| contains 213 rules |
Services
  [ref]groupThe best protection against vulnerable software is running less software. This section describes how to review
the software which Red Hat Enterprise Linux 7 installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Red Hat Enterprise Linux 7 system and provides guidance about which
ones can be safely disabled.
Red Hat Enterprise Linux 7 provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Red Hat Enterprise Linux 7 systems, it is highly recommended to select the minimal packages and then build up
the system from there. |
| contains 46 rules |
Obsolete Services
  [ref]groupThis section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Red Hat Enterprise Linux 7
by default.
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host
firewall software such as firewalld to restrict access to the
vulnerable service to only those remote hosts which have a known
need to use it. |
| contains 14 rules |
Rlogin, Rsh, and Rexec
  [ref]groupThe Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model. |
| contains 5 rules |
Uninstall rsh Package
  [ref]ruleThe rsh package contains the client commands
for the rsh services Rationale:These legacy clients contain numerous security exposures and have
been replaced with the more secure SSH package. Even if the server is removed,
it is best to ensure the clients are also removed to prevent users from
inadvertently attempting to use these commands and therefore exposing
their credentials. Note that removing the rsh package removes
the clients for rsh,rcp, and rlogin. References:Â
2.3.2, 3.1.13, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_remove telnet-server
#
function package_remove {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_remove 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if rpm -q --quiet "$package"; then
dnf remove -y "$package"
fi
elif which yum ; then
if rpm -q --quiet "$package"; then
yum remove -y "$package"
fi
elif which apt-get ; then
apt-get remove -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_remove rsh
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Ensure rsh is removed
package:
name="{{item}}"
state=absent
with_items:
- rsh
tags:
- package_rsh_removed
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27274-0
- NIST-800-171-3.1.13
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
include remove_rsh
class remove_rsh {
package { 'rsh':
ensure => 'purged',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
package --remove=rsh
|
Disable rlogin Service
  [ref]ruleThe rlogin service, which is available with
the rsh-server package and runs as a service through xinetd or separately
as a systemd socket, should be disabled.
If using xinetd, set disable to yes in /etc/xinetd.d/rlogin.
If using systemd,
The rlogin socket can be disabled with the following command:
$ sudo systemctl disable rlogin.socket Rationale:The rlogin service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network. References:Â
2.2.17, 3.1.13, 3.4.7, CCI-001436, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(8), CM-7, IA-5(1)(c)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
grep -qi disable /etc/xinetd.d/rlogin && \
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/rlogin
#
# Disable rlogin.socket for all systemd targets
#
systemctl disable rlogin.socket
#
# Stop rlogin.socket if currently running
#
systemctl stop rlogin.socket
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service rlogin
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- rlogin
tags:
- service_rlogin_disabled
- high_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27336-7
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
- NIST-800-53-IA-5(1)(c)
- NIST-800-171-3.1.13
- NIST-800-171-3.4.7
|
Disable rsh Service
  [ref]ruleThe rsh service, which is available with
the rsh-server package and runs as a service through xinetd or separately
as a systemd socket, should be disabled.
If using xinetd, set disable to yes in /etc/xinetd.d/rsh.
If using systemd,
The rsh socket can be disabled with the following command:
$ sudo systemctl disable rsh.socket Rationale:The rsh service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network. References:Â
2.2.17, 3.1.13, 3.4.7, CCI-000068, CCI-001436, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(8), CM-7, IA-5(1)(c)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
grep -qi disable /etc/xinetd.d/rsh && \
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/rsh
#
# Disable rsh.socket for all systemd targets
#
systemctl disable rsh.socket
#
# Stop rsh.socket if currently running
#
systemctl stop rsh.socket
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service rsh
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- rsh
tags:
- service_rsh_disabled
- high_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27337-5
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
- NIST-800-53-IA-5(1)(c)
- NIST-800-171-3.1.13
- NIST-800-171-3.4.7
|
Disable rexec Service
  [ref]ruleThe rexec service, which is available with
the rsh-server package and runs as a service through xinetd or separately
as a systemd socket, should be disabled.
If using xinetd, set disable to yes in /etc/xinetd.d/rexec.
If using systemd,
The rexec socket can be disabled with the following command:
$ sudo systemctl disable rexec.socket Rationale:The rexec service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network. References:Â
2.2.17, 3.1.13, 3.4.7, CCI-000068, CCI-001436, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(8), CM-7
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
grep -qi disable /etc/xinetd.d/rexec && \
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/rexec
#
# Disable rexec.socket for all systemd targets
#
systemctl disable rexec.socket
#
# Stop rexec.socket if currently running
#
systemctl stop rexec.socket
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service rexec
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- rexec
tags:
- service_rexec_disabled
- high_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27408-4
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
- NIST-800-171-3.1.13
- NIST-800-171-3.4.7
|
Remove Rsh Trust Files
  [ref]ruleThe files /etc/hosts.equiv and ~/.rhosts (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
$ sudo rm /etc/hosts.equiv
$ rm ~/.rhosts Rationale:Trust files are convenient, but when
used in conjunction with the R-services, they can allow
unauthenticated access to a system. Remediation Shell script:Â Â Â (show)
find /home -maxdepth 2 -type f -name .rhosts -exec rm -f '{}' \;
if [ -f /etc/hosts.equiv ]; then
/bin/rm -f /etc/hosts.equiv
fi
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | restrict |
|---|
- block:
- name: "Detect shosts.equiv Files on the System"
find:
paths: /
recurse: yes
patterns: shosts.equiv
check_mode: no
register: shosts_equiv_locations
- name: "Remove Rsh Trust Files"
file:
path: "{{ item.path }}"
state: absent
with_items: "{{ shosts_equiv_locations.files }}"
when: shosts_equiv_locations
tags:
- no_rsh_trust_files
- high_severity
- restrict_strategy
- low_complexity
- low_disruption
- CCE-27406-8
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
|
Telnet
  [ref]groupThe telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol. |
| contains 2 rules |
Remove telnet Clients
  [ref]ruleThe telnet client allows users to start connections to other
systems via the telnet protocol. Rationale:The telnet protocol is insecure and unencrypted. The use
of an unencrypted transmission medium could allow an unauthorized user
to steal credentials. The ssh package provides an
encrypted session and stronger security and is included in Red Hat
Enterprise Linux. References:Â
2.3.4, 3.1.13, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_remove telnet-server
#
function package_remove {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_remove 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if rpm -q --quiet "$package"; then
dnf remove -y "$package"
fi
elif which yum ; then
if rpm -q --quiet "$package"; then
yum remove -y "$package"
fi
elif which apt-get ; then
apt-get remove -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_remove telnet
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Ensure telnet is removed
package:
name="{{item}}"
state=absent
with_items:
- telnet
tags:
- package_telnet_removed
- low_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27305-2
- NIST-800-171-3.1.13
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
include remove_telnet
class remove_telnet {
package { 'telnet':
ensure => 'purged',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
package --remove=telnet
|
Disable telnet Service
  [ref]ruleThe telnet service configuration file /etc/xinetd.d/telnet
is not created automatically. If it was created manually, check the
/etc/xinetd.d/telnet file and ensure that disable = no
is changed to read disable = yes as follows below:
# description: The telnet server serves telnet sessions; it uses \\
# unencrypted username/password pairs for authentication.
service telnet
{
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
disable = yes
}
If the /etc/xinetd.d/telnet file does not exist, make sure that
the activation of the telnet service on system boot is disabled
via the following command:
The rexec socket can be disabled with the following command:
$ sudo systemctl disable rexec.socket Rationale:The telnet protocol uses unencrypted network communication, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network. The telnet protocol is also
subject to man-in-the-middle attacks. References:Â
2.2.18, 3.1.13, 3.4.7, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(8), CM-7, IA-5(1)(c)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
grep -qi disable /etc/xinetd.d/telnet && \
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/telnet
#
# Disable telnet.socket for all systemd targets
#
systemctl disable telnet.socket
#
# Stop telnet.socket if currently running
#
systemctl stop telnet.socket
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service telnet
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- telnet
tags:
- service_telnet_disabled
- high_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27401-9
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
- NIST-800-53-IA-5(1)(c)
- NIST-800-171-3.1.13
- NIST-800-171-3.4.7
|
NIS
  [ref]groupThe Network Information Service (NIS), also known as 'Yellow
Pages' (YP), and its successor NIS+ have been made obsolete by
Kerberos, LDAP, and other modern centralized authentication
services. NIS should not be used because it suffers from security
problems inherent in its design, such as inadequate protection of
important authentication information. |
| contains 2 rules |
Remove NIS Client
  [ref]ruleThe Network Information Service (NIS), formerly known as Yellow Pages,
is a client-server directory service protocol used to distribute system configuration
files. The NIS client (ypbind) was used to bind a system to an NIS server
and receive the distributed configuration files. Rationale:The NIS service is inherently an insecure system that has been vulnerable
to DOS attacks, buffer overflows and has poor authentication for querying NIS maps.
NIS generally has been replaced by such protocols as Lightweight Directory Access
Protocol (LDAP). It is recommended that the service be removed. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_remove telnet-server
#
function package_remove {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_remove 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if rpm -q --quiet "$package"; then
dnf remove -y "$package"
fi
elif which yum ; then
if rpm -q --quiet "$package"; then
yum remove -y "$package"
fi
elif which apt-get ; then
apt-get remove -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_remove ypbind
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Ensure ypbind is removed
package:
name="{{item}}"
state=absent
with_items:
- ypbind
tags:
- package_ypbind_removed
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27396-1
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
include remove_ypbind
class remove_ypbind {
package { 'ypbind':
ensure => 'purged',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
package --remove=ypbind
|
Uninstall ypserv Package
  [ref]ruleThe ypserv package can be uninstalled with
the following command:
$ sudo yum erase ypserv Rationale:The NIS service provides an unencrypted authentication service which does not
provide for the confidentiality and integrity of user passwords or the remote session.
Removing the ypserv package decreases the risk of the accidental (or intentional)
activation of NIS or NIS+ services. References:Â
SV-86593r1_rule, 2.2.16, CCI-000381, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(8), CM-7(a), SRG-OS-000095-GPOS-00049
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_remove telnet-server
#
function package_remove {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_remove 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if rpm -q --quiet "$package"; then
dnf remove -y "$package"
fi
elif which yum ; then
if rpm -q --quiet "$package"; then
yum remove -y "$package"
fi
elif which apt-get ; then
apt-get remove -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_remove ypserv
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Ensure ypserv is removed
package:
name="{{item}}"
state=absent
with_items:
- ypserv
tags:
- package_ypserv_removed
- high_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27399-5
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7(a)
- DISA-STIG-RHEL-07-020010
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
include remove_ypserv
class remove_ypserv {
package { 'ypserv':
ensure => 'purged',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
package --remove=ypserv
|
TFTP Server
  [ref]groupTFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found. |
| contains 1 rule |
Disable tftp Service
  [ref]ruleThe tftp service should be disabled.
The tftp service can be disabled with the following command:
$ sudo systemctl disable tftp.service Rationale:Disabling the tftp service ensures the system is not acting
as a TFTP server, which does not provide encryption or authentication. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable tftp
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service tftp
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- tftp
tags:
- service_tftp_disabled
- medium_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80212-4
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
|
Xinetd
  [ref]groupThe xinetd service acts as a dedicated listener for some
network services (mostly, obsolete ones) and can be used to provide access
controls and perform some logging. It has been largely obsoleted by other
features, and it is not installed by default. The older Inetd service
is not even available as part of Red Hat Enterprise Linux 7. |
| contains 2 rules |
Disable xinetd Service
  [ref]rule
The xinetd service can be disabled with the following command:
$ sudo systemctl disable xinetd.service
Rationale:The xinetd service provides a dedicated listener service for some programs,
which is no longer necessary for commonly-used network services. Disabling
it ensures that these uncommon services are not running, and also prevents
attacks against xinetd itself. References:Â
2.1.7, 3.4.7, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), AC-17(8), CM-7
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable xinetd
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service xinetd
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- xinetd
tags:
- service_xinetd_disabled
- medium_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27443-1
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
- NIST-800-171-3.4.7
|
Install tcp_wrappers Package
  [ref]ruleWhen network services are using the xinetd service, the
tcp_wrappers package should be installed.
The tcp_wrappers package can be installed with the following command:
$ sudo yum install tcp_wrappers Rationale:Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | enable |
|---|
# Function to install packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_install aide
#
function package_install {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_install 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if ! rpm -q --quiet "$package"; then
dnf install -y "$package"
fi
elif which yum ; then
if ! rpm -q --quiet "$package"; then
yum install -y "$package"
fi
elif which apt-get ; then
apt-get install -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_install tcp_wrappers
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | enable |
|---|
- name: Ensure tcp_wrappers is installed
package:
name="{{item}}"
state=present
with_items:
- tcp_wrappers
tags:
- package_tcp_wrappers_installed
- medium_severity
- enable_strategy
- low_complexity
- low_disruption
- CCE-27361-5
- NIST-800-53-CM-6(b)
- DISA-STIG-RHEL-07-TBD
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | enable |
|---|
include install_tcp_wrappers
class install_tcp_wrappers {
package { 'tcp_wrappers':
ensure => 'installed',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | enable |
|---|
package --add=tcp_wrappers
|
Chat/Messaging Services
  [ref]groupThe talk software makes it possible for users to send and receive messages
across systems through a terminal session. |
| contains 2 rules |
Uninstall talk Package
  [ref]ruleThe talk package contains the client program for the
Internet talk protocol, which allows the user to chat with other users on
different systems. Talk is a communication program which copies lines from one
terminal to the terminal of another user.
The talk package can be removed with the following command:
$ sudo yum erase talk Rationale:The talk software presents a security risk as it uses unencrypted protocols
for communications. Removing the talk package decreases the
risk of the accidental (or intentional) activation of talk client program. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_remove telnet-server
#
function package_remove {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_remove 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if rpm -q --quiet "$package"; then
dnf remove -y "$package"
fi
elif which yum ; then
if rpm -q --quiet "$package"; then
yum remove -y "$package"
fi
elif which apt-get ; then
apt-get remove -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_remove talk
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Ensure talk is removed
package:
name="{{item}}"
state=absent
with_items:
- talk
tags:
- package_talk_removed
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27432-4
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
include remove_talk
class remove_talk {
package { 'talk':
ensure => 'purged',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
package --remove=talk
|
Uninstall talk-server Package
  [ref]rule
The talk-server package can be removed with the following command:
$ sudo yum erase talk-server
Rationale:The talk software presents a security risk as it uses unencrypted protocols
for communications. Removing the talk-server package decreases the
risk of the accidental (or intentional) activation of talk services. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_remove telnet-server
#
function package_remove {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_remove 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if rpm -q --quiet "$package"; then
dnf remove -y "$package"
fi
elif which yum ; then
if rpm -q --quiet "$package"; then
yum remove -y "$package"
fi
elif which apt-get ; then
apt-get remove -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_remove talk-server
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Ensure talk-server is removed
package:
name="{{item}}"
state=absent
with_items:
- talk-server
tags:
- package_talk-server_removed
- medium_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-27210-4
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
include remove_talk-server
class remove_talk-server {
package { 'talk-server':
ensure => 'purged',
}
}
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
package --remove=talk-server
|
FTP Server
  [ref]groupFTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
However, there are some FTP server configurations which may
be appropriate for some environments, particularly those which
allow only read-only anonymous access as a means of downloading
data available to the public. |
| contains 1 rule |
Disable vsftpd if Possible
  [ref]groupTo minimize attack surface, disable vsftpd if at all
possible. |
| contains 1 rule |
Disable vsftpd Service
  [ref]rule
The vsftpd service can be disabled with the following command:
$ sudo systemctl disable vsftpd.service
Rationale:Running FTP server software provides a network-based avenue
of attack, and should be disabled if not needed.
Furthermore, the FTP protocol is unencrypted and creates
a risk of compromising sensitive information. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable vsftpd
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service vsftpd
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- vsftpd
tags:
- service_vsftpd_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80244-7
- NIST-800-53-CM-7
|
SNMP Server
  [ref]groupThe Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string. |
| contains 1 rule |
Disable SNMP Server if Possible
  [ref]groupThe system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed. |
| contains 1 rule |
Disable snmpd Service
  [ref]rule
The snmpd service can be disabled with the following command:
$ sudo systemctl disable snmpd.service
Rationale:Running SNMP software provides a network-based avenue of attack, and
should be disabled if not needed. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable snmpd
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service snmpd
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- snmpd
tags:
- service_snmpd_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80274-4
|
Cron and At Daemons
  [ref]groupThe cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively. |
| contains 1 rule |
Enable cron Service
  [ref]ruleThe crond service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
The crond service can be enabled with the following command:
$ sudo systemctl enable crond.service Rationale:Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | enable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command enable crond
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | enable |
|---|
- name: Enable service crond
service:
name="{{item}}"
enabled="yes"
state="started"
with_items:
- crond
tags:
- service_crond_enabled
- medium_severity
- enable_strategy
- low_complexity
- low_disruption
- CCE-27323-5
- NIST-800-53-CM-7
|
X Window System
  [ref]groupThe X Window System implementation included with the
system is called X.org. |
| contains 1 rule |
Disable X Windows
  [ref]groupUnless there is a mission-critical reason for the
system to run a graphical user interface, ensure X is not set to start
automatically at boot and remove the X Windows software packages.
There is usually no reason to run X Windows
on a dedicated server system, as it increases the system's attack surface and consumes
system resources. Administrators of server systems should instead login via
SSH or on the text console. |
| contains 1 rule |
Remove the X Windows Package Group
  [ref]ruleBy removing the xorg-x11-server-common package, the system no longer has X Windows
installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a graphical.target
mode. To do so, run the following command:
$ sudo yum groupremove "X Window System"
$ sudo yum remove xorg-x11-server-common Rationale:Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
vulnerabilities and should not be installed unless approved and documented. |
DNS Server
  [ref]groupMost organizations have an operational need to run at
least one nameserver. However, there are many common attacks
involving DNS server software, and this server software should
be disabled on any system
on which it is not needed. |
| contains 1 rule |
Disable DNS Server
  [ref]groupDNS software should be disabled on any systems which does not
need to be a nameserver. Note that the BIND DNS server software is
not installed on Red Hat Enterprise Linux 7 by default. The remainder of this section
discusses secure configuration of systems which must be
nameservers. |
| contains 1 rule |
Disable DNS Server
  [ref]rule
The named service can be disabled with the following command:
$ sudo systemctl disable named.service
Rationale:All network services involve some risk of compromise due to
implementation flaws and should be disabled if possible. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable named
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service named
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- named
tags:
- service_named_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80325-4
- NIST-800-53-CM-7
|
LDAP
  [ref]groupLDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
Red Hat Enterprise Linux 7 includes software that enables a system to act as both
an LDAP client and server. |
| contains 1 rule |
Configure OpenLDAP Server
  [ref]groupThis section details some security-relevant settings
for an OpenLDAP server. Installation and configuration of OpenLDAP on Red Hat Enterprise Linux 7 is available at:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html. |
| contains 1 rule |
Uninstall openldap-servers Package
  [ref]ruleThe openldap-servers package should be removed if not in use.
Is this system the OpenLDAP server? If not, remove the package.
$ sudo yum erase openldap-servers
The openldap-servers RPM is not installed by default on Red Hat Enterprise Linux 7
system. It is needed only by the OpenLDAP server, not by the
clients which use LDAP for authentication. If the system is not
intended for use as an LDAP Server it should be removed.Rationale:Unnecessary packages should not be installed to decrease the attack
surface of the system. While this software is clearly essential on an LDAP
server, it is not necessary on typical desktop or workstation systems. |
DHCP
  [ref]groupThe Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
This guide recommends configuring networking on clients by manually editing
the appropriate files under /etc/sysconfig. Use of DHCP can make client
systems vulnerable to compromise by rogue DHCP servers, and should be avoided
unless necessary. If using DHCP is necessary, however, there are best practices
that should be followed to minimize security risk. |
| contains 1 rule |
Disable DHCP Server
  [ref]groupThe DHCP server dhcpd is not installed or activated by
default. If the software was installed and activated, but the
system does not need to act as a DHCP server, it should be disabled
and removed. |
| contains 1 rule |
Disable DHCP Service
  [ref]ruleThe dhcpd service should be disabled on
any system that does not need to act as a DHCP server.
The dhcpd service can be disabled with the following command:
$ sudo systemctl disable dhcpd.service Rationale:Unmanaged or unintentionally activated DHCP servers may provide faulty information
to clients, interfering with the operation of a legitimate site
DHCP server if there is one. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable dhcpd
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service dhcpd
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- dhcpd
tags:
- service_dhcpd_disabled
- medium_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80330-4
- NIST-800-53-CM-7
|
Samba(SMB) Microsoft Windows File Sharing Server
  [ref]groupWhen properly configured, the Samba service allows
Linux systems to provide file and print sharing to Microsoft
Windows systems. There are two software packages that provide
Samba support. The first, samba-client, provides a series of
command line tools that enable a client system to access Samba
shares. The second, simply labeled samba, provides the Samba
service. It is this second package that allows a Linux system to
act as an Active Directory server, a domain controller, or as a
domain member. Only the samba-client package is installed by
default. |
| contains 1 rule |
Disable Samba if Possible
  [ref]groupEven after the Samba server package has been installed, it
will remain disabled. Do not enable this service unless it is
absolutely necessary to provide Microsoft Windows file and print
sharing functionality. |
| contains 1 rule |
Disable Samba
  [ref]rule
The smb service can be disabled with the following command:
$ sudo systemctl disable smb.service
Rationale:Running a Samba server provides a network-based avenue of attack, and
should be disabled if not needed. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable smb
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service smb
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- smb
tags:
- service_smb_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80277-7
|
Web Server
  [ref]groupThe web server is responsible for providing access to
content via the HTTP protocol. Web servers represent a significant
security risk because:
- The HTTP port is commonly probed by malicious sources
- Web server software is very complex, and includes a long
history of vulnerabilities
- The HTTP protocol is unencrypted and vulnerable to passive
monitoring
The system's default web server software is Apache 2 and is
provided in the RPM package httpd. |
| contains 1 rule |
Disable Apache if Possible
  [ref]groupIf Apache was installed and activated, but the system
does not need to act as a web server, then it should be disabled
and removed from the system. |
| contains 1 rule |
Disable httpd Service
  [ref]rule
The httpd service can be disabled with the following command:
$ sudo systemctl disable httpd.service
Rationale:Running web server software provides a network-based avenue
of attack, and should be disabled if not needed. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable httpd
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service httpd
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- httpd
tags:
- service_httpd_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80300-7
- NIST-800-53-CM-7
|
Network Time Protocol
  [ref]groupThe Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of systems, and that their time is consistent with the
outside world.
If every system on a network reliably reports the same time, then it is much
easier to correlate log messages in case of an attack. In addition, a number of
cryptographic protocols (such as Kerberos) use timestamps to prevent certain
types of attacks. If your network does not have synchronized time, these
protocols may be unreliable or even unusable.
Depending on the specifics of the network, global time accuracy may be just as
important as local synchronization, or not very important at all. If your
network is connected to the Internet, using a public timeserver (or one
provided by your enterprise) provides globally accurate timestamps which may be
essential in investigating or responding to an attack which originated outside
of your network.
A typical network setup involves a small number of internal systems operating
as NTP servers, and the remainder obtaining time information from those
internal servers.
There is a choice between the daemons ntpd and chronyd, which
are available from the repositories in the ntp and chrony
packages respectively.
The default chronyd daemon can work well when external time references
are only intermittently accesible, can perform well even when the network is
congested for longer periods of time, can usually synchronize the clock faster
and with better time accuracy, and quickly adapts to sudden changes in the rate
of the clock, for example, due to changes in the temperature of the crystal
oscillator. Chronyd should be considered for all systems which are
frequently suspended or otherwise intermittently disconnected and reconnected
to a network. Mobile and virtual systems for example.
The ntpd NTP daemon fully supports NTP protocol version 4 (RFC 5905),
including broadcast, multicast, manycast clients and servers, and the orphan
mode. It also supports extra authentication schemes based on public-key
cryptography (RFC 5906). The NTP daemon (ntpd) should be considered
for systems which are normally kept permanently on. Systems which are required
to use broadcast or multicast IP, or to perform authentication of packets with
the Autokey protocol, should consider using ntpd.
Refer to https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html for more detailed comparison of features of chronyd
and ntpd daemon features respectively, and for further guidance how to
choose between the two NTP daemons.
The upstream manual pages at http://chrony.tuxfamily.org/manual.html for
chronyd and http://www.ntp.org for ntpd provide additional
information on the capabilities and configuration of each of the NTP daemons. |
| contains 1 rule |
Enable the NTP Daemon
  [ref]rule
The chronyd service can be enabled with the following command:
$ sudo systemctl enable chronyd.service
Note: The chronyd daemon is enabled by default.
The ntpd service can be enabled with the following command:
$ sudo systemctl enable ntpd.service
Note: The ntpd daemon is not enabled by default. Though as mentioned
in the previous sections in certain environments the ntpd daemon might
be preferred to be used rather than the chronyd one. Refer to:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html
for guidance which NTP daemon to choose depending on the environment used.Rationale:Enabling some of chronyd or ntpd services ensures
that the NTP daemon will be running and that the system will synchronize its
time to any servers specified. This is important whether the system is
configured to be a client (and synchronize only its own clock) or it is also
acting as an NTP server to other systems. Synchronizing time is essential for
authentication services such as Kerberos, but it is also important for
maintaining accurate logs and auditing possible security breaches.
The chronyd and ntpd NTP daemons offer all of the
functionality of ntpdate, which is now deprecated. Additional
information on this is available at
http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate Remediation Shell script:Â Â Â (show)
if ! `rpm -q --quiet chrony` && ! `rpm -q --quiet ntp-`; then
# Function to install packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
# package_install aide
#
function package_install {
# Load function arguments into local variables
local package="$1"
# Check sanity of the input
if [ $# -ne "1" ]
then
echo "Usage: package_install 'package_name'"
echo "Aborting."
exit 1
fi
if which dnf ; then
if ! rpm -q --quiet "$package"; then
dnf install -y "$package"
fi
elif which yum ; then
if ! rpm -q --quiet "$package"; then
yum install -y "$package"
fi
elif which apt-get ; then
apt-get install -y "$package"
else
echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
echo "Aborting."
exit 1
fi
}
package_install chrony
service_command enable chronyd
elif `rpm -q --quiet chrony`; then
if ! [ `/usr/sbin/pidof ntpd` ] ; then
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command enable chronyd
fi
else
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command enable ntpd
fi
|
Base Services
  [ref]groupThis section addresses the base services that are installed on a
Red Hat Enterprise Linux 7 default installation which are not covered in other
sections. Some of these services listen on the network and
should be treated with particular discretion. Other services are local
system utilities that may or may not be extraneous. In general, system services
should be disabled if not required. |
| contains 1 rule |
Disable Red Hat Network Service (rhnsd)
  [ref]ruleThe Red Hat Network service automatically queries Red Hat Network
servers to determine whether there are any actions that should be executed,
such as package updates. This only occurs if the system was registered to an
RHN server or satellite and managed as such.
The rhnsd service can be disabled with the following command:
$ sudo systemctl disable rhnsd.service Rationale:Although systems management and patching is extremely important to
system security, management by a system outside the enterprise enclave is not
desirable for some environments. However, if the system is being managed by RHN or
RHN Satellite Server the rhnsd daemon can remain on. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable rhnsd
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service rhnsd
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- rhnsd
tags:
- service_rhnsd_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80269-4
- NIST-800-53-AC-17(8)
- NIST-800-53-CM-7
|
Proxy Server
  [ref]groupA proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the system acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name. |
| contains 1 rule |
Disable Squid if Possible
  [ref]groupIf Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed. |
| contains 1 rule |
Disable Squid
  [ref]rule
The squid service can be disabled with the following command:
$ sudo systemctl disable squid.service
Rationale:Running proxy server software provides a network-based avenue
of attack, and should be removed if not needed. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if [ "x$xinetd" != x ] ; then
grep -qi disable /etc/xinetd.d/$xinetd && \
if [ "$service_operation" = 'disable' ] ; then
sed -i "s/disable.*/disable = no/gI" /etc/xinetd.d/$xinetd
else
sed -i "s/disable.*/disable = yes/gI" /etc/xinetd.d/$xinetd
fi
fi
}
service_command disable squid
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
- name: Disable service squid
service:
name="{{item}}"
enabled="no"
state="stopped"
register: service_result
failed_when: "service_result|failed and ('Could not find the requested service' not in service_result.msg)"
with_items:
- squid
tags:
- service_squid_disabled
- unknown_severity
- disable_strategy
- low_complexity
- low_disruption
- CCE-80285-0
|
Mail Server Software
  [ref]groupMail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that systems are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
The alternatives program in Red Hat Enterprise Linux permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, http://www.postfix.org. |
| contains 1 rule |
Configure SMTP For Mail Clients
  [ref]groupThis section discusses settings for Postfix in a submission-only
e-mail configuration. |
| contains 1 rule |
Disable Postfix Network Listening
  [ref]ruleEdit the file /etc/postfix/main.cf to ensure that only the following
inet_interfaces line appears:
inet_interfaces = localhost Rationale:This ensures postfix accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack. |
IMAP and POP3 Server
  [ref]groupDovecot provides IMAP and POP3 services. It is not
installed by default. The project page at http://www.dovecot.org
contains more detailed information about Dovecot
configuration. |
| contains 1 rule |
Disable Dovecot
  [ref]groupIf the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed. |
| contains 1 rule |
Disable Dovecot Service
  [ref]rule
The dovecot service can be disabled with the following command:
$ sudo systemctl disable dovecot.service
Rationale:Running an IMAP or POP3 server provides a network-based
avenue of attack, and should be disabled if not needed. Remediation Shell script:Â Â Â (show)
| Complexity: | low |
|---|
| Disruption: | low |
|---|
| Strategy: | disable |
|---|
# Function to enable/disable and start/stop services on RHEL and Fedora systems.
#
# Example Call(s):
#
# service_command enable bluetooth
# service_command disable bluetooth.service
#
# Using xinetd:
# service_command disable rsh.socket xinetd=rsh
#
function service_command {
# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)
# Check sanity of the input
if [ $# -lt "2" ]
then
echo "Usage: service_command 'enable/disable' 'service_name.service'"
echo
echo "To enable or disable xinetd services add \'xinetd=service_name\'"
echo "as the last argument"
echo "Aborting."
exit 1
fi
# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
service_util="/usr/bin/systemctl"
else
service_util="/sbin/service"
chkconfig_util="/sbin/chkconfig"
fi
# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
service_state="enable"
service_operation="start"
chkconfig_state="on"
else
service_state="disable"
service_operation="stop"
chkconfig_state="off"
fi
# If chkconfig_util is not empty, use chkconfig/service commands.
if [ "x$chkconfig_util" != x ] ; then
$service_util $service $service_operation
$chkconfig_util --level 0123456 $service $chkconfig_state
else
$service_util $service_operation $service
$service_util $service_state $service
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
$service_util reset-failed $service
fi
# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinet
|