Payment Card Industry Data Security Standard
Evaluation Characteristics
| Target machine | solarisvm |
|---|---|
| Benchmark Title | Payment Card Industry Data Security Standard |
| Benchmark Version | v1.0.0 |
| Benchmark Description | solaris-PCI-DSS-v.1.0-xccdf.xml |
| Profile ID | Solaris_PCI-DSS |
| Started at | 2016-12-24T16:23:29 |
| Finished at | 2016-12-24T16:32:28 |
| Performed by | ccebi |
CPE Platforms
Addresses
Compliance and Scoring
Rule results
Severity of failed rules
Score
| Scoring system | Score | Maximum | Percent |
|---|---|---|---|
| urn:xccdf:scoring:default | 60.056084 | 100.000000 |
Rule Overview
Result Details
The OS version is current
| Rule ID | OSC-53005 |
| Result | pass |
| Time | 2016-12-24T16:23:32 |
| Severity | medium |
| Identifiers and References | |
| Description | Systems should be kept up to date to ensure that the latest security and operational updates are installed. You can run 'pkg update -n' to check the current state of the system against the configured repositories. |
Package integrity is verified
| Rule ID | OSC-54005 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | high |
| Identifiers and References | |
| Description | Run 'pkg verify' to check that all installed Oracle Solaris software matches the packaging database and that ownership, permissions and content are correct. |
SCE stdout | |
Remediation description:
'pkg verify' has produced errors.
Rerun the command and evaluate the errors.
As appropriate, based on errors found,
you should run 'pkg fix <package-fmri>'
See the pkg(1) man page.
| |
Remediation script: | |
Package signature checking is globally activated
| Rule ID | OSC-53505 |
| Result | pass |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | Package signature checking should be globally activated. |
Booting the system should require a password
| Rule ID | OSC-04511 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | The GRUB menu, the BIOS, and the eeprom should be password-protected to prevent configuration by unauthorized users. The BIOS protections prevent booting from an external device, such as a USB flash drive. |
SCE stdout | |
Remediation description:
On an x86, create passwords for the BIOS and the GRUB menu.
On SPARC, protect the eeprom with a password.
| |
Remediation script: | |
Address Space Layout Randomization (ASLR) is enabled
| Rule ID | OSC-01511 |
| Result | pass |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description |
Oracle Solaris tags many of its userland binaries
to enable Address Space Layout Randomization (ASLR).
ASLR randomizes the starting address of key parts of an address space.
This security defense mechanism can cause
Return Oriented Programming (ROP) attacks to fail
when they try to exploit software vulnerabilities.
See the sxadm(1M) man page.
|
Stacks are non-executable
| Rule ID | OSC-75511 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | Programs read and write data on the stack. Typically, they execute from read-only portions of memory that are specifically designated for code. Some attacks that cause buffers on the stack to overflow try to insert new code on the stack and cause the program to execute it. Removing execute permission from the stack memory prevents these attacks from succeeding. Properly written programs function correctly without using executable stacks. |
Remediation description:
Set noexec parameters in the /etc/system file, then reboot.
| |
Remediation script: | |
The umask(1) for SMF services is 022
| Rule ID | OSC-77500 |
| Result | pass |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | Files that the Service Management Facility (SMF) creates should be created with 644 file permissions. |
Service svc:/network/ipfilter is enabled
| Rule ID | OSC-27505 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | IP Filter is a host-based firewall that provides stateful packet filtering and network address translation (NAT). Packet filtering provides basic protection against network-based attacks. IP Filter also includes stateless packet filtering and can create and manage address pools. See the ipf(1M) and ipfilter(5) man pages. |
Remediation description:
Enable IP Filter.
| |
Remediation script: | |
The tcp_wrappers feature is enabled
| Rule ID | OSC-88011 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | TCP wrappers provides a way of implementing access controls by checking the address of a host that is requesting a particular network service against an ACL. Requests are granted or denied accordingly. TCP wrappers also logs host requests for network services, which is a useful monitoring function. The ssh(1) and sendmail(1M) services are configured to use TCP wrappers. Network services that might be placed under access control include proftpd(8) and rpcbind(1M). See the tcpd(1M) man page. |
Remediation description:
For most TCP services, see the Network Administration Guide
(http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=NWIPA).
For FTP, see the Security Guidelines
(http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=SYSADV7).
| |
Remediation script: | |
All local filesystems are ZFS
| Rule ID | OSC-16005 |
| Result | pass |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | ZFS is the default filesystem for Oracle Solaris. On most systems other filesystem types should not be mounted. See the zfs(7FS) man page. |
Non-root ZFS filesystems are encrypted
| Rule ID | OSC-17000 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | All ZFS file systems that are not the root file system should be encrypted. Encryption must be applied at filesystem creation. You must remember the encryption passphrase. Store it in a safe place. See the zfs(1M) and zfs_encrypt(1M) man pages. |
SCE stdout | |
Remediation description:
Back up any data needed from any unencrypted non-root file system.
Unmount and destroy those offending file systems.
Re-create the file systems with encryption on
(default algorithm is aes-128-ccm).
Remember the passphrase!
Restore data (preserved earlier) to the file systems.
| |
Remediation script: | |
swap(1M) is encrypted
| Rule ID | OSC-78000 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | Swap space, either a ZFS volume or raw device, should be encrypted. Encryption ensures that any sensitive data, such as user passwords, are protected if the system needs to swap those pages out to disk. See the swap(1M) man page. |
Remediation description:
To edit the vfstab file, you must become an administrator
with the solaris.admin.edit/etc/vfstab authorization.
The root role has this authorization.
Specify the encrypted option in vfstab(4) for the swap device entry. | |
Remediation script: | |
A size limit is set on tmpfs(7FS)
| Rule ID | OSC-16500 |
| Result | fail |
| Time | 2016-12-24T16:26:23 |
| Severity | medium |
| Identifiers and References | |
| Description | The size of the tmpfs file system is not limited by default. To avoid a performance impact, you can limit the size of each tmpfs mount. See the mount_tmpfs(1M) and vfstab(4) man pages. |
Remediation description:
To edit the vfstab file, you must become an administrator
with the solaris.admin.edit/etc/vfstab authorization.
To reboot the system, you must be assigned
the Maintenance and Repair rights profile.
The root role has all of these rights.
Set a limit on the tmpfs file system in the /etc/vfstab file, then reboot the system. For more information, see the Security Guidelines (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=SYSADV7). | |
Remediation script: | |
World-writable directories have sticky bit set
| Rule ID | OSC-14500 |
| Result | pass |
| Time | 2016-12-24T16:26:40 |
| Severity | medium |
| Identifiers and References | |
| Description | The sticky bit on a directory prevents files in a world-writable directory from being deleted or moved by anyone except the owner of the file, or root. This is useful in directories that are common to many users, such as the /tmp directory. |
coreadm(1M) configuration is correct
| Rule ID | OSC-07500 |
| Result | fail |
| Time | 2016-12-24T16:26:41 |
| Severity | medium |
| Identifiers and References | |
| Description | Core dumps can contain sensitive data. Protections can include file permissions and logging core dump events. See the coreadm(1m) and chmod(1M) man pages. |
SCE stdout | |
Remediation description:
Locate the directory and protect the core dumps.
Protections include file permissions and logging.
| |
Remediation script: | |
Find and list world writable files
| Rule ID | OSC-13000 |
| Result | pass |
| Time | 2016-12-24T16:27:33 |
| Severity | medium |
| Identifiers and References | |
| Description | World-writable files are unprotected files. Modification and removal of a file should be limited to the owner of the file. |
Find and list suid and sgid files other than those in standard Oracle Solaris packages
| Rule ID | OSC-13500 |
| Result | fail |
| Time | 2016-12-24T16:30:50 |
| Severity | high |
| Identifiers and References | |
| Description | Programs that set the UID and GID offer entry points for malicious code. |
SCE stdout | |
Remediation description:
Remove files that have the setuid or setgid bit set, or remove the bit.
| |
Remediation script: | |
Find and list files with no known owner
| Rule ID | OSC-14000 |
| Result | fail |
| Time | 2016-12-24T16:31:32 |
| Severity | medium |
| Identifiers and References | |
| Description | Files with no owner should be removed. Accounts that are closed should be archived and removed from the system. |
SCE stdout | |
Remediation description:
Remove unowned files.
If the files were owned by an account that is closed,
archive the files before removing them.
See the rm(1) man page.
| |
Remediation script: | |
Find and list files with extended attributes
| Rule ID | OSC-15000 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | Oracle Solaris implements extended attributes as files in an "extended attribute" name space visible only by using extended attribute aware commands. It is possible for attackers or malicious users to hide information in the extended attribute name space. Oracle Solaris currently does not ship any files with extended attributes. See the runat(1) and fsattr(5) man pages. |
Directed broadcasts are not forwarded
| Rule ID | OSC-79510 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, Oracle Solaris forwards broadcast packets. To reduce the possibility of broadcast flooding, change the default. Note that you are also disabling broadcast pings. |
Source-routed packets are not forwarded
| Rule ID | OSC-87010 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | To prevent DOS attacks from spoofed packets, ensure that source-routed packets are not forwarded. The default is not to forward them. |
TCP reverse source routing is disabled
| Rule ID | OSC-86010 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | The default value prevents packets from bypassing network security measures. Source-routed packets allow the source of the packet to suggest a path different from the path configured on the router. Note - This parameter might be set to 1 for diagnostic purposes. After diagnosis is complete, return the value to 0. |
ICMP redirects are disabled
| Rule ID | OSC-82010 |
| Result | fail |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | Routers use ICMP redirect messages to inform hosts of more direct routes to a destination. An illicit ICMP redirect message could result in a man-in-the-middle attack. |
SCE stdout | |
Remediation description:
ICMP redirects are managed using the ipadm command.
See the ipadm(1M) man page.
| |
Remediation script: | |
Responses to echo requests on multicast addresses are disabled
| Rule ID | OSC-85510 |
| Result | fail |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | To prevent the dissemination of information about the network topology, disable these responses. |
SCE stdout | |
Remediation description:
Responses to echo requests are managed using the ipadm command.
See the ipadm(1M) man page.
| |
Remediation script: | |
Responses to ICMP broadcast timestamp requests are disabled
| Rule ID | OSC-81510 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | To prevent the dissemination of information about the network topology, disable these responses if they are currently enabled. |
Responses to ICMP echo requests on broadcast addresses are disabled
| Rule ID | OSC-80510 |
| Result | fail |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | To prevent the dissemination of information about the network topology, disable these responses if they are currently enabled. |
SCE stdout | |
Remediation description:
Responses to ICMP echo requests on broadcast addresses are managed
using the ipadm command.
See the ipadm(1M) man page.
| |
Remediation script: | |
Responses to ICMP netmask requests are disabled
| Rule ID | OSC-81010 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | To prevent the dissemination of information about the network topology, disable these responses if they are currently enabled. |
Responses to ICMP timestamp requests are disabled
| Rule ID | OSC-82510 |
| Result | pass |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | The default value removes additional CPU demands on systems and prevents the dissemination of information about the network. |
Routing daemons are disabled
| Rule ID | OSC-86510 |
| Result | fail |
| Time | 2016-12-24T16:31:47 |
| Severity | medium |
| Identifiers and References | |
| Description | Systems in a secure datacenter should not need automatic routing reconfiguration. |
Remediation description:
List all routing services and daemons by running routeadm(1M) command.
Stop running any routing configuration daemons by using svcadm to
disable the services associated with them.
The route(1M) command can be used to establish any static
routes needed for the system.
| |
Remediation script: | |
Strict multihoming is enabled
| Rule ID | OSC-87500 |
| Result | fail |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | For systems that are gateways to other domains, such as a firewall or a VPN node, strict multihoming must be enabled. The hostmodel property controls the send and receive behavior for IP packets on a multihomed system. |
SCE stdout | |
Remediation description:
Strict multihoming should be set to "1"
so that packets don't get accepted on a different interface.
The default is "0"
| |
Remediation script: | |
Strong TCP packet sequence numbering
| Rule ID | OSC-83002 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | Ensure that the TCP initial sequence number generation parameter complies with RFC 6528 (http://www.ietf.org/rfc/rfc6528.txt). |
The maximum number of half-open TCP connections is at least 4096
| Rule ID | OSC-84000 |
| Result | fail |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | Setting the maximum half-open TCP connections to 4096 per IP address per port helps to defend against SYN flood denial of service attacks. |
SCE stdout | |
Remediation description:
The maximum number of half-open TCP connections is managed
using the ipadm command.
See the ipadm(1M) man page.
| |
Remediation script: | |
The maximum number of waiting TCP connections is set to at least 1024
| Rule ID | OSC-85000 |
| Result | fail |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | Setting the maximun number of queued incoming connections TCP to at least 1024 can help prevent certain Distributed Denial of Service (DDoS) attacks. |
SCE stdout | |
Remediation description:
The maximum number of waiting TCP connections is managed
using the ipadm command.
See the ipadm(1M) man page.
| |
Remediation script: | |
Service svc:/system/coreadm is enabled
| Rule ID | OSC-07011 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The coreadm service manages the core files that are produced by processes that terminate abnormally. See the core(4) and coreadm(1M) man pages. |
Service svc:/system/cron is enabled
| Rule ID | OSC-08011 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The cron service manages the cron(1M) command, which runs processes that execute commands at specified dates and times. See the at(1), crontab(1), and cron(1M) man pages. |
Service svc:/system/cryptosvc is enabled
| Rule ID | OSC-09011 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The cryptosvc service manages the use of cryptographic mechanisms from the Cryptographic Framework feature of Oracle Solaris. See the cryptoadm(1M) man page. |
Service svc:/system/dbus is enabled
| Rule ID | OSC-10011 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The dbus service manages the D-Bus message bus daemon. Programs use the message bus daemon to exchange messages with one another. For example, the Hardware Abstraction Layer (HAL) uses dbus. See the dbus-daemon(1) and hal(5) man pages. |
Service svc:/system/filesystem/autofs is enabled
| Rule ID | OSC-03511 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The autofs service manages the mount points for the automount(1M) daemon. |
Service svc:/system/hal is enabled in global zone
| Rule ID | OSC-21511 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The Hardware Abstraction Layer (HAL) service manages dynamic hardware configuration changes. See the hal(5) man page. This service only runs in the global zone. |
Service svc:/system/identity:domain is enabled
| Rule ID | OSC-22011 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The identity:domain service instance manages system identity. See the domainname(1M) man page. |
Service svc:/system/intrd is enabled in global zone
| Rule ID | OSC-27011 |
| Result | pass |
| Time | 2016-12-24T16:31:48 |
| Severity | medium |
| Identifiers and References | |
| Description | The interrupt balancer (intrd) service monitors the assignments between interrupts and CPUs to ensure optimal performance. See the intrd(1M) man page. This service only runs in the global zone. |
Service svc:/system/keymap is enabled in global zone
| Rule ID | OSC-28511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The keymap service manages the default configuration of the keyboard. See the kbd(1) man page. This service only runs in the global zone. |
Service svc:/system/name-service/cache is enabled
| Rule ID | OSC-35511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The name-service/cache service manages the caching of name service information. See the nscd(1M) man page. |
Service svc:/system/name-service/switch is enabled
| Rule ID | OSC-36011 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The name-service/switch service manages the databases that contain information about hosts, users, and groups. See the nsswitch.conf(4) man page. |
Service svc:/system/ocm is enabled
| Rule ID | OSC-43011 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The Oracle Configuration Manager (ocm) service collects configuration information and uploads it to the Oracle repository. See the configCCR(1M) man page. |
Service svc:/system/picl is enabled in global zone
| Rule ID | OSC-52511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The platform information and control (picl) service manages the publishing of platform configuration information that can respond to client requests for information about the configuration. See the picld(1M) and prtcpicl(1M) man pages. This service only runs in the global zone. |
Service svc:/system/power management is enabled in global zone
| Rule ID | OSC-54511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The system/power service manages the power management configuration of an Oracle Solaris system. See the poweradm(1M) man page. This service only runs in the global zone. |
Service svc:/system/scheduler is enabled in global zone
| Rule ID | OSC-67011 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The system/scheduler service manages the process scheduler. See the dispadmin(1M) man page. This service only runs in the global zone. |
Service svc:/system/system-log is enabled
| Rule ID | OSC-78511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The system-log service reads and forwards system messages to the appropriate log files or users. See the syslogd(1M) and rsyslogd(1M) man pages. |
Service svc:/system/utmp is enabled
| Rule ID | OSC-95011 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The utmp service manages a table of processes, detects when a process has terminated, and updates the table. See the utmpd(1M) man page. |
Service svc:/system/zones is enabled in global zone
| Rule ID | OSC-97511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The zones service manages the autoboot and graceful shutdown of zones. See the zones(5) and zonecfg(1M) man pages. This service only runs in the global zone. |
Service svc:/system/zones-install is enabled
| Rule ID | OSC-98011 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The zones-install service manages the auto-installation of zones. |
Service svc:/network/inetd is enabled
| Rule ID | OSC-26511 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The inetd service manages the restarting of inet services. See the inetd(1M) man page. |
Service svc:/network/ntp is enabled and properly configured as a client
| Rule ID | OSC-42011 |
| Result | fail |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The Network Time Protocol daemon should be enabled and properly configured as a client. The /etc/inet/ntp.conf file must include at least one server definition. The file should also contain the line "restrict default ignore" to prevent the client from also acting as a server. |
Remediation description:
The ntp service should be installed on all systems
where security and compliance is desired.
If it is not installed on your system,
install it using 'pkg install service/network/ntp'.
Then configure the service properly as a client and enable the service.
| |
Remediation script: | |
Service svc:/network/rpc/bind is enabled
| Rule ID | OSC-62011 |
| Result | pass |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The rpc/bind service manages the conversion of RPC program numbers to universal addresses. See the rpcbind(1M) man page. |
Service svc:/network/rpc/gss is enabled if and only if Kerberos is configured
| Rule ID | OSC-63005 |
| Result | fail |
| Time | 2016-12-24T16:31:49 |
| Severity | medium |
| Identifiers and References | |
| Description | The generic security service (gss) service manages the generation and validation of Generic Security Service Application Program Interface (GSS-API) security tokens. The gssd(1M) daemon operates between the kernel rpc and the GSS-API. Kerberos uses this service. |
Remediation description:
Disable the rpc/gss service
if Kerberos is not configured and not in use.
| |
Remediation script: | |
Service svc:/network/sendmail-client is enabled
| Rule ID | OSC-68011 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | The sendmail-client service manages email on a client. The sendmail-client service needs to be running to ensure delivery of mail to local accounts such as root. See the sendmail(1M) man page. |
Service svc:/network/smtp:sendmail is enabled
| Rule ID | OSC-67511 |
| Result | fail |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | The sendmail service should be running. Otherwise, important system mail to root will not be delivered. If receipt of remote mail is not required, sendmail should be in local_only mode. See check OSC-68505-sendmail-local-only to verify that sendmail is running in local_only mode. See the sendmail(1M) man page. |
Remediation description:
Enable the smtp:sendmail service.
| |
Remediation script: | |
Service svc:/network/smtp:sendmail only listens on loopback
| Rule ID | OSC-68505 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | Check that sendmail listens in local_only mode. This is also called listens on loopback. See the sendmail(1M) and svccfg(1M) man pages |
Service svc:/network/ssh is enabled
| Rule ID | OSC-72011 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | The ssh service manages the Secure Shell (ssh) daemon, which provides secure encrypted communications between two untrusted hosts over an insecure network. By default, ssh is the only network service that can send and receive network packets on a newly-installed Oracle Solaris system. See the sshd(1M) man page. |
Service svc:/application/stosreg is enabled in global zone
| Rule ID | OSC-77011 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | The service tag OS registry inserter (stosreg) service manages the service tag registry. See the stclient(1M) man page. This service only runs in the global zone. |
The NIS client service is disabled or not installed
| Rule ID | OSC-40510 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, NIS client software is not installed. NIS is an RPC-based naming service that does not conform to current security requirements, so can be less secure than the LDAP naming service. See the nis(5) and ypbind(1M) man pages. |
The NIS server service is disabled or not installed
| Rule ID | OSC-41010 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, NIS server software is not installed. NIS is an RPC-based naming service that does not conform to current security requirements, that can be less secure than the LDAP naming service. See the nis(5) and ypserv(1M) man pages. |
The r-protocols services are disabled in PAM
| Rule ID | OSC-55010 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, legacy services such as the r-protocols, rlogin(1) and rsh(1), are not installed. Their services, however, are defined in /etc/pam.d. See the pam.d(4) man page. |
mesg(1) prevents talk(1) and write(1) access to remote terminals
| Rule ID | OSC-34510 |
| Result | fail |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | This program controls whether users can send messages by using write(1), talk(1) or other utilities to a terminal device. See the mesg(1) man page. |
Remediation description:
Deny permission to remote users to send messages to the terminal.
| |
Remediation script: | |
ssh(1) is the only service binding a listener to non-loopback addresses
| Rule ID | OSC-73505 |
| Result | fail |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, ssh(1) is the only network service that can send and receive network packets on a newly-installed Oracle Solaris system. See the sshd(1M) man page. |
SCE stdout | |
Remediation description:
Disable any unneeded services listening on the network.
| |
Remediation script: | |
Service svc:/network/dhcp-server is disabled or not installed
| Rule ID | OSC-10510 |
| Result | pass |
| Time | 2016-12-24T16:31:50 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, the dhcp-server service is not installed. If you are not using this system as a DHCP server, you should not install or enable the service. |
Service svc:/network/dns/multicast is disabled or not installed
| Rule ID | OSC-80010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | Multicast DNS (mDNS) implements DNS in a small network where no conventional DNS server has been installed. DNS Service Discovery (DNS-SD) extends multicast DNS to also provide simple service discovery (network browsing). This service is disabled by default, because while it can ease finding hosts and servers, it can also provide information about the network to malicious users. See the named(1M) and mdnsd(1M) man pages. |
Service svc:/network/finger is disabled or not installed
| Rule ID | OSC-15510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service enables users to display information about local and remote users. By default, this service is not installed as part of solaris-small-server. It is however installed as part of solaris-large-server. This service is almost never needed and either should be removed or at least, disabled. See the fingerd(1M) and finger(1) man pages. |
Service svc:/network/ftp is disabled or not installed
| Rule ID | OSC-17510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | high |
| Identifiers and References | |
| Description | The FTP service provides unencrypted file transfer service and uses plain text authentication. The secure copy program (scp(1)) program should be used instead of FTP as it provides encrypted authentication and file transfer. |
Service svc:/network/http:apache22 is disabled or not installed
| Rule ID | OSC-01010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This program provides Apache web server services by using the Apache hypertext transfer protocol (http). See the httpd(8) man page. |
Service svc:/network/login:rlogin is disabled or not installed
| Rule ID | OSC-58010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service enables users to log in remotely. By default, this service is not installed as part of solaris-small-server. See the rlogind(1M) and rlogin(1) man pages. |
Service svc:/network/login:klogin is disabled or not installed
| Rule ID | OSC-30010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This service enables users to log in remotely with Kerberos authentication. By default, this service is not installed. See the rlogind(1M) and rlogin(1) man pages. |
Service svc:/network/login:eklogin is disabled or not installed
| Rule ID | OSC-12010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This service enables users to log in remotely with Kerberos authentication over an encrypted line. By default, this service is not installed. See the rlogind(1M) and rlogin(1) man pages. |
Service svc:/network/nfs/cbd is disabled or not installed
| Rule ID | OSC-37010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | This service manages communication endpoints for the NFS Version 4 protocol. The nfs4cbd(1M) daemon runs on the NFS Version 4 client and creates a listener port for callbacks. |
Service svc:/network/nfs/client is disabled or not installed
| Rule ID | OSC-37510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | The NFS client service is needed only if the system is mounting files from an NFS server. If the system is not mounting files, the service can be disabled or its package unistalled. See the mount_nfs(1M) man page. |
Service svc:/network/nfs/fedfs-client is disabled or not installed
| Rule ID | OSC-12510 |
| Result | fail |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | The Federated Filesystem (FedFS) client service manages defaults and connection information for LDAP servers that store FedFS information. See the nsdbparams(1M) and fedfs(5) man pages. |
Remediation description:
If you are either not using FedFS
for DNS SRV records or LDAP-based referrals, disable the service.
| |
Remediation script: | |
Service svc:/network/nfs/mapid is disabled or not installed
| Rule ID | OSC-38010 |
| Result | fail |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | The NFS user and group ID mapping daemon service maps to and from NFS version 4 owner and owner_group identification attributes and local UID and GID numbers used by both the NFS version 4 client and server. See the nfsmapid(1M) man page. |
Remediation description:
Disable the service if you are not using NFSv4.
| |
Remediation script: | |
Service svc:/network/nfs/nlockmgr is disabled or not installed
| Rule ID | OSC-38510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | The NFS lock manager supports record locking operations on NFS files in NFSv2 and NFSv3. See the lockd(1M) and sharectl(1M) man pages. |
Service svc:/network/nfs/rquota is disabled or not installed
| Rule ID | OSC-39010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | The remote quota server returns quotas for a user of a local file system which is mounted over NFS. The results are used by quota(1M) to display user quotas for remote file systems. The rquotad(1M) daemon is normally invoked by inetd(1M). |
Service svc:/network/nfs/server is disabled or not installed
| Rule ID | OSC-39510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | The NFS server service handles client file system requests over NFS versions 2, 3, and 4. If this system is not an NFS server, this service should be disabled. See the nfsd(1M) man page. |
Service svc:/network/nfs/status is disabled or not installed
| Rule ID | OSC-40010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | low |
| Identifiers and References | |
| Description | The NFS status monitor service interacts with lockd(1M) to provide the crash and recovery functions for the locking services on NFS. |
Service svc:/network/comsat is disabled or not installed
| Rule ID | OSC-06510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service process listens for reports of incoming mail and notifies interested users. By default, this service is not installed as part of solaris-small-server. See the comsat(1M) man page. |
Service svc:/network/rarp is disabled or not installed
| Rule ID | OSC-55510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service responds to DARPA reverse address resolution protocol (RARP) requests. Historically, RARP was used by machines at boot time to discover their Internet Protocol (IP) address. By default, this service is not installed. See the rarpd(1M) and rarp(7P) man pages. |
Service svc:/network/rexec is disabled or not installed
| Rule ID | OSC-57510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides remote execution facilities with authentication based on user names and passwords. See the in.rexecd(1M) and rexec(3C) man pages. |
Service svc:/network/slp is disabled or not installed
| Rule ID | OSC-70010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service provides common server functionality for the Service Location Protocol (SLP) versions 1 and 2, as defined by IETF in RFC 2165 and RFC 2608. SLP discovers and selects network services. By default, this service is not enabled. See the slpd(1M), slp.conf(4), and slp(7P) man pages. |
Service svc:/network/stdiscover is disabled or not installed
| Rule ID | OSC-76010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy program is used to locate the service tag listener. For more information, see the in.stdiscover(1M) man page. |
Service svc:/network/stlisten is disabled or not installed
| Rule ID | OSC-76510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy program is used to listen for discovery probes. See the in.stlisten(1M) man page. |
Service svc:/network/talk is disabled or not installed
| Rule ID | OSC-79010 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy program enables two-way, screen-oriented communication. For more information, see the talk(1) and mesg(1) man pages. |
Service svc:/network/telnet is disabled or not installed
| Rule ID | OSC-88510 |
| Result | pass |
| Time | 2016-12-24T16:31:51 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service supports the DARPA standard TELNET virtual terminal protocol to connect to a remote system over the TELNET port. By default, this service is not installed. See the telnetd(1M) and telnet(1) man pages. |
Service svc:/network/uucp is disabled or not installed
| Rule ID | OSC-95510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service, UNIX to UNIX copy, provides a user interface for requesting file copy operations, typically used when constant connectivity is not possible. By default, this service is not installed. See the uucpd(1M) and uucp(1C) man pages. |
Service svc:/network/security/kadmin is disabled or not installed
| Rule ID | OSC-28010 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | medium |
| Identifiers and References | |
| Description | The Kerberos administration daemon service runs on the master key distribution center (KDC), which stores the principal and policy databases. This service should not be run on a system that is not a KDC. See the kadmind(1M) man page. |
Service svc:/network/security/krb5_prop is disabled or not installed
| Rule ID | OSC-30510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | medium |
| Identifiers and References | |
| Description | The Kerberos propagation daemon runs on slave KDC servers to update the database from the master KDC. See the kpropd(1M) man page. |
Service svc:/network/security/krb5kdc is disabled or not installed
| Rule ID | OSC-31010 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | medium |
| Identifiers and References | |
| Description | The Kerberos key distribution center service manages Kerberos tickets on the master and slave KDCs. See the krb5kdc(1M) man page. |
Service svc:/network/security/ktkt_warn is disabled or not installed
| Rule ID | OSC-32010 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | medium |
| Identifiers and References | |
| Description | The Kerberos V5 warning messages daemon on Kerberos clients can warn users when their Kerberos tickets are about to expire and can renew the tickets before they expire. By default, this service is disabled. If the system is Kerberos client, then this service should be enabled. See the ktkt_warnd(1M) man page. |
Service svc:/network/shell:default is disabled or not installed
| Rule ID | OSC-69510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | medium |
| Identifiers and References | |
| Description | The remote shell daemon provides remote execution facilities with authentication based on Kerberos V5 or privileged port numbers. The Secure Shell service, svc:/network/ssh, is the best choice for remote execution. See the rshd(1M) and sshd(1M) man pages. |
Service svc:/network/shell:kshell is disabled or not installed
| Rule ID | OSC-31510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | medium |
| Identifiers and References | |
| Description | The remote shell daemon provides remote execution facilities with authentication based on Kerberos V5 or privileged port numbers. The Secure Shell service, svc:/network/ssh, is the best choice for remote execution. See the rshd(1M) and sshd(1M) man pages. |
Service svc:/network/chargen:stream is disabled or not installed
| Rule ID | OSC-06020 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Character Generator Protocol (RFC 864) for TCP. See the in.chargend(1M) man page. |
Service svc:/network/chargen:dgram is disabled or not installed
| Rule ID | OSC-06010 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Character Generator Protocol (RFC 864) for UDP. See the in.chargend(1M) man page. |
Service svc:/network/daytime:stream is disabled or not installed
| Rule ID | OSC-09520 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Daytime Protocol (RFC 867) for TCP. See the in.daytimed(1M) man page. |
Service svc:/network/daytime:dgram is disabled or not installed
| Rule ID | OSC-09510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Daytime Protocol (RFC 867) for UDP. See the in.daytimed(1M) man page. |
Service svc:/network/discard:stream is disabled or not installed
| Rule ID | OSC-11020 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Discard Protocol (RFC 863) for TCP. See the in.discardd(1M) man page. |
Service svc:/network/discard:dgram is disabled or not installed
| Rule ID | OSC-11010 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Discard Protocol (RFC 863) for UDP. See the in.discardd(1M) man page. |
Service svc:/network/echo:stream is disabled or not installed
| Rule ID | OSC-11520 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Echo Protocol (RFC 862) for TCP. See the in.echod(1M) man page. |
Service svc:/network/echo:dgram is disabled or not installed
| Rule ID | OSC-11510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Echo Protocol (RFC 862) for UDP. See the in.echod(1M) man page. |
Service svc:/network/time:stream is disabled or not installed
| Rule ID | OSC-89520 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Time Protocol (RFC 868) for TCP. See the in.timed(1M) man page. |
Service svc:/network/time:dgram is disabled or not installed
| Rule ID | OSC-89510 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | high |
| Identifiers and References | |
| Description | This legacy service provides the server side of the Time Protocol (RFC 868) for UDP. See the in.timed(1M) man page. |
Service svc:/network/rpc/keyserv is disabled or not installed
| Rule ID | OSC-29010 |
| Result | pass |
| Time | 2016-12-24T16:31:52 |
| Severity | low |
| Identifiers and References | |
| Description | keyserv is a daemon that is used for storing the private encryption keys of each user logged into the system. These encryption keys are used for accessing secure network services such as secure NFS. For more information, see the keyserv(1M) man page. |
Service svc:/network/rpc/keyserv cannot use the nobody user key
| Rule ID | OSC-29510 |
| Result | fail |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | The value of ENABLE_NOBODY_KEYS is YES by default. See the keyserv(1M) man page. |
Remediation description:
Edit the /etc/default/keyserv file to change the value
of ENABLE_NOBODY_KEYS to NO.
| |
Remediation script: | |
Service svc:/network/rpc/meta is disabled or not installed
| Rule ID | OSC-64010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service uses an rpc(4) daemon to manage local copies of metadevice diskset information. By default, this service is not installed. See the rpc.metad(1M) man page. |
Service svc:/network/rpc/metamed is disabled or not installed
| Rule ID | OSC-64510 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service manages mediator information for 2-string high availability configurations. See the rpc.metamedd(1M) man page. |
Service svc:/network/rpc/metamh is disabled or not installed
| Rule ID | OSC-65010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service uses an rpc(4) daemon to manage multi-hosted disks. By default, this service is not installed. See the rpc.metamhd(1M) man page. |
Service svc:/network/rpc/rex is disabled or not installed
| Rule ID | OSC-57010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This program is the Oracle Solaris RPC server for remote program execution. If this service is enabled, the daemon is started by inetd(1M) whenever a remote execution request is made. See the rpc.rexd(1M) man page. |
Service svc:/network/rpc/rstat is disabled or not installed
| Rule ID | OSC-66010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service displays performance data from a remote system. By default, this service is not installed. See the rstatd(1M) and rstat(3RPC) man pages. |
Service svc:/network/rpc/rusers is disabled or not installed
| Rule ID | OSC-66510 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This legacy service displays information about users on a remote system. By default, this service is not installed. See the rusersd(1M) and rusers(1) man pages. |
Service svc:/network/rpc/smserver is disabled or not installed
| Rule ID | OSC-65510 |
| Result | fail |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This program is used to access removable media devices. See the rpc.smserverd(1M) man page. |
Remediation description:
Disable the smserver service.
| |
Remediation script: | |
Service svc:/network/rpc/spray is disabled or not installed
| Rule ID | OSC-71510 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This program is a server that records the packets sent by spray(1M). See the rpc.sprayd(1M) man page. |
Service svc:/network/rpc/wall is disabled or not installed
| Rule ID | OSC-96510 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This program broadcasts messages to all logged-in users. See the rpc.rwalld(1M) and wall(1M) man pages. |
Service svc:/network/smb/client is disabled or not installed
| Rule ID | OSC-70510 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | The SMB/CIFS client allows an Oracle Solaris system to natively mount file systems by means of SMB shares from SMB enabled servers such as a Windows system. See the mount_smbfs(1M) man page. |
Service svc:/system/avahi-bridge-dsd is disabled or not installed
| Rule ID | OSC-04010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This program provides an object-oriented interface to DBUS-enabled applications. See the avahi-daemon-bridge-dsd(1) man page. |
Service svc:/system/filesystem/rmvolmgr is disabled or not installed
| Rule ID | OSC-58510 |
| Result | fail |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | The removable volume manager is a HAL-aware volume manager that can automatically mount and unmount removable media and hot-pluggable storage. Users might import malicious programs, or transfer sensitive data off the system. See the rmvolmgr(1M) man page. This service only runs in the global zone. |
Remediation description:
Disable the remote volume manager service.
| |
Remediation script: | |
Service svc:/application/cups/in-lpd is disabled or not installed
| Rule ID | OSC-34010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This service supports the CUPS Line Printer Daemon (LPD) for legacy client systems that use the LPD protocol. By default, this service is not installed. See the cups-lpd(8) man page. |
Service svc:/application/graphical-login/gdm is disabled or not installed
| Rule ID | OSC-19510 |
| Result | fail |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | The GNOME Display Manager manages the displays on a system, including the console display, attached displays, XDMCP displays, and virtual terminals. If a windowing display is not needed, this service should be disabled. See the gdm(1M) man page. |
Remediation description:
Disable this service if a windows login is not needed on this system.
| |
Remediation script: | |
Service svc:/application/management/net-snmp is disabled or not installed
| Rule ID | OSC-71010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | The Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment. The net-snmp SNMP daemon processes requests from SNMP management software. See the snmpd(8) and snmp_config(5) man pages. |
Service svc:/application/x11/xfs is disabled or not installed
| Rule ID | OSC-97010 |
| Result | pass |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | This program provides fonts to X Window System display servers. The server is usually run by inetd(1M). See the xfs(1) and fsadmin(1) man pages. |
/etc/motd and /etc/issue contain appropriate policy text
| Rule ID | OSC-35000 |
| Result | fail |
| Time | 2016-12-24T16:31:53 |
| Severity | medium |
| Identifiers and References | |
| Description | The /etc/issue and /etc/motd (message of the day) files are designed to hold system and security information. The contents of the /etc/issue file are displayed prior to the login prompt on the console, or in a window if the file is called from the GNOME Display Manager (gdm). Several applications call this file, such as Secure Shell and FTP. The /etc/motd contents are displayed after login. By default, the /etc/motd file exists while the /etc/issue file does not. See the issue(4), gdm(1M), and sshd_config(4) man pages. |
Remediation description:
Edit the /etc/motd file and create and edit the /etc/issue file
to add the security policy text that your legal department supplies.
An administrator with the Administrator Message Edit rights profile
can edit these files.
| |
Remediation script: | |
The ftp(1) banner shows a suitable security message
| Rule ID | OSC-18000 |
| Result | pass |
| Time | 2016-12-24T16:31:54 |
| Severity | medium |
| Identifiers and References | |
| Description | The banner informs users who are attempting to access the system that the system is monitored. Note that the pkg:/service/network/ftp package must be installed for ftp to work. |
The gdm(1M) banner shows a suitable security message
| Rule ID | OSC-20500 |
| Result | fail |
| Time | 2016-12-24T16:31:54 |
| Severity | medium |
| Identifiers and References | |
| Description | The banner informs users who are attempting to access the system that the system is monitored. The banner uses the /etc/issue file. See the issue(4) and gdm(1M) man pages. |
Remediation description:
Modify the /etc/gdm/Init/Default file to display a dialog box
with the contents of the /etc/issue file.
zenity(1) displays simple GNOME dialogs.
| |
Remediation script: | |
The ssh(1) banner shows a suitable security message
| Rule ID | OSC-75000 |
| Result | pass |
| Time | 2016-12-24T16:31:54 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, the ssh(1) banner displays the contents of the /etc/issue file. See the issue(4) and sshd_config(4) man pages. |
The telnet(1) banner shows a suitable security message
| Rule ID | OSC-89000 |
| Result | pass |
| Time | 2016-12-24T16:31:54 |
| Severity | medium |
| Identifiers and References | |
| Description | The telnetd(1M) DARPA TELNET protocol server is a legacy service that does not conform to current security requirements. By default, this service is not installed, and systems use the ssh(1M) protocol to communicate. |
Use of the cron(1M) and at(1) daemons is restricted
| Rule ID | OSC-08505 |
| Result | fail |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | The cron(1M) and at(1) daemons execute commands at specified dates and times. Only qualified accounts should be allowed to run commands at arbitrary times on the system. |
SCE stdout | |
Remediation description:
In order to restrict cron(1M) and at(1) properly,
the file /etc/cron.d/cron.allow should exist
and have only one entry for root.
In addition, the file /etc/cron.d/at.allow should exist and be empty.
| |
Remediation script: | |
Name services are set to all local (files) only
| Rule ID | OSC-36500 |
| Result | fail |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | The operating system uses a number of databases of information about hosts, ipnodes, users (passwd(4), shadow(4), and user_attr(4)), and groups. Data for these can come from a variety of sources: hostnames and host addresses, for example, can be found in /etc/hosts, NIS, LDAP, DNS, or Multicast DNS. Systems in restricted environments may be more secure if only local files entries are used for these entries. See the nsswitch.conf(4) man page for more information |
Remediation description:
If the system does not need to use remote name services,
make sure that the name service is set to local files only.
See the nsswitch.conf(4) man page.
| |
Remediation script: | |
Find and list remote consoles
| Rule ID | OSC-56505 |
| Result | pass |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | Remote consoles can be a source of unauthorized access. A system console should be kept physically secure and no unauthorized consoles should be defined. The "consadm -p" command displays alternate consoles across reboots. If none are defined, the command displays no output. See the consadm(1M) man page. |
SCE stdout | |
Remote serial logins are disabled
| Rule ID | OSC-69010 |
| Result | pass |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | Serial logins can be a source of unauthorized access. Login services should not be enabled for serial ports that are not required to support the purpose of the system. |
root access is console-only
| Rule ID | OSC-59510 |
| Result | pass |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | The root account should not be able to log in remotely, and its actions should be monitored. See the login(1) man page. |
ftp(1) is restricted to a specific set of users
| Rule ID | OSC-19000 |
| Result | pass |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | FTP file transfers should not be available to all users, and must require qualified users to supply their names and password. In general, system users should not be allowed to use FTP. This check verifies that system accounts are included in the /etc/ftpd/ftpusers file so that they are not allowed to use FTP. See the ftp(1) man page. |
Files written in ftp(1) sessions have a suitable umask
| Rule ID | OSC-18500 |
| Result | pass |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | The FTP server does not necessarily use the user's system file creation mask. Setting the FTP umask ensures that files transmitted over FTP use a strong file creation umask. See the umask(1) and proftpd(8) man pages. |
The GNOME desktop has suitable screensaver settings
| Rule ID | OSC-21000 |
| Result | pass |
| Time | 2016-12-24T16:31:55 |
| Severity | medium |
| Identifiers and References | |
| Description | The timeout parameter for the xscreensaver application specifies the amount of time that the keyboard and mouse can be inactive before a password-protected screensaver appears. See the xscreensaver(1) man page. |
gdm(1M) does not accept logins without passwords
| Rule ID | OSC-20010 |
| Result | pass |
| Time | 2016-12-24T16:31:56 |
| Severity | high |
| Identifiers and References | |
| Description | Automatic logins are a known security risk for other than public kiosks. By default, GNOME automatic login is disallowed, so users must supply a password. Automatic and Timed login is controlled by the entries in /etc/gdm/custom.conf See the gdm(1M) man page. |
ssh(1) requires passwords
| Rule ID | OSC-73010 |
| Result | fail |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | Logins without a password put the system at risk. In the default remote login service, Secure Shell, the PermitEmptyPasswords parameter in the /etc/ssh/sshd_config file should remain set to no. See the sshd_config(4) man page. |
Remediation description:
Ensure that PermitEmptyPasswords value
in the /etc/ssh/sshd_config file has not been changed.
The default value is no.
If you reset the value, restart the ssh service.
| |
Remediation script: | |
ssh(1) does not forward X11
| Rule ID | OSC-74510 |
| Result | fail |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | The X11Forwarding parameter in the /etc/ssh/sshd_config file specifies whether users can forward an X Window session through an encrypted tunnel. This parameter allows the remote user to display windows remotely over Secure Shell. See the sshd_config(1M) and X(5) man pages. |
Remediation description:
By default, X11Forwarding is set to yes.
X11Forwarding could permit a malicious user
to secretly open an X11 connection to a different client
and perform unobtrusive activities such as keystroke monitoring.
If the remote window display is not required, disable or restrict it,
then restart the ssh service.
| |
Remediation script: | |
Consecutive login attempts for ssh(1) are limited
| Rule ID | OSC-72511 |
| Result | fail |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, the MaxAuthTries parameter in the /etc/ssh/sshd_config file is set to 6. This parameter specifies the maximum number of authentication attempts that the server permits before ending the connection. By restricting the number of failed authentication attempts, Secure Shell lessens the effectiveness of brute-force login attempts. It is important to note that setting MaxAuthTries to 6 actually provides only 3 failed login attempts because of the way SSH counts failures. See the sshd_config(4) man page. |
Remediation description:
Set the MaxAuthTries parameter in the /etc/ssh/sshd_config file
to the value that site security requires, then restart the ssh service.
| |
Remediation script: | |
rhost-based authentication in ssh(1) is disabled
| Rule ID | OSC-74010 |
| Result | pass |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | rhost-based authentication in Secure Shell allows users to remotely log in without supplying a password. The IgnoreRhosts parameter specifies whether .rhosts and .shosts files can be used rather than a password. See the sshd_config(4) and hosts.equiv(4) man pages. |
root login by using ssh(1) is disabled
| Rule ID | OSC-61510 |
| Result | pass |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, remote root logins are not permitted because root is a role and roles cannot log in. If root has been changed to a user, the default value of the PermitRootLogin parameter in the /etc/ssh/sshd_config file prevents root from remotely logging in. See the sshd_config(4) man page. |
The auditd(1M) daemon is enabled
| Rule ID | OSC-02511 |
| Result | pass |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | Auditing is a service, svc:/system/auditd, that is enabled by default and should not be disabled. See the audit(1M) man page. |
Audit parameters are set to recommended values
| Rule ID | OSC-02001 |
| Result | fail |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | At minimum, events in the lo class are audited and audit policy is set to argv,cnt. Add audit classes and policy per your site's security requirements. See the auditconfig(1M) man page. |
SCE stdout | |
Remediation description:
An administrator with the Audit Configuration rights profile
can get and set audit parameters.
| |
Remediation script: | |
All roles are audited with the "cusa" audit class
| Rule ID | OSC-03000 |
| Result | fail |
| Time | 2016-12-24T16:31:56 |
| Severity | medium |
| Identifiers and References | |
| Description | The cusa audit class contains events that cover administrative actions that could affect the system's security posture. See the audit_class(4), audit_event(4), rolemod(1M), and userattr(1) man pages. |
SCE stdout | |
Remediation description:
Check that all roles are being audited with the cusa audit class.
By default, only the root role can set audit flags
for individual accounts.
| |
Remediation script: | |
Passwords are hashed with a secure algorithm
| Rule ID | OSC-44000 |
| Result | pass |
| Time | 2016-12-24T16:31:57 |
| Severity | high |
| Identifiers and References | |
| Description | The hash used is determined by values of CRYPT_ALGORITHMS_ALLOW and CRYPT_DEFAULT set in /etc/security/policy.conf file. The value for SHA-256 is "5", and the value for SHA-512 is "6". To confirm properly set, the second field in the /etc/shadow file indicates the algorithm that was used to create the password hash. If the algorithm is set to SHA-256, the entry begins with "$5$" If the algorithm is set to SHA-512, the entry begins with "$6$" See the crypt.conf(4) and policy.conf(4) man pages. |
Password history logs the last ten passwords
| Rule ID | OSC-44510 |
| Result | fail |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | HISTORY in the /etc/default/passwd file prevents users from using similar passwords within the HISTORY value. If MINWEEKS is set to 3 and HISTORY is set to 10, passwords are checked for reuse for ten months. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the HISTORY variable to 10.
| |
Remediation script: | |
Passwords allow repeat characters
| Rule ID | OSC-45000 |
| Result | pass |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MAXREPEATS in the `/etc/default/passwd file allows users to repeat characters in passwords. The default is 0, which permits repeated characters. Any other value indicates how many characters can be repeated. See the passwd(1) man page. |
Passwords allow whitespace
| Rule ID | OSC-52000 |
| Result | pass |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | WHITESPACE in the /etc/default/login file indicates whether passwords can include the space character. The space character provides some protection against dictionary-based password attacks. The default is YES. See the passwd(1) man page. |
Passwords require at least two alphabetic characters
| Rule ID | OSC-46502 |
| Result | pass |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MINALPHA in the /etc/default/passwd file indicates the minimum number of alphabetic characters that passwords must contain. Alphabetic characters provide more values than numeric or special characters, so allow for more variation. The default value is 2. See the passwd(1) man page. |
Passwords require at least three characters difference from the previous password
| Rule ID | OSC-47003 |
| Result | pass |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MINDIFF in the /etc/default/passwd file indicates the minimum difference a password must have from the previous password. The default is 3. See the passwd(1) man page. |
Passwords require at least one digit
| Rule ID | OSC-47501 |
| Result | fail |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MINDIGIT in the /etc/default/passwd file indicates the minimum number of digits that a password must contain. Digits provide some protection against dictionary-based password attacks. The default is 0. A value of at least 1 is recommended. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the MINDIGIT variable to 1.
| |
Remediation script: | |
Passwords require at least one lowercase character
| Rule ID | OSC-48001 |
| Result | fail |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MINLOWER in the /etc/default/passwd file indicates the minimum number of lowercase letters that a password must contain. This provides some protection against dictionary-based password attacks. The default is 0. A value of at least 1 is recommended. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the MINLOWER variable to 1.
| |
Remediation script: | |
Passwords require a minimum of one non-alphabetic character
| Rule ID | OSC-48501 |
| Result | pass |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MINNONALPHA in the /etc/default/passwd file indicates the minimum number of non-alphabetic characters that a password must contain. Non-alphabetic characters provide some protection against dictionary-based password attacks. The default is 0. A value of at least 1 is recommended. See the passwd(1) man page. |
Passwords require at least one special character
| Rule ID | OSC-49001 |
| Result | fail |
| Time | 2016-12-24T16:31:57 |
| Severity | medium |
| Identifiers and References | |
| Description | MINSPECIAL in the /etc/default/passwd file indicates the minimum number of special characters that a password must contain. Special characters provide some protection against dictionary-based password attacks. The default is 0. A value of at least 1 is recommended. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the MINSPECIAL variable to 1.
| |
Remediation script: | |
Passwords require at least one uppercase character
| Rule ID | OSC-49501 |
| Result | fail |
| Time | 2016-12-24T16:31:58 |
| Severity | medium |
| Identifiers and References | |
| Description | MINUPPER in the /etc/default/passwd file indicates the minimum number of uppercase letters that a password must contain. Uppercase letters provide some protection against dictionary-based password attacks. The default is 0. A value of at least 1 is recommended. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the MINUPPER variable to 1.
| |
Remediation script: | |
Passwords require at least eight characters
| Rule ID | OSC-46008 |
| Result | fail |
| Time | 2016-12-24T16:31:59 |
| Severity | high |
| Identifiers and References | |
| Description | PASSLENGTH in the /etc/default/login file indicates the minimum number of characters that a password must contain. A longer password length plus a strong password hashing algorithm provide some protection against password attacks. The default for Oracle Solaris 12 is 8. See the passwd(1) man page. |
Remediation description:
In the /etc/default/login file, set the PASSLENGTH variable to 8.
| |
Remediation script: | |
Passwords cannot be changed for at least three weeks
| Rule ID | OSC-50003 |
| Result | fail |
| Time | 2016-12-24T16:31:59 |
| Severity | medium |
| Identifiers and References | |
| Description | MINWEEKS in the /etc/default/passwd file indicates the minimum number of weeks before a password can be changed. This value prevents users from reusing a password quickly. The default is unspecified. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the MINWEEKS variable to 3.
| |
Remediation script: | |
Passwords must be changed at least every 13 weeks
| Rule ID | OSC-45513 |
| Result | fail |
| Time | 2016-12-24T16:31:59 |
| Severity | medium |
| Identifiers and References | |
| Description | MAXWEEKS in the /etc/default/passwd file indicates the maximum number of weeks that a password can be used. This value is a balance between users remembering a new password and malicious users attacking long-term passwords. The default is unspecified. See the passwd(1) man page. |
Remediation description:
In the /etc/default/passwd file, set the MAXWEEKS variable to 13.
| |
Remediation script: | |
DICTIONBDIR is set to /var/passwd
| Rule ID | OSC-43500 |
| Result | pass |
| Time | 2016-12-24T16:31:59 |
| Severity | medium |
| Identifiers and References | |
| Description | DICTIONBDIR in the /etc/default/passwd file points to the /var/passwd dictionary by default. A password dictionary can strengthen users' password selection by preventing the use of common words or letter combinations. The passwd command performs dictionary lookups in the dictionary that DICTIONBDIR indicates. See the passwd(1) man page. |
DISABLETIME is set for logins
| Rule ID | OSC-32500 |
| Result | pass |
| Time | 2016-12-24T16:31:59 |
| Severity | medium |
| Identifiers and References | |
| Description | DISABLETIME in the /etc/default/login file is set to 20 by default. Any value greater than zero indicates the seconds before a login prompt appears after RETRIES failed login attempts. This delay can mitigate rapid-fire, brute force attacks on passwords. See the login(1) man page. |
SLEEPTIME following an invalid login attempt is set to 4
| Rule ID | OSC-33500 |
| Result | pass |
| Time | 2016-12-24T16:31:59 |
| Severity | medium |
| Identifiers and References | |
| Description | SLEEPTIME in the /etc/default/login file is set to 4 by default. This number indicates the number of seconds that elapse before the "login incorrect" message appears after an incorrect password is typed. The maximum number is 5. This delay can mitigate rapid-fire, brute force attacks on passwords. See the login(1) man page. |
NAMECHECK for passwords is set to YES
| Rule ID | OSC-50500 |
| Result | pass |
| Time | 2016-12-24T16:31:59 |
| Severity | medium |
| Identifiers and References | |
| Description | NAMECHECK in the /etc/default/passwd file indicates whether login names are checked in the files naming service. The default, YES, prevents malicious users from using a login name that is not in a local file. See the passwd(1) man page. |
Logins require passwords
| Rule ID | OSC-33000 |
| Result | pass |
| Time | 2016-12-24T16:31:59 |
| Severity | high |
| Identifiers and References | |
| Description | PASSREQ in the /etc/default/login file indicates whether logins require passwords. Passwords are required for defense against computer attacks. The default is YES. See the login(1) man page. |
Default system accounts are locked
| Rule ID | OSC-26005 |
| Result | pass |
| Time | 2016-12-24T16:32:00 |
| Severity | medium |
| Identifiers and References | |
| Description | Oracle Solaris is installed with correctly configured system accounts. These accounts should not be modified. |
Default system accounts are no-login
| Rule ID | OSC-51505 |
| Result | pass |
| Time | 2016-12-24T16:32:00 |
| Severity | medium |
| Identifiers and References | |
| Description | Oracle Solaris is installed with correctly configured system accounts. These accounts should not be modified. |
Reserved system accounts remain unused
| Rule ID | OSC-25505 |
| Result | fail |
| Time | 2016-12-24T16:32:00 |
| Severity | medium |
| Identifiers and References | |
| Description | Accounts whose ID is 100 or less are system accounts. These accounts should not be replaced or reconfigured. |
SCE stdout | |
Remediation description:
Users should not be assigned UIDs less than 100
and existing system accounts should not be renamed or renumbered.
Undo any changes that have made involving these accounts.
See the usermod(1M) man page.
| |
Remediation script: | |
root is a role
| Rule ID | OSC-59000 |
| Result | pass |
| Time | 2016-12-24T16:32:00 |
| Severity | medium |
| Identifiers and References | |
| Description | By default, root is a role. Roles cannot log in directly. Rather, a user logs in and then assumes the root role, thus providing an audit trail of who is operating as root. See the roles(1), user_attr(4), and usermod(1M) man pages. |
root is the only user with UID=0
| Rule ID | OSC-61001 |
| Result | pass |
| Time | 2016-12-24T16:32:01 |
| Severity | medium |
| Identifiers and References | |
| Description | The UID of 0 has superuser privileges. Only root should have those privileges. |
The root password is hashed with the SHA-256 algorithm
| Rule ID | OSC-60000 |
| Result | pass |
| Time | 2016-12-24T16:32:01 |
| Severity | high |
| Identifiers and References | |
| Description | The second field in the /etc/shadow file indicates the algorithm that was used to create the password hash. If the entry begins with "$5$", then password is hashed with SHA-256 algorithm. If the entry begins with "$6$", then password is hashed with SHA-512 algorithm. See the crypt.conf(4) and policy.conf(4) man pages. |
The root PATH variable is correct
| Rule ID | OSC-60505 |
| Result | pass |
| Time | 2016-12-24T16:32:02 |
| Severity | medium |
| Identifiers and References | |
| Description | The root PATH variable should not include the current directory (.), or any paths not related to administration. |
Role details are unchanged
| Rule ID | OSC-56000 |
| Result | fail |
| Time | 2016-12-24T16:32:24 |
| Severity | medium |
| Identifiers and References | |
| Description | Oracle Solaris ships with Role Based Access Control (RBAC). This feature enables administrators to delegate specific, limited, additional privileges and authorizations to individual users to administer parts of the system without giving them access to the root account. The provided rights databases should not be changed directly. To add rights to roles, use the roleadd and rolemod commands. These commands add entries to the /etc/user_attr file. See the profiles(1), auths(1), roles(1), rbac(5), roleadd(1M), rolemod(1M), and user_attr(4) man pages. |
SCE stdout | |
Remediation description:
The files in /etc/user_attr.d/ should not be changed;
changes and additions should be made
using the roleadd(1M), rolemod(1M), profiles(1), auths(1),
and usermod(1M) commands.
| |
Remediation script: | |
shadow(4) password fields are not empty
| Rule ID | OSC-51005 |
| Result | pass |
| Time | 2016-12-24T16:32:24 |
| Severity | high |
| Identifiers and References | |
| Description | The second field in the /etc/shadow file contains passwords. When creating roles, you can easily forget to assign a password. See the shadow(4) and passwd(1) man pages. |
All groups specified in /etc/passwd are defined in /etc/group
| Rule ID | OSC-24505 |
| Result | pass |
| Time | 2016-12-24T16:32:24 |
| Severity | medium |
| Identifiers and References | |
| Description | Users are assigned to at least one group and can be assigned to secondary groups. All groups must be defined in the /etc/group file. |
Find and list duplicate GIDs
| Rule ID | OSC-22500 |
| Result | pass |
| Time | 2016-12-24T16:32:24 |
| Severity | medium |
| Identifiers and References | |
| Description | Groups, like users, are unique. Duplicate group IDs must be removed. |
Find and list duplicate group names
| Rule ID | OSC-23000 |
| Result | pass |
| Time | 2016-12-24T16:32:24 |
| Severity | medium |
| Identifiers and References | |
| Description | Groups, like users, are unique. Duplicate group names must be removed. |
Find and list duplicate UIDs
| Rule ID | OSC-23500 |
| Result | pass |
| Time | 2016-12-24T16:32:24 |
| Severity | medium |
| Identifiers and References | |
| Description | Users are identified by IDs, which must be unique. Duplicate user IDs must be removed. |
Find and list duplicate usernames
| Rule ID | OSC-24000 |
| Result | pass |
| Time | 2016-12-24T16:32:24 |
| Severity | medium |
| Identifiers and References | |
| Description | Users log in by name, which must be unique. Duplicate user names must be removed. |
Inactive user accounts will be locked after 35 days
| Rule ID | OSC-25000 |
| Result | fail |
| Time | 2016-12-24T16:32:25 |
| Severity | medium |
| Identifiers and References | |
| Description | Inactive user accounts can provide a back door into the system. User accounts should be locked after a period of inactivity. |
SCE stdout | |
Remediation description:
Inactive user accounts can be locked in a number of ways.
MAXWEEKS can be set in the /etc/default/passwd file;
alternatively, defaults can be set using useradd.
See the useradd(1M), passwd(1), and passwd(4) man pages.
| |
Remediation script: | |
The default user UMASK is 022
| Rule ID | OSC-94000 |
| Result | pass |
| Time | 2016-12-24T16:32:25 |
| Severity | medium |
| Identifiers and References | |
| Description | UMASK in the /etc/default/login file indicates the permissions on user files at creation. This value should not allow group or world write. The default value is 022, which allows group and world to read files owned by a user. See the login(1) man page. |
Local users are assigned home directories
| Rule ID | OSC-94501 |
| Result | pass |
| Time | 2016-12-24T16:32:27 |
| Severity | medium |
| Identifiers and References | |
| Description | Users need a place to store and create files. A home directory enables a user to place configuration files, such as the .profile file, and ongoing work in a directory that is owned by the user. |
Home directories for all users exist
| Rule ID | OSC-93505 |
| Result | pass |
| Time | 2016-12-24T16:32:27 |
| Severity | medium |
| Identifiers and References | |
| Description | Users need a place to store and create files. A home directory enables a user to place configuration files, such as the .profile file, and ongoing work in a directory that is owned by the user. |
User home directories have appropriate permissions
| Rule ID | OSC-93005 |
| Result | fail |
| Time | 2016-12-24T16:32:27 |
| Severity | medium |
| Identifiers and References | |
| Description | Home directories must be writable and searchable by their owners. Typically, other users do not have rights to modify those files or add files to the user's home directory. |
SCE stdout | |
Remediation description:
User home directories should have permissions of 750
to prevent other users
from having inappropriate access to their files.
| |
Remediation script: | |
User home directory ownership is correct
| Rule ID | OSC-92505 |
| Result | pass |
| Time | 2016-12-24T16:32:28 |
| Severity | medium |
| Identifiers and References | |
| Description | The user must own the user's home directory. |
Find and list .rhosts files
| Rule ID | OSC-91505 |
| Result | pass |
| Time | 2016-12-24T16:32:28 |
| Severity | medium |
| Identifiers and References | |
| Description | .rhosts files can provide easy access to remote hosts by bypassing the password requirement. These files should be removed. |
Find and list .forward files
| Rule ID | OSC-90000 |
| Result | pass |
| Time | 2016-12-24T16:32:28 |
| Severity | medium |
| Identifiers and References | |
| Description | .forward files can provide easy transport of information outside the firewall or outside the user's home directory. |
Find and list .netrc files
| Rule ID | OSC-90500 |
| Result | pass |
| Time | 2016-12-24T16:32:28 |
| Severity | medium |
| Identifiers and References | |
| Description | The .netrc file contains data for logging in to a remote host over the network for file transfers by FTP. |
Permissions on User .netrc Files are correct
| Rule ID | OSC-91005 |
| Result | pass |
| Time | 2016-12-24T16:32:28 |
| Severity | medium |
| Identifiers and References | |
| Description | The .netrc file contains login credentials to remote systems for file transfers by FTP. The permissions should be set to disallow read access by group and others. See the chmod(1) man page. |
Permissions on User "." (Hidden) Files are correct
| Rule ID | OSC-92005 |
| Result | pass |
| Time | 2016-12-24T16:32:28 |
| Severity | medium |
| Identifiers and References | |
| Description | Hidden files in a user's home directory should be owned by the user. Directories should allow read-write-execute (rwx) permissions to the user only. Files should allow read-write (rw) permissions to the user only. |
SCE stdout | |