Definition of Standard Benchmark for UOS Desktop 25 for uosdesktop25

1.1.1: Ensure All Files Have Owner And Group

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
no_files_unowned_by_user: Ensure All Files Are Owned by a User

1.1.2: Ensure Sticky Set On Global Writable Folder

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set

1.1.3: Ensure UMASK Correct

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
var_accounts_user_umask = 027

1.1.4: Ensure No Global Writable File

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist

2.1.1: Ensure rsync Service Disabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

service_rsyncd_disabled: Ensure rsyncd service is disabled

2.2.1: Ensure X11 Forwarding Disabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_disable_x11_forwarding: Disable X11 Forwarding

2.2.2: Ensure SSH MaxAuthTries Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_max_auth_tries_value = 4
sshd_set_max_auth_tries: Set SSH authentication attempt limit

2.2.3: Ensure SSH MaxStartups Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_set_maxstartups: Ensure SSH MaxStartups is configured
var_sshd_set_maxstartups = 10:30:60

2.2.4: Ensure SSH LoginGraceTime Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
var_sshd_set_login_grace_time = 60

2.2.5: Ensure SSH Idle Timeout Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_set_keepalive: Set SSH Client Alive Count Max
var_sshd_set_keepalive = 1

2.3.1: Ensure SSH Root Login Disabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_disable_root_login: Disable SSH Root Login

2.3.2: Ensure SSH Empty Passwords Disabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords

3.1.1: Ensure auditd Installed And Enabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

package_audit_installed: Ensure the audit Subsystem is Installed
service_auditd_enabled: Enable auditd Service

3.2.1: Ensure Logging Configured For rsyslog

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions

3.2.2: Ensure Logrotate Activated

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

ensure_logrotate_activated: Ensure Logrotate Runs Periodically

4.1.1: Ensure Password Expiration Is Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

accounts_maximum_age_login_defs: Set Password Maximum Age
var_accounts_maximum_age_login_defs = 90

4.1.2: Ensure Minimum Days Between Password Changes

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

accounts_minimum_age_login_defs: Set Password Minimum Age
var_accounts_minimum_age_login_defs = 7

4.1.3: Ensure Password Expiration Warning Days Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

accounts_password_warn_age_login_defs: Set Password Warning Age
var_accounts_password_warn_age_login_defs = 7

4.1.4: Ensure Strong Password Hashing Algorithm

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth

5.1.1: Ensure Permissions On /etc/passwd Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_groupowner_etc_passwd: Verify Group Who Owns passwd File
file_owner_etc_passwd: Verify User Who Owns passwd File
file_permissions_etc_passwd: Verify Permissions on passwd File

5.1.2: Ensure Permissions On /etc/shadow Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_groupowner_etc_shadow: Verify Group Who Owns shadow File
file_owner_etc_shadow: Verify User Who Owns shadow File
file_permissions_etc_shadow: Verify Permissions on shadow File

5.1.3: Ensure Permissions On /etc/gshadow Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
file_owner_etc_gshadow: Verify User Who Owns gshadow File
file_permissions_etc_gshadow: Verify Permissions on gshadow File

5.1.4: Ensure Permissions On /etc/group Configured

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_groupowner_etc_group: Verify Group Who Owns group File
file_owner_etc_group: Verify User Who Owns group File
file_permissions_etc_group: Verify Permissions on group File

5.1.5: Ensure Permissions On SSH Private Host Key Files

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files

6.1.1: Ensure AIDE Is Installed

Description: None

Levels:

l2_desktop

Automated: yes

Selections:

package_aide_installed: Install AIDE

6.2.1: Ensure Accounts In /etc/passwd Use Shadowed Passwords

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed

6.2.2: Ensure Root Is Only UID 0 Account

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

accounts_no_uid_except_zero: Verify Only Root Has UID 0

6.3.1: Ensure Kernel Randomize VA Space Enabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space

6.3.2: Ensure FS Protected Symlinks Enabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sysctl_fs_protected_symlinks: Enable Kernel Parameter to Enforce DAC on Symlinks

6.3.3: Ensure FS Protected Hardlinks Enabled

Description: None

Levels:

l1_desktop

Automated: yes

Selections:

sysctl_fs_protected_hardlinks: Enable Kernel Parameter to Enforce DAC on Hardlinks