Oracle -甲骨文-相关文档 CIS-Distribution-Independent-Linux-Benchmark-v1.1.0

CISDistributionIndependentLinux

v1.1.0-12-26-2017

1|Page

TermsofUse

ThisworkislicensedunderaCreativeCommonsAttribution-NonCommercial-ShareAlike4.0InternationalPublicLicense.Thelinktothelicensetermscanbefoundat

/licenses/by-nc-sa/4.0/legalcode

TofurtherclarifytheCreativeCommonslicenserelatedtoCISBenchmarkcontent,youareauthorizedtocopyandredistributethecontentforusebyyou,withinyourorganizationandoutsideyourorganizationfornon-commercialpurposesonly,providedthat(i)appropriatecreditisgiventoCIS,(ii)alinktothelicenseisprovided.Additionally,ifyouremix,transformorbuildupontheCISBenchmark(s),youmayonlydistributethemodifiedmaterialsiftheyaresubjecttothesamelicensetermsastheoriginalBenchmarklicenseandyourderivativewillnolongerbeaCISBenchmark.CommercialuseofCISBenchmarksissubjecttothepriorapprovaloftheCenterforInternetSecurity.

2|Page

TableofContents

TermsofUse 1

Overview 12

IntendedAudience 12

ConsensusGuidance 12

TypographicalConventions 14

ScoringInformation 14

ProfileDefinitions 15

Acknowledgements 17

Recommendations 19

1InitialSetup 19

1.1FilesystemConfiguration 19

Ensuremountingofcramfsfilesystemsisdisabled(Scored) 20

Ensuremountingoffreevxfsfilesystemsisdisabled(Scored) 22

Ensuremountingofjffs2filesystemsisdisabled(Scored) 23

Ensuremountingofhfsfilesystemsisdisabled(Scored) 24

Ensuremountingofhfsplusfilesystemsisdisabled(Scored) 25

Ensuremountingofsquashfsfilesystemsisdisabled(Scored) 26

Ensuremountingofudffilesystemsisdisabled(Scored) 27

EnsuremountingofFATfilesystemsisdisabled(Scored) 28

1.1.2Ensureseparatepartitionexistsfor/tmp(Scored) 30

1.1.3Ensurenodevoptionseton/tmppartition(Scored) 32

1.1.4Ensurenosuidoptionseton/tmppartition(Scored) 33

1.1.5Ensurenoexecoptionseton/tmppartition(Scored) 34

1.1.6Ensureseparatepartitionexistsfor/var(Scored) 35

1.1.7Ensureseparatepartitionexistsfor/var/tmp(Scored) 36

1.1.8Ensurenodevoptionseton/var/tmppartition(Scored) 38

1.1.9Ensurenosuidoptionseton/var/tmppartition(Scored) 39

1.1.10Ensurenoexecoptionseton/var/tmppartition(Scored) 40

1.1.11Ensurenoexecoptionseton/var/tmppartition(Scored) 41

3|Page

1.1.12Ensurenoexecoptionseton/var/tmppartition(Scored) 42

1.1.13Ensurenoexecoptionseton/var/tmppartition(Scored) 43

1.1.14Ensurenoexecoptionseton/var/tmppartition(Scored) 44

1.1.15Ensureseparatepartitionexistsfor/var/log(Scored) 45

1.1.16Ensureseparatepartitionexistsfor/var/log/audit(Scored) 47

1.1.17Ensureseparatepartitionexistsfor/home(Scored) 49

1.1.18Ensurenodevoptionseton/homepartition(Scored) 50

1.1.19Ensurenodevoptionseton/dev/shmpartition(Scored) 51

1.1.20Ensurenosuidoptionseton/dev/shmpartition(Scored) 52

1.1.21Ensurenoexecoptionseton/dev/shmpartition(Scored) 53

1.1.22Ensurenodevoptionsetonremovablemediapartitions(NotScored) 54

1.1.23Ensurenosuidoptionsetonremovablemediapartitions(NotScored) 55

1.1.24Ensurenoexecoptionsetonremovablemediapartitions(NotScored) 56

1.1.25Ensurestickybitissetonallworld-writabledirectories(Scored) 57

1.1.26DisableAutomounting(Scored) 58

1.2ConfigureSoftwareUpdates 60

1.2.1Ensurepackagemanagerrepositoriesareconfigured(NotScored) 60

1.2.2EnsureGPGkeysareconfigured(NotScored) 62

1.3FilesystemIntegrityChecking 63

1.3.1EnsureAIDEisinstalled(Scored) 63

1.3.2Ensurefilesystemintegrityisregularlychecked(Scored) 65

1.4SecureBootSettings 67

1.4.1Ensurepermissionsonbootloaderconfigareconfigured(Scored) 67

1.4.2Ensurebootloaderpasswordisset(Scored) 69

1.4.3Ensureauthenticationrequiredforsingleusermode(NotScored) 71

1.4.4Ensureinteractivebootisnotenabled(NotScored) 73

1.5AdditionalProcessHardening 74

1.5.1Ensurecoredumpsarerestricted(Scored) 74

1.5.2EnsureXD/NXsupportisenabled(NotScored) 76

1.5.3Ensureaddressspacelayoutrandomization(ASLR)isenabled(Scored) 78

1.5.4Ensureprelinkisdisabled(Scored) 80

1.6MandatoryAccessControl 81

EnsureSELinuxisnotdisabledinbootloaderconfiguration(Scored) 83

EnsuretheSELinuxstateisenforcing(Scored) 85

EnsureSELinuxpolicyisconfigured(Scored) 86

EnsureSETroubleshootisnotinstalled(Scored) 87

EnsuretheMCSTranslationService(mcstrans)isnotinstalled(Scored) 88

Ensurenounconfineddaemonsexist(Scored) 89

EnsureAppArmorisnotdisabledinbootloaderconfiguration(Scored) 90

EnsureallAppArmorProfilesareenforcing(Scored) 93

1.6.3EnsureSELinuxorAppArmorareinstalled(NotScored) 95

1.7WarningBanners 96

Ensuremessageofthedayisconfiguredproperly(Scored) 97

Ensurelocalloginwarningbannerisconfiguredproperly(NotScored) 99

Ensureremoteloginwarningbannerisconfiguredproperly(NotScored)101

Ensurepermissionson/etc/motdareconfigured(NotScored) 103

Ensurepermissionson/etc/issueareconfigured(Scored) 104

Ensurepermissionson/etc/areconfigured(NotScored) 105

1.7.2EnsureGDMloginbannerisconfigured(Scored) 106

1.8Ensureupdates,patches,andadditionalsecuritysoftwareareinstalled(Not

Scored) 108

2Services 109

2.1inetdServices 110

2.1.1Ensurechargenservicesarenotenabled(Scored) 110

2.1.2Ensuredaytimeservicesarenotenabled(Scored) 112

2.1.3Ensurediscardservicesarenotenabled(Scored) 113

2.1.4Ensureechoservicesarenotenabled(Scored) 114

2.1.5Ensuretimeservicesarenotenabled(Scored) 115

2.1.6Ensurershserverisnotenabled(Scored) 116

2.1.7Ensuretalkserverisnotenabled(Scored) 118

2.1.8Ensuretelnetserverisnotenabled(Scored) 119

4|Page

5|Page

2.1.9Ensuretftpserverisnotenabled(Scored) 121

2.1.10Ensurexinetdisnotenabled(Scored) 122

2.2SpecialPurposeServices 123

Ensuretimesynchronizationisinuse(NotScored) 124

Ensurentpisconfigured(Scored) 126

Ensurechronyisconfigured(Scored) 128

2.2.2EnsureXWindowSystemisnotinstalled(Scored) 130

2.2.3EnsureAvahiServerisnotenabled(Scored) 132

2.2.4EnsureCUPSisnotenabled(Scored) 134

2.2.5EnsureDHCPServerisnotenabled(Scored) 136

2.2.6EnsureLDAPserverisnotenabled(Scored) 138

2.2.7EnsureNFSandRPCarenotenabled(Scored) 140

2.2.8EnsureDNSServerisnotenabled(Scored) 142

2.2.9EnsureFTPServerisnotenabled(Scored) 144

2.2.10EnsureHTTPserverisnotenabled(Scored) 146

2.2.11EnsureIMAPandPOP3serverisnotenabled(Scored) 148

2.2.12EnsureSambaisnotenabled(Scored) 150

2.2.13EnsureHTTPProxyServerisnotenabled(Scored) 152

2.2.14EnsureSNMPServerisnotenabled(Scored) 154

2.2.15Ensuremailtransferagentisconfiguredforlocal-onlymode(Scored) 156

2.2.16Ensurersyncserviceisnotenabled(Scored) 158

2.2.17EnsureNISServerisnotenabled(Scored) 160

2.3ServiceClients 162

2.3.1EnsureNISClientisnotinstalled(Scored) 162

2.3.2Ensurershclientisnotinstalled(Scored) 164

2.3.3Ensuretalkclientisnotinstalled(Scored) 166

2.3.4Ensuretelnetclientisnotinstalled(Scored) 168

2.3.5EnsureLDAPclientisnotinstalled(Scored) 170

3NetworkConfiguration 171

3.1NetworkParameters(HostOnly) 172

6|Page

3.1.1EnsureIPforwardingisdisabled(Scored) 172

3.1.2Ensurepacketredirectsendingisdisabled(Scored) 174

3.2NetworkParameters(HostandRouter) 176

3.2.1Ensuresourceroutedpacketsarenotaccepted(Scored) 176

3.2.2EnsureICMPredirectsarenotaccepted(Scored) 178

3.2.3EnsuresecureICMPredirectsarenotaccepted(Scored) 180

3.2.4Ensuresuspiciouspacketsarelogged(Scored) 182

3.2.5EnsurebroadcastICMPrequestsareignored(Scored) 184

3.2.6EnsurebogusICMPresponsesareignored(Scored) 186

3.2.7EnsureReversePathFilteringisenabled(Scored) 188

3.2.8EnsureTCPSYNCookiesisenabled(Scored) 190

3.3IPv6 192

3.3.1EnsureIPv6routeradvertisementsarenotaccepted(NotScored) 192

3.3.2EnsureIPv6redirectsarenotaccepted(NotScored) 194

3.3.3EnsureIPv6isdisabled(NotScored) 196

3.4TCPWrappers 198

3.4.1EnsureTCPWrappersisinstalled(Scored) 198

3.4.2Ensure/etc/hosts.allowisconfigured(Scored) 200

3.4.3Ensure/etc/hosts.denyisconfigured(Scored) 201

3.4.4Ensurepermissionson/etc/hosts.allowareconfigured(Scored) 202

3.4.5Ensurepermissionson/etc/hosts.denyareconfigured(Scored) 203

3.5UncommonNetworkProtocols 204

3.5.1EnsureDCCPisdisabled(NotScored) 204

3.5.2EnsureSCTPisdisabled(NotScored) 206

3.5.3EnsureRDSisdisabled(NotScored) 207

3.5.4EnsureTIPCisdisabled(NotScored) 208

3.6FirewallConfiguration 209

3.6.1Ensureiptablesisinstalled(Scored) 209

3.6.2Ensuredefaultdenyfirewallpolicy(Scored) 211

3.6.3Ensureloopbacktrafficisconfigured(Scored) 213

7|Page

3.6.4Ensureoutboundandestablishedconnectionsareconfigured(NotScored)215

3.6.5Ensurefirewallrulesexistforallopenports(Scored) 217

3.7Ensurewirelessinterfacesaredisabled(NotScored) 219

4LoggingandAuditing 220

4.1ConfigureSystemAccounting(auditd) 221

Ensureauditlogstoragesizeisconfigured(NotScored) 222

Ensuresystemisdisabledwhenauditlogsarefull(Scored) 224

Ensureauditlogsarenotautomaticallydeleted(Scored) 225

4.1.2Ensureauditdserviceisenabled(Scored) 226

4.1.3Ensureauditingforprocessesthatstartpriortoauditdisenabled(Scored)228

4.1.4Ensureeventsthatmodifydateandtimeinformationarecollected(Scored)

230

4.1.5Ensureeventsthatmodifyuser/groupinformationarecollected(Scored) 232

4.1.6Ensureeventsthatmodifythesystem'snetworkenvironmentarecollected

(Scored) 234

4.1.7Ensureeventsthatmodifythesystem'sMandatoryAccessControlsare

collected(Scored) 237

4.1.8Ensureloginandlogouteventsarecollected(Scored) 239

4.1.9Ensuresessioninitiationinformationiscollected(Scored) 241

4.1.10Ensurediscretionaryaccesscontrolpermissionmodificationeventsare

collected(Scored) 243

4.1.11Ensureunsuccessfulunauthorizedfileaccessattemptsarecollected(Scored)

246

4.1.12Ensureuseofprivilegedcommandsiscollected(Scored) 248

4.1.13Ensuresuccessfulfilesystemmountsarecollected(Scored) 250

4.1.14Ensurefiledeletioneventsbyusersarecollected(Scored) 252

4.1.15Ensurechangestosystemadministrationscope(sudoers)iscollected

(Scored) 254

4.1.16Ensuresystemadministratoractions(sudolog)arecollected(Scored) 256

4.1.17Ensurekernelmoduleloadingandunloadingiscollected(Scored) 258

4.1.18Ensuretheauditconfigurationisimmutable(Scored) 260

4.2ConfigureLogging 261

8|Page

EnsurersyslogServiceisenabled(Scored) 262

Ensureloggingisconfigured(NotScored) 264

Ensurersyslogdefaultfilepermissionsconfigured(Scored) 266

Ensurersyslogisconfiguredtosendlogstoaremoteloghost(Scored) 268

Ensureremotersyslogmessagesareonlyacceptedondesignatedloghosts.

(NotScored) 270

Ensuresyslog-ngserviceisenabled(Scored) 272

Ensureloggingisconfigured(NotScored) 274

Ensuresyslog-ngdefaultfilepermissionsconfigured(Scored) 276

Ensuresyslog-ngisconfiguredtosendlogstoaremoteloghost(NotScored)

277

Ensureremotesyslog-ngmessagesareonlyacceptedondesignatedloghosts

(NotScored) 279

4.2.3Ensurersyslogorsyslog-ngisinstalled(Scored) 281

4.2.4Ensurepermissionsonalllogfilesareconfigured(Scored) 283

4.3Ensurelogrotateisconfigured(NotScored) 284

5Access,AuthenticationandAuthorization 285

5.1Configurecron 286

5.1.1Ensurecrondaemonisenabled(Scored) 286

5.1.2Ensurepermissionson/etc/crontabareconfigured(Scored) 288

5.1.3Ensurepermissionson/etc/cron.hourlyareconfigured(Scored) 289

5.1.4Ensurepermissionson/etc/cron.dailyareconfigured(Scored) 291

5.1.5Ensurepermissionson/etc/cron.weeklyareconfigured(Scored) 293

5.1.6Ensurepermissionson/etc/cron.monthlyareconfigured(Scored) 295

5.1.7Ensurepermissionson/etc/cron.dareconfigured(Scored) 297

5.1.8Ensureat/cronisrestrictedtoauthorizedusers(Scored) 299

5.2SSHServerConfiguration 301

5.2.1Ensurepermissionson/etc/ssh/sshd_configareconfigured(Scored) 301

5.2.2EnsureSSHProtocolissetto2(Scored) 303

5.2.3EnsureSSHLogLevelissettoINFO(Scored) 304

5.2.4EnsureSSHX11forwardingisdisabled(Scored) 305

9|Page

5.2.5EnsureSSHMaxAuthTriesissetto4orless(Scored) 306

5.2.6EnsureSSHIgnoreRhostsisenabled(Scored) 307

5.2.7EnsureSSHHostbasedAuthenticationisdisabled(Scored) 308

5.2.8EnsureSSHrootloginisdisabled(Scored) 309

5.2.9EnsureSSHPermitEmptyPasswordsisdisabled(Scored) 310

5.2.10EnsureSSHPermitUserEnvironmentisdisabled(Scored) 311

5.2.11EnsureonlyapprovedMACalgorithmsareused(Scored) 312

5.2.12EnsureSSHIdleTimeoutIntervalisconfigured(Scored) 314

5.2.13EnsureSSHLoginGraceTimeissettooneminuteorless(Scored) 316

5.2.14EnsureSSHaccessislimited(Scored) 317

5.2.15EnsureSSHwarningbannerisconfigured(Scored) 319

5.3ConfigurePAM 320

5.3.1Ensurepasswordcreationrequirementsareconfigured(Scored) 320

5.3.2Ensurelockoutforfailedpasswordattemptsisconfigured(NotScored) 323

5.3.3Ensurepasswordreuseislimited(NotScored) 325

5.3.4EnsurepasswordhashingalgorithmisSHA-512(NotScored) 327

5.4UserAccountsandEnvironment 328

Ensurepasswordexpirationis365daysorless(Scored) 329

Ensureminimumdaysbetweenpasswordchangesis7ormore(Scored).331

Ensurepasswordexpirationwarningdaysis7ormore(Scored) 333

Ensureinactivepasswordlockis30daysorless(Scored) 335

Ensurealluserslastpasswordchangedateisinthepast(Scored) 337

5.4.2Ensuresystemaccountsarenon-login(Scored) 338

5.4.3EnsuredefaultgroupfortherootaccountisGID0(Scored) 340

5.4.4Ensuredefaultuserumaskis027ormorerestrictive(Scored) 341

5.4.5Ensuredefaultusershelltimeoutis900secondsorless(Scored) 343

5.5Ensurerootloginisrestrictedtosystemconsole(NotScored) 345

5.6Ensureaccesstothesucommandisrestricted(Scored) 346

6SystemMaintenance 347

6.1SystemFilePermissions 348

6.1.1Auditsystemfilepermissions(NotScored) 348

6.1.2Ensurepermissionson/etc/passwdareconfigured(Scored) 350

6.1.3Ensurepermissionson/etc/shadowareconfigured(Scored) 351

6.1.4Ensurepermissionson/etc/groupareconfigured(Scored) 353

6.1.5Ensurepermissionson/etc/gshadowareconfigured(Scored) 354

6.1.6Ensurepermissionson/etc/passwd-areconfigured(Scored) 355

6.1.7Ensurepermissionson/etc/shadow-areconfigured(Scored) 356

6.1.8Ensurepermissionson/etc/group-areconfigured(Scored) 357

6.1.9Ensurepermissionson/etc/gshadow-areconfigured(Scored) 358

6.1.10Ensurenoworldwritablefilesexist(Scored) 359

6.1.11Ensurenounownedfilesordirectoriesexist(Scored) 360

6.1.12Ensurenoungroupedfilesordirectoriesexist(Scored) 361

6.1.13AuditSUIDexecutables(NotScored) 362

6.1.14AuditSGIDexecutables(NotScored) 364

6.2UserandGroupSettings 366

6.2.1Ensurepasswordfieldsarenotempty(Scored) 366

6.2.2Ensurenolegacy"+"entriesexistin/etc/passwd(Scored) 368

6.2.3Ensurenolegacy"+"entriesexistin/etc/shadow(Scored) 369

6.2.4Ensurenolegacy"+"entriesexistin/etc/group(Scored) 370

6.2.5EnsurerootistheonlyUID0account(Scored) 371

6.2.6EnsurerootPATHIntegrity(Scored) 372

6.2.7Ensureallusers'homedirectoriesexist(Scored) 374

6.2.8Ensureusers'homedirectoriespermissionsare750ormorerestrictive

(Scored) 375

6.2.9Ensureusersowntheirhomedirectories(Scored) 377

6.2.10Ensureusers'dotfilesarenotgrouporworldwritable(Scored) 379

6.2.11Ensurenousershave.forwardfiles(Scored) 381

6.2.12Ercfiles(Scored) 383

6.2.13Ensureusers'.netrcFilesarenotgrouporworldaccessible(Scored) 385

6.2.14Ensurenousershave.rhostsfiles(Scored) 387

6.2.15Ensureallgroupsin/etc/passwdexistin/etc/group(Scored) 389

10|Page

11|Page

6.2.16EnsurenoduplicateUIDsexist(Scored) 390

6.2.17EnsurenoduplicateGIDsexist(Scored) 391

6.2.18Ensurenoduplicateusernamesexist(Scored) 393

6.2.19Ensurenoduplicategroupnamesexist(Scored) 394

6.2.20Ensureshadowgroupisempty(Scored) 395

Appendix:SummaryTable 396

Appendix:ChangeHistory 404

12|Page

Overview

ThisdocumentprovidesprescriptiveguidanceforestablishingasecureconfigurationpostureforLinuxsystemsrunningonx86andx64platforms.

Commandsandscriptsareprovidedwhichshouldworkonmostdistributionshoweversometranslationtolocalstylesmayberequiredinplaces.WherepossibleRedHat,Debian,andSUSEderivativestylesareprovided.

Manylistsareincludedincludingfilesystemtypes,services,clients,andnetworkprotocols.Notallitemsintheselistsareguaranteedtoexistonalldistributionsandadditionalsimilaritemsmayexistwhichshouldbeconsideredinadditiontothoseexplicitlymentioned.

Theguidancewithinbroadlyassumesthatoperationsarebeingperformedastherootuser.Non-rootusersmaynotbeabletoaccesscertainareasofthesystem,especiallyafterremediationhasbeenperformed.Itisadvisabletoverifyrootuserspathintegrityandtheintegrityofanyprogramsbeingrunpriortoexecutionofcommandsandscriptsincludedinthisbenchmark.

Toobtainthelatestversionofthisguide,pleasevisit

.Ifyouhavequestions,comments,o