Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
Check if the system requires a password when booted into single user mode. If it does not, this is a finding.
Configure the system to require a password upon booting into single user mode.
Use the last command to check for multiple accesses to an account from different workstations/IP addresses. If users log directly onto accounts, rather than using the su command from their own named account to access them, this is a finding (such as logging directly on to Oracle). Also, ask the SA or the IAO if shared accounts are logged into directly or if users log on to an individual account and switch user to the shared account.
Use the switch user (su) command from a named account login to access shared accounts. Maintain audit trails that identify the actual user of the account name. Document requirements and procedures for users/administrators to log into their own accounts first and then switch user (su) to the shared account.
Obtain a list of system accounts and check the list for any duplicate user names. If duplicates user names are found, this is a finding.
Change user account names, or delete accounts, so each account has a unique name.
List any duplicate UIDs in /etc/passwd: # cut -d':' -f3 /etc/passwd | uniq -d This will show one copy of each duplicate UID.
Edit user accounts to provide unique UIDs for each account.
Access the system console and make a logon attempt. Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. " OR "I've read & consent to terms in IS user agreem't."
Configure the system to display one of the DoD login banners (based on the character limitations imposed by the system) prior to any local login attempt. DoD Login Banners: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. OR I've read & consent to terms in IS user agreem't.
Attempt to log on with a valid user id and incorrect password three times. If the system does not lock the account, requiring an SA to unlock it, this is a finding.
Configure the system to lock accounts after three unsuccessful login attempts.
Attempt to log on to the system with an invalid user account name and an incorrect password. If the system does not pause for at least 4 seconds before displaying another logon prompt, this is a finding.
Configure the system to delay at least 4 seconds between login prompts following a failed login attempt.
If there is an application running on the system continuously in use (such as a network monitoring application), ask the SA what the name of the application is. Execute the following to determine which user owns the process(es) associated with the application. If the owner is root, this is a finding. # ps -ef | more
Configure the system so the owner of a session requiring a continuous screen display, such as a network management display, is not root. Ensure the display is also located in a secure, controlled access area. Document and justify this requirement. Ensure the terminal and keyboard for the display (or workstation) are secure from all but authorized personnel by maintaining them in a secure area, in a locked cabinet where a swipe card, or other positive forms of identification, must be used to gain entry.
Check the system's accounts for blank passwords. If any are found, this is a finding.
Remove, lock, or configure a password for any account with a blank password.
Check the system for duplicate UID 0 assignments by listing all accounts assigned UID 0. Procedure: # grep ":0:" /etc/passwd | awk -F":" '{print$1":"$3":"}' | grep ":0:" If any accounts other than root are assigned UID 0, this is a finding.
Remove or change the UID of accounts other than root that have UID 0.
Determine if root is assigned a home directory other than / by listing its home directory. Procedure: # grep "^root" /etc/passwd | awk -F":" '{print $6}' If the root user home directory is /, this is a finding.
The root home directory should be something other than / (such as /rootdir). Procedure: # mkdir /rootdir # chown root /rootdir # chgrp root /rootdir # chmod 700 /rootdir # cp -r /.??* /rootdir Edit the passwd file and change the root home directory to /rootdir. The cp -r /.??* command copies all files and subdirectories of file names beginning with "." into the new root directory, which preserves the previous root environment. The cp command must be executed from the / directory.
Check the mode of the root home directory. Procedure: # grep "^root" /etc/passwd | awk -F":" '{print $6}' # ls -ld <root home directory> If the mode of the directory is not equal to 0700, this is a finding. If the home directory is /, this is not applicable.
The root home directory will have permissions of 0700. Do not change the protections of the / directory. Use the following command to change protections for the root home directory. # chmod 0700 /rootdir.
To view the root user's PATH, log in as the root user, and execute the following. # env | grep PATH This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/) or other than "$PATH", it is a relative path and this is a finding. If directories beyond those in the vendor's default root path are present, this is a finding.
Edit the root user's local initialization files. Change any found PATH variable settings to the vendor's default path for the root user. Remove any empty path entries or references to relative paths.
Check for world-writable permissions on all directories in the root user's executable search path. Procedure: # ls -ld `echo $PATH | sed "s/:/ /g"` If any of the directories in the PATH variable are world-writable, this is a finding.
For each world-writable path in root's executable search path, perform one of the following. 1. Remove the world-writable permission on the directory. Procedure: # chmod o-w <path> 2. Remove the world-writable directory from the executable search path. Procedure: Identify and edit the initialization file referencing the world-writable directory and remove it from the PATH variable.
Verify the system only allows root account logins from the system console.
Configure the system to only allow root logins from the system console.
# more /etc/passwd Confirm all accounts with a GID of 99 and below (499 and below for Linux) are used by a system account. If a GID reserved for system accounts, 0 - 99 (0 - 499 for Linux), is used by a non-system account, this is a finding.
Change the primary group GID numbers for non-system accounts with reserved primary group GIDs (those less or equal to 99 in general, or 499 for Linux).
List the primary group GIDs for all user accounts on the system. If these GIDs do not correspond to any groups defined on the system, this is a finding.
Add a group to the system for each GID referenced without a corresponding group.
Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. Determine if the application is loaded on the system. Procedure: # find / -name <daemon name> -print Determine if the application is active on the system. Procedure: # ps -ef | grep <daemon name> If no host-based intrusion detection system is installed on the system, this is a finding.
Install a host-based intrusion detection tool.
Check system directories for uneven file permissions. Procedure: # ls -lL /etc /bin /usr/bin /usr/lbin /usr/ucb /sbin /usr/sbin Uneven file permissions exist if the file owner has less permissions than the group or other user classes. If any of the files in the above listed directories contain uneven file permissions, this is a finding.
Change the mode of files with uneven permissions so owners do not have less permission than group or world users.
Check the system for files with no assigned owner. Procedure: # find / -nouser -print If any files have no assigned owner, this is a finding.
All directories and files (executable and data) will have an identifiable owner and group name. Either trace files to an authorized user, change the file's owner to root, or delete them. Determine the legitimate owner of the files and use the chown command to set the owner and group to the correct value. If the legitimate owner cannot be determined, change the owner to root (but make sure none of the changed files remain executable because they could be Trojan horses or other malicious code). Examine the files to determine their origin and the reason for their lack of an owner/group.
Check the mode of network services daemon files. If any have modes more permissive than 0755, this is a finding.
Change the mode of the network services daemon. # chmod 0755 <path>
Check the mode of log files. Procedure: # ls -lL /var/log /var/log/syslog /var/adm If any of the log files have modes more permissive than 0640, this is a finding.
Change the mode of the system log file(s) to 0640 or less permissive. Procedure: # chmod 0640 /path/to/system-log-file NOTE: Do not confuse system log files with audit logs. Any subsystems that require less stringent permissions must be documented.
Check skeleton files permissions. # ls -alL /etc/skel If a skeleton file has a mode more permissive than 0644, this is a finding.
Change the mode of skeleton files with incorrect mode. # chmod 0644 <skeleton file>
Check the ownership of NIS/NIS+/yp files. Consult vendor documentation to determine the location of these files on the system. Procedure (example): # ls -lL /path/to/file If such a file is not owned by root, sys, bin, or system, this is a finding.
Change the ownership of NIS/NIS+/yp files to root, sys, bin, or system. Consult vendor documentation to determine the location of the files. Procedure (example): # chown root <filename>
Check the group ownership of the NIS/NIS+/yp files. Procedure: # ls -lL <NIS file> If any such file is not group-owned by root, sys, bin, other, or system, this is a finding.
Change the group owner of the NIS files to root, sys, bin, other, or system. Procedure: # chgrp root <filename>
Check the mode of the NIS/NIS+/yp files. Consult vendor documentation to determine the location of these files. Procedure (example): # ls -lL /path/to/file If any such file has a mode more permissive than 0755, this is a finding.
Change the mode of NIS/NIS+/yp files to 0755 or less permissive. Procedure (example): # chmod 0755 <filename>
Check the mode of the manual page files. Procedure: # ls -lLR /usr/share/man /usr/share/info /usr/share/infopage If any of the manual page files have a mode more permissive than 0644, this is a finding.
Change the mode of manual page files to 0644 or less permissive. Procedure (example): # chmod 0644 <path>/<manpage>
Check the mode of library files. Procedure: # ls -lLR /usr/lib /lib If any of the library files have a mode more permissive than 0755, this is a finding.
Change the mode of library files to 0755 or less permissive. Procedure (example): # chmod 0755 /path/to/library-file NOTE: Library files should have an extension of .a or .so, possibly followed by a version number.
Check the permissions for files in /etc, /bin, /usr/bin, /usr/lbin, /usr/ucb, /sbin, and /usr/sbin. Procedure: # ls -lL /etc /bin /usr/bin /usr/lbin /usr/ucb /sbin /usr/sbin If any command file is listed and has a mode more permissive than 755, this is a finding. Note: Elevate to Severity Code I if any command file listed is world-writable.
Change the mode for system command files to 755 or less permissive. Procedure: # chmod 755 <filename>
Check the ownership of system files, programs, and directories. Procedure: # ls -lLa /etc /bin /usr/bin /usr/lbin /usr/ucb /sbin /usr/sbin If any of the system files, programs, or directories are not owned by a system account, this is a finding.
Change the owner of system files, programs, and directories to a system account. Procedure: # chown root /some/system/file (A different system user may be used in place of root.)
Check the group ownership of system files, programs, and directories. Procedure: # ls -lLa /etc /bin /usr/bin /usr/lbin /usr/ucb /sbin /usr/sbin If any system file, program, or directory is not group-owned by a system group, this is a finding.
Change the group owner of system files to a system group. Procedure: # chgrp root /path/to/system/file (System groups other than root may be used.)
Check the ownership of the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file is not owned by root, this is a finding.
Change the ownership of the /etc/shadow (or equivalent) file. # chown root <file>
Check the mode of the /etc/passwd file. Procedure: # ls -lL /etc/passwd If /etc/passwd has a mode more permissive than 0644, this is a finding.
Change the mode of the passwd file to 0644. Procedure: # chmod 0644 /etc/passwd Document all changes.
Check the mode of the /etc/shadow file. # ls -lL /etc/shadow If the /etc/shadow file has a mode more permissive than 0400, this is a finding.
Change the mode of the /etc/shadow (or equivalent) file. # chmod <mode> <file>
Files with the setuid bit set will allow anyone running these files to be temporarily assigned the user or group ID of the file. If an executable with setuid allows shell escapes, the user can operate on the system with the effective permission rights of the user or group owner. List all setuid files on the system. Procedure: # find / -perm -4000 -exec ls -l {} \; | more NOTE: Executing these commands may result in large listings of files; the output may be redirected to a file for easier analysis. Ask the SA or IAO if files with the setuid bit set have been documented. If any undocumented file has its setuid bit set, this is a finding.
Document the files with the setuid bit set or unset the setuid bit on the executable.
Locate all setgid files on the system. Procedure: # find / -perm -2000 If the ownership, permissions, location, and ACLs of all files with the setgid bit set are not documented, this is a finding.
All files with the setgid bit set will be documented in the system baseline and authorized by the Information Systems Security Officer. Locate all setgid files with the following command. find / -perm -2000 -exec ls -lLd {} \; Ensure setgid files are part of the operating system software, documented application software, documented utility software, or documented locally developed software. Ensure none are text files or shell programs.
Determine if a weekly automated or manual process is used to generate a list of setuid files on the system and compare it with the prior list. If no such process is in place, this is a finding.
Establish a weekly automated or manual process to generate a list of setuid files on the system and compare it with the prior list. To create a list of setuid files use the following command. # find / -perm -4000 > setuid-file-list
Determine if a weekly automated or manual process is used to generate a list of setgid files on the system and compare it with the prior list. If no such process is in place, this is a finding.
Establish a weekly automated or manual process to generate a list of setgid files on the system and compare it with the prior list. To create a list of setgid files use the following command. # find / -perm -2000 > setgid-file-list
Check /etc/fstab and verify the "nosuid" mount option is used on file systems mounted from removable media, network shares, or any other file system that does not contain approved setuid or setgid files.
Edit /etc/fstab and add the "nosuid" mount option to all file systems mounted from removable media or network shares, and any file system that does not contain approved setuid or setgid files.
Verify all world-writable directories have the sticky bit set. Procedure: # find / -type d -perm -002 ! -perm -1000 > wwlist If the sticky bit is not set on a world-writable directory, this is a finding.
Set the sticky bit on all public directories. Procedure: # chmod 1777 /tmp (Replace /tmp with the public directory missing the sticky bit, if necessary.)
Check the ownership of all public directories. Procedure: # find / -type d -perm -1002 -exec ls -ld {} \; If any public directory is not owned by root or an application user, this is a finding.
Change the owner of public directories to root or an application account. Procedure: # chown root /tmp (Replace root with an application user and/or /tmp with another public directory as necessary.)
Check global initialization files for the configured umask value. Procedure: # grep umask /etc/* Check local initialization files for the configured umask value. Procedure: # grep umask /userhomedirectory/.* If the system and user default umask is not 077, this is a finding. NOTE: If the default umask is 000 or allows for the creation of world-writable files, this becomes a Severity Code I (CAT I) finding.
Edit local and global initialization files that contain "umask" and change them to use 077 instead of the current value.
Determine if auditing is enabled. If auditing is not enabled, this is a finding.
Configure the system to implement auditing.
Check the ownership of the audit log file(s). # ls -l <audit log file> If any audit log file is not owned by root, this is a finding.
Change the ownership of the audit log file(s). Procedure: # chown root <audit log file>
Check the mode of the audit log file(s). # ls -l <audit log file> If any audit log file has a mode more permissive than 0640, this is a finding.
Change the mode of the audit log directories/files. # chmod 0750 <audit directory> # chmod 0640 <audit file>
Check the audit configuration to determine if failed attempts to access files and programs are audited. If they are not, this is a finding.
Configure the system to audit failed attempts to access files and programs.
Check the system audit configuration. If the system is not configured to audit file and program deletion, this is a finding.
Configure the system to audit file and program deletion.
Check the system configuration to determine if all administrative, privileged, and security actions are audited. If any of these categories of events is not audited, this is a finding.
Configure the system to audit all administrative, privileged, and security actions.
Verify the system is configured to audit login, logout, and session initiation. If the system does not audit any of these events, this is a finding.
Configure the system to audit login, logout, and session initiation.
Verify the system is configured to audit all discretionary access control permission modifications. If the system does not audit any of these events, this is a finding.
Configure the system to audit all discretionary access control permission modifications.
Check the ownership of inetd.conf file. Procedure: # ls -lL /etc/inetd.conf This is a finding if any of the above files or directories are not owned by root or bin.
Change the ownership of the inetd.conf file to root or bin. Procedure: # chown root /etc/inetd.conf
Check the mode of inetd.conf file. # ls -lL /etc/inetd.conf If the mode of the file(s) is more permissive than 0440, this is a finding.
Change the mode of the inetd.conf file. # chmod 0440 /etc/inetd.conf
Check the ownership of the services file. Procedure: # ls -lL /etc/services If the services file is not owned by root or bin, this is a finding.
Change the ownership of the services file to root or bin. Procedure: # chown root /etc/services
Check the mode of the services file. Procedure: # ls -lL /etc/services If the services file has a mode more permissive than 0444, this is a finding.
Change the mode of the services file to 0444 or less permissive. Procedure: # chmod 0444 /etc/services
Check global initialization files for the presence of mesg -n or mesg n. Procedure: # grep "mesg" /etc/.login /etc/profile /etc/bashrc /etc/environment /etc/security/environ If no global initialization files contain mesg -n or mesg n, this is a finding.
Edit /etc/profile or another global initialization script and add the mesg -n command.
Look for the presence of a print service configuration file. Procedure: # find /etc -name hosts.lpd -print # find /etc -name Systems -print # find /etc -name printers.conf If none of the files are found, this check is not applicable. Otherwise, examine the configuration file. Procedure: # more <print service file> Check for entries that contain a "+" or "_" character. If any are found, this is a finding.
Remove the "+" entries from the hosts.lpd (or equivalent) file.
Locate any print service configuration file on the system. Consult vendor documentation to verify the names and locations of print service configuration files on the system. Procedure: # find /etc -name hosts.lpd -print # find /etc -name Systems -print If no print service configuration file is found, this is not applicable. Check the ownership of the print service configuration file(s). Procedure: # ls -lL <print service file> If the owner of the file is not root, sys, bin, or lp, this is a finding.
Change the owner of the /etc/hosts.lpd file (or equivalent, such as /etc/lp/Systems) to root, lp, or another privileged UID. Consult vendor documentation to determine the name and location of print service configuration files. Procedure: # chown root /etc/hosts.lpd
Locate any print service configuration file on the system. Consult vendor documentation for the name and location of print service configuration files. Procedure: # find /etc -name hosts.lpd -print # find /etc -name Systems -print If no print service configuration file is found, this is not applicable. Check the mode of the print service configuration file. Procedure: # ls -lL <print service file> If the mode of the print service configuration file is more permissive than 0644, this is a finding.
Change the mode of the /etc/hosts.lpd file (or equivalent, such as /etc/lp/Systems) to 0644 or less permissive. Consult vendor documentation for the name and location of print service configuration files. Procedure: # chmod 0644 /etc/hosts.lpd
Find the aliases file on the system. Procedure: # find / -name aliases -depth -print Check the ownership of the alias file. Procedure: # ls -lL <alias location> If the file is not owned by root, this is a finding.
Change the owner of the /etc/mail/aliases file (or equivalent, such as /usr/lib/aliases) to root. Procedure: # chown root /etc/mail/aliases
Find the aliases file on the system. Procedure: # find / -name aliases -depth -print Check the mode of the alias file. Procedure: # ls -lL <alias location> If the alias file has a mode more permissive than 0644, this is a finding.
Change the mode of the /etc/mail/aliases file (or equivalent, such as /usr/lib/aliases) to 0644. Procedure: # chmod 0644 /etc/aliases
Find the aliases file on the system. Procedure: # find / -name aliases -depth -print # more < aliases file location > Examine the aliases file for any directories or paths that may be utilized. Procedure: # ls -lL < path > Check if the file or parent directory is owned by root. If not, this is a finding.
Edit the /etc/mail/aliases file (alternatively, /usr/lib/sendmail.cf). Locate the entries executing a program. They will appear similar to the following line. Aliasname: : /usr/local/bin/ls (or some other program name) Ensure root owns the programs and the directory(ies) they reside in by using the chown command to change owner to root. Procedure: # chown root filename
Find the aliases file on the system. Procedure: # find / -name aliases -depth -print Examine the aliases file for any directories or paths that may be utilized. Procedure: # more <aliases file location> Check the permissions for any paths referenced. Procedure: # ls -lL <path> If any file referenced from the aliases file has a mode more permissive than 0755, this is a finding.
Use the chmod command to change the access permissions for files executed from the alias file. For example: # chmod 0755 < filename >
Check if Sendmail logging is set to level 9. Procedure: # grep "O L" /etc/mail/sendmail.cf OR # grep LogLevel /etc/mail/sendmail.cf If logging is set to less than 9, this is a finding.
Edit the sendmail.conf file, locate the "O L" or LogLevel entry and change it to 9.
Check the syslog configuration file for mail.crit logging configuration. Procedure: # more /etc/syslog.conf Verify a line similar to one of the following lines is present in syslog.conf is configured so that critical mail log data is logged. (Critical log data may also be captured by a remote log host in accordance with GEN005460.) mail.crit /var/adm/messages *.crit /var/log/messages If syslog is not configured to log critical Sendmail messages, this is a finding.
Edit the syslog.conf file and add a configuration line specifying an appropriate destination for mail.crit syslogs.
Locate any mail log files by checking the syslog configuration file. Procedure: # more /etc/syslog.conf Identify any log files configured for the mail service at any severity level, or those configured for all services. Check the ownership of these log files. Procedure: # ls -lL <file location> If any mail log file is not owned by root, this is a finding.
Change the ownership of the Sendmail log file. # chown root <sendmail log file>
Check the mode of the SMTP service log file. Procedure: # more /etc/syslog.conf Check the configuration to determine which log files contain logs for mail.crit, mail.debug, or *.crit. Procedure: # ls -lL <file location> If the log file permissions are greater than 0644, this is a finding.
Change the mode of the SMTP service log file. Procedure: # chmod 0644 <sendmail log file>
Check the system for an ftpusers file. If no ftpusers file appropriate for the system's FTP service exists, this is a finding.
Create an ftpusers file appropriate for the system's FTP service.
Check the contents of the ftpusers file. If the system has accounts not allowed to use FTP that are not listed in the ftpusers file, this is a finding.
Add accounts not allowed to use FTP to the ftpusers file.
Check the ownership of the ftpusers file. If the ftpusers file is not owned by root, this is a finding.
Change the owner of the ftpusers file to root.
Check the permissions of the ftpusers file. If the ftpusers file has a mode more permissive than 0640, this is a finding.
Change the mode of the ftpusers file to 0640.
Examine the FTP daemon service configuration. # grep ftpd /etc/inetd.conf, Check the line for ftpd and determine if the -l or -v options are present. If not, this is a finding.
Edit the FTP daemon configuration in /etc/inetd.conf and add the "-l" or "-v" options (as appropriate) to enable verbose logging.
Attempt to log into this host with a user name of anonymous and a password of guest (also try the password of guest@mail.com). If the logon is successful, this is a finding. Procedure: # ftp localhost Name: anonymous 530 Guest login not allowed on this machine.
Configure the FTP service to not permit anonymous logins.
Determine if tftpd is running in secure mode. If tftpd is running and not using secure mode, this is a finding.
Configure tftpd to run in secure mode.
Check the mode of the TFTP daemon. Procedure: # find / -name "*tftpd" -print # ls -lL <file location> If the mode of the file is more permissive than 0755, this is a finding.
Change the mode of the TFTP daemon. Procedure: # chmod 0755 <tftp server>
Check the /etc/passwd file to determine if TFTP is configured properly. Procedure: # grep tftp /etc/passwd If a TFTP user account does not exist and TFTP is active, this is a finding. Check the user shell for the TFTP user. If it is not /bin/false or equivalent, this is a finding. Check the home directory assigned to the TFTP user. If no home directory is set, or the directory specified is not dedicated to the use of the TFTP service, this is a finding.
Create a TFTP user account if none exists. Assign a non-login shell to the TFTP user account, such as /bin/false. Assign a home directory to the TFTP user account.
Check for .Xauthority files being utilized by looking for such files in the home directory of a user that uses X. Procedure: # cd ~someuser # ls -la .Xauthority If the .Xauthority file does not exist, ask the SA if the user is using X Windows. If the user is utilizing X Windows and the .Xauthority file does not exist, this is a finding.
Ensure the X Windows host is configured to write .Xauthority files into user home directories. Edit the Xaccess file. Ensure the line that writes the .Xauthority file is uncommented.
Perform the following to determine if NIS is active on the system. # ps -ef | egrep '(ypbind|ypserv)' If NIS is found active on the system, this is a finding.
Disable the use of NIS. Possible replacements are NIS+ and LDAP.
Check all user accounts home directory assignments. If any user account does not have a home directory, this is a finding.
Assign a home directory to any user without one.
Check all user accounts home directory assignments. If any user account does not have a home directory, this is a finding.
If a user has no home directory, determine why. If possible, delete accounts with no home directory. If the account is valid, then create the home directory using the appropriate system administration utility or manually create, i.e., mkdir <directory name>; copy the skeleton files into the directory; chown <user name> <directory name> for the new directory and the skeleton files. Document all changes.
Check the home directory mode of each user in /etc/passwd. Procedure: # cut -d : -f 6 /etc/passwd | xargs -n1 ls -ld | more If a user's home directory's mode is more permissive than 0750, this is a finding. NOTE: Application directories are allowed and may need 0755 permissions (or greater) for correct operation.
Change the mode of users' home directories to 0750 or less permissive. Procedure (example): # chmod 0750 <home directory>
Check the ownership of each user's home directory listed in the /etc/passwd file. Procedure: # ls -lLd <user home directory> If any user's home directory is not owned by the assigned user, this is a finding.
Change the owner of a user's home directory to its assigned user. Procedure: # chown <user> <home directory>
Check the group ownership for each user in the /etc/passwd file. Procedure: # ls -lLd <user home directory> If any user's home directory is not group-owned by the assigned user's primary group, this is a finding. Home directories for application accounts requiring different group ownership must be documented using site-defined procedures.
Change the group owner for user's home directories to the primary group of the assigned user. Procedure: # chgrp groupname directoryname (Replace examples with appropriate group and home directory.) Document all changes.
NOTE: The following commands must be run in the BASH shell. Check the ownership of local initialization files. Procedure (using a shell that supports ~USER as USER's home directory): # cut -d : -f 1 /etc/passwd | xargs -n1 -IUSER sh -c "ls -l ~USER/.[a-z]*" # cut -d : -f 1 /etc/passwd | xargs -n1 -IUSER find ~USER/.dt ! -fstype nfs ! -user USER -exec ls -ld {} \; If local initialization files are not owned by the home directory's user, this is a finding.
Change the ownership of the startup and login files in the user's directory to the user or root, as appropriate. Examine each user's home directory and verify all file names beginning with "." are owned by the owner of the directory or root. If they are not, use the chown command to change the owner to the user and research the reasons why the owners were not assigned as required. Procedure: # chown username .filename Document all changes.
Check the modes of local initialization files. Procedure: # ls -al /<usershomedirectory>/.login # ls -al /<usershomedirectory>/.cshrc # ls -al /<usershomedirectory>/.logout # ls -al /<usershomedirectory>/.profile # ls -al /<usershomedirectory>/.bash_profile # ls -al /<usershomedirectory>/.bashrc # ls -al /<usershomedirectory>/.bash_logout # ls -al /<usershomedirectory>/.env # ls -al /<usershomedirectory>/.dtprofile (permissions should be 0755) # ls -al /<usershomedirectory>/.dispatch # ls -al /<usershomedirectory>/.emacs # ls -al /<usershomedirectory>/.exrc # find /<usershomedirectory>/.dt ! -fstype nfs \( -perm -0002 -o -perm -0020 \) -exec ls -ld {} \; (permissions not to be more permissive than 0755) If local initialization files are more permissive than 0740, the .dt directory or the .dtprofile file is more permissive than 0755, this is a finding.
Ensure user startup files have permissions of 0740 or more restrictive. Examine each user's home directory and verify all file names beginning with "." have access permissions of 0740 or more restrictive. If they do not, use the chmod command to correct the vulnerability. Procedure: # chmod 0740 .filename NOTE: The period is part of the file name and is required.
Check the mode for all run control scripts. If any run control script has a mode more permissive than 0755, this is a finding.
Ensure all system startup files have mode 0755 or less permissive. Examine the rc files, and all files in the rc1.d (rc2.d, and so on) directories, and in the /etc/init.d directory to ensure they are not world-writable. If they are world-writable, use the chmod command to correct the vulnerability and to research why. Procedure: # chmod 755 startupfile
Verify run control scripts' library search paths. Procedure: # grep -r PATH /etc/rc* This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/) or other than "$PATH", it is a relative path and this is a finding.
Edit the run control script and remove the relative path entry from the executable search path variable.
Check the permissions on the files or scripts executed from system startup scripts to see if they are world-writable. Create a list of all potential run command level scripts. # ls -l /etc/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " " OR # ls -l /sbin/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " " Create a list of world writeable files. # find / -perm -002 -type f >> worldWriteableFileList Determine if any of the world writeable files in worldWriteableFileList are called from the run command level scripts. Note: Depending upon the number of scripts vs world writeable files, it may be easier to inspect the scripts manually. # more `ls -l /etc/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " "` OR # more `ls -l /sbin/init.d/* | tr '\011' ' ' | tr -s ' ' | cut -f 9,9 -d " "` If any system startup script executes any file or script that is world-writable, this is a finding.
Remove the world-writable permission from programs or scripts executed by run control scripts. Procedure: # chmod o-w <program or script executed from run control script>
Check the system for the existence of any .netrc files. Procedure: # find / -name .netrc If any .netrc file exists, this is a finding.
Remove the .netrc file(s). Procedure: # rm .netrc
For each user in the /etc/passwd file, check for the presence of files and directories within the user's home directory not owned by the home directory owner. Procedure: # find /<usershomedirectory> ! -fstype nfs ! -user <username> ! \( -name .login -o -name .cshrc -o -name .logout -o -name .profile -o -name .bash_profile -o -name .bashrc -o -name .env -o -name .dtprofile -o -name .dispatch -o -name .emacs -o -name .exrc \) -exec ls -ld {} \; If user's home directories contain files or directories not owned by the home directory owner, this is a finding.
Change the ownership of files and directories in user's home directories to the owner of the home directory. Procedure: # chown accountowner filename OR # find /<usershomedirectory> ! -fstype nfs ! -user <username> ! /( -name .login -o -name .cshrc -o -name .logout -o -name .profile -o -name .bash_profile -o -name .bashrc -o -name .env -o -name .dtprofile -o -name .dispatch -o -name .emacs -o -name .exrc \) -exec chown <username> {} \;
For each user in the /etc/passwd file, check for files and directories with a mode more permissive than 0750. Procedure: # find /<usershomedirectory> ! -fstype nfs ! \( -name .login -o -name .cshrc -o -name .logout -o -name .profile -o -name .bash_profile -o -name .bashrc -o -name .env -o -name .dtprofile -o -name .dispatch -o -name .emacs -o -name .exrc \) \( -perm -0001 -o -perm -0002 -o -perm -0004 -o -perm -0020 -o -perm -2000 -o -perm -4000 \) -exec ls -ld {} \; If user's home directories contain files or directories more permissive than 0750, this is a finding.
Change the mode of files and directories within user's home directories to 0750. Procedure: # chmod 0750 filename Document all changes.
Verify /etc/shells exists. # ls -l /etc/shells If the file does not exist, this is a finding.
Create a /etc/shells file containing a list of valid system shells. Consult vendor documentation for an appropriate list of system shells. Procedure: # echo "/bin/bash" >> /etc/shells # echo "/bin/csh" >> /etc/shells (Repeat as necessary for other shells.)
Confirm the login shells referenced in the /etc/passwd file are listed in the /etc/shells file. Procedure: # more /etc/passwd # more /etc/shells The /usr/bin/false, /bin/false, /dev/null, /sbin/nologin, (and equivalents), and sdshell will be considered valid shells for use in the /etc/passwd file, but will not be listed in the /etc/shells file. If a shell referenced in /etc/passwd is not listed in the shells file, excluding the above mentioned shells, this is a finding.
Use the chsh utility or edit the /etc/passwd file and correct the error by changing the default shell of the account in error to an acceptable shell name contained in the /etc/shells file.
Indications of inactive accounts are those without entries in the last log. Check the date in the last log to verify it is within the last 35 days. If an inactive account is not disabled via an entry in the password field in the /etc/passwd or /etc/shadow (or equivalent), check the /etc/passwd file to check if the account has a valid shell. If an inactive account is found that is not disabled, this is a finding.
All inactive accounts will have /bin/false, /usr/bin/false, or /dev/null as the default shell in the /etc/passwd file and have the password disabled. Disable the inactive accounts. Examine the inactive accounts using the last command. Note the date of last login for each account. If any (other than system and application accounts) exceed 35 days, then disable them by placing a shell of /bin/false or /dev/null in the shell field of the passwd file entry for that account. An alternative, and preferable method, is to disable the account using SAM, SMIT, or ADMINTOOL.
Check the ownership of the system shells. # cat /etc/shells | xargs -n1 ls -lL If any shell is not owned by root or bin, this is a finding.
Change the ownership of the shell with incorrect ownership. # chown root <shell>
If /etc/shells exists, check the group ownership of each shell referenced. # cat /etc/shells | xargs -n1 ls -lL Otherwise, check any shells found on the system. # find / -name "*sh" | xargs -n1 ls -lL If a shell has a mode more permissive than 0755, this is a finding.
Change the mode of the shell. # chmod 0755 <shell>
Check the system for an automated job, or check with the SA, to determine if the system is checked for extraneous device files on a weekly basis. If no automated or manual process is in place, this is a finding.
Establish a weekly automated or manual process to create a list of device files on the system and determine if any files have been added, moved, or deleted since the last list was generated. Generate a list of device files. # find / -type b -o -type c > device-file-list
Find all device files existing anywhere on the system. Procedure: # find / -type b -print > devicelist # find / -type c -print >> devicelist Check the permissions on the directories above subdirectories containing device files. If any of the device files or their parent directories is world-writable, excepting device files specifically intended to be world-writable, such as /dev/null, this is a finding.
Remove the world-writable permission from the device file(s). Procedure: # chmod o-w <device file> Document all changes.
Check the system for world-writable device files. Procedure: # find / -perm -2 -a \( -type b -o -type c \) -exec ls -ld {} \; If any device file(s) used for backup are writable by users other than root, this is a finding.
Use the chmod command to remove the world-writable bit from the backup device files. Procedure: # chmod o-w backdevicefilename Document all changes.
If the system is not using NIS+, this is not applicable. Check the system to determine if NIS+ security level 2 is implemented. Procedure: # niscat cred.org_dir If the second column does not contain DES, the system is not using NIS+ security level 2, and this is a finding.
Configure the NIS+ server to use security level 2.
Check the ownership of the NFS export configuration file. If the file is not owned by root, this is a finding.
Change the ownership of the NFS export configuration file to root. # chown root <NFS export file>
Check the ownership of the NFS export configuration file. If the file has a mode more permissive than 0644, this is a finding.
Change the mode of the NFS export configuration file to 0644. # chmod 0644 <NFS export file>
Check for NFS exported file systems. Procedure: # exportfs -v This will display all of the exported file systems. For each file system displayed, check the ownership. Procedure: # ls -lLa <exported file system path> If the files and directories are not owned by root, this is a finding.
Change the ownership of exported file systems not owned by root. Procedure: # chown root <path>
Check if the anon option is set correctly for exported file systems. List exported file systems. # exportfs -v Each of the exported file systems should include an entry for the 'anon=' option set to -1 or an equivalent (60001, 60002, 65534, or 65535). If an appropriate 'anon=' setting is not present for an exported file system, this is a finding.
Edit /etc/exports and set the anon=-1 option for exports without it. Re-export the file systems.
Check the permissions on exported NFS file systems. Procedure: # exportfs -v If the exported file systems do not contain the rw or ro options specifying a list of hosts or networks, this is a finding.
Edit /etc/exports and add ro and/or rw options (as appropriate) specifying a list of hosts or networks which are permitted access. Re-export the file systems.
Determine if the NFS server is exporting with the root access option. Procedure: # exportfs -v | grep "root=" If an export with the root option is found, this is a finding.
Edit /etc/exports and remove the root= option for all exports. Re-export the file systems.
Check the system for NFS mounts not using the nosuid option. Procedure: # mount -v | grep " type nfs " | grep -v nosuid If the mounted file systems do not have the nosuid option, this is a finding.
Edit /etc/fstab and add the "nosuid" option for all NFS file systems. Remount the NFS file systems to make the change take effect.
Perform the following to check for a security tool executing monthly: # crontab –l Check for the existence of a vulnerability assessment tool being scheduled and run monthly. If no entries exist in the crontab, ask the SA if a vulnerability tool is run monthly. In addition, if the tool is run monthly, ask to see any reports that may have been generated from the tool. If a tool is not run monthly then this a finding.
Add a monthly cronjob to run the system vulnerability tool.
Normally, TCPD logs to the mail facility in /etc/syslog.conf. Determine if syslog is configured to log events by TCPD. Procedure: # more /etc/syslog.conf Look for entries similar to the following: mail.debug /var/adm/maillog mail.none /var/adm/maillog mail.* /var/log/mail auth.info /var/log/messages The above entries would indicate mail alerts are being logged. If no entries for mail exist, then TCPD is not logging and this is a finding.
Configure the access restriction program to log every access attempt. Ensure the implementation instructions for TCP_WRAPPERS are followed, so system access attempts are logged into the system log files. If an alternate application is used, it must support this function.
Check for the existence of the cron.allow and cron.deny files. If neither file exists, this is a finding.
Create a cron.allow and/or cron.deny file(s) with appropriate content in the appropriate directory for the system.
Check the mode of the cron.allow file. If the file has a mode more permissive than 0600, this is a finding.
Change the mode of the cron.allow file to 0600.
List all cron jobs on the system. If any cron job executes a program with group-writable or world-writable permissions, this is a finding.
Remove the world-writable and group-writable permissions from the cron program file(s) identified. # chmod go-w <cron program file>
List all cron jobs on the system. If any cron job executes a program located in a world-writable directory, this is a finding.
Remove the world-writable permission from the cron program directories identified. Procedure: # chmod o-w <cron program directory>
Check the modes of the crontab and cron job script files. If the mode is more permissive than 0600 for crontab files or 0700 for cron job script files, this is a finding.
Change the modes of crontab files to 0600 and cron job script files to 0700.
Check the mode of crontab directories. If any have a mode more permissive than 0755, this is a finding.
Change the mode of crontab directories to 0755.
Check the owner of the cron and crontab directories. If any cron or crontab directory is not owned by root or bin, this is a finding.
Change the owner of the cron and crontab directories to root or bin.
Check the group owner of cron and crontab directories. If a cron or crontab directory is not group-owned by root, sys, bin, or cron, this is a finding.
Change the group owner of the cron and crontab directories to root, sys, bin, or cron.
Check the mode of the system cron log. If the mode is more permissive than 0600, this is a finding.
Change the mode of the system cron log to 0600.
Check for the existence of at.allow and at.deny files. If neither file exists, this is a finding.
Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the "at" daemon.
Check the at.deny file. If the at.deny file exists and is empty, this is a finding.
Add appropriate users to the at.deny file, or remove the empty at.deny file if an at.allow file exists.
Check the contents of the at.allow file. If default accounts (such as bin, sys, adm, and others) are listed in the at.allow file, this is a finding.
Remove the default accounts (such as bin, sys, adm, and others) from the at.allow file.
Check the mode of the at.allow file. If the at.allow file has a mode more permissive than 0600, this is a finding.
Change the mode of the at.allow file to 0600.
List the "at" jobs on the system. Procedure: # ls -la /var/spool/cron/atjobs /var/spool/atjobs For each "at" job file, determine which programs are executed. Procedure: # more <at job file> Check each program executed by "at" for group- or world-writable permissions. Procedure: # ls -la <at program file> If "at" executes group- or world-writable programs, this is a finding.
Remove group-write and world-write permissions from files executed by "at" jobs. Procedure: # chmod go-w <file>
List any "at" jobs on the system. Procedure: # ls /var/spool/cron/atjobs /var/spool/atjobs For each "at" job, determine which programs are executed. Procedure: # more <at job file> Check the directory containing each program executed by "at" for world-writable permissions. Procedure: # ls -la <at program file directory> If "at" executes programs in world-writable directories, this is a finding.
Remove the world-writable permission from directories containing programs executed by "at". Procedure: # chmod o-w <at program directory>
Check the SNMP configuration for default passwords. Locate and examine the SNMP configuration. Procedure: # find / -name snmpd.conf -print # more snmpd.conf Identify any community names or user password configuration. If any community name or password is set to a default value, such as public, private, snmp-trap, password, or any value which does not meet DISA password requirements, this is a finding.
Change the default passwords. To change them, locate the snmpd.conf file and edit it. Locate the line system-group-read-community which has a default password of public and make the password something more random (less guessable). Make the same changes for the lines that read system-group-write-community, read-community, write-community, trap, and trap-community. Read the information in the file carefully. The trap is defining who to send traps to, for instance, by default. It is not a password, but the name of a host.
Check the mode of the SNMP daemon configuration file. Locate the SNMP daemon configuration file. Consult vendor documentation to verify the name and location of the file. Procedure: # find / -name snmpd.conf Check the mode of the SNMP daemon configuration file. Procedure: # ls -lL <snmpd.conf> If the snmpd.conf file has a mode more permissive than 0600, this is a finding.
Change the mode of the SNMP daemon configuration file to 0600. Procedure: # chmod 0600 <snmpd.conf>
Check the modes for all Management Information Base (MIB) files on the system. Procedure: # find / -name *.mib -print # ls -lL <mib file> If any file is returned that does not have mode 0640 or less permissive, this is a finding.
Change the mode of MIB files to 0640. Procedure: # chmod 0640 <mib file>
Check the system for world-writable files and directories. Procedure: # find / -perm -2 -a \( -type d -o -type f \) -exec ls -ld {} \; If any world-writable files or directories are located, except those required for proper system or application operation, such as /tmp and /dev/null, this is a finding.
Remove or change the mode for any world-writable file or directory on the system that is not required to be world-writable. Procedure: # chmod o-w <file/directory> Document all changes.
Determine if the system is configured to boot from devices other than the system startup media. If so, this is a finding. In most cases, this will require access to the BIOS or system controller. The exact procedure will be hardware-dependent, and the SA should be consulted to identify the specific configuration. In the event the BIOS or system controller is not accessible without adversely impacting (e.g., restarting) the system, the SA may be interviewed to determine compliance with the requirement.
Configure the system to only boot from system startup media.
Perform the following to check for ext3 filesystems: # more /etc/fstab If a local filesystem on a Linux platform is not using ext3, this is a finding. Note: the CD, floppy drives, proc, and, swap entries do not support ext3.
Use the ext3 filesystem type for Linux partitions.
X servers get started several ways, such as xdm, gdm or xinit. Perform: # ps –ef |grep X Output for example: /usr/X11R6/bin/X –nolisten –ctp –br vt7 –auth /var/lib/xdm/authdir/authfiles/A:0 Check the Xservers file to ensure the following options are enabled: -audit, -auth, and –s 15. Xserver files can found in: /etc/X11/xdm/Xservers /etc/opt/kde3/share/config/kdm/Xservers /etc/X11/gdm/Xservers
Enable the following options: -audit (at level 4), -auth and -s with 15 minutes as the timeout value.
X servers get started several ways, such as xdm, gdm or xinit. Perform: # ps –ef |grep X Output for example: /usr/X11R6/bin/X –nolisten –ctp –br vt7 –auth /var/lib/xdm/authdir/authfiles/A:0 The above example show xdm is controlling the Xserver. Check the Xservers file to ensure the following options are not enabled: -ac, -core, and -nolock . Xserver files can found in: /etc/X11/xdm/Xservers /etc/opt/kde3/share/config/kdm/Xservers /etc/X11/gdm/Xservers
Disable the following options: -ac, -core and -nolock.
# ps -ef | egrep "innd|nntpd" If an INN server is running, this is a finding.
Disable the INN server.
Check access configuration ownership: # ls –lL /etc/login.access /etc/security/access.conf /etc/access.conf If any of these files exist and are not owned by root, this is a finding.
Follow the correct configuration parameters for access configuration file. Use the chown command to configure it properly. For example: # chown root /etc/login.access /etc/security/access.conf /etc/access.conf
Check the system for an enabled SWAT service. # grep -i swat /etc/inetd.conf If SWAT is found enabled, it must be utilized with SSL to ensure a secure connection between the client and the server. Ask the SA to identify the method used to provide SSL protection for the SWAT service. Verify (or ask the SA to demonstrate) this configuration is effective by accessing SWAT using an HTTPS connection from a web browser. If SWAT is found enabled and has no SSL protection, this is a finding.
Disable SWAT (e.g., remove the "swat" line from inetd.conf or equivalent, and restart the service) or configure SSL protection for the SWAT service.
Check the ownership of the smb.conf file. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. Procedure: # ls -lL /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf # ls -l /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If an smb.conf file is not owned by root, this is a finding.
Change the ownership of the smb.conf file. Procedure: # chown root /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf
Check the mode of the smb.conf file. Procedure: # find / -name smb.conf # ls -lL <smb.conf file> If the smb.conf has a mode more permissive than 0644, this is a finding.
Change the mode of the smb.conf file to 0644 or less permissive. Procedure: # chmod 0644 smb.conf
Check the ownership of the smbpasswd file. # find / -name smbpasswd # ls -l <smbpasswd file> If an smbpasswd file is not owned by root, this is a finding.
Use the chown command to configure the smbpasswd file. # chown root /etc/smbpasswd
Examine the smb.conf file. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. # more /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the hosts option is not present to restrict access to a list of authorized hosts and networks, this is a finding.
Edit the smb.conf file and set the hosts option to permit only authorized hosts to access Samba.
Determine if root has logged in over an unencrypted network connection. First, determine if root has logged in over a network. Procedure: # last | grep "^root " | egrep -v "reboot|console" | more Next, determine if the SSH daemon is running. Procedure: # ps -ef |grep sshd If root has logged in over the network and SSHD is not running, this is a finding.
Enable SSH on the system and use it for all remote connections used to attain root access.
Determine if the SSH daemon is configured to permit root logins. Procedure: # find / -name sshd_config -print # grep -v "^#" <sshd_config path> | grep -i permitrootlogin If the PermitRootLogin entry is not found or is not set to no, this is a finding.
Edit the configuration file and set the PermitRootLogin option to no.
Check the mode of audio devices. If the mode of audio devices are more permissive than 0660, this is a finding.
Change the mode of audio devices. # chmod o-w <audio device>
Check the owner of audio devices. If the owner of an audio device is not root, this is a finding.
Change the owner of the audio device. # chown root <audio device>
Check access configuration group ownership: # ls -lL /etc/login.access /etc/security/access.conf /etc/access.conf If any of these files exist and are have a group-owner that is not a privileged user, this is a finding.
Use the chgrp command to ensure the group owner is root, sys, or bin. For example: # chgrp root /etc/login.access /etc/security/access.conf /etc/access.conf
Check access configuration mode: # ls -lL /etc/login.access /etc/security/access.conf /etc/access.conf If any of these files exist and have a mode more permissive than 0640, this is a finding.
Use the chmod command to set the permissions to 0640. For example: # chmod 0640 /etc/login.access /etc/security/access.conf /etc/access.conf
Check the group ownership of the smb.conf file. Procedure: # find / -name /etc/samba/smb.conf # ls -l <smb.conf file> If an smb.conf file is not group-owned by root, bin, or sys, this is a finding
Change the group owner of the smb.conf file. Procedure: # chgrp root smb.conf
Check smbpasswd ownership. # find / -name smbpasswd # ls -lL <smbpasswd file> If smbpasswd is not group-owned by root, this is a finding.
Use the chgrp command to ensure the group owner of the smbpasswd file is root. # chgrp root /etc/smbpasswd.
Check smbpasswd mode. Procedure: # find / -name smbpasswd # ls -lL <smbpasswd file> If smbpasswd has a mode more permissive than 0600, this is a finding.
Change the mode of the smbpasswd file to 0600. Procedure: # chmod 0600 smbpasswd
Check the group owner of audio devices. Procedure: # ls -lL <audio device file> If the group owner of an audio device is not root, sys, bin, or system, this is a finding.
Change the group owner of the audio device. Procedure: # chgrp system <audio device>
Determine if /usr has a dedicated file system. Procedure: # grep /usr /etc/fstab If /usr is on a dedicated file system, check the location of root's default shell. Procedure: # grep "^root:" /etc/passwd | grep ":/usr" If the root shell is found to be on a /usr dedicated file system, this is a finding.
Change the root account's shell to one present on the / file system. Procedure: Edit /etc/passwd and change the shell for the root account to one present on the / file system (such as /bin/sh, assuming /bin is not on a separate file system). If the system does not store shell configuration in the /etc/passwd file, consult vendor documentation for the correct procedure for the system.
Log into a graphical desktop environment provided by the system. Allow the session to remain idle for 15 minutes. If the desktop session is not automatically locked after 15 minutes, or does not require re-authentication to resume operations, this is a finding.
Consult vendor documentation to determine the settings required for the system to lock graphical desktop environments. Configure the system to lock graphical desktop environments after 15 minutes of inactivity and require re-authentication to resume operations.
Verify the system is configured to prohibit the reuse of passwords within five iterations.
Configure the system to prohibit the reuse of passwords within five iterations.
Check local initialization files for any executed world-writable programs or scripts. Procedure: # more /<usershomedirectory>/.* # ls -al <program or script> If any local initialization file executes a world-writable program or script, this is a finding.
Remove the world-writable permission of files referenced by local initialization scripts, or remove the references to these files in the local initialization scripts.
# grep "mesg" /<usershomedirectory>/.* If local initialization files contain the mesg -y or mesg y command, this is a finding.
Edit the local initialization file(s) and remove the mesg -y command.
Check the ownership of system run control scripts. If any are owned by a user other than root or bin, this is a finding.
Change the ownership of the run control script(s) with incorrect ownership. # chown root <run control script>
Check the group ownership of system run control scripts. If any are group-owned by a user other than root, sys, bin, other, or the system default, this is a finding.
Change the group ownership of the run control script(s) with incorrect group ownership. Procedure: # chgrp root <run control script>
Check the ownership of any files executed from system startup scripts. If any of these files are not owned by root, bin, sys, or other, this is a finding.
Change the ownership of the file executed from system startup scripts to root, bin, sys, or other. # chown root <executed file>
On systems with a BIOS or system controller, verify a supervisor or administrator password is set. If a password is not set, this is a finding. If the BIOS or system controller supports user-level access in addition to supervisor/administrator access, determine if this access is enabled. If so, this is a finding. The exact procedure will be hardware-dependent, and the SA should be consulted to identify the specific configuration. In the event the BIOS or system controller is not accessible without adversely impacting (e.g., restarting) the system, the SA may be interviewed to determine compliance with the requirement.
Access the system's BIOS or system controller. Set a supervisor/administrator password if one has not been set. Disable a user-level password if one has been set.
Ask the SA if the system uses removable media for the boot loader. If it does, this is a finding.
Configure the system to use a bootloader installed on fixed media.
This check applies to the global zone only. Determine the type of zone that you are currently securing. # zonename If the command output is "global", this check applies. On systems that have a ZFS root, the active menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset. On systems that have a UFS root, the active menu.lst file is typically located at /boot/grub/menu.lst. To locate the active GRUB menu, use the bootadm command with the list-menu option: # bootadm list-menu Determine if the system uses the GRUB boot loader. Procedure: # more /pool-name/boot/grub/menu.lst or # more /boot/grub/menu.lst If menu.lst does not exist, this is a finding.
Configure the system to use the GRUB bootloader.
This check applies to the global zone only. Determine the type of zone that you are currently securing. # zonename If the command output is "global", this check applies. On systems that have a ZFS root, the active menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset. On systems that have a UFS root, the active menu.lst file is typically located at /boot/grub/menu.lst. To locate the active GRUB menu, use the bootadm command with the list-menu option: # bootadm list-menu Check the menu.lst file for the use of passwords. Procedure: # more /pool-name/boot/grub/menu.lst or # more /boot/grub/menu.lst Check for a password configuration line, such as the one below. password --md5 <password-hash> This line should be just below the line beginning with "timeout". Please note <password-hash> will be replaced by the actual MD5 encrypted password. If the password line is not in either of the files, this is a finding.
The GRUB console boot loader can be configured to use an MD5 encrypted password by adding password --md5 password-hash to the /pool-name/boot/grub/menu.lst or /boot/grub/menu.lst file. Use grub-md5-crypt to generate MD5 passwords from the command line.
This check applies to the global zone only. Determine the type of zone that you are currently securing. # zonename If the command output is "global", this check applies. Check the permission of the menu.lst file. On systems that have a ZFS root, the menu.lst file is typically located at /pool-name/boot/grub/menu.lst where "pool-name" is the mount point for the top-level dataset. On systems that have a UFS root, the menu.lst file is typically located at /boot/grub/menu.lst . Procedure: # ls -lL /pool-name/boot/grub/menu.lst or # ls -lL /boot/grub/menu.lst If menu.lst has a mode more permissive than 0600, this is a finding.
Change the mode of the menu.lst file to 0600. # chmod 0600 /pool-name/boot/grub/menu.lst or # chmod 0600 /boot/grub/menu.lst
Check for the password to precede the first image stanza in /etc/lilo.conf: # more /etc/lilo.conf password=”” image=/boot/vmlinuz-2.4.20-6smp If a password is not found, then this is a finding.
Password protect LILO by including the password=password line to the global section of /etc/lilo.conf.
Check /etc/lilo.conf permissions: # ls –lL /etc/lilo.conf If /etc/lilo.conf has a mode more permissive than 0600, then this is a finding.
Change the mode of the lilo.conf file. # chmod 0600 /etc/lilo.conf
Ask the SA if the system boots from removable media. If so, ask if the boot media is stored in a secure container when not in use. If it is not, this is a finding.
Store the system boot media in a secure container when not in use.
To check for the rpc.ugidd daemon perform: # chkconfig –list rpc.ugidd Or # ps –ef | grep –i ugidd If the daemon is running or installed this is a finding.
If the rpc.ugidd daemon is installed, disable it using the chkconfig utility.
Perform the following to check for unnecessary privileged accounts: # more /etc/passwd Some examples of unnecessary privileged accounts include halt, shutdown, reboot and who.
Remove any special privilege accounts, such as shutdown and halt, from the /etc/passwd and /etc/shadow files.
Check the system for unnecessary user accounts. Procedure: # more /etc/passwd Some examples of unnecessary accounts include games, news, gopher, ftp, and lp. If any unnecessary accounts are found, this is a finding.
Remove all unnecessary accounts, such as games, from the /etc/passwd file before connecting a system to the network. Other accounts, such as news and gopher, associated with a service not in use should also be removed.
Check /etc/news/hosts.nntp permissions. # ls -lL /etc/news/hosts.nntp If /etc/news/hosts.nntp has a mode more permissive than 0600, this is a finding.
Change the mode of the /etc/news/hosts.nntp file to 0600. # chmod 0600 /etc/news/hosts.nntp
Check /etc/news/hosts.nntp.nolimit permissions. # ls -lL /etc/news/hosts.nntp.nolimit If /etc/news/hosts.nntp.nolimit has a mode more permissive than 0600, this is a finding.
Change the mode of /etc/news/hosts.nntp.nolimit to 0600. # chmod 0600 /etc/news/hosts.nntp.nolimit
Check /etc/news/nnrp.access permissions. # ls -lL /etc/news/nnrp.access If /etc/news/nnrp.access has a mode more permissive than 0600, this is a finding.
Change the mode of the /etc/news/nnrp.access file to 0600. # chmod 0600 /etc/news/nnrp.access
Check /etc/news/passwd.nntp permissions. # ls -lL /etc/news/passwd.nntp If /etc/news/passwd.nntp has a mode more permissive than 0600, this is a finding.
Change the mode of the /etc/news/passwd.nntp file. # chmod 0600 /etc/news/passwd.nntp
Check the ownership of the files in /etc/news. Procedure: # ls -al /etc/news If any files are not owned by root or news, this is a finding.
Change the ownership of the files in /etc/news to root or news. Procedure: # chown root /etc/news/*
Check /etc/news files group ownership. Procedure: # ls -al /etc/news If /etc/news files are not group-owned by root or news, this is a finding.
Change the group owner of the files in /etc/news to root or news. Procedure: # chgrp root /etc/news/*
Examine the sshd configuration file. cat /opt/ssh/etc/sshd_config | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v '^#' | grep -i "Protocol" If Protocol 2,1 or Protocol 1 are defined on a line without a leading comment, this is a finding.
Edit the configuration file and modify the Protocol line. Protocol 2 Restart sshd: /sbin/init.d/secsh stop /sbin/init.d/secsh start
Check the system for configured remote consoles. If any console port is connected to a terminal outside of a secured environment or to any aggregation device (KVM, serial concentrator), or virtualization system that does not protect the console at the level of a privileged resource in accordance with the appropriate STIGs for these devices, this is a finding.
Remove the configuration for remote consoles.
Check if NTP running: # ps -ef | egrep "xntpd|ntpd" Check if ntpdate scheduled to run: # grep ntpdate /var/spool/cron/crontabs/* If NTP is running or ntpdate is found: # more /etc/ntp/ntp.conf Confirm the servers and peers or multicast client (as applicable) are local or an authoritative U.S. DoD source. If a non-local/non-authoritative (U.S. DoD source) time-server is used, this is a finding.
Use a local authoritative time server synchronizing to an authorized DoD time source. Ensure all systems in the facility feed from one or more local time servers that feed from the authoritative time server.
Logging should be enabled for those types of files systems that do not turn on logging by default. Procedure: # mount JFS, VXFS, HFS, XFS, reiserfs, EXT3, and EXT4 all turn logging on by default and will not be a finding. The ZFS file system uses other mechanisms to provide for file system consistency, and will not be a finding. For other file systems types, if the root file system does not have the logging option, this is a finding. If the nolog option is set on the root file system, this is a finding.
Implement file system journaling for the root file system, or use a file system using other mechanisms to ensure consistency. If the root file system supports journaling, enable it. If the file system does not support journaling or another mechanism to ensure consistency, a migration to a different file system will be necessary.
Check the system for a running Samba server. Procedure: # ps -ef |grep smbd If the Samba server is running, ask the SA if the Samba server is operationally required. If it is not, this is a finding.
If there is no functional need for Samba and the daemon is running, disable the daemon by killing the process ID as noted from the output of ps -ef |grep smbd. The utility should also be removed or not installed if there is no functional requirement.
Check /etc/sysctl.conf permissions: # ls -lL /etc/sysctl.conf If /etc/sysctl.conf is not owned by root, this is a finding.
Use the chown command to change the owner of /etc/sysctl.conf to root: # chown root /etc/sysctl.conf
Check /etc/sysctl.conf group ownership: # ls -lL /etc/sysctl.conf If /etc/sysctl.conf is not group-owned by root, this is a finding.
Use the chgrp command to change the group owner of /etc/sysctl.conf to root: # chgrp root /etc/sysctl.conf
Check /etc/sysctl.conf permissions: # ls –lL /etc/sysctl.conf If /etc/sysctl.conf has a mode more permissive than 0600, this is a finding.
Use the chmod command to change the mode of the /etc/sysctl.conf file. # chmod 0600 /etc/sysctl.conf
Determine if an NFS server is running on the system by: # ps –ef |grep nfsd If an NFS server is running, confirm that it is not configured with the insecure_locks option by: # exportfs –v The example below would be a finding: /misc/export speedy.example.com(rw,insecure_locks)
Remove the "insecure_locks" option from all NFS exports on the system. Procedure: Edit /etc/exports and remove all instances of the insecure_locks option. Re-export the file systems to make the setting take effect. # exportfs -a
Verify that Linux systems have disabled the <CTRL><ALT><DELETE> key sequence by performing: # grep ctrlaltdel /etc/inittab If the line returned is not commented out then this is a finding.
Ensure that the CTRL-ALT-DELETE key sequence has been disabled. If necessary, comment out the following line in the /etc/inittab file: #ca::ctrlaltdel:/sbin/shutdown -t3 -r now
Ensure the pam_console.so module is not configured in any files in /etc/pam.d by: # cd /etc/pam.d # grep pam_console.so * Or # ls -la /etc/security/console.perms If either the pam_console.so entry or the file /etc/security/console.perms is found then this is a finding.
Configure PAM to not grant sole access of administrative privileges to the first user logged in at the console. Identify any instances of pam_console. # cd /etc/pam.d # grep pam_console.so * For any files containing an un-commented reference to pam_console.so, edit the file and remove or comment out the reference. Remove the console.perms file if it exists: # rm /etc/security/console.perms
Check for any crontab entries that rotate audit logs. Procedure: # crontab -l If such a cron job is found, this is not a finding. Otherwise, query the SA. If there is a process automatically rotating audit logs, this is not a finding. If the SA manually rotates audit logs, this is still a finding, because if the SA is not there, it will not be accomplished. If the audit output is not archived daily, to tape or disk, this is a finding. This can be ascertained by looking at the audit log directory and, if more than one file is there, or if the file does not have today's date, this is a finding.
Configure a cron job or other automated process to rotate the audit logs on a daily basis.
Check the mode of the cron.deny file. If the cron.deny file is more permissive than 0600, this is a finding.
Change the mode of the cron.deny file to 0600.
Check programs run from cron for umask settings. If any specify a umask more permissive than 077, this is a finding.
Edit cron script files and modify the umask to 077.
Check the mode of the "at" directory. Procedure: # ls -ld /var/spool/cron/atjobs /var/spool/atjobs /var/spool/at If the directory mode is more permissive than 0755, this is a finding.
Change the mode of the "at" directory to 0755. Procedure: # chmod 0755 < at directory >
Check the ownership of the "at" directory. Procedure: # ls -ld /var/spool/cron/atjobs /var/spool/atjobs /var/spool/at If the directory is not owned by root, sys, bin, daemon, or cron, this is a finding.
Change the owner of the "at" directory to root, bin, sys, or system. Procedure: # chown root /var/spool/at (Replace root with another system group and/or /var/spool/at with a different "at" directory as necessary.)
Determine what "at" jobs exist on the system. Procedure: # ls /var/spool/cron/atjobs /var/spool/atjobs If there are no "at" jobs present, this is not applicable. Determine if any of the "at" jobs or any scripts referenced execute the umask command. Check for any umask setting more permissive than 077. # grep umask <at job or referenced script> If any "at" job or referenced script sets umask to a value more permissive than 077, this is a finding.
Edit "at" jobs or referenced scripts to remove umask commands setting umask to a value less restrictive than 077.
Check the owner of the at.allow file. If the owner is not root, bin, or sys, this is a finding.
Change the owner of the at.allow file to root, bin, or sys.
Check the ownership of the at.deny file. If the owner is not root, bin, or sys, this is a finding.
Change the owner of the at.deny file to root, bin, or sys.
Determine traceroute command locations and ownership. Procedure: # find / -name traceroute -exec ls -lL {} \; If the traceroute command is not owned by root, this is a finding.
Change the owner of the traceroute command to root, bin, or sys. Example: # chown root <traceroute command>
Determine traceroute command locations and group ownership. Procedure: # find / -name traceroute -exec ls -lL {} \; If the traceroute command is not group-owned by root, sys, bin, or system, this is a finding.
Change the group owner of the traceroute command to root, bin, sys, or system. Procedure: # chgrp root <traceroute command>
Determine traceroute command locations and mode. # find / -name traceroute -exec ls -lL {} \; If the traceroute command has a mode more permissive than 0700, this is a finding.
Change the mode of the traceroute command. # chmod 0700 <traceroute command>
Look in the root account home directory for a .netscape or a .mozilla directory. If none exists, this is not a finding. If there is one, verify with the root users and the IAO what the intent of the browsing is. Some evidence may be obtained by using the browser to view cached pages under the .netscape directory.
Enforce policy requiring administrative accounts use web browsers only for local service administration.
Check for the Sendmail version being displayed in the greeting. # telnet localhost 25 If a version number is displayed, this is a finding.
Ensure Sendmail or its equivalent has been configured to mask the version information. If necessary, change the O SmtpGreetingMessage line in the /etc/mail/sendmail.cf file as noted below. O SmtpGreetingMessage=$j Sendmail $v/$Z; $b Change it to: O SmtpGreetingMessage= Mail Server Ready ; $b
Search for any .forward files on the system. # find / -name .forward -print This is considered a finding if any .forward files are found on the system.
Remove .forward files from the system.
Check the shell for the anonymous FTP account. Procedure: # grep "^ftp" /etc/passwd This is a finding if the seventh field is empty (the entry ends with a ':') or if the seventh field does not contain one of the following. /bin/false /dev/null /usr/bin/false /bin/true /sbin/nologin
Configure anonymous FTP accounts to use a non-functional shell. If necessary, edit the /etc/passwd file to remove any functioning shells associated with the FTP account and replace them with non-functioning shells, such as, /dev/null.
Consult vendor documentation for the anonymous FTP service to determine the necessary configuration for operating the service in a chroot environment. If the system is not configured to operate the anonymous FTP service in a chroot environment, this is a finding.
Configure the anonymous FTP service to operate in a chroot environment. Consult vendor documentation for the necessary configuration procedures.
Ask the SA if this is an NMS server. If it is an NMS server, then ask what other applications run on it. If there is anything other than network management software and DBMS software used only for the storage and inquiry of NMS data, this is a finding.
Ensure only authorized software is loaded on a designated NMS server. Authorized software is limited to the NMS software itself, a database management system for the NMS server if necessary, and network management software.
Check /etc/syslog.conf ownership. # ls -lL /etc/syslog.conf If /etc/syslog.conf is not owned by root, this is a finding.
Use the chown command to set the owner to root. # chown root /etc/syslog.conf
Check /etc/syslog.conf group ownership. Procedure: # ls -lL /etc/syslog.conf If /etc/syslog.conf is not group-owned by root, sys, bin, or system, this is a finding.
Change the group owner of the /etc/syslog.conf file to root, bin, sys, or system. Procedure: # chgrp root /etc/syslog.conf
Examine the syslog.conf file for any references to remote log hosts. # grep -v "^#" /etc/syslog.conf | grep '@' Destination locations beginning with an @ represent log hosts. If the log host name is a local alias, such as log host, consult the /etc/hosts or other name databases as necessary to obtain the canonical name or address for the log host. Determine if the host referenced is a log host documented using site-defined procedures. If an undocumented log host is referenced, this is a finding.
Remove, replace, or document the referenced undocumented log host.
Check the system for an IPv4 default route. Procedure: # netstat -r |grep default If a default route is not defined, this is a finding.
Set a default gateway for IPv4.
Ask the SA if the system is a designated router. If it is not, this is not applicable. Check the system for non-routing network services. Procedure: # netstat -a | grep -i listen # ps -ef If non-routing services, including Web servers, file servers, DNS servers, or applications servers, but excluding management services, such as SSH and SNMP, are running on the system, this is a finding.
Ensure only authorized software is loaded on a designated router. Authorized software will be limited to the most current version of routing protocols and SSH for system administration purposes.
If the system does not use NIS or NIS+, this is not applicable. Check if NIS or NIS+ is implemented using UDP. Procedure: # rpcinfo -p | grep yp | grep udp If NIS or NIS+ is implemented using UDP, this is a finding.
Configure the system to not use UDP for NIS and NIS+. Consult vendor documentation for the required procedure.
Locate and examine all .rhosts, .shosts, hosts.equiv, and shosts.equiv files. Procedure: # find / -name .rhosts # more /<directorylocation>/.rhosts # find / -name .shosts # more /<directorylocation>/.shosts # find / -name hosts.equiv # more /<directorylocation>/hosts.equiv # find / -name shosts.equiv # more /<directorylocation>/shosts.equiv If any .rhosts, .shosts, hosts.equiv, or shosts.equiv file contains other than host-user pairs, this is a finding.
If possible, remove the .rhosts, .shosts, hosts.equiv, and shosts.equiv files. If the files are required, remove any content from the files except for necessary host-user pairs.
Verify the rshd service is not running.
Disable the rshd service.
Determine if the rexecd service is running. If the service is running, this is a finding.
Disable the rexecd service.
Determine the version of the SMTP service software. Locate the Sendmail daemon. Procedure: # find / -name sendmail Obtain version information for the Sendmail daemon. Procedure: # what <file location> OR # strings <file location> | grep version Version 8.14.4 is the latest required version. If the Sendmail version is not at least 8.14.4 or the vendor's latest version, this is a finding.
Obtain and install a newer version of Sendmail from the operating system vendor or from http://www.sendmail.org or ftp://ftp.cs.berkeley.edu/ucb/sendmail.
Check for an enabled debug command provided by the SMTP service. Procedure: # telnet localhost 25 debug If the command does not return a 500 error code of command unrecognized, this is a finding. If telnet is unavailable for testing, check the version of sendmail installed on the system. # echo \$Z | /usr/sbin/sendmail -bt -d0 If the sendmail reported version is less than 8.6, this is a finding.
Obtain and install a more recent version of Sendmail, which does not implement the DEBUG feature.
Check the SMTP service for an active decode command. Procedure: # telnet localhost 25 decode If the command does not return a 500 error code of command unrecognized, this is a finding.
Disable mail aliases for decode and uudecode. If the /etc/aliases or /usr/lib/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the "newaliases" command. For more information on mail aliases, refer to the man page for aliases. Disabled aliases would be similar to the examples below: # decode: |/usr/bin/uudecode # uudecode: |/usr/bin/uuencode -d
Determine if EXPN is disabled. Procedure: # telnet localhost 25 expn root If the command does not return a 500 error code of command unrecognized, this is a finding. OR Locate the sendmail.cf configuration file. Procedure: # find / -name sendmail.cf -print # grep -v "^#" <sendmail.cf location> | egrep -i "(goaway|noexpn)" Verify the EXPN command is disabled with an entry in the sendmail.cf file that reads as one of the following: Opnoexpn O PrivacyOptions=noexpn Opgoaway O PrivacyOptions=goaway (Other privacy options, such as novrfy or noetrn, may be included in the same line, separated by commas. The goaway option encompasses a number of privacy options, including noexpn.) If the EXPN command is not disabled, this is a finding.
Edit the sendmail.cf file and add Opnoexpn option. Restart the Sendmail service.
Determine if VRFY is disabled. Procedure: # telnet localhost 25 vrfy root If the command does not return a 500 error code of command unrecognized, this is a finding. OR Locate the sendmail.cf configuration file. Procedure: # find / -name sendmail.cf -print # grep -v "^#" <sendmail.cf location> |grep -i "(goaway|vrfy)" Verify the VRFY command is disabled with an entry in the sendmail.cf file that reads as one of the following: Opnovrfy O PrivacyOptions=novrfy Opgoaway O PrivacyOptions=goaway (Other privacy options, such as noexpn or noetrn, may be included in the same line, separated by commas. The goaway option encompasses a number of privacy options, including novrfy.) If the VRFY command is not disabled, this is a finding.
If Sendmail is running, add the line Opnovrfy to the Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact the vendor for information on how to disable the verify command. Newer versions of Sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail.
Locate the sendmail.cf configuration file and check for wiz configuration. Procedure: # find / -name sendmail.cf -print # grep -v "^#" <sendmail.cf location> |grep -i wiz If an entry is found for wiz, this is a finding.
If the WIZ command is enabled on Sendmail, it should be disabled by adding this line to the sendmail.cf configuration file (it must be typed in uppercase). OW* For the change to take effect, kill the Sendmail process, refreeze the sendmail.cf file, and restart the Sendmail process.
Determine if the TFTP daemon is active. If it is, this is a finding unless documented using site-defined procedures.
Disable the TFTP daemon.
Determine if the UUCP service is active. If the service is active, this is a finding.
Disable the UUCP service.
If X Windows is not used on the system, this is not applicable. Check the output of the xhost command from an X terminal. Procedure: $ xhost If the output reports access control is enabled (and possibly lists the hosts that can receive X Window logins), this is not a finding. If the xhost command returns a line indicating access control is disabled, this is a finding. NOTE: It may be necessary to define the display if the command reports it cannot open the display. Procedure: $ DISPLAY=MachineName:0.0; export DISPLAY MachineName may be replaced with an Internet Protocol Address. Repeat the check procedure after setting the display.
If using an xhost-type authentication the xhost - command can be used to remove current trusted hosts and then selectively allow only trusted hosts to connect with xhost + commands. A cryptographically secure authentication, such as provided by the xauth program, is always preferred. Refer to your X11 server's documentation for further security information.
Determine if the system has the finger service active. If the finger service is active, this is a finding.
Disable the finger service.
Use the command ftp to connect the system's FTP service. Attempt to log into this host with a user name of anonymous and a password of guest (also try the password of guest@mail.com). If the logon is not successful, this check is not applicable. Ask the SA if the system is located on a DMZ network. If the system is not located on a DMZ network, this is a finding.
Move the system to a DMZ network.
The reviewer will interview the IAO and view the SFUG, or equivalent documentation, to verify that it is documented that users should remove all power from a USB device when it is moved from one IS to another for at least 60 seconds to allow all power to dissipate and the memory to erase.
Update the SFUG, or an equivalent document, to include this information.
The reviewer will interview the IAO to verify that the IAO knows that USB devices such as MP3 players, camcorders, or digital cameras are not to be attached to ISs without prior DAA approval, and that this information is disseminated to all users.
The IAO will be made aware of the policy that USB devices such as MP3 players, camcorders, or digital cameras are not to be attached to ISs without prior DAA approval. The IAO will disseminate the policy to all users.
The reviewer will interview the IAO or SA to verify that prior approval by the IAO is required before USB devices are attached to DoD ISs and that this policy is disseminated to all users.
The IAO will know that approval by the IAO is required before USB devices are attached to DoD ISs and the IAO will ensure that this policy is disseminated to all users.
The reviewer will interview the IAO to verify that the policy banning disguised jump drives from locations containing DoD ISs is disseminated to all users.
Disseminate the policy banning disguised jump drives from locations containing DoD ISs to all users.
The reviewer will interview the IAO and view the notices.
Post the required notices informing people entering a location containing DOD ISs that disguised USB jump drives are banned
The reviewer will interview the IAO to verify that the policy for treating persistent memory USB devices as removable media, and in accordance with DODD 5200.1-R; the devices are secured, transported, and sanitized in a manner appropriate for the classification level of the data they contain is disseminated to all users. This would include any device with internal non-removable persistent memory not just jump drives or disk driver.
Disseminate the policy requiring that persistent memory USB devices will be treated as removable media and, in accordance with DODD 5200.1-R; the devices will be secured, transported, and sanitized in a manner appropriate for the classification level of the data they contain.
The reviewer will interview the IAO or SA to verify that the labeling of persistent memory USB devices is in accordance with the classification level of the data they contain.
Label persistent memory USB devices in accordance with the classification level of the data they contain. Disseminate this policy to all users.
The reviewer will interview the IAO to verify that all sensitive data stored on a USB device with persistent memory, if required by the data owner, is encrypted using NIST-certified cryptography.
Establish a process that will disseminate the requirement for encrypt of sensitive data that the data owner designates as needing encryption. Also establish a process identifying which data needs to be encrypted and notifying the users that the identified data needs encryption.
The reviewer will interview the IAO to verify that USB devices with persistent memory are formatted in a manner to allow the application of Access Controls to files or data stored on the device.
Develop a process to disseminate the requirement that USB devices with persistent memory will be formatted in a manner to allow the application of Access Controls to files or data stored on the device.
The reviewer will interview the IAO and review the relevant document. What needs to be here is a description for handling, and labeling of USB devices. Additionally an explanation of the restrictions placed on attaching non-government owned USB devices to a government owned IS and the prohibition of disguised USB jump drives.
Develop, update, and distribute a SFUG section dealing with USB devices in accordance with the SPAN STIG.
The reviewer will interview the IAO and review the relevant documentation. The discussion should point out that with some devices it may not be obvious that it contains persistent non-removable memory and that, if there is a doubt, it will be treated as if it contains persistent memory.
Develop, update, and distribute a SFUG section on USB devices that discusses devices that may contain persistent non-removable memory in accordance with the SPAN STIG.
The reviewer will interview the IAO or SA to verify that no IS has its BIOS set to allow a boot from any USB device. Note an IS can be booted from a USB device for maintenance or recovery purposes, but will never be allowed to do so when in normal use. Note: Some systems do not have a setting for disabling Boot from USB. In these cases, boot from USB should be moved to last in the boot device list in the bios. The risk is lessened not mitigated so the reviewer will mark this as a CAT 2 finding.
Develop a plan to check all ISs' BIOS settings as soon a possible. The check will verify that none of the BIOS are set to allow a boot from a USB device. Obtain CM approval for the plan and execute the plan.
Check the release information for the operating system. If the release is not supported, this is a finding.
Upgrade to a supported version of the operating system.
Determine if a file integrity baseline, which includes cryptographic hashes, has been created and maintained for the system. If no file integrity baseline exists for the system, this is a finding. If the file integrity baseline contains no cryptographic hashes, this is a finding. If the file integrity baseline is not maintained (has not been updated to be consistent with the latest approved system configuration changes), this is a finding.
Create a file integrity baseline, including cryptographic hashes, for the system.
Determine if there is a cron job, scheduled to run weekly or more frequently, to run the file integrity tool to check for unauthorized system libraries or binaries, or unauthorized modification to authorized system libraries or binaries. Procedure: # crontab -l If there is no cron job meeting these requirements, this is a finding. NOTE: The frequency may be increased to daily, if necessary, in accordance with the contingency plan.
Create a cron job, scheduled to run weekly or more frequently, to run the file integrity tool to check for unauthorized system libraries or binaries, or unauthorized modification to authorized system libraries or binaries. NOTE: The frequency may be increased to daily, if necessary, in accordance with the contingency plan.
Check the UID assignments of all accounts. # more /etc/passwd Confirm all accounts with a UID of 99 and below are used by a system account. If a UID reserved for system accounts (0 - 99) is used by a non-system account, this is a finding.
Change the UID numbers for non-system accounts with reserved UIDs (those less or equal to 99).
Check the system minimum password length setting. If the setting is not 14 or greater, this is a finding.
Set the system minimum password length setting to 14 or greater.
Determine if at least 1 lowercase letter is required for passwords. If the settings do not enforce at least 1 lower case letter, this is a finding.
Configure the system to require at least 1 lowercase letter for passwords.
Verify the system requires passwords contain at least one numeric character.
Configure the system to require passwords contain at least one numeric character.
Verify the system requires passwords contain at least one special character.
Configure the system to require passwords contain at least one special character.
Verify the system requires passwords to contain no more than three consecutive repeating characters. If the system allows passwords to contain more than three consecutive repeating characters, this is a finding.
Configure the system to require passwords to contain no more than three consecutive repeating characters.
Verify the system requires passwords be changed at least every 60 days.
Configure the system to require passwords be changed at least every 60 days.
Ask the SA if there are any automated processing accounts on the system. If there are automated processing accounts on the system, ask the SA if the passwords for those automated accounts are changed at least once a year. If SA indicates passwords for automated processing accounts are not changed once per year, this is a finding.
Implement or establish procedures to change the passwords of automated processing accounts at least once per year.
Check if the root is used for direct logins. Procedure: # last root | grep -v reboot If the last command is not available, consult vendor documentation to determine an appropriate method for obtaining a list of root account logins. If any direct login records for root are listed, this is a finding.
Enforce policy requiring all root account access is attained by first logging into a user account and then becoming root (using su, for example).
Verify the system logs successful and unsuccessful access to the root account. If it does not, this is a finding.
Troubleshoot the system logging configuration to provide for logging of root account login attempts.
Check global initialization files' permissions: # ls -l /etc/.login # ls -l /etc/profile # ls -l /etc/bashrc # ls -l /etc/environment # ls -l /etc/security/environ If global initialization files are more permissive than 0444, this is a finding.
Change the mode of the global initialization file(s) to 0444. # chmod 0444 <global initialization file>
Check the ownership of global initialization files. Procedure: # ls -lL /etc/.login /etc/profile /etc/bashrc /etc/environment /etc/security/environ If any global initialization file is not owned by bin, this is a finding.
Change the ownership of global initialization files with incorrect ownership. Procedure: # chown bin <global initialization files>
Check the group ownership of global initialization files. Procedure: # ls -lL /etc/.login /etc/profile /etc/bashrc /etc/environment /etc/security/environ If any global initialization file is not group-owned by root, sys, bin, other, system, or the system default, this is a finding.
Change the group ownership of the global initialization file(s) with incorrect group ownership. Procedure: # chgrp root <global initialization file>
Check skeleton files ownership. # ls -alL /etc/skel If a skeleton file is not owned by bin, this is a finding.
Change the ownership of skeleton files with incorrect mode. # chown bin <skeleton file>
Check the global initialization files' executable search paths. Procedure: # grep -i PATH /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/environment /etc/.login /etc/security/environ This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit the global initialization file(s) with PATH variables containing relative paths. Edit the file and remove the relative path from the PATH variable.
NOTE: The following must be done in the BASH shell. Examine the PATH variable contained in any user's local initialization files to ensure the use of only absolute paths, using a command shell that supports the use of ~USER as USER's home directory. # cat /etc/passwd | cut -f 1,1 -d ":" | xargs -n1 -IUSER sh -c 'grep -i PATH ~USER/.*' The PATH variable is a colon-delimited directory list. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/) or other than "$PATH", it is a relative path and this is a finding.
Edit the local initialization file(s) and remove the relative path entry from the PATH variable.
Check system configuration files for plus (+) entries. Procedure: # find / -name .rhosts -exec grep + {} \; # find / -name .shosts -exec grep + {} \; # find / -name hosts.equiv -exec grep + {} \; # find / -name shosts.equiv -exec grep + {} \; # grep + /etc/passwd # grep + /etc/shadow # grep + /etc/group If the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files contain a plus (+) and do not define entries for NIS+ netgroups, this is a finding.
Edit the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files and remove entries containing a plus (+).
Check for the existence of the files. # find / -name .rhosts # find / -name .shosts # find / -name hosts.equiv # find / -name shosts.equiv If .rhosts, .shosts, hosts.equiv, or shosts.equiv are found, this is a finding.
Remove the .rhosts, .shosts, hosts.equiv, and/or shosts.equiv files.
Check the PAM configuration for rhosts_auth. Procedure: # grep rhosts_auth /etc/pam.conf If a rhosts_auth entry is found, this is a finding.
Edit /etc/pam.conf and remove the reference(s) to the rhosts_auth module.
Check the group ownership of public directories. Procedure: # find / -type d -perm -1002 -exec ls -ld {} \; If any public directory is not group-owned by root, sys, bin, or an application group (such as mail), this is a finding.
Change the group ownership of the public directory. Procedure: # chgrp root /tmp (Replace root with a different system group and/or /tmp with a different public directory as necessary.)
List all crontab files on the system. If any crontab is not owned by root or the creating user, this is a finding.
Change the crontab owner to root or the crontab creator. # chown root <crontab file>
Check the cron.allow and cron.deny files for the system. If a default system account (such as bin, sys, adm, or others) is listed in the cron.allow file, or not listed in the cron.deny file if no cron.allow file exists, this is a finding.
Remove default system accounts (such as bin, sys, adm, or others) from the cron.allow file if it exists, or add those accounts to the cron.deny file.
Determine if process core dumps are enabled on the system. If process core dumps are enabled, this is a finding.
Disable process core dumps on the system.
Check the ownership of the kernel core dump data directory. If the kernel core dump data directory is not owned by root, this is a finding.
Change the owner of the kernel core dump data directory to root.
Determine if the system implements non-executable program stacks. If the system does not implement non-executable program stacks, this is a finding.
Enable non-executable program stacks on the system.
Determine if the system uses easily guessable initial TCP sequence numbers. If it does, this is a finding.
Configure the system to use initial TCP sequence numbers most resistant to sequence number guessing attacks.
If the system is configured to forward source-routed packets, this is a finding.
Configure the system to not forward source-routed packets.
Determine if the /home path is a separate file system. If it is not, this is a finding.
Migrate the /home (or equivalent) path onto a separate file system.
Check /etc/syslog.conf and verify the auth facility is logging both the notice and info level messages by using one of the procedures below. # grep "auth.notice" /etc/syslog.conf # grep "auth.info" /etc/syslog.conf OR # grep 'auth.*' /etc/syslog.conf If auth.* is not found, and either auth.notice or auth.info is not found, this is a finding.
Edit /etc/syslog.conf and add local log destinations for auth.* or both auth.notice and auth.info.
First, determine if inetd/xinetd is running. # ps -ef |grep inetd If inetd is not running, this is not a finding. # grep -v "^#" /etc/inetd.conf If no active services are found, yet the inetd daemon is running, this is a finding.
Remove or disable the inetd startup scripts and kill the service.
Check if Help is disabled in Sendmail. Procedure: # telnet <host> 25 > help If the help command returns any Sendmail version information, this is a finding.
To disable the SMTP HELP command, remove or empty the Sendmail help file: /etc/mail/helpfile.
Determine if unencrypted ftp or telnet are enabled. # cat /etc/inetd.conf | tr ‘\011’ ‘ ‘ | tr –s ‘ ‘ | sed -e 's/^[ \t]*//' | grep –v “^#” | \ egrep –c –i “ i^ftp|ftp| ftp|^telnet|telnet| telnet” If either of these services are found (IE: the command returns a non-zero value), and are not commented, ask the SA if both of these services are encrypted. If they are not, this is a finding.
Edit /etc/inetd.conf and comment out or remove the "ftp" and "telnet" services.
Check the umask setting for the FTP user. Procedure: # su - ftp $ umask If the umask value does not return 077, this is a finding.
Edit the initialization files for the FTP user and set the umask to 077.
Check the file permissions for the .Xauthority files in the home directories of users of X. Procedure: # cd ~<X user> # ls -lL .Xauthority If the file mode is more permissive than 0600, this is finding.
Change the mode of the .Xauthority files. Procedure: # chmod 0600 .Xauthority
Determine if the X server is running. Procedure: # ps -ef |grep X Determine if xauth is being used. Procedure: # xauth xauth> list If the above command sequence does not show any host other than the localhost, then xauth is not being used. Search the system for an X*.hosts files, where * is a display number that may be used to limit X window connections. If no files are found, X*.hosts files are not being used. If the X*.hosts files contain any unauthorized hosts, this is a finding. If both xauth and X*.hosts files are not being used, this is a finding.
Create an X*.hosts file, where * is a display number that may be used to limit X window connections. Add the list of authorized X clients to the file.
Check the X Window system access is limited to authorized clients. Procedure: # xauth xauth> list Ask the SA if the clients listed are authorized. If any are not, this is a finding.
Remove unauthorized clients from the xauth configuration. # xauth remove <display name>
Determine if the X Window system is running. Procedure: # ps -ef |grep X Ask the SA if the X Window system is an operational requirement. If it is not, this is a finding.
Disable the X Windows server on the system.
Determine the owner of the SNMP configuration file. Consult vendor documentation to determine the location and name of the file. Procedure: # find / -name snmpd.conf # ls -lL <snmpd.conf> If the snmpd.conf file is not owned by bin, this is a finding.
Change the owner of the snmpd.conf file to bin. Procedure: # chown bin <snmpd.conf file>
Ask the SA if the log host server is collecting data for hosts outside the local enclave. If it is, this is a finding.
Configure the hosts outside of the local enclave to not log to this system.
Determine if the syslog daemon accepts remote messages. If it does, this is a finding.
Configure the system syslog daemon to not accept messages from remote hosts.
Check the TCP wrappers configuration files to determine if SSHD is configured to use TCP wrappers. Procedure: # grep sshd /etc/hosts.deny # grep sshd /etc/hosts.allow If no entries are returned, the TCP wrappers are not configured for SSHD and this is a finding.
Add appropriate IP restrictions for SSH to the /etc/hosts.deny and/or /etc/hosts.allow files.
Determine if the system is configured for IPv4 forwarding. If so, this is a finding.
Disable IPv4 forwarding on the system.
If an IM client is installed, ask the SA if it has access to any public domain IM servers. If it does have access to public servers, this is a finding.
Uninstall the IM client from the system, or configure the client to only connect to DoD-approved IM services.
Ask the SA if any peer-to-peer file-sharing applications are installed. Some examples of these applications include: - Napster, - Kazaa, - ARES, - Limewire, - IRC Chat Relay, and - BitTorrent. If any of these applications are installed, this is a finding.
Uninstall the peer-to-peer file sharing application(s) from the system.
Check the domain name for NIS maps. Procedure: # domainname If the name returned is simple to guess, such as the organization name, building, or room name, etc., this is a finding.
Change the NIS domain name to a value difficult to guess. Consult vendor documentation for the required procedure.
For each security tool on the system, determine if the tool is configured to notify the IAO and SA of any detected security problem. If such notifications are not configured, this is a finding.
Configure the security tools on the system to notify the IAO and SA when any security issues are detected.
Check for the existence of the /etc/hosts.allow and /etc/hosts.deny files. Procedure: # ls -la /etc/hosts.allow # ls -la /etc/hosts.deny If either file does not exist, this is a finding. Check for the presence of a default deny entry. Procedure: # grep "ALL: ALL" /etc/hosts.deny If the "ALL: ALL" entry is not present in the /etc/hosts.deny file, any TCP service from a host or network not matching other rules will be allowed access. If the entry is not in /etc/hosts.deny, this is a finding.
Edit the /etc/hosts.allow and /etc/hosts.deny files to configure access restrictions.
On newer Linux systems, the LILO password can be hashed in a separate file. To determine if the LILO password is encrypted perform the following: # grep password /etc/lilo.conf If the returned line contains password=””, then perform the following: # more /etc/lilo.conf.crc If the system uses the LILO boot loader, and the file does not exist, this is a finding.
Configure LILO for encrypted passwords.
Check /etc/securetty group ownership: # ls -lL /etc/securetty If /etc/securetty is not group owned by root, sys, or bin, then this is a finding.
Change the group-owner of /etc/securetty to root, sys, or bin. Example: # chgrp root /etc/securetty
Check /etc/securetty ownership. Procedure: # ls -lL /etc/securetty If /etc/securetty is not owned by root, this is a finding.
Change the owner of the /etc/securetty file to root. Procedure: # chown root /etc/securetty
Check /etc/securetty permissions. Procedure: # ls –lL /etc/securetty If /etc/securetty has a mode more permissive than 0640, this is a finding.
Change the mode of the /etc/securetty file to 0640. Procedure: # chmod 0640 /etc/securetty
Determine if any network analysis tools are installed. Procedure: # find / -name ethereal # find / -name wireshark # find / -name tshark # find / -name netcat # find / -name tcpdump # find / -name snoop If any network analysis tools are found, this is a finding.
Remove the network analysis tool binary from the system. Consult vendor documentation for removing packaged software, or remove the binary directly. Procedure: # rm <binary>
Determine if a DoD-approved virus scan program is installed and using updates less than 14 days old. If not, this is a finding.
Install McAfee command line virus scan tool, or an appropriate alternative from https://www.jtfgno.mil. Ensure the virus signature definition files are no older than seven (7) days. Updates are also available from https://www.jtfgno.mil. Ensure the command line virus scan tool is run on a regular basis using a utility, such as cron.
1. Use the UNIX Checklist to manually verify compliance to the UNIX requirements. OR 2. On the ESX Server service console, perform the following command: # find / -iname Script.* If the command brings back an output, review the result files that are located under (Script.Month)/hostname. Review the results and verify that only GEN003540 and GEN006640 are open. If any other findings are open this is a finding. If the command does not return a result, then the reviewer will have to run the UNIX SRR scripts from the CD. If there are any open findings other than GEN003540 and GEN006640 this is a finding. The following open findings will NOT be applicable when running the UNIX SRR against the ESX Server service console: GEN003540 - Executable Stack GEN003540 (CAT II) OPEN FINDING DESCRIPTION GEN003540: The SA will ensure the executable stack is disabled. SYSTEM CONFIGURATION: VMware ESX Server 3 does not support this configuration. The kernel has executable stack enabled. GEN006640 - Virus Protection GEN006640 (CAT I) OPEN FINDING DESCRIPTION GEN006640: An approved DoD virus scan program in not used and/or updated. SYSTEM CONFIGURATION: Unable to install McAfee Virus scan command-line tool on VMware ESX. Some of the prerequisite filesets for this product conflict with the versions required by VMware Operating System filesets. Note: The UNIX SRR Scripts are not supported on the ESX Server. If used, please verify all results and findings against the UNIX Checklist.
Manually check the UNIX requirements against the ESX Server or run the UNIX SRR scripts against the ESX Server service console.
On the ESX Server service console, perform the following: # ps –ef | grep nfsd If you see the something other than the “grep nfsd” process, this is a finding.
Do not configure an NFS Server on the ESX Server host.
On the ESX Server host, perform the following commands on the service console: # find /vmfs or nfs –type f –name ‘*.vmx’ –exec ls –Al {} \; | grep –v -- “rwxr-x-r--“ Review the results from this command. If the result has permissions that are more restrictive, then this is not a finding. Any result that has less restrictive permissions (greater than 754) is a finding. If no result is returned, then this is not a finding. Permissions for all .vmx files should be 754 or rwxr-xr—or more restrictive.
Configure .vmx files to 754.
Validating the iSCSI device software will require the assistance of the system administrator. The system administrator will have to give you the version number of the software and validate that the software is at the latest version. If the software is not at the latest version, this is a finding.
Install the latest patches and updates to the iSCSI device.
Work with the system administrator to determine compliance. Request the system administrator login to the iSCSI storage device and verify that the password is 14 characters. Review the complexity requirements are met by reviewing the configuration with the system administrator. The complexity requirements are one upper case letter, one lower case letter, one special character, and one number. If the password does not meet these requirements, this is a finding.
Configure all iSCSI passwords according to DoD policy.
At the ESX Server service console terminal, type the following: # grep usb /etc/modules.conf Verify that all “alias usb-controller“ text is commented out with a pound sign (#). Text should look similar to the following: # alias usb-controller usb-uhci # alias usb-controller1 usb-ohci If not, this is a finding. Caveat: This is not applicable to usb keyboards and mice that are plugged into the system. If this is the case, this check is Not Applicable.
Disable the external USB drive from loading automatically.
Go to the ESX Server service console, and type the following: # esxcfg-nics –l vmnic0 vmnic1 If you do not see vmnic0 and vmnic1 in the listing, this is a finding. A minimum of two network adapters are required.
Configure the ESX Server with two network adapters.
Work with the network reviewer and system administrator to determine compliance. Go to the switch that connects the ESX Server to the network. Request a copy of the switch configuration to verify the ports that the ESX Server plugs into are not configured to VLAN 1. Below is an example of disabling VLAN 1 and creating a VLAN that may be used for ESX Server traffic. Cisco IOS Example: Interface VLAN1 no ip address shutdown interface VLAN 12 ip address 10.0.0.25 255.255.255.0 no shutdown set interface sc0 10.0.0.25 255.255.255.0
Configure ESX Server external physical switches to something other than VLAN 1.
Logon to the ESX Server service console, and perform the following to review the permissions on the esx* utilities. # ls -lL /usr/sbin/esx* | less All permissions here should be 500 except for esxcfg-auth and esxupdate which should be 544. If they are not the correct permissions, this is a finding.
Change the permissions to all esx* utilities to 500 except for esxcfg-auth and exsupdate which should be 544.
Work with the system administrator to gain access to the ESX Server service console to perform the following command. # esxcfg-vswitch –l If the ‘Used Ports’ has the number 0, this is a finding. Caveat: VMotion, HA, and DRS virtual switches may have unused port groups. This check is not applicable to these switches. Also, if VMotion is configured for a virtual machine(s), then when VMotion occurs, a duplicate virtual switch will be configured so the virtual machine can run once the migration is complete. These virtual switches will have 0 used ports until it is VMotioned to the ESX Server host. Therefore, virtual switches in this scenario are not applicable to this check. These virtual switches must be available for proper VMotion, HA, and DRS purposes.
Remove all unused port groups from virtual switches.
On the ESX service console, perform the following: # less /etc/rc.local #!/bin/sh # # This script will be executed *after* all other init scripts. # You can put your own initialization entries in here if you don’t # want to do the full Sys V style init stuff. Touch /var/lock/subsys/local If you see something similar to the following, this is a finding: echo “PromiscuousAllowed yes” > /proc/vmware/net/vmnic0/config Note: If promiscuous mode is turned on for troubleshooting purposes, it must be documented and approved with the IAO/SA.
Disable promiscuous mode during the ESX Server boot process.
Request a copy of the external switch configuration that the ESX Server is connected to. Work with the network reviewer and system administrator to review the configuration to ensure that either spanning-tree is disabled for those ports or spanning-tree is configured to portfast. If either one of these conditions is not configured, this is a finding. Cisco IOS panning-tree portfast: Switch# show running-config interface <gigabit or fastethernet> <module/port number> Interface gigabit 5/1 No ip address Switchport Switchport access vlan <number> Switchport mode access Spanning-tree portfast End Switch# Cisco IOS spanning-tree disabled: Switch# show running config …. No spanning-tree vlan <number> …. Should see the VLAN number in the no spanning-tree vlan command.
Disable spanning-tree or configure spanning-tree to portfast for the external switch ports.
Request of copy of the external switch configuration that the ESX Server has trunk links configured. Work with the network reviewer and system administrator to verify the non-negotiate option is set. Cisco CATOS switch: CATOS Console> (enable) set trunk <port number> nonnegotiate dot1q Cisco IOS switch: IOS Console# switchport trunk nonnegotiate If the non-negotiate option is not set, this is a finding.
Configure the non-negotiate option for trunks connected to external physical switches.
1. Request from the IAO/SA the documentation that details the VLANs configured on the physical switch port to the ESX Server. 2. Request a copy of the external switch port configurations to verify the documented VLANs match the configured VLANs. If there are undocumented VLANs configured on the external switch ports, this is a finding.
Document all trunk VLANs between ESX Server and external switches.
1. Log into VirtualCenter with the VI Client and select the ESX server from the Inventory panel. 2. Click the Configuration tab and click Security Profile. The VI Client displays a list of currently active incoming and outgoing connections with the corresponding firewall ports. 3. Click Properties to open the Properties dialog box. The Firewall Properties dialog box lists all the services and management agents that are configured for the host. 4. If you do not see the Firewall Properties window, then check proceed to step 7. 5. Review the services enabled to ensure that only the following ports are open: Ports that may be open for High Security: 902, 80, 443, and 22. If only these ports are open, this is not a finding. 6. If there are other ports that are open, request the documentation from the IAO/SA that details the reasons for the additional ports are required. If no documentation can be produced, this is a finding. 7. Verify IPtables are configured on the ESX Server service console by performing the following: # iptables –L | grep hostd The displayed result should look similar to the following: iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 443 –j Accept //hostd iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 80 –j Accept //hostd # iptables –L | grep authd The displayed result should look similar to the following: iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 902 –j Accept //authd # iptables –L | grep snmpd The displayed result should look similar to the following: iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 161 –j Accept //snmpd At the bottom of the INPUT chain you should see the following: iptables –A INPUT –j REJECT //deny all rule at end of chain If no rules are applied to the INPUT chain for these services, this is a finding. If this cannot be verified, this is a finding. Caveat: Medium Security may be used only if additional ports are required to be open and it has been approved and documented by the IAO/SA.
Configure the ESX Server firewall to High Security.
1. If check ESX0320 was not a finding, then this check is not a finding. If it was a finding, then proceed to step 2. 2. Ask the IAO/SA what device is being used to restrict these services. If it is a router or firewall, then work with the network reviewer or system administrator to verify compliance. 3. If it is not a router/firewall, then review the IPtables configuration. Verify IPtables are configured on the ESX Server service console by performing the following: # iptables –L | grep hostd The displayed result should look similar to the following: iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 443 –j Accept //hostd iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 80 –j Accept //hostd # iptables –L | grep authd The displayed result should look similar to the following: iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 902 –j Accept //authd # iptables –L | grep snmpd The displayed result should look similar to the following: iptables –A INPUT -d <IP Addresses Allowed> –p tcp –dport 161 –j Accept //snmpd At the bottom of the INPUT chain you should see the following: iptables –A INPUT –j REJECT //deny all rule at end of chain If no rules are applied to the INPUT chain for these services, this is a finding. If this cannot be verified, this is a finding. Note: ESX Server 3.x uses hostd for the server daemon and it is not configurable with TCP wrappers. Hostd listens on http/https ports.
Restrict access to the ESX Server services to only authorized IP addresses.
Request the required services documentation from the IAO/SA. If no documentation can be produced, this is a finding. Compare this to the services running on the ESX Server by performing the following on the service console: #netstat –an If a discrepancy exists between the services documented, and the services running, this is a finding.
Document all required services for the ESX Server.
Request the ESX Server service console user documentation from the IAO/SA. Compare this documentation to the users on the ESX Server by performing the following at the service console: # less /etc/passwd If a discrepancy exists between the ESX Server and the documentation, this is a finding.
Document all ESX Server service console users for the ESX Server.
The following /etc files in the table below need to have hash signatures that are stored offline. Ask the IAO/SA the location of the hash signatures and verify that it is not on the ESX Server host. If it is, this is a finding. If the hash signatures are incomplete, this is a finding. File Location Permission /etc/fstab 640 /etc/group 644 /etc/host.conf 640 /etc/hosts 640 /etc/hosts.allow 640 /etc/hosts.deny 640 /etc/logrotate.conf 640 /etc/logrotate.d/ 700 /etc/modules.conf 640 /etc/motd 640 /etc/ntp 755 /etc/ntp.conf 644 /etc/pam.d/system-auth 644 /etc/profile 644 /etc/shadow 400 /etc/securetty 600 /etc/ssh/sshd_config 600 /etc/snmp 755 /etc/sudoers 440 /etc/vmware 755
Store the hash signatures for the /etc files in an offline location.
All the following setuid applications should have the setuid bit configured so that normal users may run the application with raised privileges. To verify the setuid bit is set (s), perform the following on the ESX Server service console: # find /sbin /usr/bin /bin /usr/lib/vmware/bin \ /usr/lib/vmware/bin-debug/ /usr/sbin –perm -4000 pam_timestamp_check pwdb_chkpwd unix_chkpwd crontab passwd su vmkload_app vmware-vmx vmkload_app vmware-vmx vmware-authd If the setuid bit is not set on these applications, this is a finding. OR # find /sbin –perm -4000 pam_timestamp_check pwdb_chkpwd unix_chkpwd # find /usr/bin –perm -4000 crontab passwd # find /bin –perm -4000 su # find /usr/lib/vmware/bin/ -perm -4000 vmkload_app vmware-vmx # find /usr/lib/vmware/bin-debug/ -perm -4000 vmkload_app vmware-vmx # find /usr/sbin/ -perm -4000 vmware-authd If the setuid bit is not set on these applications, this is a finding.
Configure the setuid and setgid applications with the appropriate permissions.
NTP authentication is used by time clients to authenticate the time server to prevent rogue server intervention. NTP authentication is based on encrypted keys. A key is encrypted and sent to the client by the server, where it is unencrypted and checked against the client key to ensure a match. NTP keys are stored in the ntp.keys file in the following format: Key-number M Key (The M stands for MD5 encryption), e.g.: 1 M secret 5 M RaBBit 7 M TiMeLy 10 M MYKEY The NTP configuration file ntp.conf specifies which of the keys are trusted. Any keys specified in the keys file but not trusted will not be used for authentication, e.g.: trustedkey 1 7 10 In this example, 5 is not trusted, only 1, 7, and 10 above. 1. On the ESX Server service console perform the following: # cat /etc/ntp.conf Review the configuration file to verify that the following are uncommented: authenticate yes …. keys /etc/ntp/keys If these are commented out, this is a finding. 2. Next verify that the trusted keys are configured in the ntp.conf file. trustedkey <number> If none are listed, this is a finding. 3. Next, review the keys file located at /etc/ntp/keys by performing the following: # cat /etc/ntp/keys Verify that keys are listed in the keys file. File should look similar to the following: 5 M RaBBit 7 M TiMeLy 10 M MYKEY If no keys are configured here, this is a finding.
Configure the ESX Server to authenticate the time source.
To verify that all the log files are being written to, perform the following on the ESX Server service console: # ls –l /var/log | awk ‘{if ($5 ~ /^0$/) print}’ If any of the following log files are returned, this is a finding. vmkernel vmkwarning vmksummary.txt messages secure # ls –l /var/log/vmware/ | awk ‘{if ($5 ~ /^0$/) print}’ If any of the following log files are returned, this is a finding. vpxa.log webAccess Work with SA to locate the path to the virtual machines. # ls –l <virtual machine path on ESX>/ | awk ‘{if ($5 ~ /^0$/) print}’ If the following log file is returned, this is a finding. vmware.log Caveat: If logs are being sent to a syslog server, then work with the system administrator to verify they are being written to. Location of all logs to be verified are listed below: VMkernel /var/log/vmkernel VMkernel warnings: /var/log/vmkwarning VMkernel summary: /var/log/vmksummary.txt ESX Server host agent log: /var/log/vmware/hostd.log Individual virtual machine logs: <path to virtual machine on ESX Server>/vmware.log VI Client agent log: /var/log/vmware/vpx/vpxa.log Web access: /var/log/vmware/webAccess Service console: /var/log/messages Authentication log: /var/log/secure
Record all critical log files on the ESX Server.
On the ESX Server service console review the following log file permissions. For each file or folder perform the following: # ls –lL /var/log OR # ls –lL /var/log/(directory) Log Location Permission /var/log/boot.log 600 /var/log/cron 600 /var/log/dmesg 640 /var/log/initrdlogs/ 600 /var/log/ksyms 600 /var/log/maillog 600 /var/log/messages 600 /var/log/oldconf/ 700 /var/log/rpmpkgs 600 /var/log/secure 600 /var/log/spooler 600 /var/log/storageMonitor 600 /var/log/sudolog 600 /var/log/vmkernel 600 /var/log/vmkproxy 600 /var/log/vmksummary 600 /var/log/vmksummary.d/ 600 /var/log/vmkwarning 600 /var/log/vmware/ 700 If any of the directories or files do not match the table above, this is a finding.
Restrict unauthorized users from log files.
1. To determine is the ESX Server is sending its logs to a remote syslog server, examine the /etc/syslog.conf file on the ESX Server service console. 2. To send all syslog data from the ESX Server to a remote syslog host, search for the following line(s) in the /etc/syslog.conf file: *.* <Tab><Tab> @loghost (name of remote host) Or *.debug, info, etc.@loghost. At a minimum, the following log files should be configured to send logs to the syslog server: Log Name Facility.Level Default Location Service Console Logs *.info /var/log/messages Authentication Logs Authpriv.* /var/log/secure VMkernel Logs Local6.notice /var/log/vmkernel VMkernel Warnings Local6.warning /var/log/vmkwarning If these are not configured to the syslog server, this is a finding. 3. Verify the loghost referred to in the syslog.conf file is not resolving to the localhost. Check /etc/hosts file to review what the remote host is referring to. If it is not in this file, check the DNS server to determine what it is resolving to. If it is resolving to localhost, this is a finding. Caveat: This syslog server may be a virtual machine within an ESX Server farm with HA enabled. If the syslog server is a virtual machine within a server farm and HA is not enabled, this is a finding. It may not be a virtual machine if there is only one ESX Server for the site. If this is the case, this is a finding.
Configure the ESX Server to send all its logs to a syslog server.
On the ESX Server service console perform the following command: #ps –ef | grep auditd Verify the auditd daemon is running. If it is not, this is a finding.
Configure LAUS on the ESX Server. LAUS is included on the ESX distribution media. The procedures to install it are as follows: laus-libs-0.1-76RHEL3.i386.rpm is installed, but laus-0.1-76RHEL3.i386.rpm is not. 1. Mount the ISO image / CD-ROM to VMware/RPMS, and install via # rpm -ivh laus- 0.1-76RHEL3.i386.rpm 2. Run the following command from the shell # service audit start 3. Run the following commands to test to see if LAUS is configured. These commands will produce output: # /usr/sbin/aucat OR # /usr/sbin/augrep.
On the ESX Server service console perform the following: # esxupdate –l query The output will look similar to the following: Installed software bundles -----Name---- --Install Date-- --------Summary-------- 3.5.0-56329 23:37:26 11/04/08 Full installation of ESX 3.5.0-56329 ESX350-200802055-BG 23:49:26 11/04/08 Fix COS running Dell OM5 w/QLogic ESX350-200803066-SG 23:50:02 11/04/08 Fix COS security bug Verify the latest release is listed. The latest release for the various software versions is listed: Version 3.5.0 - ESX350-200712401-BG Version 3.0.2 Update 1 - ESX-1003359 Version 3.0.2 - ESX-1003359 (End of support is 10/29/2008) Version 3.0.1 - ESX-1003347 (End of support is 7/31/2008) Version 3.0.0 – Not Supported by VMware Version 2.5.5 – Update Patch 4 (End of support 6/15/2010) Version 2.5.4 – Update Patch 15 (End of Support is 10/8/2008) Patches are released monthly, so check Vmware’s website to ensure new patches have not been released. The website for patch downloads is http://www.vmware.com/download/vi/. If the latest release is not installed, this is a finding.
Configure the ESX Server software with the latest release.
Ask the IAO/SA to show you where the test and development ESX Server is located. At the service console of the test and development ESX Server perform the following command: # esxupdate –l query The output will look similar to the following: Installed software bundles -----Name---- --Install Date-- --------Summary-------- 3.5.0-56329 23:37:26 11/04/08 Full installation of ESX 3.5.0-56329 ESX350-200802055-BG 23:49:26 11/04/08 Fix COS running Dell OM5 w/QLogic ESX350-200803066-SG 23:50:02 11/04/08 Fix COS security bug If no patch results are returned, this is a finding. The test and development ESX Server cannot be the production ESX Server(s).
Use the test and development ESX Server to test all patches before moving them to production.
On the ESX Server service console perform the following commands: # grep esxupdate /var/log/vmware/esxupdate.log If no entries are returned, this is a finding.
Utilize VMware tools for all ESX Server updates.
On the ESX Server service console perform the following: # esxupdate –l query Output will look similar to this: Installed software bundles -----Name---- --Install Date-- --------Summary-------- 3.5.0-56329 23:37:26 11/04/08 Full installation of ESX 3.5.0-56329 The line above is the ESX software version is installed. ESX350-200802055-BG 23:49:26 11/04/08 Fix COS running Dell OM5 w/QLogic ESX350-200803066-SG 23:50:02 11/04/08 Fix COS security bug Check VMware’s website to double check the support policy in case it has been updated if you have access to the internet. The URL is http://www.vmware.com/support/policies/eos_vi.html#General Below is the support schedule for the various releases of the ESX Server. If the esxupdate –l query return anything below 2.5.4, this is a finding. If the query returns 3.0.0, this is a finding. For all other results, check the schedule and date for end of support to determine if this check is a finding. VMware ESX Server General Availability Date End of Support (Security and Bug fixes) Note Version 3.0.2 Update 1 10/29/2007 One year after Version 3.0.2 Update 2 GA Version 3.0.2 07/31/2007 10/29/2008 Version 3.0.1 10/05/2006 07/31/2008 Version 3.0.0 06/15/2006 EOS Reached Not covered by VI Support Life Cycle, see FAQ ________________________________________ Version 2.5.5 10/08/2007 06/15/2010, pending no Version 2.5.6 release Version 2.5.4 10/05/2006 10/08/2008 Version 2.5.3 04/13/2006 EOS Reached Not covered by VI Support Life Cycle, see FAQ Version 2.5.2 09/15/2005 EOS Reached Not covered by VI Support Life Cycle, see FAQ Version 2.5.1 06/20/2005 EOS Reached Not covered by VI Support Life Cycle, see FAQ Version 2.5.0 11/29/2004 EOS Reached Not covered by VI Support Life Cycle, see FAQ
Implement only VMware supported ESX Server software.
There are many third party applications that may be used in conjunction with VI3. There are many VMware applications that may be used to enhance the virtualization infrastructure. These include VMware Consolidated Backup, VirtualCenter, VMotion, Hardware Availability, and Distributed Resource Scheduling. 1. Request the list of all the VMware and third party applications used in the virtualization infrastructure. Use this list to research the support of each product. If no list can be produced this is a finding. 2. For all third party applications, go to the vendor’s website or request from the IAO/SA documentation verifying that the application is supported. If the application is not supported, this is a finding. 3. For VMware applications, look at the table and end of support dates below. Check VMware’s website to double check the support policy in case it has been updated if you have access to the internet. The URL is http://www.vmware.com/support/policies/eos_vi.html#General If the VMware application is not supported, this is a finding. VMware Consolidated Backup General Availability Date End of Support (Security and Bug fixes) Note Version 1.0.3 Update 1 10/31/2007 One year after Version 1.0.3 Update 2 GA Version 1.0.3 07/31/2007 10/31/2008 Version 1.0.2 Update 1 10/31/2007 07/31/2008 Version 1.0.2 04/05/2007 10/31/2008 Version 1.0.1 10/02/2006 04/05/2008 Version 1.0.0 06/15/2006 EOS Reached Not covered by VI Support Life Cycle, see FAQ VMware VirtualCenter, VMware Vmotion, VMware HA, and VMware DRS General Availability Date End of Support (Security and Bug fixes) Note Version 2.0.2 Update 2 11/08/2007 One year after Version 2.0.2 Update 3 Version 2.0.2 Update 1 10/29/2007 11/08/2008 Version 2.0.2 07/19/2007 10/29/2008 Version 2.0.1 10/05/2006 07/19/2008 Version 2.0.0 06/15/2006 EOS Reached Not covered by VI Support Life Cycle, see FAQ ________________________________________ Version 1.4.1 09/28/2006 06/15/2010, pending no Version 1.4.2 Version 1.4.0 07/06/2006 EOS Reached Not covered by VI Support Life Cycle, see FAQ ________________________________________ Version 1.3.1 P1 03/23/2006 EOS Reached Not covered by VI Support Life Cycle, see FAQ Version 1.3.1 12/22/2005 EOS Reached Not covered by VI Support Life Cycle, see FAQ Version 1.3.0 09/22/2005 EOS Reached Not covered by VI Support Life Cycle, see FAQ ________________________________________ Version 1.2.0 P1 02/24/2005 EOS Reached Not covered by VI Support Life Cycle, see FAQ Version 1.2.0 12/19/2004 EOS Reached Not covered by VI Support Life Cycle, see FAQ ________________________________________ Version 1.1.0 08/06/2004 EOS Reached Not covered by VI Support Life Cycle, see FAQ ________________________________________ Version 1.0.0 03/31/2004 EOS Reached Not covered by VI Support Life Cycle, see FAQ
Use only vendor supported products with the virtualization infrastructure.
1. Determine the MAC level of the ESX and management servers by asking the IAO/SA. 2. Once the MAC level is determined, locate the backup media or storage location. For MAC I servers, a redundant secondary system is required that is not collocated. For MAC II servers, daily backups are required with recovery media stored offline. For MAC III servers, backups must be performed weekly. 3. Depending on the MAC level, verify the servers are backed up to media or storage within the guidelines of the MAC level. If they are not, this is a finding.
Backup the ESX and management servers in accordance to the MAC level.
Ask the IAO/SA to show you the location of the backup data for the ESX Servers, VirtualCenter servers, virtual machines, and any other virtual infrastructure applications. If the backup data is on separate physical media, this would not be a finding. If the backups are located on a SAN, verify that the production data is logically partitioned from the backup media. If the backup data is on the same partition as the production data, this is a finding.
Place backup data on a separate partition from the production data.
1. Log into the VirtualCenter server using the VI Client. 2. Click Administration > VirtualCenter Management Server Configuration The VirtualCenter Management Server Configuration dialog appears. 3. Click SSL Settings in the left pane and enable Check host certificates checkbox. Click OK. If the Check host certificates checkbox is not checked, this is a finding. 4. Verify that the SSL certificates exist on the ESX Server. On the ESX Server service console check the /etc/vmware/ssl/ directory for the certificates by performing the following: # ls –lL /etc/vmware/ssl/ If the default ESX Server keys are present below, this is a finding. rui.cert rui.key This directory should contain a DoD certificate and key only (server.crt and server.key) If this directory does not contain a DoD certificate and key file, then this is a finding. If no valid DoD certificate and private key are present here this is a finding. This directory should contain a DoD certificate and key only (server.crt and server.key). Validate the certificate is listed in the InstallRoot3.12_SAG.pdf document. The DoD certificates that are listed in the InstallRoot3.12_SAG.pdf document are listed in Section 1, Appendix B. If the certificate is not listed here, this is a finding. Note: The InstallRoot3.12_SAG.pdf document may have been replaced with a newer version. If so, use the most current version listed on the DoD PKE site. Note: The InstallRoot3.12 _SAG.pdf document can be downloaded from the following links: (Note: These links may have changed since the release of the checklist.) https://www.us.army.mil/suite/page/474113 OR https://www.us.army.mil/suite/portal/index.jsp. Select Files and search for the InstallRoot folder. Select the InstallRoot folder and select the InstallRoot3.12_SAG.pdf document to download.
Enable encryption for all VI client sessions with the ESX Server. To create DoD certificate and private key perform the following steps: 1. On the ESX Server, navigate to /usr/bin/ and execute the following command: # openssl req –new –out filename.csr 2. When prompted enter the following: (Do not type the quotations) For Country Name, type “US” For State or Province Name, type “.” For Locality Name, type “.” For Organization Name, type “U.S. Government” For Organizational Unit Name, type “OU=DISA, OU=PKI, OU=DoD” For Common Name, type your Fully Qualified Domain Name of your server (i.e. server.disa.mil) For Email Address, type your email address 3. The output from this command will yield two files: filename.csr and privkey.pem 4. Upload/Copy the filename.csr to the Regular SSL Server Enrollment Form for the DoD PKI site. You may use either of the two sites below. Note: These Certificate Authorities may have been decommissioned since the release of the checklist. If so, please use the most current Certificate Authority for enrolling your certificate request. CA-17 URL - https://ca-17.c3pki.chamb.disa.mil/ca CA-18 URL - https://ca-18.c3pki.den.disa.mil/ca 5. You will be emailed that your certificate is ready and you will retrieve your signed certificate from the CA. 6. Put the new signed certificate and private key in the /etc/vmware/ssl/ directory. Move the old certificate and key from the directory and put them somewhere safe for backup purposes.
1. First verify Web Access is enabled by having the IAO/SA attempt to login to the ESX Server. 2. Start the Web Browser 3. Enter the URL of the ESX Server: http://(host or server name)/ui. The http should transition to https://(host or server name)/ui. If it does not transition to https, this is a finding.
Encrypt all Web Access session to ESX Servers.
On the ESX Server service console perform the following: # grep ssl /etc/vmware/hostd/config.xml (ssl) (privatekey)/etc/vmware/ssl/DoD Key(/privatekey) (certificate)/etc/vmware/ssl/DoD Cert(/certificate) (/ssl) If you do not see the DoD key and certificate listed between the SSL tags or the lines are commented out, this is a finding.
Encrypt all VirtualCenter sessions with ESX Servers.
Log into the ESX Server service console and perform the following. # grep rwcommunity /etc/snmp/snmpd.conf If the command returns a result, then this is a finding.
Disable SNMP write mode.
On the ESX Server service console perform the following: # grep vpx /etc/passwd Output should appear as follows: vpxuser:x:500:100:Vmware VirtualCenter administration account: /home/vpxuser:/bin/false #grep vpx /etc/shadow Output should appear as follows: vpxuser:(hash value)/:13995:1:360:14::: (These numbers may be different based on the site) If any of these files have been changed from the above values for the vpxuser, this is a finding.
Do not modify the vpxuser account.
On the ESX Server service console perform the following command to determine if the /ISO, /Utilities, or /vmimages file partitions are accessible to unauthorized users. # ls -la /vmimages (Or the name of the partition) Permissions for .iso files should be 440 (r--r-----). If they are not 440 or more restrictive, this is a finding.
Restrict iso images to only authorized users.
On the ESX Server service console go to the partition that stores the ISO images and verify hash checksums are present for any ISO files. Perform the following to determine if ISO images are verified for integrity: # ls -al /vmimages (Or the name of the ISO partition) If no sha1sums are returned or the number of ISO images is different from the number of sha1sums, this is a finding.
Create SHA1 checksums for all ISO images.
On the ESX Server service console go to the partition that stores the ISO images and verify hash checksums are present for any ISO files. Perform the following to determine if ISO images are verified for integrity: # cd /vmimages (Or location of ISO images) && ls -al # cat iso_sha1sum_file (Where this is the sha1sum file of ISO file) # sha1sum Filename.iso – ISO file OR #Sha1sum –c iso_sha1sum_file Filename.iso : OK Examples: # cat Redhat.iso.sha1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Redhat.iso # sha1sum Redhat.iso da39a3ee5e6b4b0d3255bfef95601890afd80709 Redhat.iso OR # sha1sum –c Redhat.iso.sha1 Redhat.iso : OK Compare the sha1sum against each other to ensure they are the same. If they are not the same, this is a finding.
Verify all SHA1 checksums for all ISO images.
Perform the following on the ESX Server service console to determine if the /Master, /Utilities, /vmimages, or /(the name of the partition) are on separate disk partitions: # vdf -h Examine the Mounted on column for the disk device and ensure the device label for /Master, /Utilities, or /vmimages is not the same as the root filesystem. If they are the same, this is a finding.
Store all master templates on a separate partition.
On the ESX Server service console perform the following command to determine if the /Master, /Utilities, or /vmimages file partitions are accessible to unauthorized users. # ls -la /vmimages (Or name of master template directory) Permissions for .vmdk files should be 600 or rw-------. If they are not 600 or more restrictive, this is a finding.
Restrict master templates to authorized users only.
Ask the IAO/SA if Vmotion is used to migrate virtual machines from one ESX Server host to another. If not, this is Not Applicable. If so, perform the following on the ESX Server service console: # grep –in vmotion /var/log/vmware/vpx/vpxa*.log If the logs are compressed, perform the following: # zcat /var/log/vmware/vpx/vpxa*.log.gz | grep –i vmotion If no result is returned, this is a finding.
Log all VMotion migrations.
Review the location of the virtual machines. Ensure that authorized users are required to verify their identity and authority before gaining access to the virtual machines. If the virtual machines are not located in a controlled access area, this is a finding.
Place all virtual machines in a controlled access area.
Typically the OS log files are sent to a syslog server. Ask the IAO/SA the location of all archived OS logs that were saved before any rollback or revert to snapshot of the virtual machine. Correlate the logs to the rollback time to ensure that they are legitimate. If no logs have been saved, this is a finding.
Archive all virtual machine OS log files before any virtual machine rollback.
1. Login to VirtualCenter with the VI Client and select the virtual machine from the Inventory panel. The configuration page for the virtual machine appears with the Summary tab displayed. 2. Click Edit Settings. 3. Click Options > General and make a record of the path displayed in the virtual machine configuration file field. 4. At the ESX Server service console, change directories to access the virtual machine configuration file recorded in step 3. 5. Virtual machine configuration files are located in the /vmfs/volumes/(datastore) directory, where (datastore) is the name of the storage device on which the virtual machine files reside. In example above, [vol1]vm-finance/vm-finance.vmx is located in /vmfs/volumes/vol1/vm-finance/. 6. To verify the log size limit, perform the following: # grep log.rotate.Size (virtual machine name).vmx log.rotateSize=(number in bytes) If no limit is set, this is a finding. The default is 500KB.
Configure a limit for virtual machine log size.
1. Login to VirtualCenter with the VI Client and select the virtual machine from the Inventory panel. The configuration page for the virtual machine appears with the Summary tab displayed. 2. Click Edit Settings. 3. Click Options > General and make a record of the path displayed in the virtual machine configuration file field. 4. At the ESX Server service console, change directories to access the virtual machine configuration file recorded in step 3. 5. Virtual machine configuration files are located in the /vmfs/volumes/(datastore) directory, where (datastore) is the name of the storage device on which the virtual machine files reside. In example above, [vol1]vm-finance/vm-finance.vmx is located in /vmfs/volumes/vol1/vm-finance/. 6. To verify the number of log files has been configured, perform the following: # grep –i log.keepOld (virtual machine name).vmx If log.keepOld=(number of files to keep) is not configured to 6 or higher, this is a finding. The default number of files to keep is 6 where the oldest ones are deleted and new ones are created.
Configure the ESX Server to limit the number of logs retained.
Locate where archived virtual machine log files (vmware.log) are stored. If they are offsite, review the process to move them to this alternative site. Verify that the log files are retained for at least one year at a minimum. This can be verified by reviewing the dates of the oldest backup files or media. If the log files are not stored for a minimum of one year, this is a finding.
Retain virtual machine log files for a minimum of one year.
1. Determine the MAC level of the virtual machines by asking the IAO/SA. 2. Once the MAC level is determined, locate the backup media or storage location. For MAC I servers, a redundant secondary system is required that is not colocated. For MAC II servers, daily backups are required with recovery media stored offline. For MAC III servers, backups must be performed weekly. 3. Depending on the MAC level, verify the virtual machines are backed up to media or storage within the guidelines of the MAC level. If they are not, this is a finding.
Backup all virtual machines according to the MAC level.
Use VMS and navigate to the site’s assets. Ensure all virtual machines are registered within VMS. If they are not registered, this is a finding.
Register all virtual machines in VMS.
Use VMS and navigate to the site’s assets. Ensure the ESX Server(s) are registered within VMS. If they are not registered, this is a finding.
Register ESX Servers in VMS.
If check ESX0863 is a finding, this should be marked a finding also. If the assets are registered, verify that the following postures are registered. If any of the postures are not registered, this is a finding. ESX Server 3 Tomcat 5.x
Register ESX Servers in VMS with the correct posture.
On the ESX Server host, perform the following commands on the service console: # find /vmfs or nfs –type f –name ‘*.vmdk’ –exec ls –Al {} \; | grep –v -- “rw--------“ Any result from this command is a finding. If no result is returned, this is not a finding. Permissions for all .vmdk files should be 600 or rw-------. If they are not, this is a finding.
Configure .vmdk files to 600.
Check the system's configuration to determine if the NTP daemon is running continuously, or if a scheduled job is configured to synchronize time at least every hour. If the NTP daemon is not running, and there is no scheduled job for time synchronization, this is a finding.
Configure the system to synchronize time continuously or schedule a job to perform time synchronization at least once per hour. Consult system documentation for implementation details.
Check the root crontab for ntpdate entries. # crontab -l | grep ntpdate If the ntpdate command is not invoked with at least two external NTP servers listed, this is a finding. Check the NTP daemon configuration for at least two external servers. # grep ^server ntp.conf | egrep -v '(127.127.1.1|127.127.1.0)' If less than two servers or external reference clocks (127.127.x.x other than 127.127.1.0 or 127.127.1.1) are listed, this is a finding.
If using ntpdate, add additional NTP servers to the cron job running ntpdate. If using the NTP daemon, add an additional "server" line to ntp.conf for each additional NTP server.
Check the root crontab for ntpdate entries. # crontab -l | grep ntpdate If the ntpdate command is invoked with NTP servers outside of the enclave, this is a finding. Check the NTP daemon configuration. # grep '^server' ntp.conf If an NTP server is listed outside of the enclave, this is a finding.
If using ntpdate, remove NTP servers external to the enclave from the cron job running ntpdate. If using the NTP daemon, remove the server line from ntp.conf for each NTP server external to the enclave.
Check the root crontab for ntpdate entries. # crontab -l | grep ntpdate If the ntpdate command is not invoked with the -a parameter, this is a finding. Check the NTP daemon configuration. # grep ^server ntp.conf | grep -v '( key | autokey )' If server lines are present without key or autokey options, this is a finding.
If using ntpdate, add the -a option with a key to the cron job running ntpdate. If using the NTP daemon, add the key or autokey options, as appropriate, to each server line in ntp.conf for each NTP server not configured for authentication.
Run ls -l ntp.conf to display the owner of the NTP configuration file. If the owner is not root, this is a finding.
Change the owner of the NTP configuration file to root. # chown root ntp.conf
Check the group-ownership of the NTP configuration file. Procedure: # ls -lL <configuration file> If the group-owner is not root, bin, sys, or system, this is a finding.
Change the group-owner of the NTP configuration file. Procedure: # chgrp root <ntp.conf>
Verify the mode for the NTP configuration file is not more permissive than 0640. # ls -l ntp.conf If the mode is more permissive than 0640, this is a finding.
Change the mode of the NTP configuration file to 0640 or less permissive. # chmod 0640 ntp.conf
Check for an extended ACL on the NTP configuration file. # ls -l ntp.conf If the permissions contain a '+' the file has an extended ACL, this is a finding.
Remove the extended ACL from the ntp.conf file.
Determine if the system is configured to limit the number of simultaneous logins for user accounts. If it is not, this is a finding.
Configure the system to limit the number of simultaneous logins for user accounts.
Determine if the system displays the date and time of the last successful login upon logging in. This can be accomplished by logging into the system and verifying whether or not the necessary information is displayed. If the system does not provide this information upon login, this is a finding.
Configure the system to display the date and time of the last successful login upon logging in. Consult OS documentation for the configuration procedure.
Determine if the system displays the number of failed login attempts upon logging in. Attempt to log into the system once using an invalid password or other authenticator, then log into the system using the same account with a valid authenticator. If the system does not display a message indicating there was a failed login attempt, this is a finding.
Configure the system to display the number of failed logins upon logging in. Consult OS documentation for the necessary procedure.
Determine if a publicly-viewable pattern is displayed during a session lock. If the session lock pattern is not publicly-viewable, this is a finding.
Configure the system to display a publicly-viewable pattern during a session lock.
Determine if the system enforces the correctness of the entire password during authentication. If it does not, this is a finding. Procedure: Set an account's password to a string longer than 8 characters. Attempt to log into the account using only the first 8 characters of the password. If the login succeeds, this is a finding.
Configure the system to enforce the correctness of the entire password during authentication. Consult vendor documentation for the required settings.
Determine if the system creates password hashes using a FIPS 140-2 approved cryptographic hashing algorithm. Consult OS documentation to determine the necessary configuration settings. If the system is not configured to generate password hashes using a FIPS 140-2 approved algorithm, this is a finding.
Configure the system to use a FIPS 140-2 approved cryptographic hash algorithm for creating password hashes.
Determine if any password hashes stored on the system were not generated using a FIPS 140-2 approved cryptographic hashing algorithm. Generally, a hash prefix of $5$ or $6$ indicates approved hashes. Consult OS documentation to determine the actual prefixes or other methods used by the OS to indicate approved hash algorithms. Procedure: # cut -d ':' -f2 /etc/passwd # cut -d ':' -f2 /etc/shadow If any password hashes are present not beginning with $5$ or $6$, or have other indications of the use of approved hash algorithms consistent with vendor documentation, this is a finding.
Replace password hashes with those created using a FIPS 140-2 approved cryptographic hashing algorithm.
Determine if the system requires at least one lowercase alphabetic character for passwords. If it does not, this is a finding.
Configure the system to require at least one lowercase alphabetic character for passwords.
Consult vendor documentation for the configuration setting that controls the minimum number of changed characters required during a password change. If the configured number is less than 4, this is a finding.
Consult vendor documentation for the configuration setting that controls the minimum number of changed characters required during a password change. Change the setting to 4.
Determine if the system prevents the use of dictionary words in passwords. If it does not, this is a finding.
Configure the system to prevent the use of dictionary words in passwords.
Consult vendor documentation to determine if a specific configuration setting is available to restrict the ability to switch to the root user. If there is, and this is not configured, this is a finding. If there is not specific configuration, verify su is group-owned by the group permitted to access root and has no other execute permission. Procedure: # ls -l /bin/su If the group owner is not the group permitted access to root, or if /bin/su is executable by other users, this is a finding.
If the OS has a specific configuration setting to restrict access to root to a particular group, configure this in accordance with vendor documentation. Otherwise, change the group ownership of su to the group permitted root access, and remove any other execute permission. Procedure: # chgrp <authorized group> /bin/su # chmod o-x /bin/su
Verify the root account's home directory has no extended ACL. # ls -ld ~root If the permissions include a "+", the directory has an extended ACL and this is a finding.
Remove the extended ACL from the root account's home directory.
Consult vendor documentation for the system's dynamic linker to determine which environment variables specify the library search path. List the root user's environment variables. Procedure: # env Determine if the root user's library search path is different from the system default. If so, this is a finding.
Configure the root user's library search path to the system default.
Consult vendor documentation for the system's dynamic linker to determine what environment variables are used to configure the list of preloaded libraries. List the root user's environment variables. Procedure: # env Determine if the root account's list of preloaded libraries is empty. If it is not, this is a finding.
Empty the root account's list of preloaded libraries.
Determine if any file on the system does not have a valid group owner. If any such files are found, this is a finding.
Change the group owner for each file without a valid group owner. # chgrp <a-valid-group> /tmp/a-file-without-a-valid-group-owner
Verify network services daemon files have no extended ACLs. # ls -la <network service daemon> If the permissions include a '+', the file has an extended ACL, this is a finding. Note: Network daemons not residing in these directories must also be checked.
Remove the extended ACL(s) from the network service daemon file(s).
Verify all system command files have no extended ACLs. # ls -lL /etc /bin /usr/bin /usr/lbin /usr/ucb /sbin /usr/sbin If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL(s) from the system command file(s).
Determine if any system log file has an extended ACL. If an extended ACL exists, verify with the SA if the ACL is required to support authorized software and provides the minimum necessary permissions. If an extended ACL exists providing access beyond the needs of authorized software, this is a finding.
Remove the extended ACL(s) from the system log file(s).
Determine if any manual page files on the system have extended ACLs. If so, this is a finding.
Remove the extended ACLs from system manual page file(s).
Determine if any system library file has an extended ACL. If so, this is a finding.
Remove the extended ACL(s) from the system library file(s).
Determine if any NIS/NIS+/yp command files have an extended ACL. If so, this is a finding.
Remove the extended ACL from the NS/NIS+/yp command file(s).
Verify the /etc/resolv.conf file is owned by root. Procedure: # ls -l /etc/resolv.conf If the file is not owned by root, this is a finding.
Change the owner of the /etc/resolv.conf file to root. # chown root /etc/resolv.conf
Check the group ownership of the resolv.conf file. Procedure: # ls -lL /etc/resolv.conf If the file is not group owned by root, bin, sys, or system, this is a finding.
Change the group owner of the /etc/resolv.conf file to root, bin, sys, or system. Procedure: # chgrp root /etc/resolv.conf
Check the mode of the /etc/resolv.conf file. Procedure: # ls -l /etc/resolv.conf If the file mode is more permissive than 0644, this is a finding.
Change the mode of the /etc/resolv.conf file to 0644 or less permissive. # chmod 0644 /etc/resolv.conf
Verify /etc/resolv.conf has no extended ACL. # ls -l /etc/resolv.conf If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from /etc/resolv.conf file.
Verify the /etc/hosts file is owned by root. Procedure: # ls -lL /etc/hosts If the file is not owned by root, this is a finding.
Change the owner of the /etc/hosts file to root. # chown root /etc/hosts
Check the /etc/hosts file's group ownership. Procedure: # ls -lL /etc/hosts If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the /etc/hosts file to root, sys, bin, or system. Procedure: # chgrp root /etc/hosts
Check the mode of the /etc/hosts file. Procedure: # ls -l /etc/hosts If the file mode is more permissive than 0644, this is a finding.
Change the mode of the /etc/hosts file to 0644 or less permissive. # chmod 0644 /etc/hosts
Verify /etc/hosts has no extended ACL. # ls -lL /etc/hosts If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/hosts file.
Verify the /etc/nsswitch.conf file is owned by root. Procedure: # ls -l /etc/nsswitch.conf If the file is not owned by root, this is a finding.
Change the owner of the /etc/nsswitch.conf file to root. # chown root /etc/nsswitch.conf
Check the group ownership of the nsswitch.conf file. Procedure: # ls -lL /etc/nsswitch.conf If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the /etc/nsswitch.conf file to root, bin, sys, or system. Procedure: # chgrp root /etc/nsswitch.conf
Check the mode of the /etc/nsswitch.conf file. Procedure: # ls -l /etc/nsswitch.conf If the file mode is more permissive than 0644, this is a finding.
Change the mode of the /etc/nsswitch.conf file to 0644 or less permissive. Procedure: # chmod 0644 /etc/nsswitch.conf
Verify /etc/nsswitch.conf has no extended ACL. Procedure: # ls -l /etc/nsswitch.conf If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/nsswitch.conf file.
Determine if DNS is enabled on the system. # grep dns /etc/nsswitch.conf If no line is returned, or any returned line is commented out, the system does not use DNS, and this is not applicable. Determine the name servers used by the system. # grep nameserver /etc/resolv.conf If less than two lines are returned that are not commented out, this is a finding.
Edit /etc/resolv.conf and add additional nameserver lines until at least two are present.
Verify the /etc/passwd file is owned by root. Procedure: # ls -l /etc/passwd If the file is not owned by root, this is a finding.
Change the owner of the /etc/passwd file to root. # chown root /etc/passwd
Check the group ownership of the passwd file. Procedure: # ls -lL /etc/passwd If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the /etc/passwd file to root, bin, sys, or system. Procedure: # chgrp root /etc/passwd
Verify /etc/passwd has no extended ACL. # ls -l /etc/passwd If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the /etc/passwd file.
Verify the /etc/group file is owned by root. Procedure: # ls -l /etc/group If the file is not owned by root, this is a finding.
Change the owner of the /etc/group file to root. # chown root /etc/group
Check the group ownership of the /etc/group file. Procedure: # ls -lL /etc/group If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the /etc/group file. Procedure: # chgrp root /etc/group
Check the mode of the /etc/group file. Procedure: # ls -l /etc/group If the file mode is more permissive than 0644, this is a finding.
Change the mode of the /etc/group file to 0644 or less permissive. # chmod 0644 /etc/group
Verify /etc/group has no extended ACL. # ls -l /etc/group If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/group file.
Check the ownership of the /etc/shadow file. Procedure: # ls -lL /etc/shadow If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the /etc/shadow file. Procedure: # chgrp root /etc/shadow
Verify /etc/shadow has no extended ACL. # ls -lL /etc/shadow If the permissions include a '+', the file has an extended ACL, this is a finding. If the /etc/shadow file does not exist and the system is in Trusted Mode, this is not a finding. Verify Trusted Mode: # ls -lLR /tcb/files/auth/<a-z,A-Z> The TCB file(s) should exist and should not have an extended ACL.
Remove the extended ACL from the /etc/shadow file.
Check that the /etc/gshadow file is owned by root. # ls -l /etc/gshadow If the file is not owned by root, this is a finding.
Change the owner of the /etc/gshadow file to root. # chown root /etc/gshadow
Check the mode of the /etc/gshadow file. # ls -l /etc/gshadow If the file mode is more permissive than 0400, this is a finding.
Change the mode of the /etc/gshadow file to 0400 or less permissive. # chmod 0400 /etc/gshadow
Verify no password hashes are present in /etc/passwd. # cut -d : -f 2 /etc/passwd | grep -v '^x$' If any password hashes are returned, this is a finding.
Migrate /etc/passwd password hashes to /etc/shadow. # pwconv
Check the /etc/group file for password hashes. Procedure: # cut -d : -f 2 /etc/group | egrep -v '^(x|!)$' If any password hashes are returned, this is a finding. If no password hashes are returned, there is no finding.
Edit /etc/group and change the password field to an exclamation point (!) to lock the group password.
Check the /etc/gshadow file for password hashes. # cut -d : -f 2 /etc/gshadow | egrep -v '^(x|!|)$' If any password hashes are returned, this is a finding.
Edit /etc/gshadow and change the password field to an exclamation point (!) to lock the group password.
Verify user's home directories have no extended ACLs. # cut -d : -f 6 /etc/passwd | xargs -n1 ls -ld If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the user home directory.
Check the contents of user home directories for files group-owned by a group of which the home directory's owner is not a member. 1. List the user accounts. # cut -d : -f 1/etc/passwd 2. For each user account, get a list of GIDs for files in the user's home directory. # find < users home directory > -exec ls -lLd 3. Obtain the list of GIDs associated with the user's account. # id < user name > 4. Check the GID lists. If there are GIDs in the file list not present in the user list, this is a finding.
Change the group of a file not group-owned by a group where the home directory's owner is a member. # chgrp [user's primary group] [file with bad group ownership]
Check the contents of user's home directories for files with extended ACLs. # cut -d : -f 6 /etc/passwd | xargs -n1 -IDIR ls -alLR DIR If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL(s) from the files and directories in user home directories.
Verify run control scripts have no extended ACLs. # ls -lL /etc/rc* /etc/init.d If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the run control script(s).
Verify run control scripts' library search paths. The variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit run control scripts' library search path variables. Remove empty entries or entries that are not absolute paths.
Check that run control scripts' library preload list. This variable is formatted as a colon-separated list of paths. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit the run control scripts' library preload list and remove relative paths.
Check global initialization files for extended ACLs. # ls -lL /etc/profile /etc/bashrc /etc/csh.login /etc/csh.cshrc /etc/environment /etc/.login /etc/security/environ If the permissions on an existing file include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the global initialization file(s).
Check skeleton files for extended ACLs. # ls -alL /etc/skel If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the skeleton file(s).
Verify the skeleton files are group-owned by root. Procedure: # ls -alL /etc/skel If a skeleton file is not group-owned by root, this is a finding.
Change the group owner of the skeleton file to root, bin, sys, system, or other. Procedure: # chgrp <group> /etc/skel/[skeleton file]
Check the global initialization files' library search paths. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit the global initialization file(s) and remove relative entries from the library search path variables.
Check the global initialization files' library preload list. This variable is formatted as a colon-separated list of paths. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit the global initialization file(s) and remove the relative path entry from the library preload list variable.
Check user home directories for local initialization files group-owned by a group other than the user's primary group or root. 1. List user accounts and their primary GID. # cut -d : -f 1,4 /etc/passwd 2. Check local initialization files for each user. # ls -alL ~USER/.login ~USER/.cshrc ~USER/.logout ~USER/.profile ~USER/.bash_profile ~USER/.bashrc ~USER/.bash_logout ~USER/.env ~USER/.dtprofile ~USER/.dispatch ~USER/.emacs ~USER/.exrc 3. If any file is not group-owned by root or the user's primary GID, this is a finding.
Change the group owner of the local initialization file to the user's primary group, or root. # chgrp [USER's primary GID] ~USER/[local initialization file]
Check user home directories for local initialization files with extended ACLs. # cut -d : -f 6 /etc/passwd | xargs -n1 -IDIR ls -alL DIR/.login DIR/.cshrc DIR/.logout DIR/.profile DIR/.bash_profile DIR/.bashrc DIR/.bash_logout DIR/.env DIR/.dtprofile DIR/.dispatch DIR/.emacs DIR/.exrc If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the local initialization file(s).
Verify local initialization files have library search paths containing only absolute paths. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit the local initialization file(s) and remove the relative path entry from the library search path.
Verify local initialization files have library preload list containing only absolute paths. This variable is formatted as a colon-separated list of paths. If there is an empty entry, such as a leading or trailing colon, or two consecutive colons, this is a finding. If an entry begins with a character other than a slash (/), this is a relative path, and this is a finding.
Edit the local initialization file and remove the relative path entry from the library preload variable.
If /etc/shells exists, check the group ownership of each shell referenced. Procedure: # cat /etc/shells | xargs -n1 ls -lL Otherwise, check any shells found on the system. Procedure: # find / -name "*sh" | xargs -n1 ls -lL If a shell is not group-owned by root, bin, sys, or system, this is a finding.
Change the group-owner of the shell to root, bin, sys, or system. Procedure: # chgrp root <shell>
If /etc/shells exists, check the permissions of each shell referenced. # cat /etc/shells | xargs -n1 ls -lL Otherwise, check any shells found on the system. # find / -name "*sh" | xargs -n1 ls -lL If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the shell file(s).
Determine the audio device files for the system. # ls -l <audio device file> If the permissions include a '+', the file has an extended ACL, this is a finding.
Remove the extended ACL from the audio device file(s).
If the system does not support a "nodev" option, this is not applicable. Check /etc/fstab (or equivalent) and verify the "nodev" mount option (or equivalent) is used on any file systems mounted from removable media or network shares, or file systems that do not contain any approved device files. If any such file system is not using the "nodev" option, this is a finding.
Edit /etc/fstab (or equivalent) and add the "nodev" mount option (or equivalent) to all entries for remote or removable media file systems, and file systems that contain no approved device files.
Determine if system audit files have an extended ACL. If any do, this is a finding.
Remove the extended ACL from the system audit file(s).
Determine if the system audit tool executables are owned by root. If any are not, this is a finding.
Change the owner of the system audit tool executables to root.
Determine the group ownership of system audit tool executables. Procedure: # ls -lL <audit tool executable> If any system audit tool executable is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of system audit tool executables to root, bin, sys, or system. Procedure: # chgrp system < system audit tool executable>
Determine if system audit tool executables have a mode more permissive than 0750. If any do, this is a finding.
Change the mode of system audit tool executables to 0750.
Determine if system audit tool executables have extended ACLs. If any do, this is a finding.
Remove the extended ACL from the system audit tool executable(s).
Determine if the audit system is configured to alert the SA in the event of an audit processing failure. If it is not, this is a finding.
Configure the audit system to alert the SA in the event of an audit processing failure.
Determine if the audit system is configured to alert the SA when the audit storage volume approaches capacity. If it does not, this is a finding.
Configure the audit system to alert the SA when the audit storage volume approaches capacity.
Determine if the audit system is configured to audit account creation. If it is not, this is a finding.
Configure the audit system to audit account creation.
Determine if the audit system is configured to audit account modification. If it is not, this is a finding.
Configure the system to audit account modification.
Determine if the system is configured to audit account disabling. If not, this is a finding.
Configure the system to audit account disabling.
Determine if the system is configured to audit account termination. If it is not, this is a finding.
Configure the system to audit account termination.
If the system does not support dynamic kernel modules, this is not applicable. Determine if the system is configured to audit the loading and unloading of dynamic kernel modules. If it is not, this is a finding.
Configure the system to audit the loading and unloading of dynamic kernel modules.
Check the permissions of the cron.allow file. # ls -l /etc/cron.allow If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the cron.allow file.
Check the group ownership of the crontab files. # ls -lL /var/spool/cron/crontabs/ If the group owner is not root, cron, or the crontab owner's primary group, this is a finding.
Change the group owner of the crontab file to root, cron, or the crontab's primary group. Procedure: # chgrp root [crontab file]
Check the permissions of the crontab files. # ls -lL /var/spool/cron/crontabs/ If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the crontab file(s).
Check the permissions of the crontab directories. # ls -ld /var/spool/cron/crontabs/ If the permissions include a "+", the directory has an extended ACL and this is a finding.
Remove the extended ACL from the crontab directories.
Determine if the cron log file has an extended ACL. If it does, this is a finding.
Remove the extended ACL from the cron log file.
Determine if the cron.deny file has an extended ACL. If so, this is a finding.
Remove the extended ACL from the cron.deny file.
Determine if the at.allow file has an extended ACL. If it does, this is a finding.
Remove the extended ACL from the at.allow file.
Determine the group owner of the cron.allow file. Procedure: # ls -lL cron.allow If the group owner is not root, bin, sys, or cron, this is a finding.
Change the group owner of the cron.allow file to root, bin, sys, or cron. Procedure: # chgrp root cron.allow
Determine the mode of the at.deny file. # ls -lL at.deny If the mode of the at.deny file is more permissive than 0600, this is a finding.
Change the mode of the at.deny file to 0600. # chmod 0600 at.deny
Determine if the at.deny file has an extended ACL. # ls -l at.deny If the file's permissions contain a '+', the file has an extended ACL, this is a finding.
Remove the extended ACL from the at.deny file.
Determine the cron.deny file's group owner. Procedure: # ls -lL cron.deny If the file is not group-owned by root, bin, sys, or cron, this is a finding.
Change the group owner of the cron.deny file to root, sys, bin, or cron. Procedure: # chown root /var/adm/cron/cron.deny
Check the permissions of the file. # ls -lLd /var/spool/cron/atjobs /var/spool/atjobs If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the "at" directory.
Check the group ownership of the file. Procedure: # ls -lL /var/spool/cron/atjobs /var/spool/atjobs If the file is not group-owned by root, bin, sys, or cron, this is a finding.
Change the group ownership of the file to root, bin, sys, or cron. Procedure: # chgrp root /var/spool/cron/atjobs /var/spool/atjobs
Determine the group owner of the at.allow file. Procedure: # ls -lL at.allow If the group owner is not root, bin, sys, or cron, this is a finding.
Change the group owner of the at.allow file to root, sys, bin, or cron. Procedure: # chgrp root at.allow
Determine the group owner of the at.deny file. Procedure: # ls -lL at.deny If the group-owner is not root, bin, sys, or cron, this is a finding.
Change the group owner of the at.deny file to root, bin, sys, or cron. Procedure: # chgrp root at.deny
Determine if the system is configured to create process core dumps in a specific, centralized directory. If not, this is a finding.
Configure the system to create process core dumps only in a specific, centralized location.
Determine the owner of the centralized process core dump directory. # ls -lLd <directory> If the owner is not root, this is a finding.
Change the owner of the centralized process core dump directory to root. # chown root <directory>
Determine the group owner of the centralized process core dump directory. # ls -lLd <directory> If the group owner is not root, bin, sys, or system, this is a finding.
Change the group owner of the centralized process core dump data directory to root, bin, sys, or system. # chgrp root <directory>
Determine the mode of the centralized process core dump data directory. Procedure: # ls -lLd <directory> If the mode is more permissive than 0700, this is a finding.
Change the mode of the centralized process core dump directory to 0700. Procedure: # chmod 0700 <directory>
Determine if the centralized process core dump data directory has an extended ACL. # ls -lLd <directory> If the permissions contain a '+', there is an extended ACL, this is a finding.
Remove the extended ACL from the centralized process core dump data directory.
Determine if kernel core dumps are enabled on the system. If so, this is a finding.
Disable kernel core dumps on the system.
Determine the group owner of the kernel core dump data directory. # ls -lLd <directory> If the group owner is not root, bin, sys, or system, this is a finding.
Change the group owner of the kernel core dump data directory to root, bin, sys, or system. # chgrp root <directory>
Determine the mode of the kernel core dump data directory. # ls -lLd <directory> If the mode is more permissive than 0700, this is a finding.
Change the mode of the kernel core dump data directory to 0700. # chmod 0700 <directory>
Determine if the kernel core dump data directory has an extended ACL. # ls -lLd <directory> If the permissions contain a '+', the directory has an extended ACL, and this is a finding.
Remove the extended ACL from the kernel core dump data directory.
Determine if any network interfaces on the system are configured to allow user control. If so, this is a finding.
Configure network interfaces to not allow user control.
Determine if the system is configured to respond to ICMP Timestamp requests. If so, this is a finding.
Configure the system to ignore ICMP Timestamp requests.
Determine if the system is configured to respond to ICMP ECHO_REQUESTs sent to broadcast addresses. If so, this is a finding.
Configure the system to ignore ICMP ECHO_REQUESTs sent to broadcast addresses.
Determine if the system is configured to respond to ICMP Timestamp requests sent to broadcast addresses. If so, this is a finding.
Configure the system to ignore ICMP Timestamp requests sent to broadcast addresses.
Determine if the system is configured to apply reverse source routing to TCP responses to source-routed packets. If so, this is a finding.
Configure the system to not apply reverse source routing to TCP responses to source-routed packets.
Determine if the system is configured to prevent local applications from generating source-routed packets. If this is not prevented, this is a finding.
Configure the system to prevent local applications from generating source-routed packets.
Determine if the system is configured to accept source-routed IPv4 packets. If so, this is a finding.
Configure the system to not accept source-routed IPv4 packets.
Determine if the system has proxy ARP enabled. If so, this is a finding.
Disable proxy ARP on the system.
Determine if the system is configured to ignore IPv4 ICMP redirect messages. If not, this is a finding.
Configure the system to ignore IPv4 ICMP redirect messages.
Determine if the system is configured to send IPv4 ICMP redirect messages. Consult vendor documentation to determine if the system originates IPv4 ICMP redirect messages and if a specific configuration setting is present and configured correctly. If no configuration is available, determine if the local firewall is configured to block IPv4 ICMP redirects originating from the system. If the system originates IPv4 ICMP redirect messages, and is not prevented from sending them through configuration or local firewall settings, this is a finding.
Configure the system to not send IPv4 ICMP redirect messages. Consult vendor documentation for the procedures for configuring the system configuration setting or adding a local firewall rule to prevent the sending of these messages.
Determine if the system is configured to log martian packets. Consult the vendor documentation to determine if a specific configuration setting is available for this function. If such a setting is available, and is not enabled, this is a finding. If no specific configuration is available for the system, check the system's local firewall configuration to determine if there are rules to log inbound traffic containing invalid source addresses, which minimally includes the system's own addresses and broadcast addresses for attached subnets. If no such rules exist, this is a finding.
Consult vendor documentation to determine if a configuration setting exists to enable the logging of martian packets. If so, enable this function. If no such function exists, configure the system's local firewall with rules to log inbound traffic containing invalid source addresses, which minimally includes the system's own addresses and broadcast addresses for attached subnets.
If the system is in an environment that does not allow the proper operation of reverse-path filtering, such as with asymmetric routing, this requirement is not applicable. Consult vendor documentation to determine if a specific configuration setting exists to enable reverse-path filtering. If this feature exists and is not enabled, this is a finding. If no specific feature is available, examine the system's local firewall configuration to determine if traffic with source addresses expected on one interface (including loopback interfaces) is blocked when received on another interface. If no such filtering is configured, this is a finding.
If the system has a reverse-path filter capability, enable this feature in accordance with vendor documentation. If the system does not have this capability, add local firewall rules to block traffic with loopback network source addresses from being received on interfaces other than the loopback. Additionally, if the system is multihomed and the attached networks are isolated or perform symmetric routing, add rules to block traffic with source addresses expected on one interface when received on another interface. For example, consider a system with two network interfaces, one attached to an isolated management network with address 10.0.0.55/24 and the other attached to a production network with address 192.168.1.2/24 and a default route. Traffic with a source address on the 10.0.0.0/24 network must be the only traffic accepted on the management interface and must not be accepted on the production interface.
Determine if the local file systems employ journaling or another mechanism ensuring file system consistency. If any do not, this is a finding.
Convert local file systems to use journaling or another mechanism ensuring file system consistency.
Check the group ownership of the inetd and xinetd configuration files, and xinetd directory. Procedure: # ls -alL /etc/inetd.conf /etc/xinetd.conf /etc/xinetd.d If a file or directory is not group-owned by root, bin, sys, or system, this is a finding.
Change the group ownership of the inetd configuration file. Procedure: # chgrp root /etc/inetd.conf
Check the permissions of the inetd configuration file. # ls -lL /etc/inetd.conf If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the inetd.conf file.
Check the xinetd.conf file for any included directories. Procedure: # grep includedir /etc/xinetd.conf If xinetd.conf does not exist, or there are no includedir lines contained within it, this is not applicable. Check the mode of the included directories. Procedure: # ls -lL <directory> If any of the included directories have a mode more permissive than 0755, this is a finding.
Change the mode of included xinetd configuration directories to 0755. Procedure: # chmod 0755 <directory>
Check xinetd configuration directories for extended ACLs. Determine any xinetd configuration directories. Procedure: # grep includedir /etc/xinetd.conf If xinetd.conf does not exist, or no includedir lines are returned, this is not applicable. Check the xinetd configuration directories for extended ACLs. Procedure: # ls -lL <directory> If any of these directories contain a "+" in the permissions field, the directory has an extended ACL and this is a finding.
Remove the extended ACL from the xinetd configuration directories.
Check the group ownership of the services file. Procedure: # ls -lL /etc/services If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the services file. Procedure: # chgrp root /etc/services
Check the permissions of the /etc/services file. # ls -lL /etc/services If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the /etc/services file.
If the portmap service is required for system operations, this is not a finding. Determine if the portmap service is running. If so, this is a finding.
Disable the portmap service.
If the system needs the portmap service to operate, this is not applicable. Consult vendor documentation to determine the name and location of the portmap service. Determine if the portmap service is installed. If so, this is a finding.
If the portmap or rpcbind service is part of a removable package, consult vendor documentation for the procedure to remove the package. If the service cannot be removed, prevent service activation by removing all permissions from the executable. Procedure: # chmod 0000 <path to daemon>
Determine if the rshd service is installed. If so, this is a finding.
Uninstall the rshd service from the system.
Determine if the rlogind service is running. If it is, this is a finding.
Disable the rlogind service.
Determine if the rlogind service is installed. If it is, this is a finding.
Uninstall the rlogind service from the system.
Determine if the rexecd service is installed. If it is, this is a finding.
Uninstall the rexecd service from the system.
Check the group ownership of the /etc/hosts.lpd file. Procedure: # ls -lL /etc/hosts.lpd If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the hosts.lpd file. Procedure: # chgrp root /etc/hosts.lpd
Check the permissions of the /etc/hosts.lpd file. # ls -lL /etc/hosts.lpd If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the hosts.lpd file.
Check the permissions of the /usr/sbin/traceroute file. # ls -lL /usr/contrib/bin/traceroute If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the traceroute file. # chacl -z /usr/contrib/bin/traceroute
Check the group ownership of the /etc/mail/aliases file. Procedure: # ls -lL /etc/mail/aliases If the file is not group-owned by root, sys, bin, or system, this is a finding.
Change the group owner of the /etc/mail/aliases file. Procedure: # chgrp root /etc/mail/aliases
Check the permissions of the /etc/mail/aliases file. # ls -lL /etc/mail/aliases If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the alias file.
Examine the contents of the /etc/mail/aliases file. For each file referenced, check the permissions of the file. # ls -lL [file referenced from aliases] If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the file(s) referenced from the aliases file.
Examine /etc/syslog.conf and determine the log file(s) receiving logs for mail.crit, mail.debug, mail.*, or *.crit. Check the permissions on these log files. # ls -lL [log file] If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the SMTP service log file.
Check the group ownership of the ftpusers file. Procedure: # ls -lL /etc/ftpusers /etc/vsftpd.ftpusers /etc/vsftpd/ftpusers If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the ftpusers file. Procedure: # chgrp root /etc/ftpusers /etc/vsftpd.ftpusers /etc/vsftpd/ftpusers
Check the permissions of the /etc/ftpusers file. # ls -lL /etc/ftpusers If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the ftpusers file.
Check the file permissions for the .Xauthority files. # ls -lL .Xauthority If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the .Xauthority file(s).
Determine if the system's SNMP service only uses SNMPv3 or its successors. Consult vendor documentation to determine if earlier versions of SNMP are supported and what configuration is necessary to enable or disable the protocols. If an earlier version of the protocol is used by the service, this is a finding.
Consult vendor documentation for SNMP configuration procedures. Configure the system's SNMP service to only use SNMPv3 or its successors.
Determine if the SNMP service uses a FIPS 140-2 approved cryptographic hash algorithm as part of its authentication and integrity methods. If it does not, this is a finding.
Configure the SNMP service to use a FIPS 140-2 approved cryptographic hash algorithm as part of its authentication and integrity methods.
Determine if the SNMP service uses a FIPS 140-2 approved encryption algorithm for protecting the privacy of SNMP messages. If it does not, this is a finding.
Configure the SNMP service to use a FIPS 140-2 approved encryption algorithm for protecting the privacy of SNMP messages.
Check the file permissions for the MIB files. # find / -name *.mib -print # ls -lL [mib file] If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the MIB file(s).
Determine the group owner of the snmpd.conf file (or equivalent). Procedure: # ls -lL <snmpd.conf file> If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the snmpd.conf file (or equivalent). Procedure: # chgrp root <snmpd.conf>
Determine if the snmpd.conf file or equivalent has an extended ACL. Procedure: # ls -lL snmpd.conf If the permissions contain a "+", this file has an extended ACL, and this is a finding.
Remove the extended ACL from the snmpd.conf file (or equivalent).
Check the permissions of the syslog configuration file. # ls -lL /etc/syslog.conf If the mode of the file is more permissive than 0640, this is a finding.
Change the permissions of the syslog configuration file. # chmod 0640 /etc/syslog.conf
Check the permissions of the syslog configuration file. # ls -lL /etc/syslog.conf If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the syslog.conf file.
Check the syslog configuration file for remote syslog servers. # grep '@' /etc/syslog.conf | grep -v '^#' If no line is returned, this is a finding.
Edit the syslog configuration file and add an appropriate remote syslog server.
Check the SSH client configuration for allowed protocol versions. # grep -i protocol /etc/ssh/ssh_config | grep -v '^#' If the returned protocol configuration allows versions less than 2, this is a finding.
Edit the /etc/ssh/ssh_config file and add or edit a Protocol configuration line that does not allow versions less than 2.
Check the SSH daemon configuration for listening network addresses. # grep -i Listen /etc/ssh/sshd_config | grep -v '^#' If no configuration is returned, or if a returned Listen configuration contains addresses not designated for management traffic, this is a finding.
Edit the SSH daemon configuration to specify listening network addresses designated for management traffic.
Check the SSH daemon configuration for allowed ciphers. # grep -i ciphers /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the returned ciphers list contains any cipher not starting with 3des or aes, this is a finding.
Edit /etc/ssh/sshd_config and add or edit the "Ciphers" line. Only include ciphers that start with "3des" or "aes" and do not contain "cbc". For the list of available ciphers for the particular version of your software, consult the sshd_config manpage. Restart the SSH daemon.
Check the SSH daemon configuration for allowed ciphers. # grep -i ciphers /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the returned ciphers list contains any cipher ending with cbc, this is a finding.
Edit /etc/ssh/sshd_config and add or edit the "Ciphers" line. Only include ciphers that start with "3des" or "aes" and do not contain "cbc". For the list of available ciphers for the particular version of your software, consult the sshd_config manpage. Restart the SSH daemon.
Check the SSH daemon configuration for allowed MACs. Procedure: # grep -i macs /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the returned MACs list contains any MAC that is not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list, this is a finding.
Edit the SSH daemon configuration and remove any MACs that are not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list. If necessary, add a MACs line.
Check the SSH client configuration for allowed ciphers. # grep -i ciphers /etc/ssh/ssh_config | grep -v '^#' If no lines are returned, the returned ciphers list contains any cipher not starting with 3des or aes, this is a finding.
Edit /etc/ssh/ssh_config and add or edit the "Ciphers" line. Only include ciphers that start with "3des" or "aes" and do not contain "cbc". For the list of available ciphers for the particular version of your software, consult the ssh_config manpage.
Check the SSH client configuration for allowed ciphers. # grep -i ciphers /etc/ssh/ssh_config | grep -v '^#' If no lines are returned, or the returned ciphers list contains any cipher ending with cbc, this is a finding.
Edit /etc/ssh/ssh_config and add or edit the "Ciphers" line. Only include ciphers that start with "3des" or "aes" and do not contain "cbc". For the list of available ciphers for the particular version of your software, consult the ssh_config manpage.
Check the SSH client configuration for allowed MACs. Procedure: # grep -i macs /etc/ssh/ssh_config | grep -v '^#' If no lines are returned, or the returned MACs list contains any MAC that is not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list, this is a finding.
Edit the SSH client configuration and remove any MACs that are not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list. If necessary, add a MACs line.
Check the SSH daemon configuration for the TCP connection forwarding setting. # grep -i AllowTCPForwarding /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the returned setting has a value evaluating to yes, this is a finding.
Edit the SSH daemon configuration and change or add the AllowTCPForwarding setting to no.
Check the SSH client configuration for the TCP forwarding setting. # egrep -i "LocalForward|RemoteForward" /etc/ssh/ssh_config | grep -v '^#' If any uncommented lines are returned, this is a finding.
Edit the SSH client configuration and change or add the AllowTCPForwarding setting to no.
Check the SSH daemon configuration for the gateway ports setting. # grep -i GatewayPorts /etc/ssh/sshd_config | grep -v '^#' If no lines are returned or the returned setting has a value evaluating to yes, this is a finding.
Edit the SSH daemon configuration and change or add the GatewayPorts setting to no.
Check the SSH client configuration for the gateway ports setting. # grep -i GatewayPorts /etc/ssh/ssh_config | grep -v '^#' If no lines are returned or the returned setting has a value evaluating to yes, this is a finding.
Edit the SSH client configuration and change or add the GatewayPorts setting to no.
Check the SSH daemon configuration for the X11 forwarding setting. # grep -i X11Forwarding /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the returned setting has a value evaluating to yes, this is a finding.
Edit the SSH daemon configuration and change or add the X11Forwarding setting to no.
Check the SSH client configuration for the X11 forwarding setting. # grep -i ForwardX11 /etc/ssh/ssh_config | grep -v '^#' If no lines are returned, or the returned setting has a value evaluating to yes, this is a finding.
Edit the SSH client configuration and change or add the ForwardX11 setting to no.
Check the SSH daemon configuration for the AllowGroups setting. # grep -i AllowGroups /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, this is a finding.
Edit the SSH daemon configuration and add an AllowGroups directive.
Check the permissions for SSH public host key files. # ls -lL /etc/ssh/*key.pub If any file has a mode more permissive than 0644, this is a finding.
Change the permissions for the SSH public host key files. # chmod 0644 /etc/ssh/*key.pub
Check the permissions for SSH private host key files. # ls -lL /etc/ssh/*key If any file has a mode more permissive than 0600, this is a finding.
Change the permissions for the SSH private host key files. # chmod 0600 /etc/ssh/*key
Ask the SA if GSSAPI authentication is used for SSH authentication to the system. If so, this is not applicable. Check the SSH daemon configuration for the GSSAPI authentication setting. # grep -i GSSAPIAuthentication /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the setting is set to yes, this is a finding.
Edit the SSH daemon configuration and set (add if necessary) a GSSAPIAuthentication directive set to no.
Check the SSH clients configuration for the GSSAPI authentication setting. # grep -i GSSAPIAuthentication /etc/ssh/ssh_config | grep -v '^#' If no lines are returned, or the setting is set to yes, this is a finding.
Edit the SSH client configuration and set (add if necessary) a GSSAPIAuthentication directive set to no.
Ask the SA if Kerberos authentication is used by the system. If it is, this is not applicable. Check the SSH daemon configuration for the Kerberos authentication setting. # grep -i KerberosAuthentication /etc/ssh/sshd_config | grep -v '^#' If no lines are returned, or the setting is set to yes, this is a finding.
Edit the SSH daemon configuration and set (add if necessary) a KerberosAuthentication directive set to no.
Check the SSH daemon configuration for the AcceptEnv setting. # grep -i AcceptEnv /etc/ssh/sshd_config | grep -v '^#' If any line is returned other than those permitting LOCALE or LC_* environment variables, this is a finding.
Edit the SSH daemon configuration and remove (or edit) the AcceptEnv setting(s) to only accept LOCALE or LC_* environment variables.
Check the SSH client configuration for the SendEnv setting. # grep -i SendEnv /etc/ssh/ssh_config | grep -v '^#' If any line is returned other than those permitting LOCALE or LC_* environment variables, this is a finding.
Edit the SSH client configuration and remove (or edit) the SendEnv setting(s) to only accept LOCALE or LC_* environment variables.
Check the PermitUserEnvironment setting in the SSH daemon configuration. Procedure: # grep -i PermitUserEnvironment sshd_config If the setting is not present or set to a value other than no, this is a finding.
Edit the SSH daemon configuration and edit (or add) the PermitUserEnvironment setting with a value of no.
Check the SSH daemon configuration for the PermitTunnel setting. # grep -i PermitTunnel /etc/ssh/sshd_config | grep -v '^#' If the setting is not present, or set to yes, this is a finding.
Edit the SSH daemon configuration and add or edit the PermitTunnel setting value to no.
Check the SSH client configuration for the Tunnel setting. # grep -i Tunnel /etc/ssh/ssh_config | grep -v '^#' If the setting is not present, or not set to no, this is a finding.
Edit the SSH client configuration and add or edit the Tunnel setting value to no.
Check the SSH daemon configuration for the MaxSessions setting. # grep -i MaxSessions /etc/ssh/sshd_config | grep -v '^#' If the setting is not present, or not set to 1, this is a finding.
Edit the SSH daemon configuration and add or edit the MaxSessions setting value to 1.
Check the SSH daemon configuration for the StrictModes setting. # grep -i StrictModes /etc/ssh/sshd_config | grep -v '^#' If the setting is not present, or not set to yes, this is a finding.
Edit the SSH daemon configuration and add or edit the StrictModes setting value to yes.
Check the SSH daemon configuration for the UsePrivilegeSeparation setting. # grep -i UsePrivilegeSeparation /etc/ssh/sshd_config | grep -v '^#' If the setting is not present, or not set to yes, this is a finding.
Edit the SSH daemon configuration and add or edit the UsePrivilegeSeparation setting value to yes.
Check the SSH daemon configuration for the RhostsRSAAuthentication setting. # grep -i RhostsRSAAuthentication /etc/ssh/sshd_config | grep -v '^#' If the setting is not present or not set to no, this is a finding.
Edit the SSH daemon configuration and add or edit the RhostsRSAAuthentication setting value to no.
Check the SSH daemon configuration for the Compression setting. # grep -i Compression /etc/ssh/sshd_config | grep -v '^#' If the setting is not present, or set to yes, this is a finding.
Edit the SSH daemon configuration and add or edit the Compression setting value to no or delayed.
Verify the SSH daemon is configured for logon warning banners. # grep -i banner /etc/ssh/sshd_config | grep -v '^#' # cat [banner file] Verify the banner configuration line is present and the file it references contains a logon warning banner. Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't." If the SSH daemon is not configured to display the logon warning banner, this is a finding.
Edit the SSH daemon configuration and add (or edit) a banner setting referencing a file containing a logon warning banner. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
If the system is a router, this is not applicable. If the system does not use IPv6, this is not applicable. Determine if the system has a default route configured for IPv6. If it does not, this is a finding.
Configure an IPv6 default route on the system.
If the system is a router, this is not applicable. Determine if the system has IPv6 forwarding enabled. If so, this is a finding.
Disable IPv6 forwarding on the system.
Check the group ownership of the NFS export configuration file. Procedure: # ls -lL <NFS export configuration file> If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group ownership of the NFS export configuration file to root, bin, sys, or system. Procedure: # chgrp root <NFS export file>
Determine if the NFS exports configuration file has an extended ACL. If it does, this is a finding.
Remove the extended ACL from the NFS export configuration file.
Determine if the NFS exported directories on the system are group-owned by root. If any are not, this is a finding.
Change the group owner of NFS exported directories to root.
Check the group ownership of the Samba configuration file. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. Procedure: # ls -lL /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/smb.conf file.
Check the group ownership of the Samba configuration file. # ls -lL /etc/smbpasswd If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/smbpasswd file.
Check the security mode of the Samba configuration. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. Procedure: # grep -i security /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the security mode is share, this is a finding.
Edit the smb.conf file and change the security setting to user or another valid setting other than share.
Check the encryption setting of the Samba configuration. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. Procedure: # grep -i 'encrypt passwords' /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the setting is not present, or not set to yes, this is a finding.
Edit the smb.conf file and change the encrypt passwords setting to yes.
Check the encryption setting for the Samba configuration. Default locations for this file include /etc, /etc/sfw, /etc/samba, and /etc/sfw/samba. If the system has Samba installed in non-standard locations, also check the smb.conf in those locations. Procedure: # grep -i 'guest ok' /etc/smb.conf /etc/sfw/smb.conf /etc/samba/smb.conf /etc/sfw/samba/smb.conf If the setting exists and is set to yes, this is a finding.
Edit the /etc/smb.conf file and change the guest ok setting to no.
Check the permissions of the file. # ls -lL /etc/news/hosts.nntp If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the /etc/news/hosts.nntp file.
Check the permissions of the file. # ls -lL /etc/news/hosts.nntp.nolimit If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/news/hosts.nntp.nolimit file.
Check the permissions of the file. # ls -lL /etc/news/nnrp.access If the permissions include a "+", the file has an extended ACL and this is a finding.
Remove the extended ACL from the /etc/news/nnrp.access file.
Check the permissions of the file. # ls -lL /etc/news/passwd.nntp If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the /etc/news/passwd.nntp file.
Check the root crontab for a job invoking the system package management tool to verify the integrity of installed packages. If no such job exists, this is a finding.
Add a job to the root crontab that invokes the system package management tool to verify the integrity of installed packages.
If using AIDE, verify the configuration contains the acl option for all monitored files and directories. Here is an example AIDE configuration fragment. SampleRule = p+i+l+n+u+g+s+m+c+acl+xattrs+sha256 /bin SampleRule If the acl option is not present, this is a finding. If using a different file integrity tool, check the configuration per tool documentation.
If using AIDE, edit the configuration and add the acl option for all monitored files and directories. If using a different file integrity tool, configure ACL checking per the tool's documentation.
If using AIDE, verify the configuration contains the xattrs option for all monitored files and directories. Here is an example AIDE configuration fragment. SampleRule = p+i+l+n+u+g+s+m+c+acl+xattrs+sha256 /bin SampleRule If the xattrs option is not present, this is a finding. If using a different file integrity tool, check the configuration per tool documentation.
If using AIDE, edit the configuration and add the xattrs option for all monitored files and directories. If using a different file integrity tool, configure extended attributes checking per the tool's documentation.
If using AIDE, verify the configuration contains the sha256 or sha512 options for all monitored files and directories. Here is an example AIDE configuration fragment. SampleRule = p+i+l+n+u+g+s+m+c+acl+xattrs+sha256 /bin SampleRule If either the sha256 or sha512 option is not present, this is a finding. If using a different file integrity tool, check the configuration per tool documentation.
If using AIDE, edit the configuration and add the sha256 or sha512 option for all monitored files and directories. If using a different file integrity tool, configure FIPS 140-2 approved cryptographic hashes per the tool's documentation.
If there is no SCTP protocol handler for the system, this is not applicable. Determine if the system is configured to prevent the dynamic loading of the SCTP protocol handler. If not, this is a finding.
Configure the system to prevent the dynamic loading of the SCTP protocol handler.
If there is no DCCP protocol handler for the system, this is not applicable. Determine if the DCCP protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to not load the DCCP protocol handler dynamically.
If there is no UDP-Lite protocol handler available for the system, this is not applicable. Determine if the UDP-Lite protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to prevent the dynamic loading of the UDP-Lite protocol handler.
If there is no IPX protocol handler for the system, this is not applicable. Determine if the IPX protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to not dynamically load the IPX protocol handler.
If there is no AppleTalk protocol handler for the system, this is not applicable. Determine if the AppleTalk protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to prevent the dynamic loading of the AppleTalk protocol handler.
If there is no DECnet protocol handler for the system, this is not applicable. Determine if the DECnet protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to not dynamically load the DECnet protocol handler.
If there is no RDS protocol handler for the system, this is not applicable. Ask the SA if RDS is required by application software running on the system. If so, this is not applicable. Determine if the RDS protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to not dynamically load the RDS protocol handler.
If there is no TIPC protocol handler for the system, this is not applicable. Determine if the TIPC protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to not dynamically load the TIPC protocol handler.
If the system does not have a PF_LLC protocol handler, this is not applicable. Determine if the PF_LLC protocol handler is bound to the network stack. If it is, this is a finding.
Unbind the PF_LLC protocol handler from the network stack.
If the PF_LLC protocol handler is not available as an optional software package for the system, this is not applicable. If the PF_LLC protocol handler is installed, this is a finding.
Uninstall the PF_LLC protocol handler.
If there is no Bluetooth protocol handler for the system, this is not applicable. Determine if the system prevents the dynamic loading of the Bluetooth protocol handler. If it does not, this is a finding.
Configure the system to prevent the dynamic loading of the Bluetooth protocol handler.
If the IPv6 protocol handler is bound to the network stack, and the system does not need IPv6, this is a finding.
Unbind the IPv6 protocol handler from the network stack.
If the system uses IPv6, this is not applicable. Determine if the IPv6 protocol handler is prevented from dynamic loading. If it is not, this is a finding.
Configure the system to prevent the dynamic loading of the IPv6 protocol handler.
If the IPv6 protocol handler is not available as an optional software package for the system, this is not applicable. If the system uses IPv6, this is not applicable. If the IPv6 protocol handler is installed, this is a finding.
Uninstall the IPv6 protocol handler from the system.
If the system does not support proxy NDP, this is not applicable. Determine if the system has proxy NDP enabled. If so, this is a finding.
Disable proxy NDP on the system.
Determine if there are any 6to4 tunnels configured on the system. If any exist, this is a finding.
Remove the configuration for any 6to4 tunnels on the system.
Determine if any software providing Teredo is installed on the system. If so, this is a finding.
Uninstall the Teredo software from the system.
Determine if any IP tunnels are configured on the system. If any are found, this is a finding.
Remove the configuration for any IP tunnels from the system.
If the DHCP client is needed by the system, this is not applicable. Determine if the DHCP client is disabled. If it is not, this is a finding.
Disable the system's DHCP client.
Determine if the system's DHCP client is configured to send dynamic DNS updates. If it is, this is a finding.
Configure the system's DHCP client to not send dynamic DNS updates.
Determine if the system is configured to ignore IPv6 ICMP redirect messages. If it is not, this is a finding.
Configure the system to ignore IPv6 ICMP redirect messages.
Determine if the system is configured to send IPv6 ICMP redirects. If it is, this is a finding.
Configure the system to not send IPv6 ICMP redirects.
Determine if the system uses a reverse-path filter for IPv6 network traffic. If it does not, this is a finding.
Configure the system to use a reverse-path filter for IPv6 network traffic.
Determine if the system is configured to forward IPv6 source-routed packets. If it is, this is a finding.
Configure the system to not forward IPv6 source-routed packets.
Check if the system is using NSS LDAP. # grep -v '^#' /etc/nsswitch.conf | grep ldap If no lines are returned, this vulnerability is not applicable. Verify a certificate is used for client authentication to the server. # grep -i '^tls_cert' /etc/ldap.conf If no line is found, this is a finding. List the certificate issuer. # open_ssl x509 -text -in <cert> If the certificate is not issued by DoD PKI or a DoD-approved external PKI, this is a finding.
Edit /etc/ldap.conf and add (or edit) the tls_cert setting to reference a file containing a client certificate issued by DoD PKI or a DoD-approved external PKI.
Check if the system is using NSS LDAP. # grep -v '^#' /etc/nsswitch.conf | grep ldap If no lines are returned, this vulnerability is not applicable. Verify a server certificate is required and verified by the NSS LDAP configuration. # grep -i '^tls_checkpeer' /etc/ldap.conf If no line is returned, or the value is not yes, this is a finding.
Edit /etc/ldap.conf and add or set the tls_checkpeer setting to yes.
Check if the system is using NSS LDAP. # grep -v '^#' /etc/nsswitch.conf | grep ldap If no lines are returned, this vulnerability is not applicable. Verify the NSS LDAP client is configured to check certificates against a certificate revocation list. # grep -i '^tls_crlcheck' /etc/ldap.conf If the setting does not exist, or the value is not all, this is a finding.
Edit /etc/ldap.conf and add (or set) the tls_crlcheck setting to all.
Check the permissions of the file. # ls -lL /etc/ldap.conf If the mode of the file is more permissive than 0644, this is a finding.
Change the permissions of the file. # chmod 0644 <LDAP configuration file>
Check the ownership of the file. # ls -lL /etc/ldap.conf If the file is not owned by root, this is a finding.
Change the owner of the file. # chown root /etc/ldap.conf
Check the group ownership of the file. Procedure: # ls -lL /etc/ldap.conf If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group owner of the file to root, bin, sys, or system. Procedure: # chgrp root /etc/ldap.conf
Check the permissions of the file. Procedure: # ls -l /etc/ldap.conf If the permissions include a "+", the file has an extended ACL, this is a finding.
Remove the extended ACL from the /etc/ldap.conf file.
Determine the certificate authority file and/or directory. # grep -i '^tls_cacert' /etc/ldap.conf For each file or directory returned, check the ownership. # ls -lLd <certpath> If the owner of any file or directory is not root, this is a finding.
Change the ownership of the file or directory. # chown root <certpath>
Consult system documentation to determine where the LDAP client certificate files are stored. Check their group ownership. Procedure: # ls -lLa <ldap certificate file(s) or directories> If a certificate file or directory is not group-owned by root, bin, sys, or system, this is a finding.
Change the group ownership of LDAP client certificate files to root, bin, sys, or system. Procedure: # chgrp root <certificate file>
Determine the certificate authority file and/or directory. Procedure: # grep -i '^tls_cacert' /etc/ldap.conf For each file or directory returned, check the permissions. Procedure: # ls -lLd <certpath> If the mode of the file is more permissive than 0644 (or 0755 for directories), this is a finding.
Change the mode of the file or directory. File Procedure: # chmod 0644 <certpath> Directory Procedure: # chmod 0755 <certpath>
Determine the certificate authority file and/or directory. # grep -i '^tls_cacert' /etc/ldap.conf For each file or directory returned, check the permissions. # ls -lLd <certpath> If the permissions of the file or directory contains a "+", an extended ACL is present, this is a finding.
Remove the extended ACL from the certificate file.
Determine the certificate file. # grep -i '^tls_cert' /etc/ldap.conf Check the ownership. # ls -lL <certpath> If the owner of the file is not root, this is a finding.
Change the ownership of the file. # chown root <certpath>
Check system documentation to determine the location of the LDAP client certificate file. Check the group ownership of the certificate file. Procedure: # ls -lL <certificate file> If the file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group ownership of the LDAP client certificate file. Procedure: # chgrp root <certificate file>
Determine the certificate file. # grep -i '^tls_cacert' /etc/ldap.conf Check the permissions. # ls -lL <certpath> If the mode of the file is more permissive than 0644, this is a finding.
Change the mode of the file. # chmod 0644 <certpath>
Determine the certificate file. # grep -i '^tls_cacert' /etc/ldap.conf Check the permissions. # ls -lL <certpath> If the permissions of the file contains a "+", an extended ACL is present, this is a finding.
Remove the extended ACL from the certificate file.
Determine the key file. # grep -i '^tls_key' /etc/ldap.conf Check the ownership. # ls -lL <keypath> If the owner of the file is not root, this is a finding.
Change the ownership of the file. # chown root <key file>
Check the system documentation to determine the location of the LDAP client certificate key file. Check the group owner of this file. Procedure: # ls -lL <key file> If the file is not owned by root, bin, sys, or system, this is a finding.
Change the group owner of the LDAP client key file. Procedure: # chgrp root <key file>
Determine the key file. # grep -i '^tls_key' /etc/ldap.conf Check the permissions. # ls -lL <keypath> If the permissions of the file contains a "+", an extended ACL is present, this is a finding.
Remove the extended ACL from the key file.
Ask the SA if a root kit check tool is run on the system weekly. If this is not performed, this is a finding.
Create an automated job or establish a site-defined procedure to check the system weekly with a root kit check tool.
Determine if the system uses automated file system mounting tools (such as autofs or automount). If it does, this is a finding.
Disable the automated file system mounting tools.
If the system uses USB, this is not applicable. Determine if the system has USB enabled. If it does, this is a finding.
Disable USB on the system.
If the system uses USB mass storage, this is not applicable. Determine if the system has USB mass storage enabled. If it does, this is a finding.
Disable USB mass storage on the system.
If the system needs IEEE 1394, this is not applicable. Determine if IEEE 1394 is enabled on the system. If so, this is a finding.
Disable IEEE 1394 on the system.
Determine if the system is using a local firewall. If it is not, this is a finding.
Configure the system to use a local firewall.
Determine if the system's local firewall implements a deny-all, allow-by-exception policy. If it does not, this is a finding.
Configure the system's local firewall to implement a deny-all, allow-by-exception policy.
If the system does not use GRUB, this is not applicable. Check the grub.conf file for an extended ACL. # ls -lL grub.conf If the listed permissions contain a "+", this file has an extended ACL, and this is a finding.
Remove the extended ACL from the grub.conf file.
If the system does not use GRUB, this is not applicable. Check the owner of the grub.conf file. # ls -lL grub.conf If the owner is not root, this is a finding.
Change the owner of the grub.conf file to root. # chown root grub.conf
For GRUB: Check the group owner of the grub.conf file. Procedure: # ls -lL grub.conf If the group owner is not root or sys, this is a finding.
Change the group owner of the grub.conf file to root or sys. Procedure: # chgrp root grub.conf
Determine if the system package management tool cryptographically verifies the authenticity of packages during installation. If it does not, this is a finding.
If possible, configure the system package management tool to cryptographically verify the authenticity of packages during installation.
Determine if the system package management tool is configured to automatically obtain updated packages. If it is, this is a finding.
Configure the system package management tool not to automatically obtain updates.
Check for any running routing protocol daemons. # ps -ef | egrep '(ospf|route|bgp|zebra|quagga)' If any routing protocol daemons are listed, this is a finding.
Disable any routing protocol daemons.
Check the group ownership of the audit log file(s). Procedure: # ls -l <audit log file> If any audit log file is not group-owned by root, bin, sys, or system, this is a finding.
Change the group ownership of the audit log file(s). Procedure: # chgrp root <audit log file>
FTP to the system. # ftp localhost Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. If the system does not run the FTP service, this is not applicable. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
Configure the system to display one of the DoD login banners (based on the character limitations imposed by the system) prior to any FTP login attempt. DoD Login Banners: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. OR I've read & consent to terms in IS user agreem't.
Determine if the /var path is a separate file system. If it is not, this is a finding.
Migrate the /var path onto a separate file system.
Determine if the system audit data path is a separate file system. If it is not, this is a finding.
Migrate the system audit data path onto a separate file system.
Determine if /tmp is located on a separate file system.
Migrate the /tmp path onto a separate file system.
Determine if the system's TCP backlog queue size is set to 1280 or higher. If it is not, this is a finding.
Set the system's TCP backlog queue size to 1280 or greater.
Determine if the system uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy. If the system does not use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes, this is a finding.
Configure the system to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes.
Determine if the SSH daemon uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). If it does not, this is a finding.
Configure the SSH daemon to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode).
Determine if the SSH client uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). If it does not, this is a finding.
Configure the SSH client to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode).
Determine if the system uses NSS LDAP. If it does not, this is not applicable. Determine if the system uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for protecting the NSS LDAP connection. If it does not, this is a finding.
Configure the system to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for protecting the NSS LDAP connection.
If the system uses Sendmail, locate the sendmail.cf file. Procedure: # find / -name sendmail.cf Determine if Sendmail only binds to loopback addresses by examining the DaemonPortOptions configuration options. Procedure: # grep -i "O DaemonPortOptions" </path/to/sendmail.cf> If there are uncommented DaemonPortOptions lines, and all such lines specify system loopback addresses, this is not a finding. Otherwise, determine if Sendmail is configured to allow open relay operation. Procedure: # find / -name sendmail.mc # grep -i promiscuous_relay </path/to/sendmail.mc> If the promiscuous relay feature is enabled, this is a finding. If the system uses Postfix, locate the main.cf file. Procedure: # find / -name main.cf Determine if Postfix only binds to loopback addresses by examining the inet_interfaces line. Procedure: # grep inet_interfaces </path/to/main.cf> If inet_interfaces is set to loopback-only or contains only loopback addresses, such as 127.0.0.1 and [::1], Postfix is not listening on external network interfaces, this is not a finding. Otherwise, determine if Postfix is configured to restrict clients permitted to relay mail by examining the smtpd_client_restrictions line. Procedure: # grep smtpd_client_restrictions </path/to/main.cf> If the smtpd_client_restrictions line is missing, or does not contain reject, this is a finding. If the line contains permit before reject, this is a finding. If the system is using other SMTP software, consult the software's documentation for procedures to verify mail relaying is restricted.
If the system uses Sendmail, edit the sendmail.mc file and remove the promiscuous_relay configuration. Rebuild the sendmail.cf file from the modified sendmail.mc and restart the service. If the system does not need to receive mail from external hosts, add one or more DaemonPortOptions lines referencing system loopback addresses (such as "O DaemonPortOptions=Addr=127.0.0.1,Port=smtp,Name=MTA") and remove lines containing non-loopback addresses. Restart the service. If the system uses Postfix, edit the main.cf file and add or edit the smtpd_client_restrictions line to have contents permit mynetworks, reject or a similarly restrictive rule. If the system does not need to receive mail from external hosts, add or edit the inet_interfaces line to have contents loopback-only or a set of loopback addresses for the system. Restart the service. If the system is using other SMTP software, consult the software's documentation for procedures to restrict mail relaying.
Consult vendor documentation concerning the ldd command. If the command provides protection from the execution of untrusted executables, this is not a finding. Determine the location of the system's ldd command. Procedure: # find / -name ldd If no file exists, this is not a finding. Check the permissions of the found ldd file. # ls -lL <path to ldd> If the file mode of the file is more permissive than 0000, this is a finding.
Disable the ldd command by removing its permissions. Procedure: # chmod 0000 <path to ldd>
Determine if the system responds to IPv6 multicast ICMP ECHO_REQUESTs. If it does, this is a finding.
Configure the system to not respond to IPv6 multicast ICMP ECHO_REQUESTs.
Access the graphical desktop environment(s) provided by the system and attempt to logon. Check for either of the following login banners based on the character limitations imposed by the system. An exact match is required. If one of these banners is not displayed, this is a finding. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. " OR "I've read & consent to terms in IS user agreem't."
Configure the system to display one of the DoD login banners (based on the character limitations imposed by the system) prior to, or as part of, the graphical desktop environment logon process. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."
Consult vendor documentation to determine if the system is capable of CAC authentication. If it is not, this is not applicable. Interview the SA to determine if all accounts not exempted by policy are using CAC authentication. If non-exempt accounts are not using CAC authentication, this is a finding.
Consult vendor documentation to determine the procedures necessary for configuring CAC authentication. Configure all accounts required by policy to use CAC authentication.
Consult vendor documentation to determine the settings required for the audit system for sending audit records to a remote system or via syslog. If the system is not configured to provide this function, this is a finding.
Consult vendor documentation for the settings required to configure the system to send audit records to a remote system. Implement the configuration settings.
Consult vendor documentation for the procedures concerning the configuration of LDAP for providing authentication and account information. Examine the LDAP configuration file(s). If the LDAP configuration file contains an unencrypted password, this is a finding. If the LDAP configuration file contains an encrypted password accessible by regular users on the system, this is a finding.
Consult vendor documentation for the procedures for configuring LDAP for authentication and account information. Remove any passwords from LDAP configuration files.
Consult vendor documentation to determine the method for determining if the telnet daemon is running. If the system uses inetd, use the following procedure. # grep -v '^#' /etc/inetd.conf | grep telnet If an entry is returned, the telnet daemon is running. If the telnet daemon is running, this is a finding.
Consult vendor documentation to determine the procedure to disable the telnet daemon. If the system uses inetd, use the following procedure. Edit the /etc/inetd.conf file and comment out the telnetd line. Restart or reload the inetd process.
Consult vendor documentation for procedures concerning the system's boot loader. If the boot loader passwords are not protected using an MD5 hash or stronger, this is a finding.
Consult vendor documentation for procedures concerning the system's boot loader. Configure the boot loader to hash boot loader passwords using MD5 or a stronger hash.
Obtain the list of available security patches or updated packages from the operating system vendor. Check that the patches or updates have been installed on the system. If there are patches or updates that have not been installed, this is a finding.
Install the security patches or updated packages available from the vendor.
Check the system logs for successful and unsuccessful logins. If these events are not present in the logs, this is a finding.
Verify the login logs are handled correctly in the /etc/syslog.conf file. Verify the service startup scripts for syslog and utmp (if present) are enabled.
Check the system's configuration to determine if user password changes are permitted more than once every 24 hours. If this is permitted, this is a finding.
Configure the system to not allow users to change their passwords more than once every 24 hours.
Determine if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp, gdm, lp, nobody) have been disabled. # cat /etc/shadow If an account's password field is "*", "*LK*", or is prefixed with a "!", the account is locked or disabled. If there is any default system accounts not locked, this is a finding.
Lock the default system account(s). # passwd -l <user>
Determine if cron logging is enabled on the system. If cron logging is not enabled, this is a finding.
Enable cron logging on the system.
Check the owner of the cron.allow file. If the owner is not root, bin, or sys, this is a finding.
Change the owner of the cron.allow file to root, bin, or sys.
Check the owner of the cron.deny file. If the owner is not root, bin, or sys, this is a finding.
Change the owner of the cron.deny file to root, bin, or sys.
Determine if the NFS service accepts requests from unprivileged ports. If it does, this is a finding.
Configure the system to not accept NFS requests from unprivileged ports.
Determine if TCP_WRAPPERS is installed and used. If it is not, this is a finding.
Install and configure the TCP_WRAPPERS software.
VMware support for ESX versions 3 and 4 ended 21 May 2016. If ESX version 3 or 4 is installed on a system, this is a finding.
Upgrade ESX version 3 and 4 systems to supported versions.