File scap-yast2sec-xccdf.xml of Package openscap

Overview Repositories Revisions Requests Users Attributes Meta

File scap-yast2sec-xccdf.xml of Package openscap (Revision 96f774067026d51a272af2388eed0104)

Currently displaying revision 96f774067026d51a272af2388eed0104 , Show latest

<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:h="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="SUSE-Security-Benchmark-YaST2" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" resolved="0">
  <status date="2012-07-24">draft</status>
  <title>Hardening Linux Kernel</title>
  <description>
    The Linux kernel is at the heart of every Linux system. With its extensive configuration
    options, it comes to no surprise that specific settings can be enabled to further harden
    your system.
    <h:br />
    <h:br />
    In this guide, we focus on Linux kernel configuration entries that support additional
    hardening of your system, as well as the configuration through the <h:em>syctl</h:em>
    settings.
  </description>
  <platform idref="cpe:/o:suse:linux"/>
  <version>1</version>
  <model system="urn:xccdf:scoring:default"/>
  <model system="urn:xccdf:scoring:flat"/>
  <Profile id="Default">
    <title>Default vanilla kernel hardening</title>
    <description>
      Profile matching all standard (vanilla-kernel) hardening rules
    </description>
	<select idref="rule-sysctl-ipv4-forward" selected="true" /> 
	<select idref="rule-sysctl-ipv4-tcpsyncookies" selected="true" /> 
	<select idref="rule-sysctl-ipv6-all-forward" selected="true" /> 
	<select idref="rule-sysctl-ipv6-default-forward" selected="true" /> 
	<select idref="rule-kernel-syncookies" selected="true" /> 
	<select idref="rule-pwd-maxdays" selected="true" /> 
	<select idref="rule-pwd-mindays" selected="true" /> 
	<select idref="rule-pwd-warnage" selected="true" /> 
	<select idref="rule-pwd-minlen" selected="true" /> 
	<select idref="rule-pwd-remember" selected="true" /> 
	<select idref="rule-authc-faildelay" selected="true" /> 
	<select idref="rule-authc-faildelayexist" selected="true" /> 
	<select idref="rule-authc-xdmcp-remote" selected="true" /> 
	<select idref="rule-authc-xdmcp-root" selected="true" /> 
	<select idref="rule-usermgmt-uidmin" selected="true" /> 
	<select idref="rule-usermgmt-uidmax" selected="true" /> 
	<select idref="rule-usermgmt-gidmin" selected="true" /> 
	<select idref="rule-usermgmt-gidmax" selected="true" /> 
	<select idref="rule-misc-sysrq" selected="true" /> 
	<select idref="rule-misc-hashalgo_md5" selected="true" /> 
	<select idref="rule-misc-hashalgo_des" selected="true" /> 
	<select idref="rule-misc-perm-check" selected="true" /> 
	<select idref="rule-misc-sig-check" selected="true" /> 
	<select idref="rule-srvc-dhcpd-chroot" selected="true" /> 
	<select idref="rule-srvc-dhcpd-uid" selected="true" /> 
	<select idref="rule-srvc-dhcpd6-chroot" selected="true" /> 
	<select idref="rule-srvc-dhcpd6-uid" selected="true" /> 
	<select idref="rule-srvc-update-restart" selected="true" /> 
	<select idref="rule-srvc-remove-stop" selected="true" /> 
  </Profile>
	 
<Rule id="rule-sysctl-ipv4-forward" selected="false">
  <title>sysctl net.ipv4.ip_forward must be 0</title>
  <description>sysctl net.ipv4.ip_forward must be 0</description>
  <fix>echo 0 &gt; /proc/sys/net/ipv4/ip_forward</fix>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:2" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-sysctl-ipv4-tcpsyncookies" selected="false">
  <title>sysctl net.ipv4.tcp_syncookies must be 1</title>
  <description>sysctl net.ipv4.tcp_syncookies must be 1</description>
  <fix>echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies</fix>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:3" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-sysctl-ipv6-all-forward" selected="false">
  <title>sysctl net.ipv6.conf.all.forwarding must be 0</title>
  <description>sysctl net.ipv6.conf.all.forwarding must be 0</description>
  <fix>echo 0 &gt; /proc/sys/net/ipv6/conf/all/forwarding</fix>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:4" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-sysctl-ipv6-default-forward" selected="false">
  <title>sysctl net.ipv6.conf.default.forwarding must be 0</title>
  <description>sysctl net.ipv6.conf.default.forwarding must be 0</description>
  <fix>echo 0 &gt; /proc/sys/net/ipv6/conf/default/forwarding</fix>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:5" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-kernel-syncookies" selected="false">
  <title>kernel config CONFIG_SYN_COOKIES must be y</title>
  <description>kernel config CONFIG_SYN_COOKIES must be y</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:6" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-pwd-maxdays" selected="false">
  <title>file /etc/login.defs must have a line that matches ^PASS_MAX_DAYS.*99999</title>
  <description>file /etc/login.defs must have a line that matches ^PASS_MAX_DAYS.*99999</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:9" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-pwd-mindays" selected="false">
  <title>file /etc/login.defs must have a line that matches ^PASS_MIN_DAYS.*0</title>
  <description>file /etc/login.defs must have a line that matches ^PASS_MIN_DAYS.*0</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:10" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-pwd-warnage" selected="false">
  <title>file /etc/login.defs must have a line that matches ^PASS_WARN_AGE.*7</title>
  <description>file /etc/login.defs must have a line that matches ^PASS_WARN_AGE.*7</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:11" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-pwd-minlen" selected="false">
  <title>file /etc/pam.d/common-password must have a line that matches minlen=6</title>
  <description>file /etc/pam.d/common-password must have a line that matches minlen=6</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:12" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-pwd-remember" selected="false">
  <title>file /etc/pam.d/common-password must have a line that matches remember=</title>
  <description>file /etc/pam.d/common-password must have a line that matches remember=</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:13" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-authc-faildelay" selected="false">
  <title>file /etc/login.defs may not have a line that matches ^FAIL_DELAY.*0</title>
  <description>file /etc/login.defs may not have a line that matches ^FAIL_DELAY.*0</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:16" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-authc-faildelayexist" selected="false">
  <title>file /etc/login.defs must have a line that matches ^FAIL_DELAY</title>
  <description>file /etc/login.defs must have a line that matches ^FAIL_DELAY</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:17" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-authc-xdmcp-remote" selected="false">
  <title>file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_REMOTE_ACCESS.*no</title>
  <description>file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_REMOTE_ACCESS.*no</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:18" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-authc-xdmcp-root" selected="false">
  <title>file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_ROOT_LOGIN_REMOTE.*no</title>
  <description>file /etc/sysconfig/displaymanager must have a line that matches ^DISPLAYMANAGER_ROOT_LOGIN_REMOTE.*no</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:19" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-usermgmt-uidmin" selected="false">
  <title>file /etc/login.defs must have a line that matches ^UID_MIN.*1000</title>
  <description>file /etc/login.defs must have a line that matches ^UID_MIN.*1000</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:22" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-usermgmt-uidmax" selected="false">
  <title>file /etc/login.defs must have a line that matches ^UID_MAX.*60000</title>
  <description>file /etc/login.defs must have a line that matches ^UID_MAX.*60000</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:23" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-usermgmt-gidmin" selected="false">
  <title>file /etc/login.defs must have a line that matches ^GID_MIN.*1000</title>
  <description>file /etc/login.defs must have a line that matches ^GID_MIN.*1000</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:24" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-usermgmt-gidmax" selected="false">
  <title>file /etc/login.defs must have a line that matches ^GID_MAX.*60000</title>
  <description>file /etc/login.defs must have a line that matches ^GID_MAX.*60000</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:25" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-misc-sysrq" selected="false">
  <title>sysctl kernel.sysrq must be 0</title>
  <description>sysctl kernel.sysrq must be 0</description>
  <fix>echo 0 &gt; /proc/sys/kernel/sysrq</fix>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:29" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-misc-hashalgo_md5" selected="false">
  <title>file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=md5</title>
  <description>file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=md5</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:30" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-misc-hashalgo_des" selected="false">
  <title>file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=des</title>
  <description>file /etc/default/passwd may not have a line that matches ^CRYPT_FILES=des</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:31" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-misc-perm-check" selected="false">
  <title>file /etc/sysconfig/security must have a line that matches ^CHECK_PERMISSIONS.*set</title>
  <description>file /etc/sysconfig/security must have a line that matches ^CHECK_PERMISSIONS.*set</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:32" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-misc-sig-check" selected="false">
  <title>file /etc/sysconfig/security must have a line that matches ^CHECK_SIGNATURES.*yes</title>
  <description>file /etc/sysconfig/security must have a line that matches ^CHECK_SIGNATURES.*yes</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:33" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-srvc-dhcpd-chroot" selected="false">
  <title>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_CHROOTED.*yes</title>
  <description>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_CHROOTED.*yes</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:38" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-srvc-dhcpd-uid" selected="false">
  <title>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_AS.*dhcpd</title>
  <description>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD_RUN_AS.*dhcpd</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:39" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-srvc-dhcpd6-chroot" selected="false">
  <title>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_CHROOTED.*yes</title>
  <description>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_CHROOTED.*yes</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:40" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-srvc-dhcpd6-uid" selected="false">
  <title>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_AS.*dhcpd</title>
  <description>file /etc/sysconfig/dhcpd must have a line that matches ^DHCPD6_RUN_AS.*dhcpd</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:41" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-srvc-update-restart" selected="false">
  <title>file /etc/sysconfig/services must have a line that matches ^DISABLE_RESTART_ON_UPDATE.*yes</title>
  <description>file /etc/sysconfig/services must have a line that matches ^DISABLE_RESTART_ON_UPDATE.*yes</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:42" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
	 
<Rule id="rule-srvc-remove-stop" selected="false">
  <title>file /etc/sysconfig/services must have a line that matches ^DISABLE_STOP_ON_REMOVAL.*yes</title>
  <description>file /etc/sysconfig/services must have a line that matches ^DISABLE_STOP_ON_REMOVAL.*yes</description>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-content-ref name="oval:de.suse.suse121:def:43" href="scap-yast2sec-oval.xml" />
  </check>
</Rule>
	
</Benchmark>

Places

File scap-yast2sec-xccdf.xml of Package openscap (Revision 96f774067026d51a272af2388eed0104)

Places