform the CERT check peer_cert_policy=CERT OR # Perform the CERT check PLUS peer_cert_policy=CNCERT

b

If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008140
Vuln IDs: V-22563
Rule IDs: SV-38386r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32152r1_fix

Change the ownership of the file and/or directory. # chown root <directory> # chown root <directory>/<file>

b

If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008160
Vuln IDs: V-22564
Rule IDs: SV-38387r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32153r1_fix

Change the group ownership of LDAP client certificate directory/files to root, bin, sys, or other. # chgrp root <directory> # chgrp root <directory>/<file>

b

If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must have mode 0644 (0755 for directories) or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008180
Vuln IDs: V-22565
Rule IDs: SV-38388r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32154r1_fix

Change the mode of the file and/or directory. # chmod 0755 <directory> # chmod 0644 <directory>/<file>

b

For systems using NSS LDAP, the TLS certificate file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008220
Vuln IDs: V-22567
Rule IDs: SV-38390r1_rule

The NSS LDAP service provides user mappings which are a vital component of system security. Its configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32157r1_fix

Change the ownership of the file. # chown root <certfile>

b

If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008240
Vuln IDs: V-22568
Rule IDs: SV-38391r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32158r1_fix

Change the group ownership of the LDAP client certificate file. # chgrp root <cert file>

b

If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must have mode 0644 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008260
Vuln IDs: V-22569
Rule IDs: SV-38392r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32159r1_fix

Change the permissions of the LDAP client certificate file. # chmod 0644 <cert file>

b

If the system is using LDAP for authentication or account information, the LDAP TLS key file must be owned by root.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008300
Vuln IDs: V-22571
Rule IDs: SV-38394r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32161r1_fix

Change the ownership of the file. # chown root <key file>

b

If the system is using LDAP for authentication or account information, the LDAP TLS key file must be group-owned by root, bin, sys, or other.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008320
Vuln IDs: V-22572
Rule IDs: SV-38395r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.System AdministratorECLP-1

Fix: F-32162r1_fix

Change the group owner of the LDAP client key file. # chgrp root <key file>

b

If the system is using LDAP for authentication or account information, the LDAP TLS key file must have mode 0600 or less permissive.

RMF Control: AC-6
Severity: M
CCI: CCI-000225
Version: GEN008340
Vuln IDs: V-22573
Rule IDs: SV-38396r1_rule

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification. NOTE: Depending on the particular implementation, group and other read permission may be necessary for unprivileged users to successfully resolve account information using LDAP. This will still be a finding, as these permissions provide users with access to system authenticators. System AdministratorECLP-1

Fix: F-32163r1_fix

Change the mode of the file. # chmod 0600 <key file>

a

Automated file system mounting tools must not be enabled unless needed.

RMF Control: CM-6
Severity: L
CCI: CCI-000366
Version: GEN008440
Vuln IDs: V-22577
Rule IDs: SV-38377r1_rule

Automated file system mounting tools may provide unprivileged users with the ability to access local media and network shares. If this access is not necessary for the system’s operation, it must be disabled to reduce the risk of unauthorized access to these resources.System AdministratorECSC-1

Fix: F-32167r1_fix

Stop and disable the autofs service. Edit /etc/rc.config.d/nfsconf and set the AUTOFS setting to 0. Restart the nfs.client service. # /usr/sbin/init.d/nfs.client stop # /usr/sbin/init.d/nfs.client start

b

The system must employ a local firewall.

RMF Control: SC-7
Severity: M
CCI: CCI-001118
Version: GEN008520
Vuln IDs: V-22582
Rule IDs: SV-38403r1_rule

A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.System AdministratorECSC-1

Fix: F-32171r1_fix

Set IPF_START=1 in /etc/rc.config.d/ipfconf. Refresh/restart. # /sbin/init.d/ipfboot start

a

The system package management tool must not automatically obtain updates.

RMF Control: SI-2
Severity: L
CCI: CCI-001233
Version: GEN008820
Vuln IDs: V-22589
Rule IDs: SV-38405r1_rule

System package management tools can obtain a list of updates and patches from a package repository and make this information available to the SA for review and action. Using a package repository outside of the organization's control presents a risk that malicious packages could be introduced.System AdministratorECSC-1

Fix: F-32179r1_fix

Configure the system package management tool to not automatically obtain updates.

b

The FTPS/FTP service on the system must be configured with the Department of Defense (DoD) login banner.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: GEN000410
Vuln IDs: V-23732
Rule IDs: SV-38407r1_rule

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. NOTE: SFTP and FTPS are encrypted alternatives to FTP that should be used in place of FTP. SFTP is implemented by the SSH service and uses its banner configuration. System AdministratorECWM-1

Fix: F-31524r1_fix

Edit /etc/inetd.conf and add the -a /etc/ftpd/ftpaccess option to the ftp line, if it is not present. If the /etc/ftpd/ftpaccess does not exist, create it by copying the example configuration file. Edit the ftpaccess file and add or set the banner setting to a banner file, such as /etc/ftpd/banner_msg. Create the banner file and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."

a

The system must use a separate file system for /var.

RMF Control: SC-32
Severity: L
CCI: CCI-001208
Version: GEN003621
Vuln IDs: V-23736
Rule IDs: SV-35050r1_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.System AdministratorECSC-1

Fix: F-30227r1_fix

Migrate the /var path onto a separate file system.

a

The system must use a separate file system for the system audit data path..

RMF Control: SC-32
Severity: L
CCI: CCI-001208
Version: GEN003623
Vuln IDs: V-23738
Rule IDs: SV-35054r1_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.System AdministratorECSC-1

Fix: F-30229r2_fix

Migrate the audit log path onto a separate filesystem. The following assumes that /var exists and that the new audit log mount point will be /var/.audit. Verify if auditing is running: # ps -ef | grep audomon | grep -v grep If auditing is running, issue the stop command: # /sbin/init.d/auditing stop Use SAM/SMH to: - Create a new Logical Volume (size to be determined based on local site requirements). - Create a VxFS file system on the new logical volume, paying special attention to site requirements such as Access Permissions, Allocation Policies, Mirroring considerations, large/no-large files and mount options such as suid/nosuid and ro/rw. Verify the /etc/fstab /var/.audit entry # more /etc/fstab Verify the current mounts: # mount Mount /var/.audit if not yet mounted: # mount -a Re-start the auditing subsystem: # /sbin/init.d/auditing start Verify that auditing is now running: # ps -ef | grep audomon | grep -v grep

a

The system must use a separate file system for /tmp (or equivalent).

RMF Control: SC-32
Severity: L
CCI: CCI-001208
Version: GEN003624
Vuln IDs: V-23739
Rule IDs: SV-35055r1_rule

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.System AdministratorECSC-1

Fix: F-30230r1_fix

Migrate the /tmp path onto a separate file system.

b

TCP backlog queue sizes must be set appropriately.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN003601
Vuln IDs: V-23741
Rule IDs: SV-29690r1_rule

To provide some mitigation to TCP Denial of Service (DoS) attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.System AdministratorECSC-1

Fix: F-26884r1_fix

Set the tcp_syn_rcvd_max parameter to 1280. # ndd -set /dev/tcp tcp_syn_rcvd_max 1280 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = tcp NDD_NAME[x] = tcp_syn_rcvd_max NDD_VALUE[x] = 1280

b

The system must not respond to ICMPv6 echo requests sent to a broadcast address.

RMF Control: CM-6
Severity: M
CCI: CCI-000366
Version: GEN007950
Vuln IDs: V-23972
Rule IDs: SV-29786r1_rule

Responding to broadcast ICMP echo requests facilitates network mapping and provides a vector for amplification attacks.System AdministratorECSC-1

Fix: F-32141r1_fix

Add an IPF rule to block inbound IPv6 ICMP ECHO_REQUEST packets sent to the all-hosts multicast address. Edit /etc/opt/ipf/ipf6.conf and add a rule such as: block in quick proto icmpv6 from any to ff02::1 icmpv6-type 128 Reload the IPF rules. # ipf -6 -Fa -A -f /etc/opt/ipf/ipf6.conf

b

The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts.

RMF Control: AC-8
Severity: M
CCI: CCI-000048
Version: GEN000402
Vuln IDs: V-24331
Rule IDs: SV-38411r1_rule

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. This requirement applies to graphical desktop environments provided by the system to locally attached displays and input devices as well as to graphical desktop environments provided to remote systems, including thin clients.System AdministratorECWM-1

Fix: F-31526r1_fix

Configure the system to display one of the DoD login banners (based on the character limitations imposed by the system) prior to, or as part of, the graphical desktop environment login process. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."

b

If the system is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.

RMF Control: IA-5
Severity: M
CCI: CCI-000196
Version: GEN008050
Vuln IDs: V-24384
Rule IDs: SV-38414r1_rule

The authentication of automated LDAP connections between systems must not use passwords since more secure methods are available, such as PKI and Kerberos. Additionally, the storage of unencrypted passwords on the system is not permitted.System AdministratorIAIA-1, IAIA-2

Fix: F-32147r1_fix

Consult vendor documentation for the procedures for configuring LDAP for authentication and account information. Remove any passwords from unencrypted LDAP configuration files.

c

The telnet daemon must not be running.

RMF Control: IA-5
Severity: H
CCI: CCI-000197
Version: GEN003850
Vuln IDs: V-24386
Rule IDs: SV-35134r1_rule

The telnet daemon provides a typically unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised.GEN003850If an enabled telnet daemon is configured to only allow encrypted sessions, such as with Kerberos or the use of encrypted network tunnels, the risk of exposing sensitive information is mitigated, and this is not a finding.System AdministratorDCPP-1

Fix: F-30286r1_fix

Consult vendor documentation to determine the procedure to disable the telnet daemon. If the system uses inetd, edit /etc/inetd.conf and comment out the telnetd line. Restart the inetd service via the following command: # inetd -c