Definition of SUSE Linux Enterprise Server 15 Security Technical Implementation Guide for sle15

SLES-15-010000: The SUSE operating system must be a vendor-supported release.

Description: None

• high

Automated: yes

• installed_OS_is_vendor_supported: The Installed Operating System Is Vendor Supported
  • CCE-83260-0

SLES-15-010010: Vendor-packaged SUSE operating system security patches and updates must be installed and up to date.

Description: None

• medium

Automated: yes

• security_patches_up_to_date: Ensure Software Patches Installed
  • CCE-83261-8

SLES-15-010020: The SUSE operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting access via local console.

Description: None

• medium

Automated: yes

• banner_etc_issue: Modify the System Login Banner
  • CCE-83262-6
• login_banner_contents = dod_default
• login_banner_text = dod_banners

SLES-15-010030: The SUSE operating system must not have the vsftpd package installed if not required for operational support.

Description: None

• high

Automated: yes

• package_vsftpd_removed: Uninstall vsftpd Package
  • CCE-85700-3

SLES-15-010040: The SUSE operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting access via SSH.

Description: None

• medium

Automated: yes

• sshd_enable_warning_banner: Enable SSH Warning Banner
  • CCE-83263-4

SLES-15-010050: The SUSE operating system must display the Standard Mandatory DoD Notice and Consent Banner until users acknowledge the usage conditions and take explicit actions to log on for further access to the local graphical user interface (GUI).

Description: None

• medium

Automated: yes

• gui_login_dod_acknowledgement: Display the Standard Mandatory DoD Notice and Consent Banner until Explicit Acknowledgement
  • CCE-85668-2

SLES-15-010060: The SUSE operating system file /etc/gdm/banner must contain the Standard Mandatory DoD Notice and Consent banner text.

Description: None

• medium

Automated: yes

• banner_etc_gdm_banner: Modify the System GUI Login Banner
  • CCE-83264-2

SLES-15-010080: The SUSE operating system must display a banner before granting local or remote access to the system via a graphical user logon.

Description: None

• medium

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner
  • CCE-83265-9

SLES-15-010090: The SUSE operating system must display the approved Standard Mandatory DoD Notice before granting local or remote access to the system via a graphical user logon.

Description: None

• medium

Automated: yes

• dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
  • CCE-83288-1
• dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
  • CCE-83266-7
• dconf_login_banner_contents = dod_default
• dconf_login_banner_text = dod_banners

SLES-15-010100: The SUSE operating system must be able to lock the graphical user interface (GUI).

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_lock_enabled: Enable GNOME3 Screensaver Lock After Idle Period
  • CCE-85766-4

SLES-15-010110: The SUSE operating system must utilize vlock to allow for session locking.

Description: None

• low

Automated: yes

• vlock_installed: Check that vlock is installed to allow session locking
  • CCE-83268-3

SLES-15-010120: The SUSE operating system must initiate a session lock after a 15-minute period of inactivity for the graphical user interface (GUI).

Description: None

• medium

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
  • CCE-85669-0
• dconf_gnome_session_idle_user_locks: Ensure Users Cannot Change GNOME3 Session Idle Settings
  • CCE-91245-1
• inactivity_timeout_value = 15_minutes

SLES-15-010130: The SUSE operating system must initiate a session lock after a 10-minute period of inactivity.

Description: None

• medium

Automated: yes

• accounts_tmout: Set Interactive Session Timeout
  • CCE-83269-1
• var_accounts_tmout = 10_min

SLES-15-010140: The SUSE operating system must conceal, via the session lock, information previously visible on the display with a publicly viewable image in the graphical user interface (GUI).

Description: None

• low

Automated: yes

• dconf_gnome_screensaver_mode_blank: Implement Blank Screensaver
  • CCE-85715-1

SLES-15-010150: The SUSE operating system must log SSH connection attempts and failures to the server.

Description: None

• medium

Automated: yes

• sshd_set_loglevel_verbose: Set SSH Daemon LogLevel to VERBOSE
  • CCE-83270-9

SLES-15-010160: The SUSE operating system must implement DOD-approved encryption to protect the confidentiality of SSH remote connections.

Description: None

• medium

Automated: yes

• sshd_use_approved_ciphers: Use Only FIPS 140-2 Validated Ciphers
  • CCE-91337-6
• sshd_use_approved_ciphers_ordered_stig: Use Only FIPS 140-2 Validated Ciphers
  • CCE-83271-7

SLES-15-010170: The SUSE operating system, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Description: None

• medium

Automated: yes

• smartcard_configure_ca: Configure Smart Card Certificate Authority Validation
  • CCE-83272-5

SLES-15-010180: The SUSE operating system must not have the telnet-server package installed.

Description: None

• high

Automated: yes

• package_telnet-server_removed: Uninstall telnet-server Package
  • CCE-83273-3

SLES-15-010190: SUSE operating systems with a basic input/output system (BIOS) must require authentication upon booting into single-user and maintenance modes.

Description: None

• high

Automated: yes

• grub2_password: Set Boot Loader Password in grub2
  • CCE-83274-1

SLES-15-010200: SUSE operating systems with Unified Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance.

Description: None

• high

Automated: yes

• grub2_uefi_password: Set the UEFI Boot Loader Password
  • CCE-83275-8

SLES-15-010220: The SUSE operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.

Description: None

• medium

Automated: yes

• package_firewalld_installed: Install firewalld Package
  • CCE-85698-9
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-85751-6

SLES-15-010230: The SUSE operating system must not have duplicate User IDs (UIDs) for interactive users.

Description: None

• medium

Automated: yes

• account_unique_id: Ensure All Accounts on the System Have Unique User IDs
  • CCE-83277-4

SLES-15-010240: The SUSE operating system must disable the file system automounter.

Description: None

• medium

Automated: yes

• service_autofs_disabled: Disable the Automounter
  • CCE-83278-2

SLES-15-010260: The SUSE operating system must employ FIPS 140-2 approved cryptographic hashing algorithm for system authentication (login.defs).

Description: None

• medium

Automated: yes

• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-83279-0

SLES-15-010270: The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

Description: None

• medium

Automated: yes

• sshd_use_approved_macs: Use Only FIPS 140-2 Validated MACs
  • CCE-91338-4
• sshd_use_approved_macs_ordered_stig: Use Only FIPS 140-2 Validated MACs
  • CCE-83280-8

SLES-15-010280: The SUSE operating system SSH daemon must be configured with a timeout interval.

Description: None

• medium

Automated: yes

• sshd_idle_timeout_value = 10_minutes
• sshd_set_idle_timeout: Set SSH Client Alive Interval
  • CCE-83281-6

SLES-15-010300: The sticky bit must be set on all SUSE operating system world-writable directories.

Description: None

• medium

Automated: yes

• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-83282-4

SLES-15-010310: The SUSE operating system must be configured to use TCP syncookies.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  • CCE-83283-2

SLES-15-010320: The SUSE operating system, for all network connections associated with SSH traffic, must immediately terminate at the end of the session or after 10 minutes of inactivity.

Description: None

• medium

Automated: yes

• sshd_set_keepalive: Set SSH Client Alive Count Max
  • CCE-91228-7
• sshd_set_keepalive_0: Set SSH Client Alive Count Max to zero
  • CCE-83284-0
• var_sshd_set_keepalive = 1

SLES-15-010330: All SUSE operating system persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.

Description: None

• high

Automated: yes

• encrypt_partitions: Encrypt Partitions
  • CCE-85719-3

SLES-15-010340: The SUSE operating system must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

Description: None

• medium

Automated: yes

• permissions_local_var_log: Verify permissions of log files
  • CCE-85755-7

SLES-15-010350: The SUSE operating system must prevent unauthorized users from accessing system error messages.

Description: None

• medium

Automated: yes

• file_permissions_local_var_log_messages: Verify that local /var/log/messages is not world-readable
  • CCE-83285-7

SLES-15-010351: The SUSE operating system library files must have mode 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_library_dirs: Verify that Shared Library Files Have Restrictive Permissions
  • CCE-85670-8

SLES-15-010352: The SUSE operating system library directories must have mode 0755 or less permissive.

Description: None

• medium

Automated: yes

• dir_permissions_library_dirs: Verify that Shared Library Directories Have Restrictive Permissions
  • CCE-85753-2

SLES-15-010353: The SUSE operating system library files must be owned by root.

Description: None

• medium

Automated: yes

• file_ownership_library_dirs: Verify that Shared Library Files Have Root Ownership
  • CCE-85756-5

SLES-15-010354: The SUSE operating system library directories must be owned by root.

Description: None

• medium

Automated: yes

• dir_ownership_library_dirs: Verify that Shared Library Directories Have Root Ownership
  • CCE-85735-9

SLES-15-010355: The SUSE operating system library files must be group-owned by root.

Description: None

• medium

Automated: yes

• root_permissions_syslibrary_files: Verify the system-wide library files in directories "/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.
  • CCE-85736-7

SLES-15-010356: The SUSE operating system library directories must be group-owned by root.

Description: None

• medium

Automated: yes

• dir_group_ownership_library_dirs: Verify that Shared Library Directories Have Root Group Ownership
  • CCE-85737-5

SLES-15-010357: The SUSE operating system must have system commands set to a mode of 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_system_commands_dirs: Verify that system commands are protected from unauthorized access
  • CCE-85738-3

SLES-15-010358: The SUSE operating system must have directories that contain system commands set to a mode of 0755 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_binary_dirs: Verify that System Executables Have Restrictive Permissions
  • CCE-85729-2

SLES-15-010359: The SUSE operating system must have system commands owned by root.

Description: None

• medium

Automated: yes

• file_ownership_binary_dirs: Verify that System Executables Have Root Ownership
  • CCE-85730-0

SLES-15-010360: The SUSE operating system must have directories that contain system commands owned by root.

Description: None

• medium

Automated: yes

• dir_system_commands_root_owned: Verify that system commands directories have root ownership
  • CCE-85741-7

SLES-15-010361: The SUSE operating system must have system commands group-owned by root or a system account.

Description: None

• medium

Automated: yes

• file_groupownership_system_commands_dirs: Verify that system commands files are group owned by root or a system account
  • CCE-85742-5

SLES-15-010362: The SUSE operating system must have directories that contain system commands group-owned by root.

Description: None

• medium

Automated: yes

• dir_system_commands_group_root_owned: Verify that system commands directories have root as a group owner
  • CCE-85743-3

SLES-15-010370: The SUSE operating system must have a firewall system installed to immediately disconnect or disable remote access to the whole operating system.

Description: None

• medium

Automated: no

No rules selected

SLES-15-010380: The SUSE operating system wireless network adapters must be disabled unless approved and documented.

Description: None

• medium

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-83286-5

SLES-15-010390: SUSE operating system AppArmor tool must be configured to control whitelisted applications and user home directory access control.

Description: None

• medium

Automated: yes

• apparmor_configured: Ensure AppArmor is Active and Configured
  • CCE-85752-4
• package_pam_apparmor_installed: Install the pam_apparmor Package
  • CCE-85765-6

SLES-15-010400: The SUSE operating system clock must, for networked systems, be synchronized to an authoritative DOD time source at least every 24 hours.

Description: None

• medium

Automated: yes

• chronyd_or_ntpd_set_maxpoll: Configure Time Service Maxpoll Interval
  • CCE-83287-3
• var_time_service_set_maxpoll = 18_hours

SLES-15-010410: The SUSE operating system must be configured to use Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Description: None

• low

Automated: yes

• ensure_rtc_utc_configuration: Ensure real-time clock is set to UTC
  • CCE-85724-3

SLES-15-010420: Advanced Intrusion Detection Environment (AIDE) must verify the baseline SUSE operating system configuration at least weekly.

Description: None

• medium

Automated: yes

• aide_periodic_cron_checking: Configure Periodic Execution of AIDE
  • CCE-85671-6

SLES-15-010430: The SUSE operating system tool zypper must have gpgcheck enabled.

Description: None

• high

Automated: yes

• ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main zypper Configuration
  • CCE-83290-7

SLES-15-010450: The SUSE operating system must reauthenticate users when changing authenticators, roles, or escalating privileges.

Description: None

• high

Automated: yes

• sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
  • CCE-83291-5
• sudo_remove_nopasswd: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
  • CCE-85663-3
• sudo_require_authentication: Ensure Users Re-Authenticate for Privilege Escalation - sudo
  • CCE-85673-2

SLES-15-010460: The SUSE operating system must have the packages required for multifactor authentication to be installed.

Description: None

• medium

Automated: yes

• install_smartcard_packages: Install Smart Card Packages For Multifactor Authentication
  • CCE-83292-3

SLES-15-010470: The SUSE operating system must implement certificate status checking for multifactor authentication.

Description: None

• medium

Automated: yes

• smartcard_configure_cert_checking: Configure Smart Card Certificate Status Checking
  • CCE-83293-1

SLES-15-010480: The SUSE operating system must disable the USB mass storage kernel module.

Description: None

• medium

Automated: yes

• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-83294-9

SLES-15-010490: If Network Security Services (NSS) is being used by the SUSE operating system it must prohibit the use of cached authentications after one day.

Description: None

• medium

Automated: yes

• sssd_memcache_timeout: Configure SSSD's Memory Cache to Expire
  • CCE-83295-6
• var_sssd_memcache_timeout = 1_day

SLES-15-010500: The SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to prohibit the use of cached offline authentications after one day.

Description: None

• medium

Automated: yes

• sssd_offline_cred_expiration: Configure SSSD to Expire Offline Credentials
  • CCE-83296-4

SLES-15-010510: FIPS 140-2 mode must be enabled on the SUSE operating system.

Description: None

• high

Automated: yes

• is_fips_mode_enabled: Verify '/proc/sys/crypto/fips_enabled' exists
  • CCE-85763-1

SLES-15-010530: All networked SUSE operating systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.

Description: None

• high

Automated: yes

• service_sshd_enabled: Enable the OpenSSH Service
  • CCE-83297-2

SLES-15-010540: The SUSE operating system must implement kptr-restrict to prevent the leaking of internal kernel addresses.

Description: None

• medium

Automated: yes

• sysctl_kernel_kptr_restrict: Restrict Exposed Kernel Pointer Addresses Access
  • CCE-83299-8

SLES-15-010550: Address space layout randomization (ASLR) must be implemented by the SUSE operating system to protect memory from unauthorized code execution.

Description: None

• medium

Automated: yes

• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
  • CCE-83300-4

SLES-15-010560: The SUSE operating system must remove all outdated software components after updated versions have been installed.

Description: None

• medium

Automated: yes

• clean_components_post_updating: Ensure zypper Removes Previous Package Versions
  • CCE-85551-0

SLES-15-010570: The SUSE operating system must notify the System Administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions.

Description: None

• medium

Automated: yes

• aide_periodic_checking_systemd_timer: Configure Systemd Timer Execution of AIDE
  • CCE-92516-4
• aide_scan_notification: Configure Notification of Post-AIDE Scan Details
  • CCE-91214-7

SLES-15-010580: The SUSE operating system must off-load rsyslog messages for networked systems in real time and off-load standalone systems at least weekly.

Description: None

• medium

Automated: yes

• rsyslog_remote_loghost: Ensure Logs Sent To Remote Host
  • CCE-85552-8

SLES-15-020000: The SUSE operating system must provision temporary accounts with an expiration date for 72 hours.

Description: None

• medium

Automated: no

No rules selected

SLES-15-020010: The SUSE operating system must lock an account after three consecutive invalid access attempts.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_tally2: Set Deny For Failed Password Attempts
  • CCE-85554-4
• var_password_pam_tally2 = 3

SLES-15-020020: The SUSE operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.

Description: None

• low

Automated: yes

• accounts_max_concurrent_login_sessions: Limit the Number of Concurrent Login Sessions Allowed Per User
  • CCE-85555-1
• var_accounts_max_concurrent_login_sessions = 10

SLES-15-020030: The SUSE operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).

Description: None

• medium

Automated: yes

• smartcard_pam_enabled: Enable Smart Card Logins in PAM
  • CCE-85556-9

SLES-15-020040: The SUSE operating system must deny direct logons to the root account using remote access via SSH.

Description: None

• medium

Automated: yes

• sshd_disable_root_login: Disable SSH Root Login
  • CCE-85557-7

SLES-15-020050: The SUSE operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.

Description: None

• medium

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
  • CCE-85558-5
• var_account_disable_post_pw_expiration = 35

SLES-15-020060: The SUSE operating system must never automatically remove or disable emergency administrator accounts.

Description: None

• medium

Automated: no

• account_emergency_admin: Never Automatically Remove or Disable Emergency Administrator Accounts
  • CCE-85559-3

SLES-15-020090: The SUSE operating system must not have unnecessary accounts.

Description: None

• medium

Automated: yes

• accounts_authorized_local_users: Only Authorized Local User Accounts Exist on Operating System
  • CCE-85561-9
• var_accounts_authorized_local_users_regex = sle15

SLES-15-020091: The SUSE operating system must not have unnecessary account capabilities.

Description: None

• medium

Automated: yes

• no_shelllogin_for_systemaccounts: Ensure that System Accounts Do Not Run a Shell Upon Login
  • CCE-85672-4

SLES-15-020100: The SUSE operating system root account must be the only account with unrestricted access to the system.

Description: None

• high

Automated: yes

• accounts_no_uid_except_zero: Verify Only Root Has UID 0
  • CCE-85664-1

SLES-15-020101: The SUSE operating system must restrict privilege elevation to authorized personnel.

Description: None

• medium

Automated: yes

• sudo_restrict_privilege_elevation_to_authorized: The operating system must restrict privilege elevation to authorized personnel
  • CCE-85712-8

SLES-15-020102: The SUSE operating system must require reauthentication when using the "sudo" command.

Description: None

• medium

Automated: yes

• sudo_require_reauthentication: Require Re-Authentication When Using the sudo Command
  • CCE-85764-9
• var_sudo_timestamp_timeout = always_prompt

SLES-15-020103: The SUSE operating system must use the invoking user's password for privilege escalation when using "sudo".

Description: None

• medium

Automated: yes

• sudoers_validate_passwd: Ensure invoking users password for privilege escalation when using sudo
  • CCE-85747-4

SLES-15-020110: All SUSE operating system local interactive user accounts, upon creation, must be assigned a home directory.

Description: None

• medium

Automated: yes

• accounts_have_homedir_login_defs: Ensure Home Directories are Created for New Users
  • CCE-85562-7

SLES-15-020120: The SUSE operating system must display the date and time of the last successful account logon upon an SSH logon.

Description: None

• medium

Automated: yes

• sshd_print_last_log: Enable SSH Print Last Log
  • CCE-85563-5

SLES-15-020130: The SUSE operating system must enforce passwords that contain at least one uppercase character.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_ucredit: Set Password Strength Minimum Uppercase Characters
  • CCE-85675-7
• var_password_pam_ucredit = 1

SLES-15-020140: The SUSE operating system must enforce passwords that contain at least one lowercase character.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_lcredit: Set Password Strength Minimum Lowercase Characters
  • CCE-85676-5
• var_password_pam_lcredit = 1

SLES-15-020150: The SUSE operating system must enforce passwords that contain at least one numeric character.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_dcredit: Set Password Strength Minimum Digit Characters
  • CCE-85564-3
• var_password_pam_dcredit = 1

SLES-15-020160: The SUSE operating system must require the change of at least eight of the total number of characters when passwords are changed.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_difok: Set Password Strength Minimum Different Characters
  • CCE-85677-3

SLES-15-020170: The SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to only store encrypted representations of passwords.

Description: None

• medium

Automated: yes

• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-85565-0

SLES-15-020180: The SUSE operating system must employ FIPS 140-2-approved cryptographic hashing algorithms for all stored passwords.

Description: None

• medium

Automated: yes

• accounts_password_all_shadowed_sha512: Verify All Account Password Hashes are Shadowed with SHA512
  • CCE-85566-8

SLES-15-020190: The SUSE operating system must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords.

Description: None

• medium

Automated: yes

• set_password_hashing_min_rounds_logindefs: Set Password Hashing Rounds in /etc/login.defs
  • CCE-85567-6
• var_password_hashing_min_rounds_login_defs = 100000

SLES-15-020200: The SUSE operating system must be configured to create or update passwords with a minimum lifetime of 24 hours (one day).

Description: None

• medium

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-85720-1
• var_accounts_minimum_age_login_defs = 7

SLES-15-020210: The SUSE operating system must employ user passwords with a minimum lifetime of 24 hours (one day).

Description: None

• medium

Automated: yes

• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-85710-2

SLES-15-020220: The SUSE operating system must be configured to create or update passwords with a maximum lifetime of 60 days.

Description: None

• medium

Automated: yes

• accounts_maximum_age_login_defs: Set Password Maximum Age
  • CCE-85570-0
• var_accounts_maximum_age_login_defs = 60

SLES-15-020230: The SUSE operating system must employ user passwords with a maximum lifetime of 60 days.

Description: None

• medium

Automated: yes

• accounts_password_set_max_life_existing: Set Existing Passwords Maximum Age
  • CCE-85571-8

SLES-15-020260: The SUSE operating system must employ passwords with a minimum of 15 characters.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_minlen: Set Password Minimum Length
  • CCE-85573-4
• var_password_pam_minlen = 15

SLES-15-020270: The SUSE operating system must enforce passwords that contain at least one special character.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_ocredit: Set Password Strength Minimum Special Characters
  • CCE-85574-2
• var_password_pam_ocredit = 1

SLES-15-020290: The SUSE operating system must prevent the use of dictionary words for passwords.

Description: None

• medium

Automated: yes

• cracklib_accounts_password_pam_retry: Set Password Retry Limit
  • CCE-85575-9

SLES-15-020300: The SUSE operating system must not be configured to allow blank or null passwords.

Description: None

• high

Automated: yes

• no_empty_passwords: Prevent Login to Accounts With Empty Password
  • CCE-85576-7

SLES-15-030000: The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd
  • CCE-85577-5

SLES-15-030010: The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group
  • CCE-85578-3

SLES-15-030020: The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow
  • CCE-85579-1

SLES-15-030030: The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd
  • CCE-85728-4

SLES-15-030040: The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
  • CCE-85580-9

SLES-15-030050: SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.

Description: None

• medium

Automated: yes

• service_auditd_enabled: Enable auditd Service
  • CCE-85581-7

SLES-15-030060: The SUSE operating system must generate audit records for all uses of the ssh-keysign command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_ssh_keysign: Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
  • CCE-85582-5

SLES-15-030070: The SUSE operating system must generate audit records for all uses of the passwd command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_passwd: Ensure auditd Collects Information on the Use of Privileged Commands - passwd
  • CCE-85583-3

SLES-15-030080: The SUSE operating system must generate audit records for all uses of the gpasswd command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_gpasswd: Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
  • CCE-85584-1

SLES-15-030090: The SUSE operating system must generate audit records for all uses of the newgrp command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_newgrp: Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
  • CCE-85585-8

SLES-15-030100: The SUSE operating system must generate audit records for a uses of the chsh command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_chsh: Ensure auditd Collects Information on the Use of Privileged Commands - chsh
  • CCE-85586-6

SLES-15-030110: The SUSE operating system must generate audit records for all uses of the unix_chkpwd or unix2_chkpwd commands.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_unix2_chkpwd: Ensure auditd Collects Information on the Use of Privileged Commands - unix2_chkpwd
  • CCE-85762-3
• audit_rules_privileged_commands_unix_chkpwd: Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
  • CCE-85727-6

SLES-15-030120: The SUSE operating system must generate audit records for all uses of the chage command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_chage: Ensure auditd Collects Information on the Use of Privileged Commands - chage
  • CCE-85587-4

SLES-15-030130: The SUSE operating system must generate audit records for all uses of the crontab command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_crontab: Ensure auditd Collects Information on the Use of Privileged Commands - crontab
  • CCE-85588-2

SLES-15-030140: The SUSE operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.

Description: None

• medium

Automated: yes

• audit_rules_sysadmin_actions: Ensure auditd Collects System Administrator Actions
  • CCE-85679-9

SLES-15-030150: The SUSE operating system must generate audit records for all uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.

Description: None

• medium

Automated: yes

• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
  • CCE-85681-5
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
  • CCE-85696-3
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
  • CCE-85680-7
• audit_rules_unsuccessful_file_modification_open_by_handle_at: Record Unsuccessful Access Attempts to Files - open_by_handle_at
  • CCE-85683-1
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
  • CCE-85682-3
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate
  • CCE-85608-8

SLES-15-030190: The SUSE operating system must generate audit records for all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
  • CCE-85686-4
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
  • CCE-85688-0
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
  • CCE-85685-6
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
  • CCE-85689-8
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
  • CCE-85684-9
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr
  • CCE-85687-2

SLES-15-030250: The SUSE operating system must generate audit records for all uses of the chown, fchown, fchownat, and lchown system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
  • CCE-85690-6
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
  • CCE-85721-9
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
  • CCE-85692-2
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown
  • CCE-85691-4

SLES-15-030290: The SUSE operating system must generate audit records for all uses of the chmod, fchmod, and fchmodat system calls.

Description: None

• medium

Automated: yes

• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
  • CCE-85693-0
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
  • CCE-85694-8
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat
  • CCE-85695-5

SLES-15-030330: The SUSE operating system must generate audit records for all uses of the sudoedit command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_sudoedit: Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit
  • CCE-85717-7

SLES-15-030340: The SUSE operating system must generate audit records for all uses of the chfn command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_chfn: Ensure auditd Collects Information on the Use of Privileged Commands - chfn
  • CCE-85589-0

SLES-15-030350: The SUSE operating system must generate audit records for all uses of the mount system call.

Description: None

• low

Automated: yes

• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-85718-5

SLES-15-030360: The SUSE operating system must generate audit records for all uses of the umount system call.

Description: None

• low

Automated: yes

• audit_rules_dac_modification_umount: Record Events that Modify the System's Discretionary Access Controls - umount
  • CCE-85734-2
• audit_rules_dac_modification_umount2: Record Events that Modify the System's Discretionary Access Controls - umount2
  • CCE-91250-1

SLES-15-030370: The SUSE operating system must generate audit records for all uses of the ssh-agent command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_ssh_agent: Record Any Attempts to Run ssh-agent
  • CCE-85590-8

SLES-15-030380: The SUSE operating system must generate audit records for all uses of the insmod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_insmod: Ensure auditd Collects Information on the Use of Privileged Commands - insmod
  • CCE-85744-1

SLES-15-030390: The SUSE operating system must generate audit records for all uses of the rmmod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_rmmod: Ensure auditd Collects Information on the Use of Privileged Commands - rmmod
  • CCE-85732-6

SLES-15-030400: The SUSE operating system must generate audit records for all uses of the modprobe command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_modprobe: Ensure auditd Collects Information on the Use of Privileged Commands - modprobe
  • CCE-85731-8

SLES-15-030410: The SUSE operating system must generate audit records for all uses of the kmod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
  • CCE-85591-6

SLES-15-030420: The SUSE operating system must generate audit records for all uses of the chmod command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chmod: Record Any Attempts to Run chmod
  • CCE-85593-2

SLES-15-030430: The SUSE operating system must generate audit records for all uses of the setfacl command.

Description: None

• medium

Automated: yes

• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl
  • CCE-85594-0

SLES-15-030440: The SUSE operating system must generate audit records for all uses of the chacl command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chacl: Record Any Attempts to Run chacl
  • CCE-85595-7

SLES-15-030450: The SUSE operating system must generate audit records for all uses of the chcon command.

Description: None

• medium

Automated: yes

• audit_rules_execution_chcon: Record Any Attempts to Run chcon
  • CCE-85716-9

SLES-15-030460: The SUSE operating system must generate audit records for all uses of the rm command.

Description: None

• medium

Automated: yes

• audit_rules_execution_rm: Record Any Attempts to Run rm
  • CCE-85596-5

SLES-15-030470: The SUSE operating system must generate audit records for all modifications to the tallylog file must generate an audit record.

Description: None

• medium

Automated: yes

• audit_rules_login_events_tallylog: Record Attempts to Alter Logon and Logout Events - tallylog
  • CCE-85597-3

SLES-15-030480: The SUSE operating system must generate audit records for all modifications to the lastlog file.

Description: None

• medium

Automated: yes

• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
  • CCE-85598-1

SLES-15-030490: The SUSE operating system must generate audit records for all uses of the passmass command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_passmass: Ensure auditd Collects Information on the Use of Privileged Commands - passmass
  • CCE-85599-9

SLES-15-030500: The SUSE operating system must generate audit records for all uses of the usermod command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
  • CCE-85600-5

SLES-15-030510: The SUSE operating system must generate audit records for all uses of the pam_timestamp_check command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_pam_timestamp_check: Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
  • CCE-85601-3

SLES-15-030520: The SUSE operating system must generate audit records for all uses of the delete_module system call.

Description: None

• medium

Automated: yes

• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
  • CCE-85748-2

SLES-15-030530: The SUSE operating system must generate audit records for all uses of the init_module and finit_module system calls.

Description: None

• medium

Automated: yes

• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
  • CCE-85749-0
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module
  • CCE-85750-8

SLES-15-030550: The SUSE operating system must generate audit records for all uses of the su command.

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_su: Ensure auditd Collects Information on the Use of Privileged Commands - su
  • CCE-85602-1

SLES-15-030560: The SUSE operating system must generate audit records for all uses of the sudo command.

Description: None

• low

Automated: yes

• audit_rules_privileged_commands_sudo: Ensure auditd Collects Information on the Use of Privileged Commands - sudo
  • CCE-85603-9

SLES-15-030570: The Information System Security Officer (ISSO) and System Administrator (SA), at a minimum, must be alerted of a SUSE operating system audit processing failure event.

Description: None

• medium

Automated: yes

• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
  • CCE-85604-7

SLES-15-030580: The Information System Security Officer (ISSO) and System Administrator (SA), at a minimum, must have mail aliases to be notified of a SUSE operating system audit processing failure.

Description: None

• medium

Automated: yes

• postfix_client_configure_mail_alias: Configure System to Forward All Mail For The Root Account
  • CCE-85605-4

SLES-15-030590: The SUSE operating system audit system must take appropriate action when the audit storage volume is full.

Description: None

• medium

Automated: yes

• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-85606-2
• var_auditd_disk_full_action = syslog

SLES-15-030600: The SUSE operating system must protect audit rules from unauthorized modification.

Description: None

• medium

Automated: yes

• permissions_local_var_log_audit: Verify that Local Logs of the audit Daemon are not World-Readable
  • CCE-85607-0

SLES-15-030620: The SUSE operating system audit tools must have the proper permissions configured to protect against unauthorized access.

Description: None

• medium

Automated: yes

• permissions_local_audit_binaries: Verify Permissions of Local Logs of audit Tools
  • CCE-85609-6

SLES-15-030630: The SUSE operating system file integrity tool must be configured to protect the integrity of the audit tools.

Description: None

• medium

Automated: yes

• aide_check_audit_tools: Configure AIDE to Verify the Audit Tools
  • CCE-85610-4

SLES-15-030640: The SUSE operating system must generate audit records for all uses of the privileged functions.

Description: None

• low

Automated: yes

• audit_rules_suid_privilege_function: Record Events When Privileged Executables Are Run
  • CCE-85611-2

SLES-15-030650: The SUSE operating system must have the auditing package installed.

Description: None

• medium

Automated: yes

• package_audit_installed: Ensure the audit Subsystem is Installed
  • CCE-85612-0

SLES-15-030660: The SUSE operating system must allocate audit record storage capacity to store at least one week of audit records when audit records are not immediately sent to a central audit record storage facility.

Description: None

• medium

Automated: no

• auditd_audispd_configure_sufficiently_large_partition: Configure a Sufficiently Large Partition for Audit Logs
  • CCE-85697-1

SLES-15-030670: The audit-audispd-plugins must be installed on the SUSE operating system.

Description: None

• medium

Automated: yes

• package_audit-audispd-plugins_installed: Ensure the default plugins for the audit dispatcher are Installed
  • CCE-85613-8

SLES-15-030680: The SUSE operating system audit event multiplexor must be configured to use Kerberos.

Description: None

• low

Automated: yes

• auditd_audispd_encrypt_sent_records: Encrypt Audit Records Sent With audispd Plugin
  • CCE-85614-6

SLES-15-030690: Audispd must off-load audit records onto a different system or media from the SUSE operating system being audited.

Description: None

• low

Automated: yes

• auditd_audispd_configure_remote_server: Configure audispd Plugin To Send Logs To Remote Server
  • CCE-85615-3

SLES-15-030700: The SUSE operating system auditd service must notify the System Administrator (SA) and Information System Security Officer (ISSO) immediately when audit storage capacity is 75 percent full.

Description: None

• medium

Automated: yes

• auditd_data_retention_space_left: Configure auditd space_left on Low Disk Space
  • CCE-85616-1

SLES-15-030740: The SUSE operating system must generate audit records for all uses of the unlink, unlinkat, rename, renameat, and rmdir system calls.

Description: None

• medium

Automated: yes

• audit_rules_unsuccessful_file_modification_rename: Record Unsuccessful Delete Attempts to Files - rename
  • CCE-85701-1
• audit_rules_unsuccessful_file_modification_renameat: Record Unsuccessful Delete Attempts to Files - renameat
  • CCE-85702-9
• audit_rules_unsuccessful_file_modification_renameat2: Record Unsuccessful Delete Attempts to Files - renameat2
  • CCE-85726-8
• audit_rules_unsuccessful_file_modification_unlink: Record Unsuccessful Delete Attempts to Files - unlink
  • CCE-85703-7
• audit_rules_unsuccessful_file_modification_unlinkat: Record Unsuccessful Delete Attempts to Files - unlinkat
  • CCE-85704-5

SLES-15-030760: The SUSE operating system must generate audit records for the /run/utmp file.

Description: None

• medium

Automated: yes

• audit_rules_session_events_utmp: Record Attempts to Alter Process and Session Initiation Information utmp
  • CCE-85714-4

SLES-15-030770: The SUSE operating system must generate audit records for the /var/log/wtmp file.

Description: None

• medium

Automated: yes

• audit_rules_session_events_wtmp: Record Attempts to Alter Process and Session Initiation Information wtmp
  • CCE-85757-3

SLES-15-030780: The SUSE operating system must generate audit records for the /var/log/btmp file.

Description: None

• medium

Automated: yes

• audit_rules_session_events_btmp: Record Attempts to Alter Process and Session Initiation Information btmp
  • CCE-85758-1

SLES-15-030790: The SUSE operating system must off-load audit records onto a different system or media from the system being audited.

Description: None

• medium

Automated: yes

• auditd_audispd_network_failure_action: Configure audispd's Plugin network_failure_action On Network Failure
  • CCE-85705-2

SLES-15-030800: Audispd must take appropriate action when the SUSE operating system audit storage is full.

Description: None

• medium

Automated: yes

• auditd_audispd_disk_full_action: Configure audispd's Plugin disk_full_action When Disk Is Full
  • CCE-85617-9

SLES-15-030810: The SUSE operating system must use a separate file system for the system audit data path.

Description: None

• low

Automated: yes

• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-85618-7

SLES-15-030820: The SUSE operating system must not disable syscall auditing.

Description: None

• medium

Automated: yes

• audit_rules_enable_syscall_auditing: Remove Default Configuration to Disable Syscall Auditing
  • CCE-85706-0

SLES-15-040000: The SUSE operating system must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

Description: None

• medium

Automated: no

No rules selected

SLES-15-040010: The SUSE operating system must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faildelay_delay: Enforce Delay After Failed Logon Attempts
  • CCE-85619-5
• var_accounts_fail_delay = 4
• var_password_pam_delay = 4000000

SLES-15-040020: There must be no .shosts files on the SUSE operating system.

Description: None

• high

Automated: yes

• no_user_host_based_files: Remove User Host-Based Authentication Files
  • CCE-85621-1

SLES-15-040030: There must be no shosts.equiv files on the SUSE operating system.

Description: None

• high

Automated: yes

• no_host_based_files: Remove Host-Based Authentication Files
  • CCE-85622-9

SLES-15-040040: The SUSE operating system file integrity tool must be configured to verify Access Control Lists (ACLs).

Description: None

• low

Automated: yes

• aide_verify_acls: Configure AIDE to Verify Access Control Lists (ACLs)
  • CCE-85623-7

SLES-15-040050: The SUSE operating system file integrity tool must be configured to verify extended attributes.

Description: None

• low

Automated: yes

• aide_verify_ext_attributes: Configure AIDE to Verify Extended Attributes
  • CCE-85624-5

SLES-15-040060: The SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence.

Description: None

• high

Automated: yes

• disable_ctrlaltdel_reboot: Disable Ctrl-Alt-Del Reboot Activation
  • CCE-85625-2

SLES-15-040061: The SUSE operating system must disable the x86 Ctrl-Alt-Delete key sequence for Graphical User Interfaces.

Description: None

• high

Automated: yes

• enable_dconf_user_profile: Configure GNOME3 DConf User Profile
  • CCE-83267-5

SLES-15-040062: The SUSE operating system must disable the systemd Ctrl-Alt-Delete burst key sequence.

Description: None

• high

Automated: yes

• disable_ctrlaltdel_burstaction: Disable Ctrl-Alt-Del Burst Action
  • CCE-85665-8

SLES-15-040070: All SUSE operating system local interactive users must have a home directory assigned in the /etc/passwd file.

Description: None

• medium

Automated: yes

• accounts_user_interactive_home_directory_defined: All Interactive Users Must Have A Home Directory Defined
  • CCE-85627-8

SLES-15-040080: All SUSE operating system local interactive user home directories defined in the /etc/passwd file must exist.

Description: None

• medium

Automated: yes

• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
  • CCE-85628-6

SLES-15-040090: All SUSE operating system local interactive user home directories must have mode 0750 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
  • CCE-85629-4

SLES-15-040100: All SUSE operating system local interactive user home directories must be group-owned by the home directory owner's primary group.

Description: None

• medium

Automated: yes

• file_groupownership_home_directories: All Interactive User Home Directories Must Be Group-Owned By The Primary Group
  • CCE-85711-0

SLES-15-040110: All SUSE operating system local initialization files must have mode 0740 or less permissive.

Description: None

• medium

Automated: yes

• file_permission_user_init_files: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
  • CCE-85630-2

SLES-15-040120: All SUSE operating system local interactive user initialization files executable search paths must contain only paths that resolve to the users home directory.

Description: None

• medium

Automated: no

• accounts_user_home_paths_only: Ensure that Users Path Contains Only Local Directories
  • CCE-85631-0

SLES-15-040130: All SUSE operating system local initialization files must not execute world-writable programs.

Description: None

• medium

Automated: yes

• accounts_user_dot_no_world_writable_programs: User Initialization Files Must Not Run World-Writable Programs
  • CCE-85632-8

SLES-15-040140: SUSE operating system file systems that contain user home directories must be mounted to prevent files with the setuid and setgid bit set from being executed.

Description: None

• medium

Automated: yes

• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-85633-6

SLES-15-040150: SUSE operating system file systems that are used with removable media must be mounted to prevent files with the setuid and setgid bit set from being executed.

Description: None

• medium

Automated: yes

• mount_option_nosuid_removable_partitions: Add nosuid Option to Removable Media Partitions
  • CCE-85634-4
• var_removable_partition = dev_cdrom

SLES-15-040160: SUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent files with the setuid and setgid bit set from being executed.

Description: None

• medium

Automated: yes

• mount_option_nosuid_remote_filesystems: Mount Remote Filesystems with nosuid
  • CCE-85635-1

SLES-15-040170: SUSE operating system file systems that are being imported via Network File System (NFS) must be mounted to prevent binary files from being executed.

Description: None

• medium

Automated: yes

• mount_option_noexec_remote_filesystems: Mount Remote Filesystems with noexec
  • CCE-85636-9

SLES-15-040180: All SUSE operating system world-writable directories must be group-owned by root, sys, bin, or an application group.

Description: None

• medium

Automated: yes

• dir_perms_world_writable_system_owned_group: Ensure All World-Writable Directories Are Group Owned by a System Account
  • CCE-85637-7

SLES-15-040190: SUSE operating system kernel core dumps must be disabled unless needed.

Description: None

• medium

Automated: yes

• service_kdump_disabled: Disable KDump Kernel Crash Analyzer (kdump)
  • CCE-85638-5

SLES-15-040200: A separate file system must be used for SUSE operating system user home directories (such as /home or an equivalent).

Description: None

• low

Automated: yes

• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-85639-3

SLES-15-040210: The SUSE operating system must use a separate file system for /var.

Description: None

• low

Automated: yes

• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-85640-1

SLES-15-040220: The SUSE operating system must be configured to not overwrite Pluggable Authentication Modules (PAM) configuration on package changes.

Description: None

• medium

Automated: yes

• pam_disable_automatic_configuration: The PAM configuration should not be changed automatically
  • CCE-85641-9

SLES-15-040230: The SUSE operating system SSH daemon must be configured to not allow authentication using known hosts authentication.

Description: None

• medium

Automated: yes

• sshd_disable_user_known_hosts: Disable SSH Support for User Known Hosts
  • CCE-85642-7

SLES-15-040240: The SUSE operating system SSH daemon public host key files must have mode 0644 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-85643-5

SLES-15-040250: The SUSE operating system SSH daemon private host key files must have mode 0640 or less permissive.

Description: None

• medium

Automated: yes

• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-85644-3

SLES-15-040260: The SUSE operating system SSH daemon must perform strict mode checking of home directory configuration files.

Description: None

• medium

Automated: yes

• sshd_enable_strictmodes: Enable Use of Strict Mode Checking
  • CCE-85645-0

SLES-15-040290: The SUSE operating system SSH daemon must disable forwarded remote X connections for interactive users, unless to fulfill documented and validated mission requirements.

Description: None

• medium

Automated: yes

• sshd_disable_x11_forwarding: Disable X11 Forwarding
  • CCE-85707-8

SLES-15-040300: The SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  • CCE-85648-4

SLES-15-040310: The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  • CCE-85649-2

SLES-15-040320: The SUSE operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  • CCE-85650-0

SLES-15-040321: The SUSE operating system must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  • CCE-85653-4

SLES-15-040330: The SUSE operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  • CCE-85651-8

SLES-15-040340: The SUSE operating system must not allow interfaces to accept Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  • CCE-85652-6

SLES-15-040341: The SUSE operating system must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  • CCE-85708-6

SLES-15-040350: The SUSE operating system must not allow interfaces to accept Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages by default.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  • CCE-85722-7

SLES-15-040360: The SUSE operating system must not allow interfaces to send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages by default.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  • CCE-85654-2

SLES-15-040370: The SUSE operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  • CCE-85655-9

SLES-15-040380: The SUSE operating system must not be performing Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router.

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_ip_forward: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  • CCE-85709-4

SLES-15-040381: The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
  • CCE-85713-6

SLES-15-040382: The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding by default unless the system is a router.

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_forwarding: Disable Kernel Parameter for IPv6 Forwarding by default
  • CCE-85725-0

SLES-15-040390: The SUSE operating system must not have network interfaces in promiscuous mode unless approved and documented.

Description: None

• medium

Automated: yes

• network_sniffer_disabled: Ensure System is Not Acting as a Network Sniffer
  • CCE-85656-7

SLES-15-040400: All SUSE operating system files and directories must have a valid owner.

Description: None

• medium

Automated: yes

• no_files_unowned_by_user: Ensure All Files Are Owned by a User
  • CCE-85657-5

SLES-15-040410: All SUSE operating system files and directories must have a valid group owner.

Description: None

• medium

Automated: yes

• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
  • CCE-85658-3

SLES-15-040420: The SUSE operating system default permissions must be defined in such a way that all authenticated users can only read and modify their own files.

Description: None

• medium

Automated: yes

• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-85659-1

SLES-15-040430: The SUSE operating system must not allow unattended or automatic logon via the graphical user interface (GUI).

Description: None

• high

Automated: yes

• gnome_gdm_disable_unattended_automatic_login: Disable GDM Unattended or Automatic Login
  • CCE-85723-5

SLES-15-040440: The SUSE operating system must not allow unattended or automatic logon via SSH.

Description: None

• high

Automated: yes

• sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords
  • CCE-85667-4
• sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options
  • CCE-85666-6

SLES-15-020099: The SUSE operating system must specify the default "include" directory for the /etc/sudoers file.

Description: None

• medium

Automated: yes

• sudoers_default_includedir: Ensure sudo only includes the default configuration directory
  • CCE-91151-1

SLES-15-020104: The SUSE operating system must not be configured to bypass password requirements for privilege escalation.

Description: None

• medium

Automated: yes

• disallow_bypass_password_sudo: Disallow Configuration to Bypass Password Requirements for Privilege Escalation
  • CCE-91156-0

SLES-15-020181: The SUSE operating system must not have accounts configured with blank or null passwords.

Description: None

• high

Automated: yes

• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-91155-2

SLES-15-040450: The SUSE operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.

Description: None

• medium

Automated: yes

• sshd_use_approved_kex_ordered_stig: Use Only FIPS 140-2 Validated Key Exchange Algorithms
  • CCE-92505-7

SLES-15-010375: The SUSE operating system must restrict access to the kernel message buffer.

Description: None

• low

Automated: yes

• sysctl_kernel_dmesg_restrict: Restrict Access to Kernel Message Buffer
  • CCE-91448-1

SLES-15-010419: The SUSE operating system must use a file integrity tool to verify correct operation of all security functions.

Description: None

• medium

Automated: yes

• aide_build_database: Build and Test AIDE Database
  • CCE-85787-0
• package_aide_installed: Install AIDE
  • CCE-83289-9

SLES-15-010418: The SUSE operating system must be configured to allow sending email notifications of unauthorized configuration changes to designated personnel.

Description: None

• medium

Automated: yes

• package_mailx_installed: The mailx Package Is Installed
  • CCE-92519-8

SLES-15-030015: The SUSE operating system must audit any script or executable called by cron as root or by any privileged user.

Description: None

• medium

Automated: yes

• audit_rules_etc_cron_d: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/
  • CCE-92586-7
• audit_rules_var_spool_cron: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron
  • CCE-92588-3