Definition of General Profile for SL Micro 6 for slmicro6

SLEM-6-SET-0101501500: Disable Mounting of cramfs

Description: None

• medium

Automated: yes

• kernel_module_cramfs_disabled: Disable Mounting of cramfs
  • CCE-94939-6

SLEM-6-SET-0101503000: Disable IEEE 1394 (FireWire) Support

Description: None

• medium

Automated: yes

• kernel_module_firewire-core_disabled: Disable IEEE 1394 (FireWire) Support
  • CCE-94844-8

SLEM-6-SET-0101504500: Disable Mounting of freevxfs

Description: None

• medium

Automated: yes

• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs
  • CCE-94831-5

SLEM-6-SET-0101506000: Disable Mounting of hfs

Description: None

• medium

Automated: yes

• kernel_module_hfs_disabled: Disable Mounting of hfs
  • CCE-94964-4

SLEM-6-SET-0101507500: Disable Mounting of hfsplus

Description: None

• medium

Automated: yes

• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus
  • CCE-94805-9

SLEM-6-SET-0101509000: Disable Mounting of jffs2

Description: None

• medium

Automated: yes

• kernel_module_jffs2_disabled: Disable Mounting of jffs2
  • CCE-94748-1

SLEM-6-SET-0101512000: Disable Mounting of squashfs

Description: None

• medium

Automated: yes

• kernel_module_squashfs_disabled: Disable Mounting of squashfs
  • CCE-94978-4

SLEM-6-SET-0101513500: Disable Mounting of udf

Description: None

• medium

Automated: yes

• kernel_module_udf_disabled: Disable Mounting of udf
  • CCE-94968-5

SLEM-6-SET-0101515000: Configure unused filesystems kernel modules are not available

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SET-0103001501: Ensure /tmp Located On Separate Partition

Description: None

• low

Automated: yes

• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-94806-7

SLEM-6-SET-0103001502: Add nodev Option to /tmp

Description: None

• medium

Automated: yes

• mount_option_tmp_nodev: Add nodev Option to /tmp
  • CCE-94812-5

SLEM-6-SET-0103001503: Add nosuid Option to /tmp

Description: None

• medium

Automated: yes

• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-94962-8

SLEM-6-SET-0103001504: Add noexec Option to /tmp

Description: None

• medium

Automated: yes

• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-94910-7

SLEM-6-SET-0103003001: Configure /dev/shm

Description: None

• low

Automated: yes

• partition_for_dev_shm: Ensure /dev/shm is configured
  • CCE-94887-7

SLEM-6-SET-0103003002: Add nodev Option to /dev/shm

Description: None

• medium

Automated: yes

• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-94952-9

SLEM-6-SET-0103003003: Add nosuid Option to /dev/shm

Description: None

• medium

Automated: yes

• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-94942-0

SLEM-6-SET-0103003004: Add noexec Option to /dev/shm

Description: None

• medium

Automated: yes

• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-94863-8

SLEM-6-SET-0103004501: Ensure /home Located On Separate Partition

Description: None

• medium

Automated: yes

• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-95066-7

SLEM-6-SET-0103004502: Add nodev Option to /home

Description: None

• medium

Automated: yes

• mount_option_home_nodev: Add nodev Option to /home
  • CCE-94977-6

SLEM-6-SET-0103004503: Add nosuid Option to /home

Description: None

• medium

Automated: yes

• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-95062-6

SLEM-6-SET-0103006001: Ensure /var Located On Separate Partition

Description: None

• medium

Automated: yes

• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-95067-5

SLEM-6-SET-0103006002: Add nodev Option to /var

Description: None

• medium

Automated: yes

• mount_option_var_nodev: Add nodev Option to /var
  • CCE-94884-4

SLEM-6-SET-0103006003: Add nosuid Option to /var

Description: None

• medium

Automated: yes

• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-94792-9

SLEM-6-SET-0103007501: Ensure /var/tmp Located On Separate Partition

Description: None

• medium

Automated: yes

• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
  • CCE-94970-1

SLEM-6-SET-0103007502: Add nodev Option to /var/tmp

Description: None

• medium

Automated: yes

• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-95008-9

SLEM-6-SET-0103007503: Add nosuid Option to /var/tmp

Description: None

• medium

Automated: yes

• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-94766-3

SLEM-6-SET-0103007504: Add noexec Option to /var/tmp

Description: None

• medium

Automated: yes

• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-94890-1

SLEM-6-SET-0103009001: Ensure /var/log Located On Separate Partition

Description: None

• medium

Automated: yes

• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-94954-5

SLEM-6-SET-0103009002: Add nodev Option to /var/log

Description: None

• medium

Automated: yes

• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-94923-0

SLEM-6-SET-0103009003: Add nosuid Option to /var/log

Description: None

• medium

Automated: yes

• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-94866-1

SLEM-6-SET-0103009004: Add noexec Option to /var/log

Description: None

• medium

Automated: yes

• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-94789-5

SLEM-6-SET-0103010501: Ensure /var/log/audit Located On Separate Partition

Description: None

• medium

Automated: yes

• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-95048-5

SLEM-6-SET-0103010502: Add nodev Option to /var/log/audit

Description: None

• medium

Automated: yes

• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-94761-4

SLEM-6-SET-0103010503: Add nosuid Option to /var/log/audit

Description: None

• medium

Automated: yes

• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-95013-9

SLEM-6-SET-0103010504: Add noexec Option to /var/log/audit

Description: None

• medium

Automated: yes

• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-95005-5

SLEM-6-SET-0201501500: Ensure SUSE GPG Key Installed

Description: None

• medium

Automated: yes

• ensure_suse_gpgkey_installed: Ensure SUSE GPG Key Installed
  • CCE-94771-3

SLEM-6-SET-0201503000: Ensure gpgcheck Enabled In Main zypper Configuration

Description: None

• high

Automated: yes

• ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main zypper Configuration
  • CCE-94715-0

SLEM-6-SET-0201504500: Configure repo_gpgcheck is configured

Description: None

• high

Automated: no

No rules selected

SLEM-6-SET-0201506000: Configure package manager repositories are configured

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SET-0201507500: Disable Installation of Weak Dependencies

Description: None

• medium

Automated: yes

• zypper_only_requires_enabled: Disable Installation of Weak Dependencies in Zypper
  • CCE-94883-6

SLEM-6-SET-0203001500: Configure updates, patches, and additional security software are installed

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SET-0301501500: Install libselinux Package

Description: None

• medium

Automated: yes

• package_libselinux_installed: Install libselinux Package
  • CCE-95023-8

SLEM-6-SET-0301503000: Ensure SELinux Not Disabled in /etc/default/grub

Description: None

• medium

Automated: yes

• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-94857-0

SLEM-6-SET-0301504500: Configure SELinux Policy

Description: None

• medium

Automated: yes

• selinux_policytype: Configure SELinux Policy
  • CCE-95094-9
• var_selinux_policy_name = targeted

SLEM-6-SET-0301506000: Uninstall mcstrans Package

Description: None

• medium

Automated: yes

• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-94752-3

SLEM-6-SET-0301507500: Ensure SELinux is Not Disabled

Description: None

• medium

Automated: yes

• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-94958-6

SLEM-6-SET-0301509000: Ensure SELinux State is Enforcing

Description: None

• medium

Automated: yes

• selinux_state: Ensure SELinux State is Enforcing
  • CCE-95092-3
• var_selinux_state = enforcing

SLEM-6-SET-0301510500: Uninstall setroubleshoot Package

Description: None

• medium

Automated: yes

• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-95029-5

SLEM-6-SET-0301512000: Configure no unconfined services exist

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SET-0401500000: Set the Boot Loader Password

Description: None

• high

Automated: yes

• grub2_password: Set Boot Loader Password in grub2
  • CCE-94664-0

SLEM-6-SET-0403000000: All GRUB configuration files must have mode 0600 or more restrictive

Description: None

• medium

Automated: yes

• file_groupowner_boot_grub2: All GRUB configuration files must be group-owned by root
  • CCE-94862-0
• file_owner_boot_grub2: All GRUB configuration files must be owned by root
  • CCE-94941-2
• file_permissions_boot_grub2: All GRUB configuration files must have mode 0600 or more restrictive
  • CCE-95015-4

SLEM-6-SET-0501500000: Enable Kernel Parameter to Enforce DAC on Hardlinks and Softlinks

Description: None

• medium

Automated: yes

• sysctl_fs_protected_hardlinks: Enable Kernel Parameter to Enforce DAC on Hardlinks
  • CCE-94921-4

SLEM-6-SET-0503000000: Enable Kernel Parameter to Enforce DAC on Hardlinks and Softlinks

Description: None

• medium

Automated: yes

• sysctl_fs_protected_symlinks: Enable Kernel Parameter to Enforce DAC on Symlinks
  • CCE-94751-5

SLEM-6-SET-0504500000: Restrict Core Dumps for All Users

Description: None

• medium

Automated: yes

• sysctl_fs_suid_dumpable: Disable Core Dumps for SUID programs
  • CCE-95033-7

SLEM-6-SET-0506000000: Restrict Access to Kernel Message Buffer

Description: None

• medium

Automated: yes

• sysctl_kernel_dmesg_restrict: Restrict Access to Kernel Message Buffer
  • CCE-94683-0

SLEM-6-SET-0507500000: Restrict Exposed Kernel Pointer Addresses Access

Description: None

• medium

Automated: yes

• sysctl_kernel_kptr_restrict: Restrict Exposed Kernel Pointer Addresses Access
  • CCE-94727-5

SLEM-6-SET-0509000000: Enable Randomized Layout of Virtual Address Space

Description: None

• medium

Automated: yes

• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
  • CCE-94728-3

SLEM-6-SET-0510500000: Restrict usage of ptrace to descendant processes

Description: None

• medium

Automated: yes

• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
  • CCE-94808-3

SLEM-6-SET-0512000000: Restrict Core Dumps for All Users

Description: None

• medium

Automated: yes

• coredump_disable_backtraces: Disable core dump backtraces
  • CCE-94769-7

SLEM-6-SET-0513500000: Restrict Core Dumps for All Users

Description: None

• medium

Automated: yes

• coredump_disable_storage: Disable storing core dump
  • CCE-94854-7

SLEM-6-SET-0601500000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-SET-0603000000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-SET-0604500000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-SET-0607500000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-SET-0609000000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-SET-0610500000: Configure sshd Ciphers

Description: None

• medium

Automated: yes

• sshd_use_strong_ciphers: Use Only Strong Ciphers
  • CCE-94817-4

SLEM-6-SET-0701500000: Modify the System Message of the Day Banner

Description: None

• medium

Automated: yes

• banner_etc_motd: Modify the System Message of the Day Banner
  • CCE-95016-2

SLEM-6-SET-0703000000: Configure SSH warning banner

Description: None

• medium

Automated: yes

• banner_etc_issue: Modify the System Login Banner
  • CCE-94665-7

SLEM-6-SET-0704500000: Modify the System Login Banner for Remote Connections

Description: None

• medium

Automated: yes

• banner_etc_issue_net: Modify the System Login Banner for Remote Connections
  • CCE-94775-4

SLEM-6-SET-0706000000: Verify Ownership and Permissions of/on Message of the Day Banner

Description: None

• medium

Automated: yes

• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-94926-3
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-94957-8
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-94938-8

SLEM-6-SET-0707500000: Verify Ownership and Permissions of/on System Login Banner

Description: None

• medium

Automated: yes

• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-95021-2
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-94944-6
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-94870-3

SLEM-6-SET-0709000000: Verify Ownership and Permissions of/on Message of the Day Banner

Description: None

• medium

Automated: yes

• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-94926-3
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-94957-8
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-94938-8

SLEM-6-SET-0710500000: Verify Ownership and Permissions of/on System Login Banner

Description: None

• medium

Automated: yes

• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-95021-2
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-94944-6
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-94870-3

SLEM-6-SET-0712000000: Verify Ownership and Permissions of/on System Login Banner for Remote Connections

Description: None

• medium

Automated: yes

• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-94902-4
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-94867-9
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-94931-3

SLEM-6-SET-0713500000: Verify Ownership and Permissions of/on System Login Banner

Description: None

• medium

Automated: yes

• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-95021-2
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-94944-6
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-94870-3

SLEM-6-SER-0103000000: Uninstall Avahi Server

Description: None

• medium

Automated: yes

• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-94836-4

SLEM-6-SER-0107500000: Disable dnsmasq Service

Description: None

• medium

Automated: yes

• service_dnsmasq_disabled: Disable dnsmasq Service
  • CCE-94772-1

SLEM-6-SER-0118000000: Uninstall rpcbind

Description: None

• medium

Automated: yes

• service_rpcbind_disabled: Disable rpcbind Service
  • CCE-95001-4

SLEM-6-SER-0124000000: Disable tftp Service

Description: None

• medium

Automated: yes

• package_tftp-server_removed: Uninstall tftp-server Package
  • CCE-94897-6

SLEM-6-SER-0133000000: Configure only approved services are listening on a network interface

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SER-0203000000: Remove LDAP clients

Description: None

• medium

Automated: yes

• package_openldap-clients_removed: Ensure LDAP client is not installed
  • CCE-94881-0

SLEM-6-SER-0301501500: Configure the Chrony

Description: None

• medium

Automated: yes

• chronyd_specify_remote_server: A remote time server for Chrony is configured
  • CCE-95027-9
• var_multiple_time_servers = suse

SLEM-6-SER-0301503000: Configure chrony is enabled and running

Description: None

• medium

Automated: yes

No rules selected

SLEM-6-SER-0403001500: Configure at permissions

Description: None

• medium

Automated: yes

• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-94838-0
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-97861-9
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-97776-9
• file_owner_at_allow: Verify User Who Owns /etc/at.allow file
  • CCE-98153-0
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-98129-0

SLEM-6-NET-0101500000: Configure IPv6 status is identified

Description: None

• medium

Automated: no

No rules selected

SLEM-6-NET-0103000000: Deactivate Wireless Network Interfaces

Description: None

• medium

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-94703-6

SLEM-6-NET-0201500000: Disable ATM Support

Description: None

• medium

Automated: yes

• kernel_module_atm_disabled: Disable ATM Support
  • CCE-95017-0

SLEM-6-NET-0203000000: Disable CAN Support

Description: None

• medium

Automated: yes

• kernel_module_can_disabled: Disable CAN Support
  • CCE-94778-8

SLEM-6-NET-0204500000: Disable DCCP Support

Description: None

• medium

Automated: yes

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-94972-7

SLEM-6-NET-0206000000: Disable TIPC Support

Description: None

• medium

Automated: yes

• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-94917-2

SLEM-6-NET-0207500000: Disable RDS Support

Description: None

• medium

Automated: yes

• kernel_module_rds_disabled: Disable RDS Support
  • CCE-94959-4

SLEM-6-NET-0209000000: Disable SCTP Support

Description: None

• medium

Automated: yes

• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-95018-8

SLEM-6-NET-0301506000: Disable Packet Redirect Sending

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  • CCE-95082-4

SLEM-6-NET-0301507500: Disable Packet Redirect Sending

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  • CCE-95081-6

SLEM-6-NET-0301509000: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  • CCE-94851-3
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value = enabled

SLEM-6-NET-0301510500: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  • CCE-94916-4
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value = enabled

SLEM-6-NET-0301512000: Disable accepting Internet Control Message Protocol (ICMP) redirects

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  • CCE-95077-4
• sysctl_net_ipv4_conf_all_accept_redirects_value = disabled

SLEM-6-NET-0301513500: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  • CCE-95078-2
• sysctl_net_ipv4_conf_default_accept_redirects_value = disabled

SLEM-6-NET-0301515000: Disable Accepting Secure ICMP Redirects

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_secure_redirects: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  • CCE-94882-8
• sysctl_net_ipv4_conf_all_secure_redirects_value = disabled

SLEM-6-NET-0301516500: Disable Accepting Secure ICMP Redirects

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_secure_redirects: Configure Kernel Parameter for Accepting Secure Redirects By Default
  • CCE-94878-6
• sysctl_net_ipv4_conf_default_secure_redirects_value = disabled

SLEM-6-NET-0301521000: Disable forwarding source-routed packets

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  • CCE-95073-3
• sysctl_net_ipv4_conf_all_accept_source_route_value = disabled

SLEM-6-NET-0301522500: Disable IP Forwarding

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  • CCE-95075-8
• sysctl_net_ipv4_conf_default_accept_source_route_value = disabled

SLEM-6-NET-0301524000: Log suspicious packets on all IPv4 interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  • CCE-95020-4
• sysctl_net_ipv4_conf_all_log_martians_value = enabled

SLEM-6-NET-0301525500: Log suspicious packets on all IPv4 interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
  • CCE-94782-0
• sysctl_net_ipv4_conf_default_log_martians_value = enabled

SLEM-6-NET-0301527000: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  • CCE-94684-8
• sysctl_net_ipv4_tcp_syncookies_value = enabled

SLEM-6-NET-0303003000: Disable Kernel Parameter for IPv6 Forwarding by default

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_forwarding: Disable Kernel Parameter for IPv6 Forwarding by default
  • CCE-95085-7
• sysctl_net_ipv6_conf_default_forwarding_value = disabled

SLEM-6-NET-0303004500: Disable accepting Internet Control Message Protocol (ICMP) redirects

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  • CCE-95079-0
• sysctl_net_ipv6_conf_all_accept_redirects_value = disabled

SLEM-6-NET-0303006000: Disable accepting Internet Control Message Protocol (ICMP) redirects

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  • CCE-95080-8
• sysctl_net_ipv6_conf_default_accept_redirects_value = disabled

SLEM-6-NET-0303007500: Disable forwarding source-routed packets

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  • CCE-95074-1
• sysctl_net_ipv6_conf_all_accept_source_route_value = disabled

SLEM-6-NET-0303009000: Disable forwarding source-routed packets

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  • CCE-95076-6
• sysctl_net_ipv6_conf_default_accept_source_route_value = disabled

SLEM-6-NET-0303010500: Disable Accepting Router Advertisements on all IPv6 Interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
  • CCE-94853-9
• sysctl_net_ipv6_conf_all_accept_ra_value = disabled

SLEM-6-NET-0303012000: Disable Accepting Router Advertisements on all IPv6 Interfaces

Description: None

• medium

Automated: yes

• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  • CCE-94861-2
• sysctl_net_ipv6_conf_default_accept_ra_value = disabled

SLEM-6-FR-0101500000: Install firewalld

Description: None

• medium

Automated: yes

• package_firewalld_installed: Install firewalld Package
  • CCE-94827-3

SLEM-6-FR-0103000000: Configure Firewalld to Use the Nftables Backend

Description: None

• medium

Automated: yes

• firewalld-backend: Configure Firewalld to Use the Nftables Backend
  • CCE-94971-9

SLEM-6-FR-0104500000: Verify firewalld Enabled

Description: None

• medium

Automated: yes

• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-94672-3

SLEM-6-FR-0106000000: Configure firewalld active zone target is configured

Description: None

• medium

Automated: no

No rules selected

SLEM-6-FR-0107500000: Configure Firewalld to Trust Loopback Traffic

Description: None

• medium

Automated: no

• firewalld_loopback_traffic_trusted: Configure Firewalld to Trust Loopback Traffic
  • CCE-94990-9

SLEM-6-FR-0109000000: Configure firewalld loopback source address traffic is configured

Description: None

• medium

Automated: no

No rules selected

SLEM-6-FR-0110500000: Configure firewalld services and ports are configured

Description: None

• medium

Automated: no

No rules selected

SLEM-6-ACC-0101500000: Verify Ownership and Permissions of/on SSH Server config file

Description: None

• medium

Automated: yes

• directory_groupowner_sshd_config_d: Verify Group Who Owns SSH Server Configuration Files
  • CCE-94876-0
• directory_owner_sshd_config_d: Verify Owner on SSH Server Configuration Files
  • CCE-94982-6
• directory_permissions_sshd_config_d: Verify Permissions on SSH Server Config File
  • CCE-94850-5
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-94973-5
• file_groupowner_sshd_drop_in_config: Verify Group Who Owns SSH Server Configuration Files
  • CCE-94757-2
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-94960-2
• file_owner_sshd_drop_in_config: Verify Owner on SSH Server Configuration Files
  • CCE-94829-9
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-95000-6
• file_permissions_sshd_drop_in_config: Verify Permissions on SSH Server Config File
  • CCE-94940-4

SLEM-6-ACC-0103000000: Verify Permissions on SSH Server Private *_key Key Files

Description: None

• medium

Automated: yes

• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-94796-0
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-94783-8
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-95070-9

SLEM-6-ACC-0104500000: Verify Permissions on SSH Server Public *.pub Key Files

Description: None

• medium

Automated: yes

• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-94777-0
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-94891-9
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-95069-1

SLEM-6-ACC-0106000000: Limit Users' SSH Access

Description: None

• medium

Automated: yes

• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-94824-0

SLEM-6-ACC-0107500000: Configure SSH warning banner

Description: None

• medium

Automated: yes

• sshd_enable_warning_banner: Enable SSH Warning Banner
  • CCE-94626-9

SLEM-6-ACC-0109000000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-ACC-0110500000: Configure SSH Idle Timeout Interval

Description: None

• medium

Automated: yes

• sshd_idle_timeout_value = 5_minutes
• sshd_set_idle_timeout: Set SSH Client Alive Interval
  • CCE-94681-4
• sshd_set_keepalive: Set SSH Client Alive Count Max
  • CCE-94685-5
• var_sshd_set_keepalive = 1

SLEM-6-ACC-0112000000: Disable SSH Forwarding

Description: None

• medium

Automated: yes

• sshd_disable_forwarding: Disable SSH Forwarding
  • CCE-94915-6

SLEM-6-ACC-0113500000: Disable sshd GSSAPIAuthentication

Description: None

• medium

Automated: yes

• sshd_disable_gssapi_auth: Disable GSSAPI Authentication
  • CCE-94780-4

SLEM-6-ACC-0115000000: Disable Host-Based Authentication

Description: None

• medium

Automated: yes

• disable_host_auth: Disable Host-Based Authentication
  • CCE-94758-0

SLEM-6-ACC-0116500000: Disable SSH Support for .rhosts Files

Description: None

• medium

Automated: yes

• sshd_disable_rhosts: Disable SSH Support for .rhosts Files
  • CCE-94975-0

SLEM-6-ACC-0118000000: Verify Any Configured IPSec Tunnel Connections

Description: None

• medium

Automated: yes

• service_sshd_enabled: Enable the OpenSSH Service
  • CCE-94726-7

SLEM-6-ACC-0119500000: Ensure SSH LoginGraceTime is configured

Description: None

• medium

Automated: yes

• sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
  • CCE-94948-7
• var_sshd_set_login_grace_time = 60

SLEM-6-ACC-0121000000: Set SSH Daemon LogLevel to VERBOSE

Description: None

• medium

Automated: yes

• sshd_set_loglevel_verbose: Set SSH Daemon LogLevel to VERBOSE
  • CCE-94627-7

SLEM-6-ACC-0122500000: Implement Custom Crypto Policy Modules for CIS Benchmark

Description: None

• medium

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-94762-2

SLEM-6-ACC-0124000000: Set SSH authentication attempt limit

Description: None

• medium

Automated: yes

• sshd_max_auth_tries_value = 4
• sshd_set_max_auth_tries: Set SSH authentication attempt limit
  • CCE-94918-0

SLEM-6-ACC-0125500000: Ensure SSH MaxStartups is configured

Description: None

• medium

Automated: yes

• sshd_set_maxstartups: Ensure SSH MaxStartups is configured
  • CCE-94927-1
• var_sshd_set_maxstartups = 10:30:60

SLEM-6-ACC-0127000000: Set SSH MaxSessions limit

Description: None

• medium

Automated: yes

• sshd_set_max_sessions: Set SSH MaxSessions limit
  • CCE-94925-5
• var_sshd_max_sessions = 10

SLEM-6-ACC-0128500000: Disable SSH Access via Empty Passwords

Description: None

• medium

Automated: yes

• sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords
  • CCE-95091-5

SLEM-6-ACC-0130000000: Disable SSH Root Login

Description: None

• medium

Automated: yes

• sshd_disable_root_login: Disable SSH Root Login
  • CCE-94674-9

SLEM-6-ACC-0131500000: Do Not Allow SSH Environment Options

Description: None

• medium

Automated: yes

• sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options
  • CCE-95090-7

SLEM-6-ACC-0133000000: Enable SSH PAM

Description: None

• medium

Automated: yes

• sshd_enable_pam: Enable PAM
  • CCE-94779-6

SLEM-6-ACC-0201500000: Install sudo Package

Description: None

• medium

Automated: yes

• package_sudo_installed: Install sudo Package
  • CCE-95014-7

SLEM-6-ACC-0203000000: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

Description: None

• medium

Automated: yes

• sudo_add_use_pty: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
  • CCE-94955-2

SLEM-6-ACC-0204500000: Ensure Sudo Logfile Exists - sudo logfile

Description: None

• medium

Automated: yes

• sudo_custom_logfile: Ensure Sudo Logfile Exists - sudo logfile
  • CCE-94914-9

SLEM-6-ACC-0206000000: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD

Description: None

• medium

Automated: yes

• sudo_remove_nopasswd: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
  • CCE-94717-6

SLEM-6-ACC-0207500000: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

Description: None

• medium

Automated: yes

• sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
  • CCE-94718-4

SLEM-6-ACC-0209000000: Require Re-Authentication When Using the sudo Command

Description: None

• medium

Automated: yes

• sudo_require_reauthentication: Require Re-Authentication When Using the sudo Command
  • CCE-94719-2
• var_sudo_timestamp_timeout = 15_minutes

SLEM-6-ACC-0210500000: Enforce Usage of pam_wheel on the System for su Authentication

Description: None

• medium

Automated: yes

• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-94950-3
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-94951-1

SLEM-6-ACC-0303001501: Configure lockout for failed password attempts

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_deny: Lock Accounts After Failed Password Attempts
  • CCE-94842-2
• var_accounts_passwords_pam_faillock_deny = 5

SLEM-6-ACC-0303001502: Configure password unlock time

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_unlock_time_with_zero: Set Lockout Time for Failed Password Attempts
  • CCE-94974-3
• var_accounts_passwords_pam_faillock_unlock_time = 900

SLEM-6-ACC-0303001503: Ensure Root Account Lockout on Failed Password Attempts

Description: None

• medium

Automated: yes

• accounts_passwords_pam_faillock_deny_root: Configure the root Account for Failed Password Attempts
  • CCE-94814-1
• accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time: Ensure Root Account Lockout on Failed Password Attempts
  • CCE-95028-7
• var_accounts_passwords_pam_faillock_root_unlock_time = 60

SLEM-6-ACC-0303003001: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words

Description: None

• medium

Automated: yes

• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-94979-2
• var_password_pam_dictcheck = 1

SLEM-6-ACC-0303003002: Configure password number of changed characters

Description: None

• medium

Automated: yes

• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-95002-2
• var_password_pam_difok = 2

SLEM-6-ACC-0303003003: Configure password length

Description: None

• medium

Automated: yes

• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-94879-4
• var_password_pam_minlen = 14

SLEM-6-ACC-0303003004: Ensure PAM Enforces Password Requirements - Minimum Different Categories

Description: None

• medium

Automated: yes

• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-94874-5
• var_password_pam_minclass = 4

SLEM-6-ACC-0303003005: Set Password Maximum Consecutive Repeating Characters

Description: None

• medium

Automated: yes

• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-94848-9
• var_password_pam_maxrepeat = 3

SLEM-6-ACC-0303003006: Limit the maximum number of sequential characters in passwords

Description: None

• medium

Automated: yes

• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-94961-0
• var_password_pam_maxsequence = 3

SLEM-6-ACC-0303003007: Ensure PAM Enforces Password Requirements - Enforce for root User

Description: None

• medium

Automated: yes

• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-94929-7

SLEM-6-ACC-0303004501: Limit Password Reuse

Description: None

• medium

Automated: yes

• accounts_password_pam_pwhistory_remember: Limit Password Reuse
  • CCE-94641-8
• var_password_pam_remember = 24
• var_password_pam_remember_control_flag = requisite_or_required

SLEM-6-ACC-0303004502: Ensure Password History Is Enforced for the Root User

Description: None

• medium

Automated: yes

• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-94802-6

SLEM-6-ACC-0303004503: Enforce Password History with use_authtok

Description: None

• medium

Automated: yes

• accounts_password_pam_pwhistory_use_authtok: Enforce Password History with use_authtok
  • CCE-94872-9

SLEM-6-ACC-0303006001: Prevent Login to Accounts With Empty Password

Description: None

• medium

Automated: yes

• no_empty_passwords: Prevent Login to Accounts With Empty Password
  • CCE-95047-7

SLEM-6-ACC-0303006002: Avoid using remember in pam_unix module

Description: None

• medium

Automated: yes

• accounts_password_pam_unix_no_remember: Avoid using remember in pam_unix module
  • CCE-94794-5

SLEM-6-ACC-0303006003: Set PAM's Password Hashing Algorithm

Description: None

• medium

Automated: yes

• set_password_hashing_algorithm_commonauth: Set PAM's Common Authentication Hashing Algorithm
  • CCE-94889-3
• var_password_hashing_algorithm_pam = sha512

SLEM-6-ACC-0303006004: Require use_authtok for pam_unix.so

Description: None

• medium

Automated: yes

• accounts_password_pam_unix_authtok: Require use_authtok for pam_unix.so
  • CCE-94767-1

SLEM-6-ACC-0401501500: Set Existing Passwords Maximum Age

Description: None

• medium

Automated: yes

• accounts_maximum_age_login_defs: Set Password Maximum Age
  • CCE-94670-7
• accounts_password_set_max_life_existing: Set Existing Passwords Maximum Age
  • CCE-94662-4
• var_accounts_maximum_age_login_defs = 365

SLEM-6-ACC-0401503000: Set Existing Passwords Minimum Age

Description: None

• medium

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-94669-9
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-94661-6
• var_accounts_minimum_age_login_defs = 1

SLEM-6-ACC-0401504500: Set and Apply Password Warning Age

Description: None

• medium

Automated: yes

• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-94822-4
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-94788-7
• var_accounts_password_warn_age_login_defs = 7

SLEM-6-ACC-0401506000: Verify All Account Password Hashes are Shadowed with SHA512

Description: None

• medium

Automated: yes

• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-95030-3
• var_password_hashing_algorithm = SHA512

SLEM-6-ACC-0401507500: Set Account Expiration Following Inactivity

Description: None

• medium

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
  • CCE-94675-6
• accounts_set_post_pw_existing: Set existing passwords a period of inactivity before they been locked
  • CCE-94847-1
• var_account_disable_post_pw_expiration = 45

SLEM-6-ACC-0401509000: Ensure all users last password change date is in the past

Description: None

• medium

Automated: yes

• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-94835-6

SLEM-6-ACC-0403001500: Verify Only Root Has UID 0

Description: None

• high

Automated: yes

• accounts_no_uid_except_zero: Verify Only Root Has UID 0
  • CCE-95041-0

SLEM-6-ACC-0403003000: Verify Root Has A Primary GID 0

Description: None

• high

Automated: yes

• accounts_root_gid_zero: Verify Root Has A Primary GID 0
  • CCE-94922-2

SLEM-6-ACC-0403004500: Verify Only Group Root Has GID 0

Description: None

• high

Automated: yes

• groups_no_zero_gid_except_root: Verify Only Group Root Has GID 0
  • CCE-95011-3

SLEM-6-ACC-0403006000: Ensure Authentication Required for with Single User Mode

Description: None

• high

Automated: yes

• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-94843-0

SLEM-6-ACC-0403007500: Ensure Root's path Integrity

Description: None

• medium

Automated: yes

• accounts_root_path_dirs_no_write: Ensure that Root's Path Does Not Include World or Group-Writable Directories
  • CCE-94875-2
• root_path_no_dot: Ensure that Root's Path Does Not Include Relative Paths or Null Directories
  • CCE-94770-5

SLEM-6-ACC-0403009000: Ensure the Root Bash Umask is Set Correctly

Description: None

• medium

Automated: yes

• accounts_umask_root: Ensure the Root Bash Umask is Set Correctly
  • CCE-94932-1

SLEM-6-ACC-0403010500: Verify system accounts do not have a valid login shell

Description: None

• medium

Automated: yes

• no_password_auth_for_systemaccounts: Ensure that System Accounts Are Locked
  • CCE-94749-9
• no_shelllogin_for_systemaccounts: Ensure that System Accounts Do Not Run a Shell Upon Login
  • CCE-95039-4

SLEM-6-ACC-0403012000: Verify Non-Interactive Accounts Are Locked

Description: None

• medium

Automated: yes

• no_invalid_shell_accounts_unlocked: Verify Non-Interactive Accounts Are Locked
  • CCE-94934-7

SLEM-6-ACC-0403013500: Only Authorized Local User Accounts Exist on Operating System

Description: None

• medium

Automated: yes

• accounts_authorized_local_users: Only Authorized Local User Accounts Exist on Operating System
  • CCE-95038-6
• var_accounts_authorized_local_users_regex = slmicro6

SLEM-6-ACC-0404501500: Ensure nologin Shell is Not Listed in /etc/shells

Description: None

• medium

Automated: yes

• no_nologin_in_shells: Ensure nologin Shell is Not Listed in /etc/shells
  • CCE-94908-1

SLEM-6-ACC-0404503000: Set Interactive Session Timeout

Description: None

• medium

Automated: yes

• accounts_tmout: Set Interactive Session Timeout
  • CCE-94645-9
• var_accounts_tmout = 15_min

SLEM-6-ACC-0404504500: Configure default user umask

Description: None

• medium

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-95031-1
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-95089-9
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-94786-1
• var_accounts_user_umask = 027

SLEM-6-AUD-0101501500: Enable systemd-journald Service

Description: None

• medium

Automated: yes

• service_systemd-journald_enabled: Enable systemd-journald Service
  • CCE-94893-5

SLEM-6-AUD-0101503000: Disable systemd-journal-remote Socket

Description: None

• medium

Automated: yes

• socket_systemd-journal-remote_disabled: Disable systemd-journal-remote Socket
  • CCE-94832-3

SLEM-6-AUD-0101504500: Configure journald Compress

Description: None

• medium

Automated: yes

• journald_compress: Ensure journald is configured to compress large log files
  • CCE-94852-1

SLEM-6-AUD-0101506000: Configure journald Storage

Description: None

• medium

Automated: yes

• journald_storage: Ensure journald is configured to write log files to persistent disk
  • CCE-94759-8

SLEM-6-AUD-0101507500: Configure systemd-journal-remote to send logs to a remote log host

Description: None

• medium

Automated: yes

• package_systemd-journal-remote_installed: Install systemd-journal-remote Package
  • CCE-94738-2
• service_systemd-journal-upload_enabled: Enable systemd-journal-upload Service
  • CCE-94735-8
• systemd_journal_upload_server_tls: Configure systemd-journal-upload TLS parameters: ServerKeyFile, ServerCertificateFile and TrustedCertificateFile
  • CCE-94737-4
• systemd_journal_upload_url: Configure systemd-journal-upload URL
  • CCE-94736-6

SLEM-6-AUD-0101509000: Configure journald log file rotation is configured

Description: None

• medium

Automated: no

No rules selected

SLEM-6-AUD-0101510500: Configure journald log file access is configured

Description: None

• medium

Automated: no

No rules selected

SLEM-6-AUD-0103012000: Configure rsyslog logrotate

Description: None

• medium

Automated: no

• ensure_logrotate_activated: Ensure Logrotate Runs Periodically
  • CCE-95003-0
• package_logrotate_installed: Ensure logrotate is Installed
  • CCE-94920-6
• timer_logrotate_enabled: Enable logrotate Timer
  • CCE-94784-6

SLEM-6-AUD-0201501500: Ensure the audit Subsystem is Installed

Description: None

• medium

Automated: yes

• package_audit-libs_installed: Ensure the libaudit1 package as a part of audit Subsystem is Installed
  • CCE-94904-0
• package_audit_installed: Ensure the audit Subsystem is Installed
  • CCE-94705-1

SLEM-6-AUD-0201503000: Enable auditd Service

Description: None

• medium

Automated: yes

• service_auditd_enabled: Enable auditd Service
  • CCE-94631-9

SLEM-6-AUD-0201504500: Enable Auditing for Processes Which Start Prior to the Audit Daemon

Description: None

• medium

Automated: yes

• grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon
  • CCE-94821-6

SLEM-6-AUD-0201506000: Extend Audit Backlog Limit for the Audit Daemon

Description: None

• medium

Automated: yes

• grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
  • CCE-94901-6
• var_audit_backlog_limit = 8192

SLEM-6-AUD-0203001500: Configure auditd Max Log File Size

Description: None

• medium

Automated: yes

• auditd_data_retention_max_log_file: Configure auditd Max Log File Size
  • CCE-94969-3
• var_auditd_max_log_file = 8

SLEM-6-AUD-0203003000: Configure auditd max_log_file_action Upon Reaching Maximum Log Size

Description: None

• medium

Automated: yes

• auditd_data_retention_max_log_file_action: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  • CCE-94815-8
• var_auditd_max_log_file_action = keep_logs

SLEM-6-AUD-0203004500: Configure auditd Disk Error Action on Disk Error

Description: None

• medium

Automated: yes

• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-94903-2
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-94657-4
• var_auditd_disk_error_action = halt
• var_auditd_disk_full_action = halt

SLEM-6-AUD-0203006000: Configure auditd actions on Low Disk Space

Description: None

• medium

Automated: yes

• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
  • CCE-94655-8
• auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
  • CCE-94936-2
• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
  • CCE-94711-9
• package_mailx_installed: The mailx Package Is Installed
  • CCE-94801-8
• var_auditd_action_mail_acct = root
• var_auditd_admin_space_left_action = halt
• var_auditd_space_left_action = email

SLEM-6-AUD-0204501500: Ensure auditd Collects System Administrator Actions

Description: None

• medium

Automated: yes

• audit_rules_sysadmin_actions: Ensure auditd Collects System Administrator Actions
  • CCE-94648-3

SLEM-6-AUD-0204503000: Record Events When Executables Are Run As Another User

Description: None

• medium

Automated: yes

• audit_rules_suid_auid_privilege_function: Record Events When Executables Are Run As Another User
  • CCE-94756-4

SLEM-6-AUD-0204504500: Record Attempts to perform maintenance activities

Description: None

• medium

Automated: yes

• audit_sudo_log_events: Record Attempts to perform maintenance activities
  • CCE-94755-6

SLEM-6-AUD-0204506000: Record attempts to modify the date and time

Description: None

• medium

Automated: yes

• audit_rules_time_adjtimex: Record attempts to alter time through adjtimex
  • CCE-94813-3
• audit_rules_time_clock_settime: Record Attempts to Alter Time Through clock_settime
  • CCE-94880-2
• audit_rules_time_settimeofday: Record attempts to alter time through settimeofday
  • CCE-94928-9
• audit_rules_time_watch_localtime: Record Attempts to Alter the localtime File
  • CCE-94834-9

SLEM-6-AUD-0204509000: Record Events that Modify the System''s Network Environment - /etc/issue

Description: None

• medium

Automated: yes

• audit_rules_networkconfig_modification_etc_issue: Record Events that Modify the System's Network Environment - /etc/issue
  • CCE-94924-8
• audit_rules_networkconfig_modification_etc_issue_net: Record Events that Modify the System's Network Environment - /etc/issue.net
  • CCE-94913-1

SLEM-6-AUD-0204510500: Record Events that Modify the System''s Network Environment - /etc/hosts

Description: None

• medium

Automated: yes

• audit_rules_networkconfig_modification_etc_hosts: Record Events that Modify the System's Network Environment - /etc/hosts
  • CCE-94864-6
• audit_rules_networkconfig_modification_hostname_file: Record Events that Modify the System's Network Environment - /etc/hostname
  • CCE-94998-2

SLEM-6-AUD-0204512000: Record Events that Modify the System''s Network Environment - /etc/NetworkManager/

Description: None

• medium

Automated: yes

• audit_rules_networkconfig_modification_networkmanager: Record Events that Modify the System's Network Environment - /etc/NetworkManager/
  • CCE-94995-8

SLEM-6-AUD-0204513500: Record Events of Use of Privileged Commands

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands: Ensure auditd Collects Information on the Use of Privileged Commands
  • CCE-94896-8

SLEM-6-AUD-0204515000: Record Events of unsuccessful file access attempts

Description: None

• medium

Automated: yes

• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
  • CCE-95004-8
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
  • CCE-94858-8
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
  • CCE-94649-1
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
  • CCE-94976-8
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate
  • CCE-94753-1

SLEM-6-AUD-0204516500: Collect events that modify user/group information

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group
  • CCE-94602-0

SLEM-6-AUD-0204518000: Collect events that modify user/group information

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd
  • CCE-94601-2

SLEM-6-AUD-0204519500: Record Events that modify user/group information

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
  • CCE-94987-5
• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow
  • CCE-94603-8

SLEM-6-AUD-0204521000: Collect events that modify user/group information

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd
  • CCE-94604-6

SLEM-6-AUD-0204522500: Record Events that Modify User/Group Information - /etc/pam.d/

Description: None

• medium

Automated: yes

• audit_rules_usergroup_modification_pamd: Record Events that Modify User/Group Information - /etc/pam.d/
  • CCE-94807-5

SLEM-6-AUD-0204528500: Ensure auditd Collects Information on Exporting to Media (successful)

Description: None

• medium

Automated: yes

• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-94635-0

SLEM-6-AUD-0204530000: Record Attempts to Alter Process and Session Initiation Information utmp

Description: None

• medium

Automated: yes

• audit_rules_session_events_btmp: Record Attempts to Alter Process and Session Initiation Information btmp
  • CCE-94734-1
• audit_rules_session_events_utmp: Record Attempts to Alter Process and Session Initiation Information utmp
  • CCE-94732-5
• audit_rules_session_events_wtmp: Record Attempts to Alter Process and Session Initiation Information wtmp
  • CCE-94733-3

SLEM-6-AUD-0204531500: Collect login and logout events

Description: None

• medium

Automated: yes

• audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock
  • CCE-94816-6
• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
  • CCE-94629-3
• var_accounts_passwords_pam_faillock_dir = run

SLEM-6-AUD-0204533000: Ensure auditd Collects File Deletion Events by Users

Description: None

• medium

Automated: yes

• audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
  • CCE-94849-7
• audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat
  • CCE-94937-0

SLEM-6-AUD-0204534500: Ensure auditd Collects File Deletion Events by Users

Description: None

• medium

Automated: yes

• audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
  • CCE-94997-4
• audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
  • CCE-94930-5
• audit_rules_file_deletion_events_renameat2: Ensure auditd Collects File Deletion Events by User - renameat2
  • CCE-94868-7

SLEM-6-AUD-0204543500: Ensure auditd Collects Information on the Use of Privileged Commands - kmod

Description: None

• medium

Automated: yes

• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
  • CCE-94616-0

SLEM-6-AUD-0204549500: Ensure the Audit Configuration is Loaded Regardless of Errors

Description: None

• medium

Automated: yes

• audit_rules_continue_loading: Ensure the Audit Configuration is Loaded Regardless of Errors
  • CCE-94885-1

SLEM-6-AUD-0204551000: Make the auditd Configuration Immutable

Description: None

• medium

Automated: yes

• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-94774-7

SLEM-6-AUD-0204552500: Configure the running and on disk configuration is the same

Description: None

• medium

Automated: no

No rules selected

SLEM-6-AUD-0206001500: System Audit Logs Must Have Mode 0750 or Less Permissive

Description: None

• medium

Automated: yes

• directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive
  • CCE-95009-7

SLEM-6-AUD-0206003000: System Audit Logs Must Have Mode 0640 or Less Permissive

Description: None

• medium

Automated: yes

• file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive
  • CCE-94966-9

SLEM-6-AUD-0206004500: System Audit Logs Must Be Owned By Root

Description: None

• medium

Automated: yes

• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-94869-5

SLEM-6-AUD-0206006000: System Audit Logs Must Be Group Owned By Root

Description: None

• medium

Automated: yes

• file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
  • CCE-98004-5

SLEM-6-AUD-0206007500: Audit Configuration Files Permissions are 640 or More Restrictive

Description: None

• medium

Automated: yes

• file_permissions_audit_configuration: Audit Configuration Files Permissions are 640 or More Restrictive
  • CCE-94907-3

SLEM-6-AUD-0206009000: Audit Configuration Files Must Be Owned By Root

Description: None

• medium

Automated: yes

• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
  • CCE-94935-4

SLEM-6-AUD-0206010500: Audit Configuration Files Must Be Owned By Group root

Description: None

• medium

Automated: yes

• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
  • CCE-94985-9

SLEM-6-AUD-0206012000: Verify that audit tools Have Mode 0755 or less

Description: None

• medium

Automated: yes

• file_permissions_audit_binaries: Verify that audit tools Have Mode 0755 or less
  • CCE-94859-6

SLEM-6-AUD-0206013500: Verify that audit tools are owned by root

Description: None

• medium

Automated: yes

• file_ownership_audit_binaries: Verify that audit tools are owned by root
  • CCE-94999-0

SLEM-6-AUD-0206015000: Verify that audit tools are owned by group root

Description: None

• medium

Automated: yes

• file_groupownership_audit_binaries: Verify that audit tools are owned by group root
  • CCE-94892-7

SLEM-6-AUD-0301500000: The AIDE package must be installed if it is to be available for integrity checking

Description: None

• medium

Automated: yes

• aide_build_database: Build and Test AIDE Database
  • CCE-94713-5
• package_aide_installed: Install AIDE
  • CCE-94712-7

SLEM-6-AUD-0303000000: Configure Systemd Timer Execution of AIDE

Description: None

• medium

Automated: yes

• aide_periodic_checking_systemd_timer: Configure Systemd Timer Execution of AIDE
  • CCE-94714-3

SLEM-6-SMA-0101500000: Configure permissions on /etc/passwd

Description: None

• medium

Automated: yes

• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-94984-2
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-94825-7
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-94826-5

SLEM-6-SMA-0103000000: Configure permissions on /etc/passwd-

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-94795-2
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-94799-4
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-94906-5

SLEM-6-SMA-0104500000: Configure permissions on /etc/group

Description: None

• medium

Automated: yes

• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-94888-5
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-95010-5
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-95022-0

SLEM-6-SMA-0106000000: Configure permissions on /etc/group-

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-94919-8
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-94953-7
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-95032-9

SLEM-6-SMA-0107500000: Configure permissions on /etc/shadow

Description: None

• high

Automated: yes

• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-94895-0
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-94994-1
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-94949-5

SLEM-6-SMA-0109000000: Configure permissions on /etc/shadow-

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-94943-8
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-94804-2
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-94933-9

SLEM-6-SMA-0110500000: Configure permissions on /etc/passwd

Description: None

• medium

Automated: yes

• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-94763-0
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-94754-9
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-94765-5

SLEM-6-SMA-0112000000: Configure permissions on /etc/passwd-

Description: None

• medium

Automated: yes

• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-94811-7
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-94873-7
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-94986-7

SLEM-6-SMA-0113500000: Configure access to /etc/shells

Description: None

• medium

Automated: yes

• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-94894-3
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-94810-9
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-94905-7

SLEM-6-SMA-0115000000: Configure access to /etc/security/opasswd

Description: None

• medium

Automated: yes

• file_groupowner_etc_security_opasswd: Verify Group Who Owns /etc/security/opasswd File
  • CCE-94791-1
• file_groupowner_etc_security_opasswd_old: Verify Group Who Owns /etc/security/opasswd.old File
  • CCE-94823-2
• file_owner_etc_security_opasswd: Verify User Who Owns /etc/security/opasswd File
  • CCE-94996-6
• file_owner_etc_security_opasswd_old: Verify User Who Owns /etc/security/opasswd.old File
  • CCE-94819-0
• file_permissions_etc_security_opasswd: Verify Permissions on /etc/security/opasswd File
  • CCE-94877-8
• file_permissions_etc_security_opasswd_old: Verify Permissions on /etc/security/opasswd.old File
  • CCE-94839-8

SLEM-6-SMA-0116500000: Ensure No World-Writable Files Exist

Description: None

• medium

Automated: yes

• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-94682-2
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-94781-2

SLEM-6-SMA-0118000000: Ensure All Files And Directories Are Owned by a User

Description: None

• medium

Automated: yes

• no_files_or_dirs_ungroupowned: Ensure All Files And Directories Are Owned by a Group
  • CCE-94797-8
• no_files_or_dirs_unowned_by_user: Ensure All Files And Directories Are Owned by a User
  • CCE-94956-0

SLEM-6-SMA-0119500000: Configure SUID and SGID files are reviewed

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SMA-0201500000: Verify All Account Password Hashes are Shadowed

Description: None

• medium

Automated: yes

• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-94828-1

SLEM-6-SMA-0203000000: Ensure There Are No Accounts With Blank or Null Passwords

Description: None

• high

Automated: yes

• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-95046-9

SLEM-6-SMA-0204500000: Ensure all GIDs referenced in /etc/passwd are defined in /etc/group

Description: None

• medium

Automated: yes

• gid_passwd_group_same: All GIDs referenced in /etc/passwd must be defined in /etc/group
  • CCE-94993-3

SLEM-6-SMA-0206000000: Ensure All Accounts on the System Have Unique User IDs

Description: None

• medium

Automated: yes

• account_unique_id: Ensure All Accounts on the System Have Unique User IDs
  • CCE-94673-1

SLEM-6-SMA-0207500000: Ensure All Groups on the System Have Unique Group ID

Description: None

• medium

Automated: yes

• group_unique_id: Ensure All Groups on the System Have Unique Group ID
  • CCE-94865-3

SLEM-6-SMA-0209000000: Ensure All Accounts on the System Have Unique Names

Description: None

• medium

Automated: yes

• account_unique_name: Ensure All Accounts on the System Have Unique Names
  • CCE-95024-6

SLEM-6-SMA-0210500000: Ensure All Groups on the System Have Unique Group Names

Description: None

• medium

Automated: yes

• group_unique_name: Ensure All Groups on the System Have Unique Group Names
  • CCE-94798-6

SLEM-6-SMA-0212000000: All Interactive Users Home Directories Must Exist

Description: None

• medium

Automated: yes

• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
  • CCE-95056-8
• file_ownership_home_directories: All Interactive User Home Directories Must Be Owned By The Primary User
  • CCE-94963-6
• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
  • CCE-95057-6

SLEM-6-SMA-0213500000: Configure local interactive user dot files access

Description: None

• medium

Automated: yes

• accounts_user_dot_group_ownership: User Initialization Files Must Be Group-Owned By The Primary Group
  • CCE-94945-3
• accounts_user_dot_no_world_writable_programs: User Initialization Files Must Not Run World-Writable Programs
  • CCE-95061-8
• accounts_user_dot_user_ownership: User Initialization Files Must Be Owned By the Primary User
  • CCE-94744-0
• accounts_users_netrc_file_permissions: Ensure users' .netrc Files are not group or world accessible
  • CCE-94768-9
• file_permission_user_bash_history: Ensure User Bash History File Has Correct Permissions
  • CCE-94760-6
• file_permission_user_init_files: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
  • CCE-95059-2
• no_forward_files: Verify No .forward Files Exist
  • CCE-94787-9
• no_netrc_files: Verify No netrc Files Exist
  • CCE-94991-7
• no_rhost_files: Verify No .rhost Files Exist
  • CCE-94980-0
• var_user_initialization_files_regex = all_dotfiles

SLEM-6-SMA-0215000000: Configure no passwords are stored in /etc/group

Description: None

• medium

Automated: no

No rules selected

SLEM-6-SMA-0216500000: Ensure shadow Group on the System is Empty

Description: None

• medium

Automated: yes

• ensure_shadow_group_empty: Ensure shadow Group is Empty
  • CCE-94912-3