Definition of Standard Benchmark for UOS Server 25 for uosserver25

1.1.1: Ensure All Files Have Owner And Group

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
no_files_unowned_by_user: Ensure All Files Are Owned by a User

1.1.2: Ensure No Hidden Executable Files

Description: None

Levels:

l1_server

Automated: yes

Selections:

no_files_unowned_by_user: Ensure All Files Are Owned by a User

1.1.3: Ensure Sticky Set On Global Writable Folder

Description: None

Levels:

l1_server

Automated: yes

Selections:

dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set

1.1.4: Ensure UMASK Correct

Description: None

Levels:

l1_server

Automated: yes

Selections:

accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
var_accounts_user_umask = 027

1.1.5: Ensure No Global Writable File

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist

2.1.1: Ensure cohana/inetd Services Disabled

Description: None

Levels:

l1_server

Automated: yes

Selections:

service_rsyncd_disabled: Ensure rsyncd service is disabled

2.2.1: Ensure X11 Forwarding Disabled

Description: None

Levels:

l1_server

Automated: yes

Selections:

sshd_disable_x11_forwarding: Disable X11 Forwarding

2.2.2: Ensure SSH MaxAuthTries Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

sshd_max_auth_tries_value = 4
sshd_set_max_auth_tries: Set SSH authentication attempt limit

2.2.3: Ensure SSH MaxStartups Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

sshd_set_maxstartups: Ensure SSH MaxStartups is configured
var_sshd_set_maxstartups = 10:30:60

2.2.4: Ensure SSH LoginGraceTime Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
var_sshd_set_login_grace_time = 60

2.2.5: Ensure SSH Idle Timeout Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

sshd_set_keepalive: Set SSH Client Alive Count Max
var_sshd_set_keepalive = 1

3.1.1: Ensure auditd Installed And Enabled

Description: None

Levels:

l1_server

Automated: yes

Selections:

package_audit_installed: Ensure the audit Subsystem is Installed
service_auditd_enabled: Enable auditd Service

3.1.2: Ensure auditd Service Enabled

Description: None

Levels:

l1_server

Automated: yes

Selections:

service_auditd_enabled: Enable auditd Service

3.2.1: Ensure Logging Configured For rsyslog

Description: None

Levels:

l1_server

Automated: yes

Selections:

rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions

4.1.1: Ensure Password Expiration Is Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

accounts_maximum_age_login_defs: Set Password Maximum Age
var_accounts_maximum_age_login_defs = 90

4.1.2: Ensure Minimum Days Between Password Changes

Description: None

Levels:

l1_server

Automated: yes

Selections:

accounts_minimum_age_login_defs: Set Password Minimum Age
var_accounts_minimum_age_login_defs = 7

4.1.3: Ensure Password Expiration Warning Days Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

accounts_password_warn_age_login_defs: Set Password Warning Age
var_accounts_password_warn_age_login_defs = 7

4.1.4: Ensure Strong Password Hashing Algorithm

Description: None

Levels:

l1_server

Automated: yes

Selections:

set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth

4.2.1: Ensure Root Login Restricted To System Console

Description: None

Levels:

l1_server

Automated: yes

Selections:

securetty_root_login_console_only: Restrict Virtual Console Root Logins

4.2.2: Ensure Root Login Limited

Description: None

Levels:

l1_server

Automated: yes

Selections:

require_singleuser_auth: Require Authentication for Single User Mode

5.1.1: Ensure Permissions On /etc/passwd Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_etc_passwd: Verify Permissions on passwd File

5.1.2: Ensure Permissions On /etc/shadow Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_etc_shadow: Verify Permissions on shadow File

5.1.3: Ensure Permissions On /etc/gshadow Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_etc_gshadow: Verify Permissions on gshadow File

5.1.4: Ensure Permissions On /etc/group Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_etc_group: Verify Permissions on group File

5.1.5: Ensure Permissions On /etc/passwd- Configured

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File

5.1.6: Ensure Permissions On SSH Private Host Key Files

Description: None

Levels:

l1_server

Automated: yes

Selections:

file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files

6.1.1: Ensure AIDE Is Installed

Description: None

Levels:

l1_server

Automated: yes

Selections:

package_aide_installed: Install AIDE

6.2.1: Ensure Accounts In /etc/passwd Use Shadowed Passwords

Description: None

Levels:

l1_server

Automated: yes

Selections:

accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed

6.2.2: Ensure Root Is Only UID 0 Account

Description: None

Levels:

l1_server

Automated: yes

Selections:

accounts_no_uid_except_zero: Verify Only Root Has UID 0