Free DISA STIG and SRG Library | Vaulted

HP-UX 11.31 Security Technical Implementation Guide

Version 1 Release 13
2016-10-28
U_HPUX_11-31_V1R13_STIG_SCAP_1-1_Benchmark-xccdf.xml
The HP-UX 11.31 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Vulnerabilities (260)

The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, console login prompts.

Finding ID
GEN000400
Rule ID
SV-38444r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000400
CCI
CCI-000048
Target Key
(None)
Documentable
No
Discussion

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.

Fix Text

Edit /etc/issue and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."

Check Content

Responsibility

System Administrator

IA Controls

ECWM-1

The system must disable accounts after three consecutive unsuccessful login attempts.

Finding ID
GEN000460
Rule ID
SV-38445r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000460
CCI
CCI-000044
Target Key
(None)
Documentable
No
Discussion

Disabling accounts after a limited number of unsuccessful login attempts improves protection against password guessing attacks.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /tcb/files/auth/system/default file and update the u_maxtries attribute. See the below example: :u_maxtries#3: If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute. See the below example: AUTH_MAXTRIES=2 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

ECLO-1, ECLO-2

The delay between login prompts following a failed login attempt must be at least 4 seconds.

Finding ID
GEN000480
Rule ID
SV-38446r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000480
CCI
CCI-002238
Target Key
(None)
Documentable
No
Discussion

Enforcing a delay between consecutive failed login attempts increases protection against automated password guessing attacks.

Fix Text

For Trusted Mode: Use the SAM/SMH interface to ensure that the t_logdelay setting is 4. For SMSE: There is no fix, however, there are attack mitigations to minimize risk (see mitigations).

Check Content

Responsibility

System Administrator

Mitigations

GEN000480

Mitigation Control

Attack mitigations to minimize risk: 1. Ensure that the “nodelay” parameter is not found in the /etc/pam.conf file. 2. In the file /opt/ssh/etc/sshd_config, the “MaxAuthTries” attribute must be explicitly set to “1”. This attribute controls the maximum number of authentication attempts permitted per SSH daemon connection. 3. In the file /opt/ssh/etc/sshd_config, the “MaxStartups” attribute must be explicitly set to an organization defined value of “10” (the default) or less. This attribute controls the maximum number of unauthenticated connections to the SSH daemon. 4. IPFilter DCA mode is disabled by default, and must be explicitly enabled. Set the following attribute in the /etc/rc.config.d/ipfconf file: DCA_START=1 The below /etc/opt/ipf/ipf.conf file rule specifies a connection limit of “<limit>“ for all hosts when attempting to connect to port “<sshd port>“. The “<sshd port>“ and “<limit>“ must be set to organization defined values. Per vendor documentation, this rule must be the next-to-last rule in /etc/opt/ipf/ipf.conf. The final rule in the file must define the default connection limit. See the below example for the last 2 line entries in /etc/opt/ipf/ipf.conf (note that the double quotes are for emphasis only): “pass in proto tcp from any to any port = <sshd port> keep limit <limit>“ “block in from any to any” Save the file before exiting the editor. The system should not require restarting for the new rule(s) to take effect.

The system must not have accounts configured with blank or null passwords.

Finding ID
GEN000560
Rule ID
SV-38448r2_rule
Severity
Cat I
CCE
(None)
Group Title
GEN000560
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. If the root user is configured without a password, the entire system may be compromised. For user accounts not using password authentication, the account must be configured with a password lock value instead of a blank or null value.

Fix Text

For Trusted Mode: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to disable null passwords and immediately expire the password for any account with a null password, forcing the user to create a password on the very next login. Alternatively, the account may also be disabled. Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Verify that SAM/SMH has now disabled null passwords for all accounts. # grep “:u_nullpw@:” /tcb/files/auth/[a-z,A-Z] For SMSE: Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute(s). See the below example: LOGIN_POLICY_STRICT=1 ALLOW_NULL_PASSWORD=0 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor. Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to immediately expire the password for any account with a null password, forcing the user to create a password on the very next login. Alternatively, the account may also be disabled.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The root account must be the only account having an UID of 0.

Finding ID
GEN000880
Rule ID
SV-38449r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000880
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If an account has an UID of 0, it has root authority. Multiple accounts with an UID of 0 afford more opportunity for potential intruders to compromise a privileged account.

Fix Text

Remove or change the UID of accounts other than root that have UID 0.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The root user's home directory must not be the root directory (/).

Finding ID
GEN000900
Rule ID
SV-34829r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN000900
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Changing the root home directory to something other than / and assigning it a 0700 protection makes it more difficult for intruders to manipulate the system by reading the files root places in its default directory. It also gives root the same discretionary access control for root's home directory as for the other plain user home directories.

Fix Text

The root home directory should be something other than / (such as /roothome). # mkdir /rootdir # chown root /rootdir # chgrp root /rootdir # chmod 700 /rootdir # cp -r /.??* /rootdir/. Edit the passwd file and change the root home directory to /rootdir. The cp -r /.??* command copies all files and subdirectories of file names that begin with "." into the new root directory, which preserves the previous root environment. Ensure you are in the "/" directory when executing the "cp" command.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The root account's home directory (other than /) must have mode 0700.

Finding ID
GEN000920
Rule ID
SV-38450r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000920
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Permissions greater than 0700 could allow unauthorized users access to the root home directory.

Fix Text

The root home directory will have permissions of 0700. Do not change the protections of the / directory. Use the following command to change protections for the root home directory: # chmod 0700 /rootdir.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The root accounts executable search path must contain only authorized paths.

Finding ID
GEN000940
Rule ID
SV-38451r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000940
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Entries starting with a slash (/) are absolute paths.

Fix Text

Edit the root user's local initialization files and remove any relative path entries that have not been documented with the ISSO. Edit the root user’s local initialization files and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

The root account must not have world-writable directories in its executable search path.

Finding ID
GEN000960
Rule ID
SV-38452r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000960
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If the root search path contains a world-writable directory, malicious software could be placed in the path by intruders and/or malicious users and inadvertently run by root with all of root's privileges.

Fix Text

For each world-writable path in root's executable search path, do one of the following: 1. Remove the world-writable permission on the directory. Procedure: # chmod o-w <path> 2. Remove the world-writable directory from the executable search path. Procedure: Identify and edit the initialization file referencing the world-writable directory and remove it from the PATH variable.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The system must prevent the root account from directly logging in except from the system console.

Finding ID
GEN000980
Rule ID
SV-38453r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000980
CCI
CCI-000770
Target Key
(None)
Documentable
No
Discussion

Limiting the root account direct logins to only system consoles protects the root account from direct unauthorized access from a non-console device.

Fix Text

If the /etc/securetty file does not exist, create the file containing only the word console and ensure correct file properties. # echo “console” > /etc/securetty

Check Content

Responsibility

System Administrator

All GIDs referenced in the /etc/passwd file must be defined in the /etc/group file.

Finding ID
GEN000380
Rule ID
SV-38455r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN000380
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If a user is assigned the GID of a group not existing on the system, and a group with that GID is subsequently created, the user may have unintended rights to the group.

Fix Text

Add a group to the system (edit /etc/group) for each GID referenced without a corresponding group.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All network services daemon files must have mode 0755 or less permissive.

Finding ID
GEN001180
Rule ID
SV-38458r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001180
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Restricting permission on daemons will protect them from unauthorized modification and possible system compromise.

Fix Text

Change the mode of the network services daemon. # chmod 0755 <path>/<daemon>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All skeleton files (typically those in /etc/skel) must have mode 0444 or less permissive.

Finding ID
GEN001800
Rule ID
SV-38459r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001800
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files.

Fix Text

Change the mode of skeleton files with incorrect mode. # chmod 0444 <skeleton file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

NIS/NIS+/yp files must be owned by root, sys, or bin.

Finding ID
GEN001320
Rule ID
SV-38460r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001320
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

NIS/NIS+/yp files are part of the system's identification and authentication processes and are, therefore, critical to system security. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the ownership of NIS/NIS+/yp files to root, sys, or bin. Consult vendor documentation to determine the location of the files. Procedure (example): # chown root <filename>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The NIS/NIS+/yp command files must have mode 0755 or less permissive.

Finding ID
GEN001360
Rule ID
SV-38462r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001360
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

NIS/NIS+/yp files are part of the system's identification and authentication processes and are, therefore, critical to system security. Unauthorized modification of these files could compromise these processes and the system.

Fix Text

Change the mode of NIS/NIS+/yp command files to 0755 or less permissive. Procedure (example): # chmod 0755 <filename>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All system files, programs, and directories must be owned by a system account.

Finding ID
GEN001220
Rule ID
SV-38466r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001220
CCI
CCI-001499
Target Key
(None)
Documentable
No
Discussion

Restricting permissions will protect the files from unauthorized modification.

Fix Text

Change the owner of system files, programs, and directories to a system account. Procedure: # chown root <path>/<system file> (A different system user may be used in place of root.)

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

System files, programs, and directories must be group-owned by a system group.

Finding ID
GEN001240
Rule ID
SV-38467r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001240
CCI
CCI-001499
Target Key
(None)
Documentable
No
Discussion

Restricting permissions will protect the files from unauthorized modification.

Fix Text

Change the group owner of system files to a system group. Procedure: # chgrp root <path>/<system file> (System groups other than root may be used.)

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/shadow (or equivalent) file must be owned by root.

Finding ID
GEN001400
Rule ID
SV-38468r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001400
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

For Trusted Mode: # chown root /tcb # chown root /tcb/files /tcb/files/auth # chown root /tcb/files/auth/[a-z]/* For SMSE: # chown root /etc/shadow

Check Content

Responsibility

System Administrator

The /etc/passwd file must have mode 0444 or less permissive.

Finding ID
GEN001380
Rule ID
SV-38469r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001380
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the passwd file is writable by a group owner or the world, the risk of passwd file compromise is increased. The passwd file contains the list of accounts on the system and associated information.

Fix Text

Change the mode of the passwd file to 0444. # chmod 0444 /etc/passwd Document all changes.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/shadow (or equivalent) file must have mode 0400.

Finding ID
GEN001420
Rule ID
SV-38470r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001420
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. The file also contains password hashes which must not be accessible to users other than root. The Trusted Mode /tcb tree requires modes more permissive than the shadow file.

Fix Text

For Trusted Mode: # chmod 0555 /tcb # chmod 0771 /tcb/files /tcb/files/auth # chmod 0664 /tcb/files/auth/[a-z]/* For SMSE: # chmod 0400 /etc/shadow

Check Content

Responsibility

System Administrator

The system and user default umask must be 077.

Finding ID
GEN002560
Rule ID
SV-38475r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002560
CCI
CCI-000366
Target Key
(None)
Documentable
Yes
Discussion

The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a 4-digit number, the first digit representing special access modes is typically ignored or required to be 0. This requirement applies to the globally configured system defaults and the user defaults for each account on the system.

Fix Text

Edit local and global initialization files containing umask and change them to use 077 instead of the current value.

Check Content

Security Override Guidance

If the default umask is 000 or does not restrict the world-writable permission, this becomes a CAT I finding.

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

Default system accounts must be disabled or removed.

Finding ID
GEN002640
Rule ID
SV-27264r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002640
CCI
CCI-000178
Target Key
(None)
Documentable
No
Discussion

Vendor accounts and software may contain backdoors that will allow unauthorized access to the system. These backdoors are common knowledge and present a threat to system security if the account is not disabled.

Fix Text

For Trusted Mode and SMSE: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to lock/disable or remove any enabled default system accounts.

Check Content

Responsibility

System Administrator

IA Controls

IAAC-1

The audit system must be configured to audit failed attempts to access files and programs.

Finding ID
GEN002720
Rule ID
SV-38479r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002720
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e open to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The audit system must be configured to audit file deletions.

Finding ID
GEN002740
Rule ID
SV-38480r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002740
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e delete to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The audit system must be configured to audit all administrative, privileged, and security actions.

Finding ID
GEN002760
Rule ID
SV-38481r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002760
CCI
CCI-000347
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e admin and -e removable to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The audit system must be configured to audit login, logout, and session initiation.

Finding ID
GEN002800
Rule ID
SV-38482r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002800
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e login to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The audit system must be configured to audit all discretionary access control permission modifications.

Finding ID
GEN002820
Rule ID
SV-38483r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002820
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e moddac to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be owned by root or bin.

Finding ID
GEN003720
Rule ID
SV-35067r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003720
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give ownership of sensitive files or utilities to root provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the ownership of the inetd.conf file to root or bin. # chown root <file or directory>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The inetd.conf and xinetd.conf files must have mode 0440 or less permissive.

Finding ID
GEN003740
Rule ID
SV-35072r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003740
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The Internet service daemon configuration files must be protected as malicious modification could cause Denial of Service or increase the attack surface of the system.

Fix Text

Change the mode of the (x)inetd.conf file. # chmod 0440 <file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The services file must be owned by root or bin.

Finding ID
GEN003760
Rule ID
SV-35077r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003760
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the ownership of the services file to root or bin. # chown root /etc/services

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The services file must have mode 0444 or less permissive.

Finding ID
GEN003780
Rule ID
SV-35078r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003780
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The services file is critical to the proper operation of network services and must be protected from unauthorized modification. Unauthorized modification could result in the failure of network services.

Fix Text

Change the mode of the services file to 0444 or less permissive. # chmod 0444 /etc/services

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Global initialization files must contain the mesg -n or mesg n commands.

Finding ID
GEN001780
Rule ID
SV-38484r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN001780
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If the mesg -n or mesg n command is not placed into the system profile, messaging can be used to cause a Denial of Service attack.

Fix Text

Edit /etc/profile or another global initialization script, and add the mesg -n command.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The hosts.lpd file (or equivalent) must not contain a "+" character.

Finding ID
GEN003900
Rule ID
SV-35140r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003900
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Having the "+" character in the hosts.lpd (or equivalent) file allows all hosts to use local system print resources.

Fix Text

Remove the "+" entries from the hosts.lpd (or equivalent) file.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The hosts.lpd (or equivalent) file must be owned by root, bin, sys, or lp.

Finding ID
GEN003920
Rule ID
SV-35143r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003920
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give ownership of the hosts.lpd file to root, bin, sys, or lp provides the designated owner, and possible unauthorized users, with the potential to modify the hosts.lpd file. Unauthorized modifications could disrupt access to local printers from authorized remote hosts or permit unauthorized remote access to local printers.

Fix Text

Change the owner of the /etc/hosts.lpd file (or equivalent) to root, lp, or another privileged UID. # chown root <print service configuration file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The hosts.lpd (or equivalent) must have mode 0644 or less permissive.

Finding ID
GEN003940
Rule ID
SV-35148r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003940
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Excessive permissions on the hosts.lpd (or equivalent) file may permit unauthorized modification. Unauthorized modifications could disrupt access to local printers from authorized remote hosts or permit unauthorized remote access to local printers.

Fix Text

Change the mode of the /etc/hosts.lpd file (or equivalent) to 0644 or less permissive. Procedure: # chmod 0644 <print service configuration file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The alias file must be owned by root.

Finding ID
GEN004360
Rule ID
SV-35161r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004360
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the aliases file is not owned by root, an unauthorized user may modify the file to add aliases to run malicious code or redirect e-mail.

Fix Text

Change the owner of the /etc/mail/aliases file (or equivalent) to root. # chown root /etc/mail/aliases

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The alias file must have mode 0644 or less permissive.

Finding ID
GEN004380
Rule ID
SV-35165r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004380
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Excessive permissions on the aliases file may permit unauthorized modification. If the alias file is modified by an unauthorized user, they may modify the file to run malicious code or redirect e-mail.

Fix Text

Change the mode of the aliases file (or equivalent) to 0644. # chmod 0644 /etc/mail/aliases

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Files executed through a mail aliases file must be owned by root and must reside within a directory owned and writable only by root.

Finding ID
GEN004400
Rule ID
SV-35169r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN004400
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If a file executed through a mail aliases file is not owned and writable only by root, it may be subject to unauthorized modification. Unauthorized modification of files executed through aliases may allow unauthorized users to attain root privileges.

Fix Text

Edit the /etc/mail/aliases file Locate the entries executing a program. They will appear similar to the following line: alias: "|/usr/local/bin/ls" (or some other program name) Ensure root owns the programs and the directory(ies) they reside in by using the chown command to change owner to root. For a directory entry: # chown root <entry> For a file entry (change BOTH the directory and file, where/as necessary: # chown root <entry> # chown root `dirname <entry>`

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Files executed through a mail aliases file must have mode 0755 or less permissive.

Finding ID
GEN004420
Rule ID
SV-35043r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004420
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If a file executed through a mail alias file has permissions greater than 0755, it can be modified by an unauthorized user and may contain malicious code or instructions possibly compromising the system.

Fix Text

Use the chmod command to change the access permissions for files executed from the aliases file. For example: # chmod 0755 <path/file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Sendmail logging must not be set to less than 9 in the sendmail.cf file.

Finding ID
GEN004440
Rule ID
SV-35047r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN004440
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If Sendmail is not configured to log at level 9, system logs may not contain the information necessary for tracking unauthorized use of the sendmail service.

Fix Text

Edit the sendmail.cf file, locate the entry (and where necessary uncomment it and/or create it) and modify/set it to 9.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The system syslog service must log informational and more severe SMTP service messages.

Finding ID
GEN004460
Rule ID
SV-35051r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004460
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.

Fix Text

Edit the syslog.conf file and add a configuration line specifying an appropriate destination for critical "mail" syslogs, for example: mail.crit /var/adm/messages mail.* /var/adm/messages *.* /var/adm/messages *.crit /var/adm/messages

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SMTP service log file must be owned by root.

Finding ID
GEN004480
Rule ID
SV-35053r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004480
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the SMTP service log file is not owned by root, then unauthorized personnel may modify or delete the file to hide a system compromise.

Fix Text

Change the ownership of the sendmail log file. # chown root <sendmail log file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SMTP service log file must have mode 0644 or less permissive.

Finding ID
GEN004500
Rule ID
SV-35058r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004500
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the SMTP service log file is more permissive than 0644, unauthorized users may be allowed to change the log file.

Fix Text

Change the mode of the SMTP service log file. # chmod 0644 <sendmail log file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The ftpusers file must exist.

Finding ID
GEN004880
Rule ID
SV-35102r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004880
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The ftpusers file contains a list of accounts not allowed to use FTP to transfer files. If this file does not exist, then unauthorized accounts can utilize FTP.

Fix Text

Create a /etc/ftpd/ftpusers (or equivalent) file containing a list of /etc/passwd accounts not authorized for FTP.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The ftpusers file must be owned by root.

Finding ID
GEN004920
Rule ID
SV-38485r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004920
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the file ftpusers is not owned by root, an unauthorized user may modify the file to allow unauthorized accounts to use FTP.

Fix Text

Change the owner of the ftpusers file to root. # chown root /etc/ftpd/ftpusers

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The ftpusers file must have mode 0640 or less permissive.

Finding ID
GEN004940
Rule ID
SV-38486r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004940
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Excessive permissions on the ftpusers file could permit unauthorized modification. Unauthorized modification could result in Denial of Service to authorized FTP users or permit unauthorized users to access the FTP service.

Fix Text

Change the mode of the ftpusers file to 0640. # chmod 0640 /etc/ftpd/ftpusers

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The TFTP daemon must operate in "secure mode" which provides access only to a single directory on the host file system.

Finding ID
GEN005080
Rule ID
SV-35110r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN005080
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Secure mode limits TFTP requests to a specific directory. If TFTP is not running in secure mode, it may be able to write to any file or directory and may seriously impair system integrity, confidentiality, and availability.

Fix Text

Edit /etc/inetd.conf and add one path argument, representing the TFTP root directory, to the tftpd command.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The TFTP daemon must have mode 0755 or less permissive.

Finding ID
GEN005100
Rule ID
SV-35155r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN005100
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If TFTP runs with the setuid or setgid bit set, it may be able to write to any file or directory and may seriously impair system integrity, confidentiality, and availability.

Fix Text

Change the mode of the TFTP daemon. # chmod 0755 /usr/lbin/tftpd

Check Content

Responsibility

System Administrator

IA Controls

ECPA-1

The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user.

Finding ID
GEN005120
Rule ID
SV-35157r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005120
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If TFTP has a valid shell, it increases the likelihood that someone could logon to the TFTP account and compromise the system.

Fix Text

Create a tftp user account if none exists. Assign a non-login shell to the tftp user account, such as /usr/bin/false. Assign/create the tftp user account home directory where/as necessary. Ensure the home directory is owned by the tftp user.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The Network Information System (NIS) protocol must not be used.

Finding ID
GEN006400
Rule ID
SV-38487r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006400
CCI
CCI-001435
Target Key
(None)
Documentable
No
Discussion

Due to numerous security vulnerabilities existing within NIS, it must not be used. Possible alternative directory services are NIS+ and LDAP.

Fix Text

Disable the use of NIS. Possible replacements are NIS+ and LDAP-UX.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All interactive users must be assigned a home directory in the /etc/passwd file.

Finding ID
GEN001440
Rule ID
SV-38488r2_rule
Severity
Cat III
CCE
(None)
Group Title
GEN001440
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If users do not have a valid home directory, there is no place for the storage and control of files they own.

Fix Text

For Trusted Mode: Determine why the user is not assigned a home directory. Possible actions include: account deletion or disablement. If the account is determined to be valid, manually create the home directory if required (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) and assign to the user in the /etc/passwd file or take corrective action via the HP SMH/SAM utility. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Determine why the user is not assigned a home directory. Possible actions include: account deletion or disablement. If the account is determined to be valid, manually create the home directory if required (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) and assign to the user in the /etc/passwd file or take corrective action via the HP SMH/SAM utility. Additionally, use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the ABORT_LOGIN_ON_MISSING_HOMEDIR attribute. See the below example: ABORT_LOGIN_ON_MISSING_HOMEDIR=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All interactive user home directories defined in the /etc/passwd file must exist.

Finding ID
GEN001460
Rule ID
SV-38489r2_rule
Severity
Cat III
CCE
(None)
Group Title
GEN001460
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If a user has a home directory defined that does not exist, the user may be given the / directory, by default, as the current working directory upon logon. This could create a Denial of Service because the user would not be able to perform useful tasks in this location.

Fix Text

Determine why the user home directory does not exist. Possible actions include: account deletion or disablement. If the account is determined to be valid, create the home directory either manually (mkdir directoryname, copy the skeleton files into the directory, chown account name for the new directory and the skeleton files) or via the HP SMH/SAM utility.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All local initialization files must have mode 0740 or less permissive.

Finding ID
GEN001880
Rule ID
SV-38493r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001880
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Local initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.

Fix Text

Ensure user startup files have permissions of 0740 or more restrictive. Examine each user's home directory and verify all file names beginning with "." have access permissions of 0740 or more restrictive. If they do not, use the chmod command to correct the vulnerability. Procedure: # chmod 0740 .filename NOTE: The period is part of the file name and is required.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Run control scripts executable search paths must contain only authorized paths.

Finding ID
GEN001600
Rule ID
SV-38495r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001600
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the run control script and remove the relative path entries from the executable search path variable that are not documented with the ISSO. Edit the run control script and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

There must be no .netrc files on the system.

Finding ID
GEN002000
Rule ID
SV-38499r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002000
CCI
CCI-000196
Target Key
(None)
Documentable
No
Discussion

Unencrypted passwords for remote FTP servers may be stored in .netrc files. Policy requires passwords to be encrypted in storage and not used in access scripts.

Fix Text

Remove the .netrc file(s). Procedure: # rm .netrc

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The /etc/shells (or equivalent) file must exist.

Finding ID
GEN002120
Rule ID
SV-34952r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002120
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The shells file (or equivalent) lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized, unsecure shell.

Fix Text

Create /etc/shells file containing a list of valid system shells. Consult vendor documentation for an appropriate list of system shells. Procedure: Typical installed shells include: /sbin/sh /usr/bin/sh /usr/bin/rsh /usr/bin/ksh /usr/bin/rksh /usr/bin/csh /usr/bin/keysh # echo "/sbin/sh" >> /etc/shells (Repeat as necessary for all existing shell programs.)

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.

Finding ID
GEN002140
Rule ID
SV-34953r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002140
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The shells file lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized, unsecure shell.

Fix Text

Use the chsh utility or edit the /etc/passwd file and correct the error by changing the default shell of the account in error to an acceptable shell name contained in the /etc/shells file. Alternatively, use the HP SMH to change the /etc/passwd shell entry.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All shell files must be owned by root or bin.

Finding ID
GEN002200
Rule ID
SV-38501r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002200
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If shell files are owned by users other than root or bin, they could be modified by intruders or malicious users to perform unauthorized actions.

Fix Text

Change the ownership of any system shell not owned by root or bin: # chown root <path/shell>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All shell files must have mode 0755 or less permissive.

Finding ID
GEN002220
Rule ID
SV-38502r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN002220
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Shells with world/group-write permissions give the ability to maliciously modify the shell to obtain unauthorized access.

Fix Text

Change the mode of the shell. # chmod 0755 <shell>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Device files and directories must only be writable by users with a system account or as configured by the vendor.

Finding ID
GEN002280
Rule ID
SV-38505r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002280
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

System device files in writable directories could be modified, removed, or used by an unprivileged user to control system hardware.

Fix Text

Remove the world-writable permission from the device file(s). # chmod o-w <device file> Document all changes.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The Network File System (NFS) share configuration file must have mode 0644 or less permissive.

Finding ID
GEN005760
Rule ID
SV-35184r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN005760
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Excessive permissions on the NFS share configuration file could allow unauthorized modification of the file, which could result in Denial-of-Service to authorized NFS shares and the creation of additional unauthorized shares.

Fix Text

# chmod 0644 /etc/dfs/dfstab

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2, ECLP-1

The Network File System (NFS) anonymous UID and GID must be configured to values that have no permissions.

Finding ID
GEN005820
Rule ID
SV-35199r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005820
CCI
CCI-000062
Target Key
(None)
Documentable
No
Discussion

When an NFS server is configured to deny remote root access, a selected UID and GID are used to handle requests from the remote root user. The UID and GID should be chosen from the system to provide the appropriate level of non-privileged access.

Fix Text

Edit /etc/dfs/sharetab and set the anon=-1 option for shares without it. Re-export the file systems.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The Network File System (NFS) server must be configured to restrict file system access to local hosts.

Finding ID
GEN005840
Rule ID
SV-35201r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005840
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The NFS access option limits user access to the specified level. This assists in protecting shared file systems. If access is not restricted, unauthorized hosts may be able to access the system's NFS shares.

Fix Text

Edit /etc/dfs/dfstab and add ro and/or rw options (as appropriate) that specify a list of hosts or networks which are permitted access. Re-share the file systems via the following commands: # unshare <the file system entry that was modified> # share <the file system entry that was modified>

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The NFS server must not allow remote root access.

Finding ID
GEN005880
Rule ID
SV-35202r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005880
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the NFS server allows root access to local file systems from remote hosts, this access could be used to compromise the system.

Fix Text

Edit /etc/dfs/dfstab and remove the root= option for all shares. Re-share the file systems.

Check Content

Responsibility

System Administrator

IA Controls

EBRP-1

The nosuid option must be enabled on all NFS client mounts.

Finding ID
GEN005900
Rule ID
SV-35204r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005900
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Enabling the nosuid mount option prevents the system from granting owner or group-owner privileges to programs with the suid or sgid bit set. If the system does not restrict this access, users with unprivileged access to the local system may be able to acquire privileged access by executing suid or sgid files located on the mounted NFS file system.

Fix Text

Edit /etc/fstab and add the nosuid option for all NFS file systems. Remount the NFS file systems to make the change take effect.

Check Content

Responsibility

System Administrator

IA Controls

ECPA-1

The system must use an access control program.

Finding ID
GEN006580
Rule ID
SV-35198r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006580
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Access control programs (such as TCP_WRAPPERS) provide the ability to enhance system security posture.

Fix Text

Edit /etc/inetd.conf and use tcpd to wrap active services.

Check Content

Responsibility

System Administrator

IA Controls

EBRU-1

The system's access control program must log each system’s access attempt.

Finding ID
GEN006600
Rule ID
SV-35206r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006600
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

If access attempts are not logged, then multiple attempts to log on to the system by an unauthorized user may go undetected.

Fix Text

Configure the access restriction program to log every access attempt. Ensure the implementation instructions for TCP_WRAPPERS are followed so logging of system access attempts is logged into the system log files. If an alternate application is used, it must support this function.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-2, ECAR-3

The system must be configured to operate in a security mode.

Finding ID
GEN000000-HPUX0020
Rule ID
SV-38681r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000000-HPUX0020
CCI
CCI-000633
Target Key
(None)
Documentable
No
Discussion

When operating in standard mode, account passwords are stored in the /etc/passwd file, which is world readable. By operating in either Trusted Mode or Standard Mode with Security Extensions, the system security posture is enhanced thru the addition of a secure, non-world readable password container other than /etc/passwd.

Fix Text

SAM/SMH must be used to convert standard mode HP-UX to Trusted Mode (optional for SMSE). For Trusted Mode only: The following command may be used to “manually” convert from Standard Mode to Trusted Mode (note that its use is not vendor supported): # tsconvert -c For SMSE only: The following command may be used to “manually” create the /etc/shadow file with information from the /etc/passwd file (use of this commend is vendor supported). # pwconv Note that additional software bundles and/or patches may be required in order to completely convert a standard mode system to SMSE.

Check Content

Responsibility

System Administrator

IA Controls

DCSW-1

The HP-UX /etc/securetty must be group-owned by root, sys, or bin.

Finding ID
GEN000000-HPUX0080
Rule ID
SV-965r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000000-HPUX0080
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Root, sys, and bin are the most privileged group accounts, by default, for most UNIX systems. If a file as sensitive as /etc/securetty is not group-owned by a privileged group, it could lead to system compromise.

Fix Text

Change the group-owner of the /etc/securetty to root, bin, or sys. Example: # chgrp root /etc/securetty

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/securetty file must be owned by root.

Finding ID
GEN000000-HPUX0060
Rule ID
SV-38682r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000000-HPUX0060
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Failure to make root the owner of sensitive files and utilities may provide unauthorized owners the potential to access and/or change sensitive information or system configurations, thus weakening the overall security posture of a site.

Fix Text

Change the owner of the /etc/securetty file to root. # chown root /etc/securetty

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/securetty file must have mode 0640 or less permissive.

Finding ID
GEN000000-HPUX0100
Rule ID
SV-967r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000000-HPUX0100
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Excessive permissions on the /etc/securetty file could result in unauthorized modification of the file. Changes to the file could reduce the system's security by specifying additional terminals permitted to accept root logins, or deny service by preventing root logins on authorized terminals.

Fix Text

Change the mode of the /etc/securetty file to 0640. Example: # chmod 0640 /etc/securetty

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2, ECLP-1

Access to the cron utility must be controlled using the cron.allow and/or cron.deny file(s).

Finding ID
GEN002960
Rule ID
SV-38541r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002960
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The cron facility allows users to execute recurring jobs on a regular and unattended basis. The cron.allow file designates accounts allowed to enter and execute jobs using the cron facility. If neither cron.allow nor cron.deny exists, then any account may use the cron facility. This may open the facility up for abuse by system intruders and malicious users.

Fix Text

Create /var/adm/cron/cron.allow and/or /var/adm/cron/cron.deny with appropriate local content.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The cron.allow file must have mode 0600 or less permissive.

Finding ID
GEN002980
Rule ID
SV-38542r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002980
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

A cron.allow file, readable and/or writable by other than root, could allow potential intruders and malicious users to use the file contents to help discern information, such as who is allowed to execute cron programs, which could be harmful to overall system and network security.

Fix Text

Change the mode of the cron.allow file to 0600. Procedure: # chmod 0600 /var/adm/cron/cron.allow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Crontab files must have mode 0600 or less permissive, and files in cron script directories must have mode 0700 or less permissive.

Finding ID
GEN003080
Rule ID
SV-38545r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003080
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

To protect the integrity of scheduled system jobs and prevent malicious modification to these jobs, crontab files must be secured.

Fix Text

Change the mode of the crontab files. # chmod 0600 /var/spool/cron/crontabs/*

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Cron and crontab directories must have mode 0755 or less permissive.

Finding ID
GEN003100
Rule ID
SV-38546r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003100
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured.

Fix Text

Change the mode of crontab directories to 0755.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Cron and crontab directories must be owned by root or bin.

Finding ID
GEN003120
Rule ID
SV-38547r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003120
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Incorrect ownership of the cron or crontab directories could permit unauthorized users the ability to alter cron jobs and run automated jobs as privileged users. Failure to give ownership of cron or crontab directories to root or to bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the mode of the crontab directory. # chown root /var/spool/cron/crontabs

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Cron and crontab directories must be group-owned by root, sys, bin or other.

Finding ID
GEN003140
Rule ID
SV-38548r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003140
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured. Failure to give group-ownership of cron or crontab directories to a system group provides the designated group and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the group owner of the crontab directories to root, sys, bin or other. # chown root /var/spool/cron/crontabs

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Cron logging must be implemented.

Finding ID
GEN003160
Rule ID
SV-38549r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003160
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Fix Text

Enable cron/logging on the system via: # /sbin/init.d/cron stop # mv <current cron log> <to a new location and new name> # /sbin/init.d/cron start # more /var/adm/cron/log Cron automatically handles its own logging function and (at least) the Start Time should be visible at the beginning of the new log file /var/adm/cron/log.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The cronlog file must have mode 0600 or less permissive.

Finding ID
GEN003180
Rule ID
SV-38550r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003180
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Cron logs contain reports of scheduled system activities and must be protected from unauthorized access or manipulation.

Fix Text

Change the mode of the cron log file. # chmod 0600 /var/adm/cron/log

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1, ECTP-1

Access to the at utility must be controlled via the at.allow and/or at.deny file(s).

Finding ID
GEN003280
Rule ID
SV-35033r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003280
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The at facility selectively allows users to execute jobs at deferred times. It is usually used for one-time jobs. The at.allow file selectively allows access to the at facility. If there is no at.allow file, there is no ready documentation of who is allowed to submit at jobs.

Fix Text

Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the at facility supported by the cron daemon.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at.deny file must not be empty if it exists.

Finding ID
GEN003300
Rule ID
SV-38551r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003300
CCI
CCI-000225
Target Key
(None)
Documentable
Yes
Discussion

On some systems, if there is no at.allow file and there is an empty at.deny file, then the system assumes everyone has permission to use the at facility. This could create an insecure setting in the case of malicious users or system intruders.

Fix Text

Add appropriate users to the at.deny file, or remove the empty at.deny file if an at.allow file exists.

Check Content

Responsibility

Information Assurance Officer

IA Controls

ECLP-1

Default system accounts (with the exception of root) must not be listed in the at.allow file or must be included in the at.deny file if the at.allow file does not exist.

Finding ID
GEN003320
Rule ID
SV-38552r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003320
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Default accounts, such as bin, sys, adm, uucp, daemon, and others, should never have access to the at facility. This would create a possible vulnerability open to intruders or malicious users.

Fix Text

Remove the default accounts (such as bin, sys, adm, and others) from the at.allow file.

Check Content

Responsibility

System Administrator

IA Controls

ECPA-1

The at.allow file must have mode 0600 or less permissive.

Finding ID
GEN003340
Rule ID
SV-38553r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003340
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Permissions more permissive than 0600 (i.e. read, write and execute for the owner) may allow unauthorized or malicious access to the at.allow and/or at.deny files.

Fix Text

Change the mode of the at.allow file. # chmod 0600 /var/adm/cron/at.allow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The snmpd.conf file must have mode 0600 or less permissive.

Finding ID
GEN005320
Rule ID
SV-35176r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005320
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The snmpd.conf file contains authenticators and must be protected from unauthorized access and modification.

Fix Text

Change the mode of the SNMP daemon configuration file to 0600. # chmod 0600 /etc/SnmpAgent.d/snmpd.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Management Information Base (MIB) files must have mode 0640 or less permissive.

Finding ID
GEN005340
Rule ID
SV-35178r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005340
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The ability to read the MIB file could impart special knowledge to an intruder or malicious user about the ability to extract compromising information about the system or network.

Fix Text

Change the mode of MIB files to 0640. # chmod 0640 <mib file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The system must not run an Internet Network News (INN) server.

Finding ID
GEN006240
Rule ID
SV-38236r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006240
CCI
CCI-000381
Target Key
(None)
Documentable
No
Discussion

INN servers access Usenet newsfeeds and store newsgroup articles. INN servers use the Network News Transfer Protocol (NNTP) to transfer information from the Usenet to the server and from the server to authorized remote hosts. If this function is necessary to support a valid mission requirement, its use must be authorized and approved in the system accreditation package.

Fix Text

Disable the INN server.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The /etc/smb.conf file must be owned by root.

Finding ID
GEN006100
Rule ID
SV-35213r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006100
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/smb.conf file allows access to other machines on the network and grants permissions to certain users. If it is owned by another user, the file may be maliciously modified and the Samba configuration could be compromised.

Fix Text

Change the ownership of the smb.conf file. # chown root /etc/opt/samba/smb.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/opt/samba/smb.conf file must have mode 0644 or less permissive.

Finding ID
GEN006140
Rule ID
SV-35221r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006140
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the smb.conf file has excessive permissions, the file may be maliciously modified and the Samba configuration could be compromised.

Fix Text

Change the mode of the smb.conf file to 0644 or less permissive. # chmod 0644 /etc/opt/samba/smb.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The smb.conf file must use the hosts option to restrict access to Samba.

Finding ID
GEN006220
Rule ID
SV-35107r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006220
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Samba increases the attack surface of the system and must be restricted to communicate only with systems requiring access.

Fix Text

Edit the smb.conf file and set the hosts option to permit only authorized hosts access Samba. An example might be: hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 hosts deny = 0.0.0.0/0 The above will only allow SMB connections from the localhost and from the two private networks 192.168.2 and 192.168.3. All other connections will be refused as soon as the client sends its first packet.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not permit root logins using remote access programs such as SSH.

Finding ID
GEN001120
Rule ID
SV-38207r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001120
CCI
CCI-000770
Target Key
(None)
Documentable
No
Discussion

Even though communications are encrypted, an additional layer of security may be gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account preserves the audit trail.

Fix Text

Edit the configuration file and set the PermitRootLogin option to no.

Check Content

Responsibility

System Administrator

IA Controls

ECPA-1

The /etc/smb.conf file must be group-owned by root, bin, sys, or system.

Finding ID
GEN006120
Rule ID
SV-35219r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006120
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group-owner of the smb.conf file is not root or a system group, the file may be maliciously modified and the Samba configuration could be compromised.

Fix Text

Change the group owner of the "smb.conf" file. # chgrp root /etc/samba/smb.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The root shell must be located in the / file system.

Finding ID
GEN001080
Rule ID
SV-38208r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN001080
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

To ensure the root shell is available in repair and administrative modes, the root shell must be located in the / file system.

Fix Text

Change the root account's shell to one present on the / file system.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Graphical desktop environments provided by the system must automatically lock after 15 minutes of inactivity and must require users to re-authenticate to unlock the environment.

Finding ID
GEN000500
Rule ID
SV-38416r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000500
CCI
CCI-000057
Target Key
(None)
Documentable
No
Discussion

If graphical desktop sessions do not lock the session after 15 minutes of inactivity, requiring re-authentication to resume operations, the system or individual data could be compromised by an alert intruder who could exploit the oversight. This requirement applies to graphical desktop environments provided by the system to locally attached displays and input devices as well as to graphical desktop environments provided to remote systems, including thin clients.

Fix Text

Configure the CDE lock manager to lock your screen after a certain amount of inactive time. To configure the CDE lock manager to lock the screen after 15 minutes of inactive time, enter the following commands (ensure to NOT overwrite an existing file): # cp /usr/dt/config/C/sys.resources /etc/dt/config/C/sys.resources # vi /etc/dt/config/C/sys.resources Locate and add/uncomment/change the line to N=15 dtsession*lockTimeout: <N> dtsession*lockTimeout: 15 Log out of CDE and log back in to verify the timeout is in effect.

Check Content

Responsibility

System Administrator

IA Controls

PESL-1

The system must prohibit the reuse of passwords within five iterations.

Finding ID
GEN000800
Rule ID
SV-38417r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000800
CCI
CCI-000200
Target Key
(None)
Documentable
No
Discussion

If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it, this would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The HP-UX AUDOMON_ARGS attribute must be explicitly initialized.

Finding ID
GEN000000-HPUX0040
Rule ID
SV-38429r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000000-HPUX0040
CCI
CCI-000126
Target Key
(None)
Documentable
No
Discussion

The minimal set of auditing requirements necessary to collect useful forensics data and provide user help when violations are detected must be configured.

Fix Text

Edit the /etc/rc.config.d/auditing file and insert the following line: AUDOMON_ARGS=“-p 20, -t 1, -w 90” Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The SSH daemon must be configured to only use the SSHv2 protocol.

Finding ID
GEN005500
Rule ID
SV-35209r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN005500
CCI
CCI-001436
Target Key
(None)
Documentable
No
Discussion

SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.

Fix Text

Edit the configuration file and modify the Protocol line entry to appear as follows: Protocol 2

Check Content

Responsibility

System Administrator

IA Controls

DCPP-1

The root file system must employ journaling or another mechanism ensuring file system consistency.

Finding ID
GEN003640
Rule ID
SV-35057r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003640
CCI
CCI-000553
Target Key
(None)
Documentable
No
Discussion

File system journaling, or logging, can allow reconstruction of file system data after a system crash, thus, preserving the integrity of data that may have otherwise been lost. Journaling file systems typically do not require consistency checks upon booting after a crash, which can improve system availability. Some file systems employ other mechanisms to ensure consistency which also satisfy this requirement.

Fix Text

Implement file system journaling for the root file system, or use a file system that uses other mechanisms to ensure file system consistency. If the root file system supports journaling, enable it. If the file system does not support journaling or another mechanism to ensure file system consistency, a migration to a different file system will be necessary.

Check Content

Responsibility

System Administrator

IA Controls

ECAR-1, ECAR-2, ECAR-3

The system must not run Samba unless needed.

Finding ID
GEN006060
Rule ID
SV-35208r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006060
CCI
CCI-001436
Target Key
(None)
Documentable
No
Discussion

Samba is a tool used for the sharing of files and printers between Windows and UNIX operating systems. It provides access to sensitive files and, therefore, poses a security risk if compromised.

Fix Text

If there is no functional need for Samba and the daemon is running, disable the daemon by killing the process ID as noted from the output of ps -ef |grep smbd. The utility should also be removed or not installed if there is no functional requirement.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The cron.deny file must have mode 0600 or less permissive.

Finding ID
GEN003200
Rule ID
SV-38430r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003200
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If file permissions for cron.deny are more permissive than 0600, sensitive information could be viewed or edited by unauthorized users.

Fix Text

Change the mode of the cron.deny file. # chmod 0600 /var/adm/cron/cron.deny

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The cron.allow file must be owned by root, bin, or sys.

Finding ID
GEN003240
Rule ID
SV-38432r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003240
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the owner of the cron.allow file is not set to root, bin, or sys, the possibility exists for an unauthorized user to view or to edit sensitive information.

Fix Text

# chown root /var/adm/cron/cron.allow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at directory must have mode 0755 or less permissive.

Finding ID
GEN003400
Rule ID
SV-38433r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003400
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the at directory has a mode more permissive than 0755, unauthorized users could be allowed to view or to edit files containing sensitive information within the at directory. Unauthorized modifications could result in Denial of Service to authorized at jobs.

Fix Text

Change the mode of the at directory to 0755. # chmod 0755 <at directory>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at directory must be owned by root, bin, or sys.

Finding ID
GEN003420
Rule ID
SV-38434r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003420
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the owner of the at directory is not root, bin, or sys, unauthorized users could be allowed to view or edit files containing sensitive information within the directory.

Fix Text

Change the owner of the existing at directory to root, bin, or sys. # chown root <at directory> (Replace root with another system group and/or <at directory> with a different at directory as necessary.)

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at.allow file must be owned by root, bin, or sys.

Finding ID
GEN003460
Rule ID
SV-34997r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003460
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the owner of the at.allow file is not set to root, sys, or bin, unauthorized users could be allowed to view or edit sensitive information contained within the file.

Fix Text

Change the owner of the at.allow file. # chown root /var/adm/cron/at.allow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at.deny file must be owned by root, bin, or sys.

Finding ID
GEN003480
Rule ID
SV-34998r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003480
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the owner of the at.deny file is not set to root, bin, or sys, unauthorized users could be allowed to view or edit sensitive information contained within the file.

Fix Text

Change the owner of the at.deny file. # chown root /usr/lib/cron/at.deny

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The traceroute command must be group-owned by sys, bin, root, or other.

Finding ID
GEN003980
Rule ID
SV-35154r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003980
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group owner of the traceroute command has not been set to a system group, unauthorized users could have access to the command and use it to gain information regarding a network's topology inside of the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.

Fix Text

Change the group-owner of the traceroute command to root. See the following example: # chgrp root /usr/contrib/bin/traceroute

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The traceroute file must have mode 0700 or less permissive.

Finding ID
GEN004000
Rule ID
SV-38435r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004000
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the mode of the traceroute executable is more permissive than 0700, malicious code could be inserted by an attacker and triggered whenever the traceroute command is executed by authorized users. Additionally, if an unauthorized user is granted executable permissions to the traceroute command, it could be used to gain information about the network topology behind the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.

Fix Text

Change the mode of the traceroute command. # chmod 0700 /usr/contrib/bin/traceroute

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SMTP service's SMTP greeting must not provide version information.

Finding ID
GEN004560
Rule ID
SV-38436r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN004560
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The version of the SMTP service can be used by attackers to plan an attack based on vulnerabilities present in the specific version.

Fix Text

Ensure Sendmail or its equivalent has been configured to mask the version information. If necessary, change the O SmtpGreetingMessage line in the /etc/sendmail.cf file as noted below: O SmtpGreetingMessage=$j Sendmail $v/$Z; $b change it to: O SmtpGreetingMessage= Mail Server Ready ; $b Then restart the Sendmail service.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not use .forward files.

Finding ID
GEN004580
Rule ID
SV-35061r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004580
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The .forward file allows users to automatically forward mail to another system. Use of .forward files could allow the unauthorized forwarding of mail and could potentially create mail loops which could degrade system performance.

Fix Text

Remove .forward files from the system.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Anonymous FTP accounts must not have a functional shell.

Finding ID
GEN005000
Rule ID
SV-35106r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN005000
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If an anonymous FTP account has been configured to use a functional shell, attackers could gain access to the shell if the account is compromised.

Fix Text

Configure anonymous FTP accounts to use a non-functional shell. If necessary, edit the /etc/passwd file to remove any functioning shells associated with the FTP account and replace them with non-functioning shells, such as /dev/null.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The /etc/syslog.conf file must be owned by bin.

Finding ID
GEN005400
Rule ID
SV-38437r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005400
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the /etc/syslog.conf file is not owned by bin, unauthorized users could be allowed to view, edit, or delete important system messages handled by the syslog facility.

Fix Text

Use the chown command to set the owner to bin. # chown bin /etc/syslog.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/syslog.conf file must be group-owned by root, bin, sys, or system.

Finding ID
GEN005420
Rule ID
SV-35186r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005420
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group owner of /etc/syslog.conf is not root, bin, or sys, unauthorized users could be permitted to view, edit, or delete important system messages handled by the syslog facility.

Fix Text

Change the group owner of the /etc/syslog.conf file to root, bin, sys, or other. # chgrp root /etc/syslog.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The cron.deny file must be owned by root, bin, or sys.

Finding ID
GEN003260
Rule ID
SV-38439r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003260
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Cron daemon control files restrict the scheduling of automated tasks and must be protected.

Fix Text

# chown root /var/adm/cron/cron.deny

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The remsh daemon must not be running.

Finding ID
GEN003820
Rule ID
SV-35130r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN003820
CCI
CCI-000068
Target Key
(None)
Documentable
No
Discussion

The remshd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.

Fix Text

Edit /etc/inetd.conf and comment out the remshd service. Refresh the inetd service. # inetd -c

Check Content

Responsibility

System Administrator

IA Controls

EBRU-1

The rexec daemon must not be running.

Finding ID
GEN003840
Rule ID
SV-35132r2_rule
Severity
Cat I
CCE
(None)
Group Title
GEN003840
CCI
CCI-001435
Target Key
(None)
Documentable
Yes
Discussion

The rexecd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.

Fix Text

Edit /etc/inetd.conf and comment out the line for the rexec daemon service. Restart the inetd service via the following command: # inetd -c

Check Content

Responsibility

Information Assurance Officer

The SMTP service must not have the EXPN feature active.

Finding ID
GEN004660
Rule ID
SV-35076r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN004660
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The SMTP EXPN function allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. EXPN may also provide additional information concerning users on the system, such as the full names of account owners.

Fix Text

Edit the /etc/mail/sendmail.cf file and add or edit the following line: O PrivacyOptions=goaway Then restart the Sendmail service.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SMTP service must not have the VRFY feature active.

Finding ID
GEN004680
Rule ID
SV-35083r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN004680
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The VRFY (Verify) command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY may provide additional information about users on the system, such as the full names of account owners.

Fix Text

If running Sendmail, add the line Opnovrfy to the Sendmail configuration file, usually located in /etc/mail/sendmail.cf. For other mail servers, contact the vendor for information on how to disable the verify command. Newer versions of Sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail. Edit the /etc/mail/sendmail.cf file and add or edit (one of) the following line(s): O PrivacyOptions=novrfy O PrivacyOptions=goaway Then restart the Sendmail service.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not have the UUCP service active.

Finding ID
GEN005280
Rule ID
SV-35171r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005280
CCI
CCI-001436
Target Key
(None)
Documentable
No
Discussion

The UUCP utility is designed to assist in transferring files, executing remote commands, and sending e-mail between UNIX systems over phone lines and direct connections between systems. The UUCP utility is a primitive and arcane system with many security issues. There are alternate data transfer utilities/products that can be configured to more securely transfer data by providing for authentication as well as encryption.

Fix Text

Edit /etc/inetd.conf and comment the uucp service entry. Restart the inetd service. # inetd -c

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not have the finger service active.

Finding ID
GEN003860
Rule ID
SV-35136r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003860
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

The finger service provides information about the system's users to network clients. This could expose information that could be used in subsequent attacks.

Fix Text

Edit /etc/inetd.conf and comment out the fingerd line. Restart the inetd service via the following command: # inetd -c

Check Content

Responsibility

System Administrator

IA Controls

DCPP-1

The system must require that passwords contain a minimum of 15 characters.

Finding ID
GEN000580
Rule ID
SV-27111r4_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000580
CCI
CCI-000205
Target Key
(None)
Documentable
No
Discussion

The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.

Fix Text

For Trusted Mode: Use the SAM/SMH interface to set the system password length attribute “MIN_PASSWORD_LENGTH” to 15 or greater. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Install the additional LongPassword11i3 and PHI11i3 product bundles where/as required. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the attribute(s). See the below example(s): CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 LONG_PASSWORD=1 MIN_PASSWORD_LENGTH=15 Note: The MIN_PASSWORD_LENGTH attribute must be set equal to or greater than 15. If the "vi" editor was used to update the /etc/default/security file, save the file before exiting the editor.

Check Content

Responsibility

System Administrator

The system must require passwords contain at least one uppercase alphabetic character.

Finding ID
GEN000600
Rule ID
SV-38244r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000600
CCI
CCI-000192
Target Key
(None)
Documentable
No
Discussion

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_UPPER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_UPPER_CASE_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_UPPER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_UPPER_CASE_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The system must require passwords contain at least one numeric character.

Finding ID
GEN000620
Rule ID
SV-38245r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000620
CCI
CCI-000194
Target Key
(None)
Documentable
No
Discussion

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_DIGIT_CHARS attribute. See the below example: PASSWORD_MIN_DIGIT_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_DIGIT_CHARS attribute. See the below example: PASSWORD_MIN_DIGIT_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The system must require passwords contain at least one special character.

Finding ID
GEN000640
Rule ID
SV-38246r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000640
CCI
CCI-001619
Target Key
(None)
Documentable
No
Discussion

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_SPECIAL_CHARS attribute. See the below example: PASSWORD_MIN_SPECIAL_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_SPECIAL_CHARS attribute. See the below example: PASSWORD_MIN_SPECIAL_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

All global initialization files must have mode 0444 or less permissive.

Finding ID
GEN001720
Rule ID
SV-38266r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001720
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.

Fix Text

Change the mode of the global initialization file(s) to 0444. # chmod 0444 <global initialization file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All global initialization files must be owned by bin.

Finding ID
GEN001740
Rule ID
SV-38267r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001740
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the ownership of global initialization files with incorrect ownership. # chown bin <global initialization files>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All global initialization files must be group-owned by root, sys, bin, other system, or the system default.

Finding ID
GEN001760
Rule ID
SV-38268r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001760
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the group ownership of the global initialization file(s) with incorrect group ownership. # chgrp root <global initialization file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All skeleton files and directories (typically in /etc/skel) must be owned by bin.

Finding ID
GEN001820
Rule ID
SV-38269r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001820
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files. Failure to give ownership of sensitive files or utilities to bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the ownership of skeleton files with incorrect mode. # chown bin <skeleton file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

All global initialization files executable search paths must contain only authorized paths.

Finding ID
GEN001840
Rule ID
SV-38270r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001840
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the global initialization file(s) with PATH variables containing relative paths and remove any relative path form the PATH variables that have not been documented with the ISSO. Edit the global initialization file(s) and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

All local initialization files executable search paths must contain only authorized paths.

Finding ID
GEN001900
Rule ID
SV-34915r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001900
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory or other relative paths, executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the local initialization file and remove the relative path entries from the PATH variable that have not been documented with the ISSO. Edit the local initialization file and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

There must be no .rhosts, .shosts, hosts.equiv, or shosts.equiv files on the system.

Finding ID
GEN002040
Rule ID
SV-38249r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN002040
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The .rhosts, .shosts, hosts.equiv, and shosts.equiv files are used to configure host-based authentication for individual users or the system. Host-based authentication is not sufficient for preventing unauthorized access to the system.

Fix Text

Remove the .rhosts, .shosts, hosts.equiv, and/or shosts.equiv files.

Check Content

Responsibility

Information Assurance Officer

IA Controls

ECCD-1, ECCD-2

The .rhosts file must not be supported in PAM.

Finding ID
GEN002100
Rule ID
SV-38264r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002100
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

.rhosts files are used to specify a list of hosts permitted remote access to a particular account without authenticating. The use of such a mechanism defeats strong identification and authentication requirements.

Fix Text

Edit /etc/pam.conf and comment/remove the "rcomds" line(s).

Check Content

Responsibility

Information Assurance Officer

Default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.

Finding ID
GEN003060
Rule ID
SV-38251r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003060
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

To centralize the management of privileged account crontabs, of the default system accounts, only root may have a crontab.

Fix Text

Remove default system accounts (such as bin, sys, adm, or others) from the cron.allow file if it exists, or add those accounts to the cron.deny file.

Check Content

Responsibility

System Administrator

IA Controls

ECPA-1

Process core dumps must be disabled unless needed.

Finding ID
GEN003500
Rule ID
SV-35008r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003500
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Process core dumps contain the memory in use by the process when it crashed. Process core dump files can be of significant size and their use can result in file systems filling to capacity, which may result in Denial of Service. Process core dumps can be useful for software debugging.

Fix Text

Edit /etc/profile, ensure the ulimit command is present with the -c argument of the ulimit command set to 0.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

The system must implement non-executable program stacks.

Finding ID
GEN003540
Rule ID
SV-35009r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003540
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

A common type of exploit is the stack buffer overflow. An application receives, from an attacker, more data than it is prepared for and stores this information on its stack, writing beyond the space reserved for it. This can be designed to cause execution of the data written on the stack. One mechanism to mitigate this vulnerability is for the system to not allow the execution of instructions in sections of memory identified as part of the stack.

Fix Text

# kctune executable_stack=0 The system will require a restart/reboot for the setting to take effect.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not forward IPv4 source-routed packets.

Finding ID
GEN003600
Rule ID
SV-38259r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003600
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.

Fix Text

Disable the IP source-routed forwarding feature. # ndd -set /dev/ip ip_forward_src_routed 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = ip NDD_NAME[x] = ip_forward_src_routed NDD_VALUE[x] = 0

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

A separate file system must be used for user home directories (such as /home or equivalent).

Finding ID
GEN003620
Rule ID
SV-35048r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003620
CCI
CCI-001208
Target Key
(None)
Documentable
Yes
Discussion

The use of separate file systems for different paths can protect the system from failures resulting from the / file system becoming full or failing.

Fix Text

Migrate the /home (or equivalent) path onto a separate file system.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Inetd and xinetd must be disabled or removed if no network services utilizing them are enabled.

Finding ID
GEN003700
Rule ID
SV-35064r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003700
CCI
CCI-000305
Target Key
(None)
Documentable
No
Discussion

Unnecessary services should be disabled to decrease the attack surface of the system.

Fix Text

Remove or disable the inetd startup scripts and kill the service.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SMTP service HELP command must not be enabled.

Finding ID
GEN004540
Rule ID
SV-35059r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004540
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The HELP command should be disabled to mask version information. The version of the SMTP service software could be used by attackers to target vulnerabilities present in specific software versions.

Fix Text

To disable the SMTP HELP command, remove or empty the Sendmail help file: /etc/mail/helpfile.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All FTP users must have a default umask of 077.

Finding ID
GEN005040
Rule ID
SV-38263r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005040
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask is stored as a 4-digit number, the first digit representing special access modes is typically ignored or required to be zero.

Fix Text

Edit the initialization files for the ftp user and set the umask to 077.

Check Content

Responsibility

System Administrator

IA Controls

ECCD-1, ECCD-2

All .Xauthority files must have mode 0600 or less permissive.

Finding ID
GEN005180
Rule ID
SV-35162r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005180
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

.Xauthority files ensure the user is authorized to access the specific X Windows host. Excessive permissions may permit unauthorized modification of these files, which could lead to Denial of Service to authorized access or allow unauthorized access to be obtained.

Fix Text

Change the mode of the .Xauthority files. # chmod 0600 .Xauthority

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The snmpd.conf file must be owned by bin.

Finding ID
GEN005360
Rule ID
SV-35203r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005360
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The snmpd.conf file contains authenticators and must be protected from unauthorized access and modification. If the file is not owned by bin, it may be subject to access and modification from unauthorized users.

Fix Text

Change the owner of the snmpd.conf file to bin. # chown bin /etc/SnmpAgent.d/snmpd.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The syslog daemon must not accept remote messages unless it is a syslog server documented using site-defined procedures.

Finding ID
GEN005480
Rule ID
SV-35195r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005480
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Unintentionally running a syslog server accepting remote messages puts the system at increased risk. Malicious syslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of Service.

Fix Text

Edit the /etc/rc.config.d/syslogd configuration startup script and add the -N option to the syslogd command. Restart the syslogd service via the following command(s): # /sbin/init.d/syslogd stop # /sbin/init.d/syslogd start

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SSH daemon must be configured for IP filtering.

Finding ID
GEN005540
Rule ID
SV-35149r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005540
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses.

Fix Text

Add appropriate IP restrictions for SSH to the /etc/hosts.deny and/or /etc/hosts.allow files.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

IP forwarding for IPv4 must not be enabled, unless the system is a router.

Finding ID
GEN005600
Rule ID
SV-35177r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005600
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.

Fix Text

Edit /etc/rc.config.d/nddconf and set the ip_forwarding option to 0.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system's access control program must be configured to grant or deny system access to specific hosts.

Finding ID
GEN006620
Rule ID
SV-35222r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006620
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If the system's access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.

Fix Text

Edit the <path>/hosts.allow and <path/hosts.deny files to configure access restrictions.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Network analysis tools must not be installed.

Finding ID
GEN003865
Rule ID
SV-35138r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003865
CCI
CCI-000305
Target Key
(None)
Documentable
No
Discussion

Network analysis tools allow for the capture of network traffic visible to the system.

Fix Text

Remove the network analysis tool binary from the system. Consult vendor documentation for removing packaged software, or remove the binary directly via the following example: # rm -i <binary>

Check Content

Responsibility

System Administrator

IA Controls

DCPA-1

The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.

Finding ID
GEN000250
Rule ID
SV-38272r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000250
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not owned by a system account, unauthorized modifications could result in the failure of time synchronization.

Fix Text

Change the owner of the NTP configuration file. # chown root /etc/ntp.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The time synchronization configuration file (such as /etc/ntp.conf) must be group-owned by root, bin, sys, or system.

Finding ID
GEN000251
Rule ID
SV-38273r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000251
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not owned by a system group, unauthorized modifications could result in the failure of time synchronization.

Fix Text

Change the group-owner of the NTP configuration file. Procedure: # chgrp root /etc/ntp.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.

Finding ID
GEN000252
Rule ID
SV-38274r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000252
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. If an illicit time source is used for synchronization, the integrity of system logs and the security of the system could be compromised. If the configuration files controlling time synchronization are not protected, unauthorized modifications could result in the failure of time synchronization.

Fix Text

Change the mode of the NTP configuration file to 0640 or less permissive. # chmod 0640 /etc/ntp.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.

Finding ID
GEN000450
Rule ID
SV-26319r2_rule
Severity
Cat III
CCE
(None)
Group Title
GEN000450
CCI
CCI-000054
Target Key
(None)
Documentable
Yes
Discussion

Limiting simultaneous user logins can insulate the system from Denial of Service problems caused by excessive logins. Automated login processes operating improperly or maliciously may result in an exceptional number of simultaneous login sessions. If the defined value of 10 logins does not meet operational requirements, the site may define the permitted number of simultaneous login sessions based on operational requirements. This limit is for the number of simultaneous login sessions for EACH user account. This is NOT a limit on the total number of simultaneous login sessions on the system.

Fix Text

For Trusted Mode: Use the SAM/SMH interface (/etc/default/security file) to update attribute. See the below example: NUMBER_OF_LOGINS_ALLOWED=10 For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update attribute. See the below example: NUMBER_OF_LOGINS_ALLOWED=10 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must display the date and time of the last successful account login upon login.

Finding ID
GEN000452
Rule ID
SV-38302r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN000452
CCI
CCI-000052
Target Key
(None)
Documentable
No
Discussion

Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.

Fix Text

Edit the configuration file and modify the PrintLastLog line entry as follows: PrintLastLog yes

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must require passwords contain at least one lowercase alphabetic character.

Finding ID
GEN000610
Rule ID
SV-38304r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000610
CCI
CCI-000193
Target Key
(None)
Documentable
No
Discussion

To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_MIN_LOWER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_LOWER_CASE_CHARS=1 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_MIN_LOWER_CASE_CHARS attribute. See the below example: PASSWORD_MIN_LOWER_CASE_CHARS=1 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The system must restrict the ability to switch to the root user to members of a defined group.

Finding ID
GEN000850
Rule ID
SV-26349r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN000850
CCI
CCI-000009
Target Key
(None)
Documentable
No
Discussion

Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing the root account, even with knowledge of the root credentials.

Fix Text

Edit /etc/default/security and uncomment, set, or add the SU_ROOT_GROUP setting with a value of wheel or equivalent. If necessary, create a wheel group and add administrative users to the group.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The root account's library search path must be the system default and must contain only absolute paths.

Finding ID
GEN000945
Rule ID
SV-38307r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000945
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. Entries starting with a slash (/) are absolute paths.

Fix Text

Edit the root user initialization files and remove any definition of LD_LIBRARY_PATH and SHLIB_PATH.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The root account's list of preloaded libraries must be empty.

Finding ID
GEN000950
Rule ID
SV-38308r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000950
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries relative to the current working directory, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with (/) are absolute paths.

Fix Text

Edit the root user initialization files and remove any definition of LD_PRELOAD.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The /etc/resolv.conf file must be owned by root.

Finding ID
GEN001362
Rule ID
SV-38310r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001362
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions such as time synchronization, centralized authentication, and remote system logging.

Fix Text

As root, change the owner of the /etc/resolv.conf file to root. # chown root /etc/resolv.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/resolv.conf file must be group-owned by root, bin, sys, or system.

Finding ID
GEN001363
Rule ID
SV-38311r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001363
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions such as time synchronization, centralized authentication, and remote system logging.

Fix Text

Change the group owner of the /etc/resolv.conf file to root, bin, sys, or other. Procedure: # chgrp root /etc/resolv.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/resolv.conf file must have mode 0644 or less permissive.

Finding ID
GEN001364
Rule ID
SV-38312r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001364
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions such as time synchronization, centralized authentication, and remote system logging.

Fix Text

Change the mode of the /etc/resolv.conf file to 0644 or less permissive. # chmod 0644 /etc/resolv.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/hosts file must be owned by root.

Finding ID
GEN001366
Rule ID
SV-38313r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001366
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/hosts file (or equivalent) configures local host name to IP address mappings that typically take precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Fix Text

Change the owner of the /etc/hosts file to root. # chown root /etc/hosts

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/hosts file must be group-owned by root, bin, sys, or system.

Finding ID
GEN001367
Rule ID
SV-38314r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001367
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/hosts file (or equivalent) configures local host name to IP address mappings that typically take precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Fix Text

Change the group owner of the /etc/hosts file to root, sys, bin, or other. Procedure: # chgrp root /etc/hosts

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/hosts file must have mode 0644 or less permissive.

Finding ID
GEN001368
Rule ID
SV-38315r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001368
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/hosts file (or equivalent) configures local host name to IP address mappings typically take precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Fix Text

Change the mode of the /etc/hosts file to 0644 or less permissive. # chmod 0644 /etc/hosts

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/nsswitch.conf file must be owned by root.

Finding ID
GEN001371
Rule ID
SV-38316r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001371
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.

Fix Text

Change the owner of the /etc/nsswitch.conf file to root. # chown root /etc/nsswitch.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/nsswitch.conf file must be group-owned by root, bin, sys, or system.

Finding ID
GEN001372
Rule ID
SV-38317r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001372
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.

Fix Text

Change the group-owner of the /etc/nsswitch.conf file to root, bin, sys, or other. Procedure: # chgrp root /etc/nsswitch.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/nsswitch.conf file must have mode 0644 or less permissive.

Finding ID
GEN001373
Rule ID
SV-38319r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001373
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.

Fix Text

Change the mode of the /etc/nsswitch.conf file to 0644 or less permissive. # chmod 0644 /etc/nsswitch.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/passwd file must be owned by root.

Finding ID
GEN001378
Rule ID
SV-38335r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001378
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.

Fix Text

Change the owner of the /etc/passwd file to root. # chown root /etc/passwd

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/passwd file must be group-owned by root, bin, sys, or system.

Finding ID
GEN001379
Rule ID
SV-38336r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001379
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.

Fix Text

Change the group owner of the /etc/passwd file to root, bin, sys, or other. Procedure: # chgrp root /etc/passwd

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/group file must be owned by bin.

Finding ID
GEN001391
Rule ID
SV-38337r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001391
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/group file is critical to system security and must be owned by a privileged user. The group file contains a list of system groups and associated information.

Fix Text

Change the owner of the /etc/group file to bin. # chown bin /etc/group

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/group file must be group-owned by root, bin, sys, or system.

Finding ID
GEN001392
Rule ID
SV-38338r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001392
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.

Fix Text

Change the group owner of the /etc/group file. Procedure: # chgrp root /etc/group

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/group file must have mode 0444 or less permissive.

Finding ID
GEN001393
Rule ID
SV-38339r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001393
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.

Fix Text

Change the mode of the /etc/group file to 0444 or less permissive. # chmod 0444 /etc/group

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/shadow file (or equivalent) must be group-owned by root, bin, sys or other.

Finding ID
GEN001410
Rule ID
SV-38340r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001410
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. The file also contains password hashes which must not be accessible to users other than root.

Fix Text

For Trusted Mode: # chgrp root /tcb #chgrp root /tcb/files /tcb/files/auth # chgrp root /tcb/files/auth/[a-z]/* For SMSE: # chgrp root /etc/shadow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/passwd file must not contain password hashes.

Finding ID
GEN001470
Rule ID
SV-38323r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001470
CCI
CCI-000201
Target Key
(None)
Documentable
No
Discussion

If password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.

Fix Text

Migrate /etc/passwd password hashes. For Trusted Mode: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to migrate from a non-SMSE Standard Mode to Trusted Mode. For SMSE Mode: Use the following command to create the shadow file. The command will then copy all encrypted passwords into the shadow file and replace the passwd file password entries with an “x”. # pwconv

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/group file must not contain any group password hashes.

Finding ID
GEN001475
Rule ID
SV-38341r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001475
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Group passwords are typically shared and should not be used. Additionally, if password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.

Fix Text

Edit /etc/group and change the password field to include an asterisk (*) as the first character to lock the group password.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Run control scripts library search paths must contain only authorized paths.

Finding ID
GEN001605
Rule ID
SV-38343r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001605
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory.. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the run control script and remove any relative or empty path entry from the library search path variable that has not been documented with the ISSO. Edit the run control script and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

Run control scripts lists of preloaded libraries must contain only authorized paths.

Finding ID
GEN001610
Rule ID
SV-38344r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001610
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries to the current working directory that have not been authorized, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the run control script and remove any relative entries from the library preload variables that have not been documented with the ISSO. Edit the run control script and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

All skeleton files (typically in /etc/skel) must be group-owned by root, bin, sys, system, or other.

Finding ID
GEN001830
Rule ID
SV-38347r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001830
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the skeleton files are not protected, unauthorized personnel could change user startup parameters and possibly jeopardize user files.

Fix Text

Change the group owner of the skeleton file to root, bin, sys, or other. # chgrp <group> /etc/skel/<skeleton file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Global initialization files library search paths must contain only authorized paths.

Finding ID
GEN001845
Rule ID
SV-38348r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001845
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library search path environment variable(s) contains a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the global initialization file and remove the relative path entries from the library search path variables that have not been documented with the ISSO. Edit the global initialization file and remove any empty entry that is defined.

Check Content

Responsibility

System Administrator

Global initialization files lists of preloaded libraries must contain only authorized paths.

Finding ID
GEN001850
Rule ID
SV-38349r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001850
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries to the current working directory that have not been authorized, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the global initialization file and remove the relative path entry from the library preload list variables that have not been documented with the ISSO. Edit the global initialization file(s) and remove any empty entry that is defined for the library preload list.

Check Content

Responsibility

System Administrator

Local initialization files library search paths must contain only authorized paths.

Finding ID
GEN001901
Rule ID
SV-38351r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001901
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find libraries. If this path includes the current working directory or other relative paths, libraries in these directories may be loaded instead of system libraries. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon, two consecutive colons, or a single period, this is interpreted as the current working directory. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the user's local initialization file(s) and remove any relative path entry from the library search LIBRARY_PATH and/or SHLIB_PATH variable(s) that have not been documented with the ISSO. Edit the user’s local initialization file(s) and remove any empty entry that is defined for the “LIBRARY_PATH” and/or “SHLIB_PATH” variable(s).

Check Content

Responsibility

System Administrator

Local initialization files lists of preloaded libraries must contain only authorized paths.

Finding ID
GEN001902
Rule ID
SV-34928r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN001902
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the libraries required by the binary. If this list contains paths to libraries to the current working directory that have not been authorized, unintended libraries may be preloaded. This variable is formatted as a space-separated list of libraries. Paths starting with a slash (/) are absolute paths.

Fix Text

Edit the local initialization file and remove any relative/empty path entry from the library LD_PRELOAD variable that has not been documented with the ISSO. Edit the local initialization file and remove any empty entry that is defined for the “LD_PRELOAD” variable.

Check Content

Responsibility

System Administrator

All shell files must be group-owned by root, bin, sys, or system.

Finding ID
GEN002210
Rule ID
SV-38352r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002210
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If shell files are group-owned by users other than root or a system group, they could be modified by intruders or malicious users to perform unauthorized actions.

Fix Text

Change the group owner of the shell to root, bin, sys, or other. Procedure: # chgrp root <shell>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

System audit tool executables must be owned by root.

Finding ID
GEN002715
Rule ID
SV-26506r2_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002715
CCI
CCI-001493
Target Key
(None)
Documentable
No
Discussion

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

Fix Text

As root, change the file ownership. # chown root <audit_tool_filename>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

System audit tool executables must be group-owned by root, bin, sys, or other.

Finding ID
GEN002716
Rule ID
SV-26509r2_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002716
CCI
CCI-001493
Target Key
(None)
Documentable
No
Discussion

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

Fix Text

As root, change the file group ownership. # chgrp root <audit_tool_filename>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

System audit tool executables must have mode 0750 or less permissive.

Finding ID
GEN002717
Rule ID
SV-26512r2_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002717
CCI
CCI-001493
Target Key
(None)
Documentable
No
Discussion

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

Fix Text

As root, change the file permissions. # chmod 0750 <audit tool executable>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The audit system must alert the SA when the audit storage volume approaches its capacity.

Finding ID
GEN002730
Rule ID
SV-29653r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN002730
CCI
CCI-000143
Target Key
(None)
Documentable
No
Discussion

An accurate and current audit trail is essential for maintaining a record of system activity. If the system fails, the SA must be notified and must take prompt action to correct the problem. Minimally, the system must log this event and the SA will receive this notification during the daily system log review. If feasible, active alerting (such as e-mail or paging) should be employed consistent with the site’s established operations management systems and procedures.

Fix Text

Edit the AUDOMON_ARGS parameter of the /etc/rc.config.d/auditing file to include -w 90.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The audit system must be configured to audit account creation.

Finding ID
GEN002750
Rule ID
SV-29670r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002750
CCI
CCI-000018
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises, and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAT-1

The audit system must be configured to audit account modification.

Finding ID
GEN002751
Rule ID
SV-29675r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002751
CCI
CCI-001403
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAT-1

The audit system must be configured to audit account disabling.

Finding ID
GEN002752
Rule ID
SV-29676r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002752
CCI
CCI-001404
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAT-1

The audit system must be configured to audit account termination.

Finding ID
GEN002753
Rule ID
SV-29679r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN002753
CCI
CCI-001405
Target Key
(None)
Documentable
No
Discussion

If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.

Fix Text

Edit /etc/rc.config.d/auditing and add -e admin to the end of the AUDEVENT_ARGS1 parameter.

Check Content

Responsibility

System Administrator

IA Controls

ECAT-1

The cron.allow file must be group-owned by root, bin, sys or other.

Finding ID
GEN003250
Rule ID
SV-34991r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003250
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group of the cron.allow is not set to root, bin, sys or other, the possibility exists for an unauthorized user to view or edit the list of users permitted to use cron. Unauthorized modification of this file could cause Denial of Service to authorized cron users or provide unauthorized users with the ability to run cron jobs.

Fix Text

Change the group ownership of the file. # chgrp root /var/adm/cron/cron.allow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at.deny file must have mode 0600 or less permissive.

Finding ID
GEN003252
Rule ID
SV-26557r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003252
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The at daemon control files restrict access to scheduled job manipulation and must be protected. Unauthorized modification of the at.deny file could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.

Fix Text

Change the mode of the file. # chmod 0600 /var/adm/cron/at.deny

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The cron.deny file must be group-owned by root, bin, sys or other.

Finding ID
GEN003270
Rule ID
SV-34993r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003270
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Cron daemon control files restrict the scheduling of automated tasks and must be protected. Unauthorized modification of the cron.deny file could result in Denial of Service to authorized cron users or could provide unauthorized users with the ability to run cron jobs.

Fix Text

Change the group-owner of the cron.deny file. # chgrp root /var/adm/cron/cron.deny

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at directory must be group-owned by root, bin, sys or other.

Finding ID
GEN003430
Rule ID
SV-34995r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003430
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group of the at directory is not root, bin, sys or other, unauthorized users could be allowed to view or edit files containing sensitive information within the directory.

Fix Text

Change the group ownership of the file to root, bin, sys or other. # chgrp root /var/spool/cron/atjobs

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at.allow file must be group-owned by root, sys, bin or other.

Finding ID
GEN003470
Rule ID
SV-26571r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003470
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group-owner of the at.allow file is not set to root, sys, bin or other, unauthorized users could be allowed to view or edit the list of users permitted to run at jobs. Unauthorized modification could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.

Fix Text

Change the group ownership of the file. # chgrp root /usr/lib/cron/at.allow

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The at.deny file must be group-owned by root, bin, sys, or other.

Finding ID
GEN003490
Rule ID
SV-26574r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003490
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the group-owner of the at.deny file is not set to root, bin, sys, other, or cron, unauthorized users could be allowed to view or edit sensitive information contained within the file. Unauthorized modification could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.

Fix Text

Change the group ownership of the at.deny file to root, bin, sys, or other. # chgrp root /usr/lib/cron/at.deny

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The kernel core dump data directory must be group-owned by root, bin, sys, or other.

Finding ID
GEN003521
Rule ID
SV-26611r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003521
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Kernel core dumps may contain the full contents of system memory at the time of the crash. As the system memory may contain sensitive information, it must be protected accordingly. If the kernel core dump data directory is not group-owned by a system group, the core dumps contained in the directory may be subject to unauthorized access.

Fix Text

Change the group-owner of the kernel core dump data directory. # chgrp root /var/adm/crash

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The kernel core dump data directory must have mode 0700 or less permissive.

Finding ID
GEN003522
Rule ID
SV-26615r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003522
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Kernel core dumps may contain the full contents of system memory at the time of the crash. As the system memory may contain sensitive information, it must be protected accordingly. If the mode of the kernel core dump data directory is more permissive than 0700, unauthorized users may be able to view or to modify kernel core dump data files.

Fix Text

Change the group-owner of the kernel core dump data directory. # chmod 0700 /var/adm/crash

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The system must not process Internet Control Message Protocol (ICMP) timestamp requests.

Finding ID
GEN003602
Rule ID
SV-35022r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003602
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

The processing of ICMP timestamp requests increases the attack surface of the system.

Fix Text

Disable ICMP Timestamp responses on the system. # ndd -set /dev/ip ip_respond_to_timestamp 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_timestamp NDD_VALUE[x]=0

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not respond to ICMPv4 echoes sent to a broadcast address.

Finding ID
GEN003603
Rule ID
SV-35025r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003603
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

Responding to broadcast Internet Control Message Protocol (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.

Fix Text

Configure the system to not respond to ICMP ECHO_REQUESTs sent to broadcast addresses. # ndd -set /dev/ip ip_respond_to_echo_broadcast 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_echo_broadcast NDD_VALUE[x]=0

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address.

Finding ID
GEN003604
Rule ID
SV-35026r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003604
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

The processing of ICMP timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.

Fix Text

Configure the system to not respond to ICMP timestamp requests sent to broadcast addresses. # ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_respond_to_timestamp_broadcast NDD_VALUE[x]=0

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not apply reversed source routing to TCP responses.

Finding ID
GEN003605
Rule ID
SV-35028r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003605
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.

Fix Text

Disable the IP source-routed forwarding feature. # ndd -set /dev/ip ip_forward_src_routed 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = ip NDD_NAME[x] = ip_forward_src_routed NDD_VALUE[x] = 0

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must prevent local applications from generating source-routed packets.

Finding ID
GEN003606
Rule ID
SV-29707r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003606
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.

Fix Text

Edit /etc/opt/ipf/ipf.conf and add rules to block outgoing source-routed packets, such as: block out log quick all with opt lsrr block out log quick all with opt ssrr Reload the IPF rules. # ipf -Fa -A -f /etc/opt/ipf/ipf.conf

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not accept source-routed IPv4 packets.

Finding ID
GEN003607
Rule ID
SV-29713r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003607
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the handling of source-routed traffic destined to the system itself, not to traffic forwarded by the system to another, such as when IPv4 forwarding is enabled and the system is functioning as a router.

Fix Text

Edit /etc/opt/ipf/ipf.conf and add rules to block incoming source-routed packets, such as: block in log quick all with opt lsrr block in log quick all with opt ssrr Reload the IPF rules. # ipf -Fa -A -f /etc/opt/ipf/ipf.conf

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must ignore IPv4 ICMP redirect messages.

Finding ID
GEN003609
Rule ID
SV-29719r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003609
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

Fix Text

Edit /etc/opt/ipf/ipf.conf and add rules to block incoming IPv4 ICMP redirect messages, such as: block in quick proto icmp from any to any icmp-type redir Reload the IPF rules. Flush the rules from your ruleset using the -Fa option. The -A option specifies the active rules list. The -f option specifies the rules configuration file to be used: # ipf -Fa -A -f /etc/opt/ipf/ipf.conf

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not send IPv4 ICMP redirects.

Finding ID
GEN003610
Rule ID
SV-35038r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003610
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.

Fix Text

Configure the system to not send IPv4 ICMP redirect messages. # ndd -set /dev/ip ip_send_redirects 0 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x]=ip NDD_NAME[x]=ip_send_redirects NDD_VALUE[x]=0

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be group-owned by root, bin, sys, or other.

Finding ID
GEN003730
Rule ID
SV-35069r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003730
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give ownership of sensitive files or utilities to system groups may provide unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Fix Text

Change the group ownership of the inetd configuration file. # chgrp root <file or directory>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The xinetd.d directory must have mode 0755 or less permissive.

Finding ID
GEN003750
Rule ID
SV-35074r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003750
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The Internet service daemon configuration files must be protected as malicious modification could cause Denial of Service or increase the attack surface of the system.

Fix Text

Change the mode of included xinetd configuration directories to 0755. # chmod 0755 <directory>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The services file must be group-owned by root, bin, sys, or other.

Finding ID
GEN003770
Rule ID
SV-35080r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003770
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give ownership of system configuration files to root or a system group provides the designated owner and unauthorized users with the potential to change the system configuration which could weaken the system's security posture.

Fix Text

Change the group-owner of the services file. Procedure: # chgrp root /etc/services

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The remshd service must not be installed.

Finding ID
GEN003825
Rule ID
SV-35129r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003825
CCI
CCI-000305
Target Key
(None)
Documentable
No
Discussion

The remshd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.

Fix Text

Uninstall the remshd service from the system. # cat /etc/inetd.conf | grep -n remshd Edit the /etc/inetd.conf file and comment the line entry for remshd, then reconfigure inetd via: # inetd -c

Check Content

Responsibility

System Administrator

IA Controls

DCPP-1

The rlogind service must not be running.

Finding ID
GEN003830
Rule ID
SV-29697r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003830
CCI
CCI-000068
Target Key
(None)
Documentable
No
Discussion

The rlogind process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.

Fix Text

Edit /etc/inetd.conf and comment out the rlogind service. Restart the inetd service via the following command: # inetd -c

Check Content

Responsibility

System Administrator

IA Controls

DCPP-1

The hosts.lpd (or equivalent) file must be group-owned by root, bin, sys, or system.

Finding ID
GEN003930
Rule ID
SV-35144r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003930
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give group-ownership of the hosts.lpd file to root, bin, sys, or system provides the members of the owning group and possible unauthorized users, with the potential to modify the hosts.lpd file. Unauthorized modifications could disrupt access to local printers from authorized remote hosts or permit unauthorized remote access to local printers.

Fix Text

Change the group-owner of the hosts.lpd (or equivalent) file(s). # chgrp root /etc/hosts.lpd

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The aliases file must be group-owned by root, sys, bin, or other.

Finding ID
GEN004370
Rule ID
SV-35163r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004370
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the alias file is not group-owned by root, bin, sys or other, an unauthorized user may modify the file to add aliases to run malicious code or redirect e-mail.

Fix Text

Change the group-owner of the /etc/mail/aliases file. # chgrp root /etc/mail/aliases

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Files executed through a mail aliases file must be group-owned by root, bin, sys, or other, and must reside within a directory group-owned by root, bin, sys, or other.

Finding ID
GEN004410
Rule ID
SV-38373r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004410
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If a file executed through a mail aliases file is not group-owned by root or a system group, it may be subject to unauthorized modification. Unauthorized modification of files executed through aliases may allow unauthorized users to attain root privileges.

Fix Text

Change the group ownership of the file referenced from /etc/mail/aliases. # chgrp root <file referenced from aliases>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The ftpusers file must be group-owned by root, bin, sys or other.

Finding ID
GEN004930
Rule ID
SV-35104r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN004930
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If the ftpusers file is not group-owned by root or a system group, an unauthorized user may modify the file to allow unauthorized accounts to use FTP.

Fix Text

Change the group owner of the ftpusers file. # chgrp root /etc/ftpd/ftpusers

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The snmpd.conf file must be group-owned by root, sys, bin or other.

Finding ID
GEN005365
Rule ID
SV-26734r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005365
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The snmpd.conf file contains authenticators and must be protected from unauthorized access and modification. If the file is not group-owned by root or a system group, it may be subject to access and modification from unauthorized users.

Fix Text

Change the group ownership of the SNMP configuration file. # chgrp root /etc/SnmpAgent.d/snmpd.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The /etc/syslog.conf file must have mode 0640 or less permissive.

Finding ID
GEN005390
Rule ID
SV-38376r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005390
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Unauthorized users must not be allowed to access or modify the /etc/syslog.conf file.

Fix Text

Change the permissions of the syslog configuration file. # chmod 0640 /etc/syslog.conf

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The system must use a remote syslog server (loghost).

Finding ID
GEN005450
Rule ID
SV-35189r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005450
CCI
CCI-000136
Target Key
(None)
Documentable
No
Discussion

A syslog server (loghost) receives syslog messages from one or more systems. This data can be used as an authoritative log source in the event a system is compromised and its local logs are suspect.

Fix Text

Edit the syslog configuration file and add an appropriate remote syslog server.

Check Content

Responsibility

System Administrator

IA Controls

ECAT-1

The SSH client must be configured to only use FIPS 140-2 approved ciphers.

Finding ID
GEN005510
Rule ID
SV-35188r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005510
CCI
CCI-000068
Target Key
(None)
Documentable
No
Discussion

DoD information systems are required to use FIPS 140-2 approved ciphers. SSHv2 ciphers meeting this requirement are 3DES and AES.

Fix Text

Edit the configuration file and remove any ciphers that do not meet the following: 3des-ctr or aes-NNN-ctr (NNN=128, 192 or 256). If necessary, add the Ciphers entry with one or more of the above keyword values.

Check Content

Responsibility

System Administrator

IA Controls

DCNR-1

The SSH client must be configured to not use Cipher-Block Chaining (CBC) based ciphers.

Finding ID
GEN005511
Rule ID
SV-35193r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005511
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

The CBC mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plaintext attacks and must not be used.

Fix Text

Edit the configuration file and remove any ciphers other than those with the "aes" prefix and the "-ctr" suffix.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SSH client must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

Finding ID
GEN005512
Rule ID
SV-35210r3_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005512
CCI
CCI-001453
Target Key
(None)
Documentable
No
Discussion

DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.

Fix Text

Edit the SSH client configuration and remove any MACs that are not hmac-sha1 or a better hmac algorithm that is on the FIPS 140-2 approved list. If necessary, add a MACs line.

Check Content

Responsibility

System Administrator

The SSH daemon must restrict login ability to specific users and/or groups.

Finding ID
GEN005521
Rule ID
SV-35052r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005521
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Restricting SSH logins to a limited group of users, such as system administrators, prevents password guessing and other SSH attacks from reaching system accounts and other accounts not authorized for SSH access.

Fix Text

Edit the SSH daemon configuration and add the appropriate keyword directive(s) and space-separated user/group names. The keyword order of precedence is as follows: DenyUsers, AllowUsers, DenyGroups, AllowGroups

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SSH public host key files must have mode 0644 or less permissive.

Finding ID
GEN005522
Rule ID
SV-35060r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005522
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Fix Text

Change the permissions for the SSH public host key files. # chmod 0644 /opt/ssh/etc/*key.pub

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SSH private host key files must have mode 0600 or less permissive.

Finding ID
GEN005523
Rule ID
SV-35063r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005523
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Fix Text

Change the permissions for the SSH private host key files. # chmod 0600 /opt/ssh/etc/*key

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SSH daemon must not permit GSSAPI authentication unless needed.

Finding ID
GEN005524
Rule ID
SV-35066r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN005524
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.

Fix Text

Edit the SSH daemon configuration and delete the keyword entry or modify the entry as follows: GSSAPIAuthentication no

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SSH client must not permit GSSAPI authentication unless needed.

Finding ID
GEN005525
Rule ID
SV-35068r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN005525
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.

Fix Text

Edit the configuration file and set/add (if necessary) the GSSAPIAuthentication directive set to no.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SSH daemon must not permit Kerberos authentication unless needed.

Finding ID
GEN005526
Rule ID
SV-35075r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN005526
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.

Fix Text

Edit the SSH daemon configuration and set (add if necessary) a KerberosAuthentication directive set to no.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SSH daemon must perform strict mode checking of home directory configuration files.

Finding ID
GEN005536
Rule ID
SV-35137r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005536
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.

Fix Text

Edit the SSH daemon configuration and add or edit the StrictModes setting value to yes.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SSH daemon must use privilege separation.

Finding ID
GEN005537
Rule ID
SV-35139r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005537
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.

Fix Text

Edit the SSH daemon configuration and add or edit the UsePrivilegeSeparation setting value to yes.

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

The SSH daemon must not allow rhosts RSA authentication.

Finding ID
GEN005538
Rule ID
SV-35142r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005538
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If SSH permits rhosts RSA authentication, a user may be able to login based on the keys of the host originating the request and not any user-specific authentication..

Fix Text

Edit the SSH daemon configuration and add or edit the RhostsRSAAuthentication setting value to no. Note that the above guidance applies exclusively to Protocol(s) 1/1,2/2,1 only. If using Protocol 2 only, the check is not applicable and further action is not required.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The SSH daemon must not allow compression or must only allow compression after successful authentication.

Finding ID
GEN005539
Rule ID
SV-35146r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005539
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Fix Text

Edit the SSH daemon configuration and add or edit the Compression setting value to no or delayed.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router.

Finding ID
GEN005610
Rule ID
SV-26811r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005610
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.

Fix Text

Disable IPv6 forwarding: # ndd -set /dev/ip6 ip6_forwarding 0 Edit /etc/rc.config.d/nddconf: TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_forwarding NDD_VALUE[index]=0 Where: index is the next available integer value of the nddconf file. n is a number: either 1 to turn the feature ON or 0 to turn it OFF.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

All Network File System (NFS) shared system files and system directories must be group-owned by root, bin, sys, or other.

Finding ID
GEN005810
Rule ID
SV-35196r2_rule
Severity
Cat II
CCE
(None)
Group Title
GEN005810
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

Failure to give group-ownership of sensitive files or directories to root provides the members of the owning group with the potential to access sensitive information or change system configuration which could weaken the system's security posture.

Fix Text

Change the group owner of the share directory. # chgrp (root|bin|sys|other) <exported directory>

Check Content

Responsibility

System Administrator

Samba must be configured to use an authentication mechanism other than share.

Finding ID
GEN006225
Rule ID
SV-35109r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006225
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Samba share authentication does not provide for individual user identification and must not be used.

Fix Text

Edit the /etc/smb.conf file and change the security setting to user or another valid setting other than share, for example: security = user

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Samba must be configured to use encrypted passwords.

Finding ID
GEN006230
Rule ID
SV-35111r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006230
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Samba must be configured to protect authenticators. If Samba passwords are not encrypted for storage, plain-text user passwords may be read by those with access to the Samba password file.

Fix Text

Edit the /etc/opt/samba/smb.conf file and change the encrypt passwords setting to yes, for example: encrypt passwords = yes

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

Samba must be configured to not allow guest access to shares.

Finding ID
GEN006235
Rule ID
SV-35112r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN006235
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Guest access to shares permits anonymous access and is not permitted.

Fix Text

Edit the /etc/opt/samba/smb.conf file and change the guest ok setting to no, for example: guest ok = no

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The Stream Control Transmission Protocol (SCTP) must be disabled unless required.

Finding ID
GEN007020
Rule ID
SV-29988r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN007020
CCI
CCI-000382
Target Key
(None)
Documentable
No
Discussion

The SCTP is an IETF-standardized transport layer protocol. This protocol is not yet widely used. Binding this protocol to the network stack increases the attack surface of the host. Unprivileged local processes may be able to cause the kernel to dynamically load a protocol handler by opening a socket using the protocol.

Fix Text

Configure the system to prevent the dynamic loading of the SCTP protocol handler. Preview the removal of SCTP: # swremove -p <SCTP software product> Remove: # swremove <SCTP software product>

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not have IP tunnels configured.

Finding ID
GEN007820
Rule ID
SV-26928r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN007820
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

IP tunneling mechanisms can be used to bypass network filtering.

Fix Text

Edit the /etc/rc.config.d/netconf* files and remove the tunnel configurations.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The DHCP client must be disabled if not needed.

Finding ID
GEN007840
Rule ID
SV-26932r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN007840
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

DHCP allows for the unauthenticated configuration of network parameters on the system by exchanging information with a DHCP server.

Fix Text

Disable the DHCP client configuration. Edit /etc/rc.config.d/netconf and set the DHCP_ENABLE setting to 0.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must ignore IPv6 Internet Control Message Protocol (ICMP ) redirect messages.

Finding ID
GEN007860
Rule ID
SV-35241r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN007860
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.

Fix Text

Add an IPF rule to block inbound IPv6 ICMP redirect packets. Edit /etc/opt/ipf/ipf6.conf and add a rule such as: block in quick proto icmpv6 from any to any icmpv6-type 137 Reload the IPF rules. # ipf -6 -Fa -A -f /etc/opt/ipf/ipf6.conf

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not send IPv6 ICMP redirects.

Finding ID
GEN007880
Rule ID
SV-26939r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN007880
CCI
CCI-001551
Target Key
(None)
Documentable
No
Discussion

ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.

Fix Text

Configure the system to not send IPv6 ICMP redirect messages. # ndd -set /dev/ip6 ip6_send_redirects 0 Edit /etc/rc.config.d/nddconf: TRANSPORT_NAME[index]=ip6 NDD_NAME[index]=ip6_send_redirects NDD_VALUE[index]=0 Where: index is the next available integer value of the nddconf file. n is a number: either 1 to turn the feature ON or 0 to turn it OFF.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

If the system is using LDAP for authentication or account information, the LDAP TLS connection must require the server provide a certificate and this certificate has a valid trust path to a trusted CA.

Finding ID
GEN008020
Rule ID
SV-38381r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008020
CCI
CCI-000185
Target Key
(None)
Documentable
No
Discussion

The NSS LDAP service provides user mappings which are a vital component of system security. Communication between an LDAP server and a host using LDAP for NSS require authentication.

Fix Text

Edit /etc/opt/ldapux/ldapux_client.conf and set # Perform the CERT check peer_cert_policy=CERT OR # Perform the CERT check PLUS peer_cert_policy=CNCERT

Check Content

Responsibility

System Administrator

IA Controls

DCNR-1

If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be owned by root.

Finding ID
GEN008140
Rule ID
SV-38386r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008140
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the ownership of the file and/or directory. # chown root <directory> # chown root <directory>/<file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must be group-owned by root, bin, sys, or other.

Finding ID
GEN008160
Rule ID
SV-38387r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008160
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the group ownership of LDAP client certificate directory/files to root, bin, sys, or other. # chgrp root <directory> # chgrp root <directory>/<file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the TLS certificate authority file and/or directory (as appropriate) must have mode 0644 (0755 for directories) or less permissive.

Finding ID
GEN008180
Rule ID
SV-38388r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008180
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the mode of the file and/or directory. # chmod 0755 <directory> # chmod 0644 <directory>/<file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

For systems using NSS LDAP, the TLS certificate file must be owned by root.

Finding ID
GEN008220
Rule ID
SV-38390r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008220
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

The NSS LDAP service provides user mappings which are a vital component of system security. Its configuration must be protected from unauthorized modification.

Fix Text

Change the ownership of the file. # chown root <certfile>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must be group-owned by root, bin, sys, or other.

Finding ID
GEN008240
Rule ID
SV-38391r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008240
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the group ownership of the LDAP client certificate file. # chgrp root <cert file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the LDAP TLS certificate file must have mode 0644 or less permissive.

Finding ID
GEN008260
Rule ID
SV-38392r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008260
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the permissions of the LDAP client certificate file. # chmod 0644 <cert file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the LDAP TLS key file must be owned by root.

Finding ID
GEN008300
Rule ID
SV-38394r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008300
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the ownership of the file. # chown root <key file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the LDAP TLS key file must be group-owned by root, bin, sys, or other.

Finding ID
GEN008320
Rule ID
SV-38395r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008320
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.

Fix Text

Change the group owner of the LDAP client key file. # chgrp root <key file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

If the system is using LDAP for authentication or account information, the LDAP TLS key file must have mode 0600 or less permissive.

Finding ID
GEN008340
Rule ID
SV-38396r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008340
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification. NOTE: Depending on the particular implementation, group and other read permission may be necessary for unprivileged users to successfully resolve account information using LDAP. This will still be a finding, as these permissions provide users with access to system authenticators.

Fix Text

Change the mode of the file. # chmod 0600 <key file>

Check Content

Responsibility

System Administrator

IA Controls

ECLP-1

Automated file system mounting tools must not be enabled unless needed.

Finding ID
GEN008440
Rule ID
SV-38377r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN008440
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Automated file system mounting tools may provide unprivileged users with the ability to access local media and network shares. If this access is not necessary for the system’s operation, it must be disabled to reduce the risk of unauthorized access to these resources.

Fix Text

Stop and disable the autofs service. Edit /etc/rc.config.d/nfsconf and set the AUTOFS setting to 0. Restart the nfs.client service. # /usr/sbin/init.d/nfs.client stop # /usr/sbin/init.d/nfs.client start

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must employ a local firewall.

Finding ID
GEN008520
Rule ID
SV-38403r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008520
CCI
CCI-001118
Target Key
(None)
Documentable
No
Discussion

A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.

Fix Text

Set IPF_START=1 in /etc/rc.config.d/ipfconf. Refresh/restart. # /sbin/init.d/ipfboot start

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system package management tool must not automatically obtain updates.

Finding ID
GEN008820
Rule ID
SV-38405r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN008820
CCI
CCI-001233
Target Key
(None)
Documentable
No
Discussion

System package management tools can obtain a list of updates and patches from a package repository and make this information available to the SA for review and action. Using a package repository outside of the organization's control presents a risk that malicious packages could be introduced.

Fix Text

Configure the system package management tool to not automatically obtain updates.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The FTPS/FTP service on the system must be configured with the Department of Defense (DoD) login banner.

Finding ID
GEN000410
Rule ID
SV-38407r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000410
CCI
CCI-000048
Target Key
(None)
Documentable
No
Discussion

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. NOTE: SFTP and FTPS are encrypted alternatives to FTP that should be used in place of FTP. SFTP is implemented by the SSH service and uses its banner configuration.

Fix Text

Edit /etc/inetd.conf and add the -a /etc/ftpd/ftpaccess option to the ftp line, if it is not present. If the /etc/ftpd/ftpaccess does not exist, create it by copying the example configuration file. Edit the ftpaccess file and add or set the banner setting to a banner file, such as /etc/ftpd/banner_msg. Create the banner file and add one of the DoD login banners (based on the character limitations imposed by the system). DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."

Check Content

Responsibility

System Administrator

IA Controls

ECWM-1

The system must use a separate file system for /var.

Finding ID
GEN003621
Rule ID
SV-35050r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003621
CCI
CCI-001208
Target Key
(None)
Documentable
No
Discussion

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix Text

Migrate the /var path onto a separate file system.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must use a separate file system for the system audit data path..

Finding ID
GEN003623
Rule ID
SV-35054r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003623
CCI
CCI-001208
Target Key
(None)
Documentable
No
Discussion

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix Text

Migrate the audit log path onto a separate filesystem. The following assumes that /var exists and that the new audit log mount point will be /var/.audit. Verify if auditing is running: # ps -ef | grep audomon | grep -v grep If auditing is running, issue the stop command: # /sbin/init.d/auditing stop Use SAM/SMH to: - Create a new Logical Volume (size to be determined based on local site requirements). - Create a VxFS file system on the new logical volume, paying special attention to site requirements such as Access Permissions, Allocation Policies, Mirroring considerations, large/no-large files and mount options such as suid/nosuid and ro/rw. Verify the /etc/fstab /var/.audit entry # more /etc/fstab Verify the current mounts: # mount Mount /var/.audit if not yet mounted: # mount -a Re-start the auditing subsystem: # /sbin/init.d/auditing start Verify that auditing is now running: # ps -ef | grep audomon | grep -v grep

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must use a separate file system for /tmp (or equivalent).

Finding ID
GEN003624
Rule ID
SV-35055r1_rule
Severity
Cat III
CCE
(None)
Group Title
GEN003624
CCI
CCI-001208
Target Key
(None)
Documentable
No
Discussion

The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

Fix Text

Migrate the /tmp path onto a separate file system.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

TCP backlog queue sizes must be set appropriately.

Finding ID
GEN003601
Rule ID
SV-29690r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003601
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

To provide some mitigation to TCP Denial of Service (DoS) attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.

Fix Text

Set the tcp_syn_rcvd_max parameter to 1280. # ndd -set /dev/tcp tcp_syn_rcvd_max 1280 Edit /etc/rc.config.d/nddconf and add/set: TRANSPORT_NAME[x] = tcp NDD_NAME[x] = tcp_syn_rcvd_max NDD_VALUE[x] = 1280

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The system must not respond to ICMPv6 echo requests sent to a broadcast address.

Finding ID
GEN007950
Rule ID
SV-29786r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN007950
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

Responding to broadcast ICMP echo requests facilitates network mapping and provides a vector for amplification attacks.

Fix Text

Add an IPF rule to block inbound IPv6 ICMP ECHO_REQUEST packets sent to the all-hosts multicast address. Edit /etc/opt/ipf/ipf6.conf and add a rule such as: block in quick proto icmpv6 from any to ff02::1 icmpv6-type 128 Reload the IPF rules. # ipf -6 -Fa -A -f /etc/opt/ipf/ipf6.conf

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts.

Finding ID
GEN000402
Rule ID
SV-38411r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN000402
CCI
CCI-000048
Target Key
(None)
Documentable
No
Discussion

Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. This requirement applies to graphical desktop environments provided by the system to locally attached displays and input devices as well as to graphical desktop environments provided to remote systems, including thin clients.

Fix Text

Configure the system to display one of the DoD login banners (based on the character limitations imposed by the system) prior to, or as part of, the graphical desktop environment login process. DoD Login Banners: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." OR "I've read & consent to terms in IS user agreem't."

Check Content

Responsibility

System Administrator

IA Controls

ECWM-1

If the system is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.

Finding ID
GEN008050
Rule ID
SV-38414r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN008050
CCI
CCI-000196
Target Key
(None)
Documentable
No
Discussion

The authentication of automated LDAP connections between systems must not use passwords since more secure methods are available, such as PKI and Kerberos. Additionally, the storage of unencrypted passwords on the system is not permitted.

Fix Text

Consult vendor documentation for the procedures for configuring LDAP for authentication and account information. Remove any passwords from unencrypted LDAP configuration files.

Check Content

Responsibility

System Administrator

IA Controls

IAIA-1, IAIA-2

The telnet daemon must not be running.

Finding ID
GEN003850
Rule ID
SV-35134r1_rule
Severity
Cat I
CCE
(None)
Group Title
GEN003850
CCI
CCI-000197
Target Key
(None)
Documentable
No
Discussion

The telnet daemon provides a typically unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised.

Fix Text

Consult vendor documentation to determine the procedure to disable the telnet daemon. If the system uses inetd, edit /etc/inetd.conf and comment out the telnetd line. Restart the inetd service via the following command: # inetd -c

Check Content

Responsibility

System Administrator

Mitigations

GEN003850

Mitigation Control

If an enabled telnet daemon is configured to only allow encrypted sessions, such as with Kerberos or the use of encrypted network tunnels, the risk of exposing sensitive information is mitigated, and this is not a finding.

IA Controls

DCPP-1