| opt_out_config: { |
| content_optout_regexes: "/etc/.*" |
| filename_optout_regexes: "/var/spool/crash" |
| } |
| |
| benchmark_configs: { |
| id: "ip-forwarding-disabled" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Ensure IP forwarding is disabled" |
| description: |
| "The net.ipv4.ip_forward and net.ipv6.conf.all.forwarding flags " |
| "are used to tell the system whether it can forward packets or " |
| "not." |
| rationale: |
| "Setting the flags to 0 ensures that a system with multiple " |
| "interfaces (for example, a hard proxy), will never be able to " |
| "forward packets, and therefore, never serve as a router" |
| remediation: |
| "Set the following parameter in a /etc/sysctl.d/* file:\n" |
| "```\n" |
| "net.ipv4.ip_forward = 0\n" |
| "net.ipv6.conf.all.forwarding = 0\n" |
| "```\n" |
| "Run the following commands to set the active kernel parameters:\n" |
| "```\n" |
| "# sysctl -w net.ipv4.ip_forward=0\n" |
| "# sysctl -w net.ipv6.conf.all.forwarding=0\n" |
| "# sysctl -w net.ipv4.route.flush=1\n" |
| "# sysctl -w net.ipv6.route.flush=1\n" |
| "```\n" |
| cis_benchmark: { |
| profile_level: 1 |
| severity: HIGH |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/proc/sys/net/ipv4/ip_forward\"}}" |
| " content:{content:\"0\\n\"}" |
| " }" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/proc/sys/net/ipv6/conf/all/forwarding\"}}" |
| " content:{content:\"0\\n\"}" |
| " }" |
| "}" |
| } |
| } |
| benchmark_configs: { |
| id: "packet-redirect-disabled" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Ensure IP forwarding is disabled" |
| description: |
| "ICMP Redirects are used to send routing information to other hosts. " |
| "As a host itself does not act as a router (in a host only configuration), " |
| "there is no need to send redirects." |
| rationale: |
| "An attacker could use a compromised host to send invalid ICMP redirects " |
| "to other router devices in an attempt to corrupt routing and have users " |
| "access a system set up by the attacker as opposed to a valid system." |
| remediation: |
| "Set the following parameters in a /etc/sysctl.d/* file:" |
| "net.ipv4.conf.all.send_redirects = 0" |
| "net.ipv4.conf.default.send_redirects = 0" |
| "Run the following commands to set the active kernel parameters:" |
| "# sysctl -w net.ipv4.conf.all.send_redirects=0" |
| "# sysctl -w net.ipv4.conf.default.send_redirects=0" |
| "# sysctl -w net.ipv4.route.flush=1" |
| cis_benchmark: { |
| profile_level: 1 |
| severity: HIGH |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/proc/sys/net/ipv4/conf/all/send_redirects\"}}" |
| " content:{content:\"0\\n\"}" |
| " }" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/proc/sys/net/ipv4/conf/default/send_redirects\"}}" |
| " content:{content:\"0\\n\"}" |
| " }" |
| " file_checks:{" |
| " files_to_check:{files_in_dir:{" |
| " dir_path:\"/etc/sysctl.d/\"" |
| " recursive: true" |
| " }}" |
| " content_entry: {" |
| " match_type: ALL_MATCH_ANY_ORDER" |
| " match_criteria: {" |
| " filter_regex: \"net.ipv4.conf.all.send_redirects *=.*\"" |
| " expected_regex: \"net.ipv4.conf.all.send_redirects *= *0\"" |
| " }" |
| " match_criteria: {" |
| " filter_regex: \"net.ipv4.conf.default.send_redirects *=.*\"" |
| " expected_regex: \"net.ipv4.conf.default.send_redirects *= *0\"" |
| " }" |
| " }" |
| " }" |
| "}" |
| } |
| } |
| benchmark_configs: { |
| id: "motd-permissions" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Ensure permissions on /etc/motd are configured" |
| description: |
| "The contents of the /etc/motd file are displayed to users " |
| "after login and function as a message of the day for " |
| "authenticated users." |
| rationale: |
| "If the /etc/motd file does not have the correct ownership it " |
| "could be modified by unauthorized users with incorrect " |
| "or misleading information." |
| remediation: |
| "Run the following commands to set permissions on /etc/motd:" |
| "# chown root:root /etc/motd" |
| "# chmod 644 /etc/motd" |
| cis_benchmark: { |
| profile_level: 1 |
| severity: MEDIUM |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/etc/motd\"}}" |
| " permission:{" |
| " set_bits: 0644" |
| " clear_bits: 0133" |
| " bits_should_match: BOTH_SET_AND_CLEAR" |
| " user: {name: \"root\" should_own: true}" |
| " group: {name: \"root\" should_own: true}" |
| " }" |
| " }" |
| "}" |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/etc/motd\"}}" |
| " existence:{should_exist:false}" |
| " }" |
| "}" |
| } |
| } |
| benchmark_configs: { |
| id: "etc-issue-permissions" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Ensure permissions on /etc/issue are configured" |
| description: |
| "The contents of the /etc/issue file are displayed to users prior to " |
| "login for local terminals." |
| rationale: |
| "If the /etc/issue file does not have the correct ownership it " |
| "could be modified by unauthorized users with incorrect or " |
| "misleading information." |
| remediation: |
| "Run the following commands to set permissions on /etc/issue:" |
| "# chown root:root /etc/issue" |
| "# chmod 644 /etc/issue" |
| cis_benchmark: { |
| profile_level: 1 |
| severity: MEDIUM |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"/etc/issue\"}}" |
| " permission:{" |
| " bits_should_match: BOTH_SET_AND_CLEAR" |
| " set_bits: 0644" |
| " clear_bits: 0133" |
| " user: {name: \"root\" should_own: true}" |
| " group: {name: \"root\" should_own: true}" |
| " }" |
| " }" |
| "}" |
| } |
| } |
| benchmark_configs: { |
| id: "home-dirs-exist" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Ensure all users' home directories exist" |
| description: |
| "Users can be defined in /etc/passwd without a home directory or with a " |
| "home directory that does not actually exist." |
| rationale: |
| "If the user's home directory does not exist or is unassigned, the user " |
| "will be placed in \"/\" and will not be able to write any files or have " |
| "local environment variables set." |
| remediation: |
| "If any users' home directories do not exist, create them and make sure " |
| "the respective user owns the directory. Users without an assigned home " |
| "directory should be removed or assigned a home directory as appropriate." |
| cis_benchmark: { |
| profile_level: 1 |
| severity: MEDIUM |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"$home\"}}" |
| " existence:{should_exist: true}" |
| " repeat_config:{type: FOR_EACH_USER_WITH_LOGIN}" |
| " }" |
| "}" |
| } |
| } |
| |
| benchmark_configs: { |
| id: "home-dirs-owned" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Ensure users own their home directories" |
| description: |
| "The user home directory is space defined for the particular user to set " |
| "local environment variables and to store personal files." |
| rationale: |
| "Since the user is accountable for files stored in the user home " |
| "directory, the user must be the owner of the directory." |
| remediation: |
| "Change the ownership of any home directories that are not owned by the " |
| "defined user to the correct user." |
| cis_benchmark: { |
| profile_level: 1 |
| severity: MEDIUM |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{single_file:{path:\"$home\"}}" |
| " permission:{user: {name: \"$user\" should_own: true}}" |
| " repeat_config:{type: FOR_EACH_USER_WITH_LOGIN}" |
| " }" |
| "}" |
| } |
| } |
| |
| benchmark_configs: { |
| id: "no-suid-execs" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Audit SUID executable" |
| description: |
| "The owner of a file can set the file's permissions to run with the " |
| "owner's or group's permissions, even if the user running the program is " |
| "not the owner or a member of the group. The most common reason for a SUID " |
| "program is to enable users to perform functions (such as changing their " |
| "password) that require root privileges." |
| rationale: |
| "There are valid reasons for SUID programs, but it is important to " |
| "identify and review such programs to ensure they are legitimate." |
| remediation: |
| "Ensure that no rogue SUID programs have been introduced into the system. " |
| "Review the files returned by the action in the Audit section and confirm " |
| "the integrity of these binaries" |
| cis_benchmark: { |
| profile_level: 1 |
| severity: HIGH |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{files_in_dir:{" |
| " dir_path:\"/\"" |
| " recursive: true" |
| " files_only: true" |
| " opt_out_path_regexes: \"/proc\"" |
| " opt_out_path_regexes: \"/usr/bin/sudo\"" |
| " opt_out_path_regexes: \"/sbin/mount.nfs\"" |
| " opt_out_path_regexes: \"/usr/libexec/dbus-daemon-launch-helper\"" |
| " }}" |
| " permission:{ clear_bits: 04000 }" |
| " non_compliance_msg: \"some files on the filesystem have the SUID bit set\"" |
| " file_display_command: \"df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -4000\"" |
| " }" |
| "}" |
| } |
| } |
| |
| benchmark_configs: { |
| id: "no-sgid-execs" |
| compliance_note: { |
| version: { cpe_uri: "cpe:/example" version: "2.0.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.1.0" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.1" } |
| version: { cpe_uri: "cpe:/example" version: "1.0.0" } |
| title: "Audit SGID executable" |
| description: |
| "The owner of a file can set the file's permissions to run with the " |
| "owner's or group's permissions, even if the user running the program is " |
| "not the owner or a member of the group. The most common reason for a SGID " |
| "program is to enable users to perform functions (such as changing their " |
| "password) that require root privileges." |
| rationale: |
| "There are valid reasons for SGID programs, but it is important to " |
| "identify and review such programs to ensure they are legitimate. Review " |
| "the files returned by the action in the audit section and check to see if " |
| "system binaries have a different md5 checksum than what from the package. " |
| "This is an indication that the binary may have been replaced." |
| remediation: |
| "Ensure that no rogue SGID programs have been introduced into the system. " |
| "Review the files returned by the action in the Audit section and confirm " |
| "the integrity of these binaries" |
| cis_benchmark: { |
| profile_level: 1 |
| severity: HIGH |
| } |
| scan_instructions: |
| "check_alternatives:{" |
| " file_checks:{" |
| " files_to_check:{files_in_dir:{" |
| " dir_path:\"/\"" |
| " recursive: true" |
| " files_only: true" |
| " opt_out_path_regexes: \"/proc\"" |
| " }}" |
| " permission:{ clear_bits: 02000 }" |
| " non_compliance_msg: \"some files on the filesystem have the SGID bit set\"" |
| " file_display_command: \"df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -2000\"" |
| " }" |
| "}" |
| } |
| } |
