kriterion 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +2 -0
- data/.ruby-version +1 -0
- data/.travis.yml +5 -0
- data/Dockerfile +18 -0
- data/Gemfile +12 -0
- data/Gemfile.lock +62 -0
- data/LICENSE.txt +21 -0
- data/README.md +58 -0
- data/Rakefile +6 -0
- data/bin/setup +8 -0
- data/bin/update_stigs.rb +42 -0
- data/criterion.gemspec +31 -0
- data/docker-compose.yml +14 -0
- data/exe/kriterion +16 -0
- data/lib/kriterion.rb +16 -0
- data/lib/kriterion/api.rb +27 -0
- data/lib/kriterion/backend.rb +13 -0
- data/lib/kriterion/backend/mongodb.rb +235 -0
- data/lib/kriterion/cli.rb +28 -0
- data/lib/kriterion/cli/api.rb +35 -0
- data/lib/kriterion/cli/worker.rb +35 -0
- data/lib/kriterion/event.rb +36 -0
- data/lib/kriterion/item.rb +42 -0
- data/lib/kriterion/logs.rb +14 -0
- data/lib/kriterion/metrics.rb +22 -0
- data/lib/kriterion/object.rb +50 -0
- data/lib/kriterion/report.rb +69 -0
- data/lib/kriterion/resource.rb +60 -0
- data/lib/kriterion/section.rb +32 -0
- data/lib/kriterion/standard.rb +65 -0
- data/lib/kriterion/version.rb +3 -0
- data/lib/kriterion/worker.rb +280 -0
- data/standards/cis_red_hat_enterprise_linux_7.json +34 -0
- data/standards/stig_a10_networks_adc_alg.json +209 -0
- data/standards/stig_a10_networks_adc_ndm.json +233 -0
- data/standards/stig_active_directory_domain.json +257 -0
- data/standards/stig_active_directory_forest.json +41 -0
- data/standards/stig_active_directory_service_2003.json +173 -0
- data/standards/stig_active_directory_service_2008.json +167 -0
- data/standards/stig_adobe_acrobat_pro_xi.json +167 -0
- data/standards/stig_adobe_acrobat_reader_dc_classic_track.json +179 -0
- data/standards/stig_adobe_acrobat_reader_dc_continuous_track.json +179 -0
- data/standards/stig_adobe_coldfusion_11.json +611 -0
- data/standards/stig_airwatch_mdm.json +185 -0
- data/standards/stig_aix_5.3.json +3095 -0
- data/standards/stig_aix_6.1.json +3047 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_alg.json +209 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_ndm.json +155 -0
- data/standards/stig_android_2.2_dell.json +311 -0
- data/standards/stig_apache_2.2_serverwindows.json +347 -0
- data/standards/stig_apache_2.2_sitewindows_security_implementation_guide.json +179 -0
- data/standards/stig_apache_server_2.0unix.json +341 -0
- data/standards/stig_apache_server_2.0windows.json +341 -0
- data/standards/stig_apache_server_2.2unix.json +347 -0
- data/standards/stig_apache_server_2.2windows.json +347 -0
- data/standards/stig_apache_site_2.0unix.json +185 -0
- data/standards/stig_apache_site_2.0windows.json +179 -0
- data/standards/stig_apache_site_2.2unix.json +185 -0
- data/standards/stig_apache_site_2.2windows.json +179 -0
- data/standards/stig_apple_ios6.json +341 -0
- data/standards/stig_apple_ios_10.json +245 -0
- data/standards/stig_apple_ios_11.json +269 -0
- data/standards/stig_apple_ios_4_good_mobility_suite_interim_security_configuration_guide_iscg.json +257 -0
- data/standards/stig_apple_ios_5.json +329 -0
- data/standards/stig_apple_ios_6.json +335 -0
- data/standards/stig_apple_ios_6_interim_security_configuration_guide_iscg.json +371 -0
- data/standards/stig_apple_ios_7.json +185 -0
- data/standards/stig_apple_ios_8_interim_security_configuration_guide.json +251 -0
- data/standards/stig_apple_ios_9_interim_security_configuration_guide.json +245 -0
- data/standards/stig_apple_os_x_10.10_yosemite_workstation.json +851 -0
- data/standards/stig_apple_os_x_10.11.json +725 -0
- data/standards/stig_apple_os_x_10.12.json +737 -0
- data/standards/stig_apple_os_x_10.8_mountain_lion_workstation.json +1241 -0
- data/standards/stig_apple_os_x_10.9_mavericks_workstation.json +809 -0
- data/standards/stig_application_layer_gateway_alg_security_requirements_guide_srg.json +911 -0
- data/standards/stig_application_layer_gateway_security_requirements_guide.json +911 -0
- data/standards/stig_application_security_and_development.json +1745 -0
- data/standards/stig_application_security_and_development_checklist.json +959 -0
- data/standards/stig_application_security_requirements_guide.json +1961 -0
- data/standards/stig_application_server_security_requirements_guide.json +791 -0
- data/standards/stig_arcgisserver_10.3.json +143 -0
- data/standards/stig_arista_mls_dcs-7000_series_l2s.json +53 -0
- data/standards/stig_arista_mls_dcs-7000_series_ndm.json +197 -0
- data/standards/stig_arista_mls_dcs-7000_series_rtr.json +143 -0
- data/standards/stig_bind_9.x.json +431 -0
- data/standards/stig_bind_dns.json +317 -0
- data/standards/stig_blackberry_10.2.x_os.json +179 -0
- data/standards/stig_blackberry_10_os.json +227 -0
- data/standards/stig_blackberry_bes_12.3.x_mdm.json +65 -0
- data/standards/stig_blackberry_bes_12.5.x_mdm.json +65 -0
- data/standards/stig_blackberry_device_service_6.2.json +425 -0
- data/standards/stig_blackberry_enterprise_mobility_server_2.x.json +149 -0
- data/standards/stig_blackberry_enterprise_server,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server,_part_3.json +647 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_3.json +653 -0
- data/standards/stig_blackberry_enterprise_service_v10.1.x_blackberry_device_service.json +317 -0
- data/standards/stig_blackberry_enterprise_service_v10.2.x_blackberry_device_service.json +263 -0
- data/standards/stig_blackberry_handheld_device.json +125 -0
- data/standards/stig_blackberry_os_10.3.x.json +257 -0
- data/standards/stig_blackberry_os_7.x.json +107 -0
- data/standards/stig_blackberry_os_7.x.x.json +101 -0
- data/standards/stig_blackberry_os_version_5-7.json +107 -0
- data/standards/stig_blackberry_playbook.json +65 -0
- data/standards/stig_blackberry_playbook_os_nea_mode.json +65 -0
- data/standards/stig_blackberry_playbook_os_v2.1.json +197 -0
- data/standards/stig_blackberry_uem_12.7.json +59 -0
- data/standards/stig_bluetoothzigbee.json +35 -0
- data/standards/stig_ca_api_gateway_alg.json +497 -0
- data/standards/stig_cisco_css_dns.json +71 -0
- data/standards/stig_cisco_ios_xe_release_3_ndm.json +395 -0
- data/standards/stig_cisco_ios_xe_release_3_rtr.json +149 -0
- data/standards/stig_cmd_management_server_policy.json +53 -0
- data/standards/stig_commercial_mobile_device_cmd_policy.json +83 -0
- data/standards/stig_csfc_campus_wlan_policy_security_implementation_guide.json +95 -0
- data/standards/stig_database_security_requirements_guide.json +767 -0
- data/standards/stig_dbn-6300_idps.json +107 -0
- data/standards/stig_dbn-6300_ndm.json +359 -0
- data/standards/stig_defense_switched_network.json +683 -0
- data/standards/stig_defense_switched_network_dsn.json +653 -0
- data/standards/stig_desktop_applications_general.json +41 -0
- data/standards/stig_dns_policy.json +155 -0
- data/standards/stig_domain_name_system_dns_security_requirements_guide.json +599 -0
- data/standards/stig_draft_aix.json +3503 -0
- data/standards/stig_edb_postgres_advanced_server.json +665 -0
- data/standards/stig_email_services_policy.json +137 -0
- data/standards/stig_exchange_2010_client_access_server.json +179 -0
- data/standards/stig_exchange_2010_edge_transport_server.json +389 -0
- data/standards/stig_exchange_2010_hub_transport_server.json +269 -0
- data/standards/stig_exchange_2010_mailbox_server.json +209 -0
- data/standards/stig_f5_big-ip_access_policy_manager_11.x.json +149 -0
- data/standards/stig_f5_big-ip_advanced_firewall_manager_11.x.json +41 -0
- data/standards/stig_f5_big-ip_application_security_manager_11.x.json +89 -0
- data/standards/stig_f5_big-ip_device_management_11.x.json +467 -0
- data/standards/stig_f5_big-ip_local_traffic_manager_11.x.json +407 -0
- data/standards/stig_final_draft_general_wireless_policy.json +71 -0
- data/standards/stig_firewall.json +449 -0
- data/standards/stig_firewall_-_cisco.json +449 -0
- data/standards/stig_firewall_security_requirements_guide.json +257 -0
- data/standards/stig_forescout_counteract_alg.json +83 -0
- data/standards/stig_forescout_counteract_ndm.json +239 -0
- data/standards/stig_free_space_optics_device.json +143 -0
- data/standards/stig_general_mobile_device_policy_non-enterprise_activated.json +113 -0
- data/standards/stig_general_mobile_device_technical_non-enterprise_activated.json +59 -0
- data/standards/stig_general_purpose_operating_system_srg.json +1199 -0
- data/standards/stig_general_wireless_policy.json +71 -0
- data/standards/stig_good_mobility_suite_server_android_os.json +203 -0
- data/standards/stig_good_mobility_suite_server_apple_ios_4_interim_security_configuration_guide_iscg.json +209 -0
- data/standards/stig_good_mobility_suite_server_windows_phone_6.5.json +449 -0
- data/standards/stig_goodenterprise_8.x.json +401 -0
- data/standards/stig_google_chrome_browser.json +209 -0
- data/standards/stig_google_chrome_current_windows.json +215 -0
- data/standards/stig_google_chrome_draft.json +281 -0
- data/standards/stig_google_chrome_v23_windows.json +275 -0
- data/standards/stig_google_chrome_v24_windows.json +263 -0
- data/standards/stig_google_chrome_v24_windows_benchmark.json +227 -0
- data/standards/stig_google_search_appliance.json +209 -0
- data/standards/stig_harris_secnet_11_54.json +89 -0
- data/standards/stig_hp-ux_11.23.json +3215 -0
- data/standards/stig_hp-ux_11.31.json +3155 -0
- data/standards/stig_hp-ux_smse.json +431 -0
- data/standards/stig_hpe_3par_storeserv_3.2.x.json +131 -0
- data/standards/stig_ibm_datapower_alg.json +401 -0
- data/standards/stig_ibm_datapower_network_device_management.json +395 -0
- data/standards/stig_ibm_db2_v10.5_luw.json +575 -0
- data/standards/stig_ibm_hardware_management_console_hmc.json +221 -0
- data/standards/stig_ibm_hardware_management_console_hmc_policies.json +35 -0
- data/standards/stig_ibm_maas360_v2.3.x_mdm.json +59 -0
- data/standards/stig_ibm_zvm_using_ca_vm:secure.json +473 -0
- data/standards/stig_idps_security_requirements_guide_srg.json +1865 -0
- data/standards/stig_idsips.json +257 -0
- data/standards/stig_iis6_server.json +221 -0
- data/standards/stig_iis6_site.json +263 -0
- data/standards/stig_iis_7.0_web_server.json +155 -0
- data/standards/stig_iis_7.0_web_site.json +299 -0
- data/standards/stig_iis_8.5_server.json +293 -0
- data/standards/stig_iis_8.5_site.json +347 -0
- data/standards/stig_infoblox_7.x_dns.json +419 -0
- data/standards/stig_infrastructure_l3_switch.json +599 -0
- data/standards/stig_infrastructure_l3_switch_-_cisco.json +659 -0
- data/standards/stig_infrastructure_l3_switch_secure_technical_implementation_guide_-_cisco.json +659 -0
- data/standards/stig_infrastructure_router.json +479 -0
- data/standards/stig_infrastructure_router_-_cisco.json +539 -0
- data/standards/stig_infrastructure_router_-_juniper.json +485 -0
- data/standards/stig_infrastructure_router__cisco.json +539 -0
- data/standards/stig_infrastructure_router__juniper.json +485 -0
- data/standards/stig_internet_explorer_8.json +821 -0
- data/standards/stig_internet_explorer_9.json +815 -0
- data/standards/stig_intrusion_detection_and_prevention_systems_idps_security_requirements_guide.json +371 -0
- data/standards/stig_ipsec_vpn_gateway.json +521 -0
- data/standards/stig_java_runtime_environment_jre_6_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_windows_xp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_6_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_6_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_xp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_7_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_winxp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_8_unix.json +107 -0
- data/standards/stig_java_runtime_environment_jre_version_8_windows.json +107 -0
- data/standards/stig_jboss_eap_6.3.json +413 -0
- data/standards/stig_juniper_srx_sg_alg.json +155 -0
- data/standards/stig_juniper_srx_sg_idps.json +179 -0
- data/standards/stig_juniper_srx_sg_ndm.json +443 -0
- data/standards/stig_juniper_srx_sg_vpn.json +185 -0
- data/standards/stig_keyboard_video_and_mouse_switch.json +269 -0
- data/standards/stig_l3_kov-26_talon_wireless_role.json +77 -0
- data/standards/stig_layer_2_switch.json +347 -0
- data/standards/stig_layer_2_switch_-_cisco.json +365 -0
- data/standards/stig_lg_android_5.x_interim_security_configuration_guide.json +245 -0
- data/standards/stig_lg_android_6.x.json +281 -0
- data/standards/stig_mac_osx_10.6_workstation.json +1319 -0
- data/standards/stig_mac_osx_10.6_workstation_draft.json +1319 -0
- data/standards/stig_mainframe_product_security_requirements_guide.json +1115 -0
- data/standards/stig_mcafee_application_control_7.x.json +203 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json +203 -0
- data/standards/stig_mcafee_move_agentless_3.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_av_agentless_4.5.json +155 -0
- data/standards/stig_mcafee_move_av_multi-platform_4.5.json +215 -0
- data/standards/stig_mcafee_virusscan_8.8_local_client.json +533 -0
- data/standards/stig_mcafee_virusscan_8.8_managed_client.json +533 -0
- data/standards/stig_mcafee_vsel_1.92.0_local_client.json +245 -0
- data/standards/stig_mcafee_vsel_1.92.0_managed_client.json +239 -0
- data/standards/stig_mdm_server_policy.json +47 -0
- data/standards/stig_microsoft_access_2003.json +47 -0
- data/standards/stig_microsoft_access_2007.json +77 -0
- data/standards/stig_microsoft_access_2010.json +119 -0
- data/standards/stig_microsoft_access_2013.json +113 -0
- data/standards/stig_microsoft_access_2016.json +107 -0
- data/standards/stig_microsoft_dot_net_framework_4.0.json +101 -0
- data/standards/stig_microsoft_excel_2003.json +47 -0
- data/standards/stig_microsoft_excel_2007.json +155 -0
- data/standards/stig_microsoft_excel_2010.json +287 -0
- data/standards/stig_microsoft_excel_2013.json +293 -0
- data/standards/stig_microsoft_excel_2016.json +257 -0
- data/standards/stig_microsoft_exchange_2010_client_access_server_role.json +71 -0
- data/standards/stig_microsoft_exchange_2010_core_server.json +47 -0
- data/standards/stig_microsoft_exchange_2010_edge_transport_server_role.json +233 -0
- data/standards/stig_microsoft_exchange_2010_hub_transport_server_role.json +125 -0
- data/standards/stig_microsoft_exchange_2010_mailbox_server_role.json +107 -0
- data/standards/stig_microsoft_exchange_server_2003.json +647 -0
- data/standards/stig_microsoft_groove_2013.json +71 -0
- data/standards/stig_microsoft_ie_version_6.json +599 -0
- data/standards/stig_microsoft_ie_version_7.json +749 -0
- data/standards/stig_microsoft_infopath_2003.json +41 -0
- data/standards/stig_microsoft_infopath_2007.json +167 -0
- data/standards/stig_microsoft_infopath_2010.json +155 -0
- data/standards/stig_microsoft_infopath_2013.json +149 -0
- data/standards/stig_microsoft_internet_explorer_10.json +857 -0
- data/standards/stig_microsoft_internet_explorer_11.json +839 -0
- data/standards/stig_microsoft_internet_explorer_9.json +821 -0
- data/standards/stig_microsoft_lync_2013.json +29 -0
- data/standards/stig_microsoft_office_system_2007.json +221 -0
- data/standards/stig_microsoft_office_system_2010.json +233 -0
- data/standards/stig_microsoft_office_system_2013.json +293 -0
- data/standards/stig_microsoft_office_system_2016.json +131 -0
- data/standards/stig_microsoft_onedrivebusiness_2016.json +89 -0
- data/standards/stig_microsoft_onenote_2010.json +77 -0
- data/standards/stig_microsoft_onenote_2013.json +71 -0
- data/standards/stig_microsoft_onenote_2016.json +71 -0
- data/standards/stig_microsoft_outlook_2003.json +65 -0
- data/standards/stig_microsoft_outlook_2007.json +479 -0
- data/standards/stig_microsoft_outlook_2010.json +515 -0
- data/standards/stig_microsoft_outlook_2013.json +497 -0
- data/standards/stig_microsoft_outlook_2016.json +359 -0
- data/standards/stig_microsoft_powerpoint_2003.json +47 -0
- data/standards/stig_microsoft_powerpoint_2007.json +131 -0
- data/standards/stig_microsoft_powerpoint_2010.json +191 -0
- data/standards/stig_microsoft_powerpoint_2013.json +251 -0
- data/standards/stig_microsoft_powerpoint_2016.json +233 -0
- data/standards/stig_microsoft_project_2010.json +83 -0
- data/standards/stig_microsoft_project_2013.json +95 -0
- data/standards/stig_microsoft_project_2016.json +95 -0
- data/standards/stig_microsoft_publisher_2010.json +107 -0
- data/standards/stig_microsoft_publisher_2013.json +101 -0
- data/standards/stig_microsoft_publisher_2016.json +101 -0
- data/standards/stig_microsoft_sharepoint_designer_2013.json +71 -0
- data/standards/stig_microsoft_skypebusiness_2016.json +29 -0
- data/standards/stig_microsoft_sql_server_2005_database.json +167 -0
- data/standards/stig_microsoft_sql_server_2005_instance.json +1001 -0
- data/standards/stig_microsoft_sql_server_2012_database.json +179 -0
- data/standards/stig_microsoft_sql_server_2012_database_instance.json +929 -0
- data/standards/stig_microsoft_visio_2013.json +89 -0
- data/standards/stig_microsoft_visio_2016.json +89 -0
- data/standards/stig_microsoft_windows_10_mobile.json +215 -0
- data/standards/stig_microsoft_windows_2008_server_domain_name_system.json +269 -0
- data/standards/stig_microsoft_windows_2012_server_domain_name_system.json +551 -0
- data/standards/stig_microsoft_windows_phone_8.1.json +161 -0
- data/standards/stig_microsoft_windows_server_2012_domain_controller.json +2633 -0
- data/standards/stig_microsoft_windows_server_2012_member_server.json +2411 -0
- data/standards/stig_microsoft_word_2003.json +47 -0
- data/standards/stig_microsoft_word_2007.json +119 -0
- data/standards/stig_microsoft_word_2010.json +221 -0
- data/standards/stig_microsoft_word_2013.json +221 -0
- data/standards/stig_microsoft_word_2016.json +215 -0
- data/standards/stig_mobile_application_management_mam_server.json +95 -0
- data/standards/stig_mobile_application_security_requirements_guide.json +233 -0
- data/standards/stig_mobile_device_integrity_scanning_mdis_server.json +119 -0
- data/standards/stig_mobile_device_management_mdm_server.json +125 -0
- data/standards/stig_mobile_device_manager_security_requirements_guide.json +2555 -0
- data/standards/stig_mobile_email_management_mem_server.json +197 -0
- data/standards/stig_mobile_operating_system_security_requirements_guide.json +1943 -0
- data/standards/stig_mobile_policy.json +35 -0
- data/standards/stig_mobile_policy_security_requirements_guide.json +437 -0
- data/standards/stig_mobileiron_core_v9.x_mdm.json +89 -0
- data/standards/stig_mobility_policy.json +65 -0
- data/standards/stig_mozilla_firefox.json +161 -0
- data/standards/stig_ms_exchange_2013_client_access_server.json +209 -0
- data/standards/stig_ms_exchange_2013_edge_transport_server.json +443 -0
- data/standards/stig_ms_exchange_2013_mailbox_server.json +437 -0
- data/standards/stig_ms_sharepoint_2010.json +269 -0
- data/standards/stig_ms_sharepoint_2013.json +245 -0
- data/standards/stig_ms_sharepoint_designer_2013.json +71 -0
- data/standards/stig_ms_sql_server_2014_database.json +263 -0
- data/standards/stig_ms_sql_server_2014_instance.json +575 -0
- data/standards/stig_ms_sql_server_2016_database.json +185 -0
- data/standards/stig_ms_sql_server_2016_instance.json +731 -0
- data/standards/stig_ms_windows_defender_antivirus.json +257 -0
- data/standards/stig_multifunction_device_and_network_printers.json +131 -0
- data/standards/stig_network_device_management_security_requirements_guide.json +863 -0
- data/standards/stig_network_devices.json +389 -0
- data/standards/stig_network_infrastructure_policy.json +455 -0
- data/standards/stig_network_security_requirements_guide.json +1961 -0
- data/standards/stig_operating_system_security_requirements_guide.json +1961 -0
- data/standards/stig_oracle_10_database_installation.json +527 -0
- data/standards/stig_oracle_10_database_instance.json +569 -0
- data/standards/stig_oracle_11_database_installation.json +527 -0
- data/standards/stig_oracle_11_database_instance.json +551 -0
- data/standards/stig_oracle_database_10g_installation.json +527 -0
- data/standards/stig_oracle_database_10g_instance.json +581 -0
- data/standards/stig_oracle_database_11.2g.json +1229 -0
- data/standards/stig_oracle_database_11g_installation.json +527 -0
- data/standards/stig_oracle_database_11g_instance.json +575 -0
- data/standards/stig_oracle_database_12c.json +1217 -0
- data/standards/stig_oracle_http_server_12.1.3.json +1703 -0
- data/standards/stig_oracle_linux_5.json +3431 -0
- data/standards/stig_oracle_linux_6.json +1583 -0
- data/standards/stig_oracle_weblogic_server_12c.json +443 -0
- data/standards/stig_palo_alto_networks_alg.json +311 -0
- data/standards/stig_palo_alto_networks_idps.json +185 -0
- data/standards/stig_palo_alto_networks_ndm.json +251 -0
- data/standards/stig_pda.json +83 -0
- data/standards/stig_pdasmartphone.json +95 -0
- data/standards/stig_perimeter_l3_switch.json +923 -0
- data/standards/stig_perimeter_l3_switch_-_cisco.json +1001 -0
- data/standards/stig_perimeter_router.json +803 -0
- data/standards/stig_perimeter_router_cisco.json +881 -0
- data/standards/stig_perimeter_router_juniper.json +803 -0
- data/standards/stig_postgresql_9.x.json +677 -0
- data/standards/stig_red_hat_enterprise_linux_5.json +3437 -0
- data/standards/stig_red_hat_enterprise_linux_6.json +1565 -0
- data/standards/stig_red_hat_enterprise_linux_7.json +1451 -0
- data/standards/stig_remote_access_policy.json +317 -0
- data/standards/stig_removable_storage_and_external_connection_technologies.json +143 -0
- data/standards/stig_removable_storage_and_external_connections.json +137 -0
- data/standards/stig_rfid_scanner.json +35 -0
- data/standards/stig_rfid_workstation.json +23 -0
- data/standards/stig_riverbed_steelhead_cx_v8_alg.json +83 -0
- data/standards/stig_riverbed_steelhead_cx_v8_ndm.json +371 -0
- data/standards/stig_router_security_requirements_guide.json +575 -0
- data/standards/stig_samsung_android_os_5_with_knox_2.0.json +365 -0
- data/standards/stig_samsung_android_os_6_with_knox_2.x.json +377 -0
- data/standards/stig_samsung_android_os_7_with_knox_2.x.json +443 -0
- data/standards/stig_samsung_android_with_knox_1.x.json +293 -0
- data/standards/stig_samsung_android_with_knox_2.x.json +371 -0
- data/standards/stig_samsung_knox_android_1.0.json +167 -0
- data/standards/stig_sharepoint_2010.json +269 -0
- data/standards/stig_sharepoint_2013.json +245 -0
- data/standards/stig_smartphone_policy.json +131 -0
- data/standards/stig_solaris_10_sparc.json +3029 -0
- data/standards/stig_solaris_10_x86.json +3065 -0
- data/standards/stig_solaris_11_sparc.json +1427 -0
- data/standards/stig_solaris_11_x86.json +1421 -0
- data/standards/stig_solaris_9_sparc.json +2915 -0
- data/standards/stig_solaris_9_x86.json +2915 -0
- data/standards/stig_sun_ray_4.json +185 -0
- data/standards/stig_sun_ray_4_policy.json +77 -0
- data/standards/stig_suse_linux_enterprise_server_v11system_z.json +3311 -0
- data/standards/stig_symantec_endpoint_protection_12.1_local_client_antivirus.json +689 -0
- data/standards/stig_symantec_endpoint_protection_12.1_managed_client_antivirus.json +695 -0
- data/standards/stig_tanium_6.5.json +461 -0
- data/standards/stig_tanium_7.0.json +803 -0
- data/standards/stig_test_and_development_zone_a.json +167 -0
- data/standards/stig_test_and_development_zone_b.json +179 -0
- data/standards/stig_test_and_development_zone_c.json +143 -0
- data/standards/stig_test_and_development_zone_d.json +143 -0
- data/standards/stig_traditional_security.json +917 -0
- data/standards/stig_unix_srg.json +3287 -0
- data/standards/stig_video_services_policy.json +497 -0
- data/standards/stig_video_teleconference.json +47 -0
- data/standards/stig_video_teleconference_vtc.json +12 -0
- data/standards/stig_vmware_esx_3_policy.json +155 -0
- data/standards/stig_vmware_esx_3_server.json +3791 -0
- data/standards/stig_vmware_esx_3_virtual_center.json +257 -0
- data/standards/stig_vmware_esx_3_virtual_machine.json +53 -0
- data/standards/stig_vmware_esxi_server_5.0.json +809 -0
- data/standards/stig_vmware_esxi_v5.json +5177 -0
- data/standards/stig_vmware_esxi_version_5_virtual_machine.json +317 -0
- data/standards/stig_vmware_nsx_distributed_firewall.json +83 -0
- data/standards/stig_vmware_nsx_distributed_logical_router.json +35 -0
- data/standards/stig_vmware_nsx_manager.json +191 -0
- data/standards/stig_vmware_vcenter_server.json +179 -0
- data/standards/stig_vmware_vcenter_server_version_5.json +149 -0
- data/standards/stig_vmware_vsphere_esxi_6.0.json +659 -0
- data/standards/stig_vmware_vsphere_vcenter_server_version_6.json +311 -0
- data/standards/stig_vmware_vsphere_virtual_machine_version_6.json +269 -0
- data/standards/stig_voice_and_video_over_internet_protocol_vvoip_policy.json +407 -0
- data/standards/stig_voice_video_endpoint_security_requirements_guide.json +395 -0
- data/standards/stig_voice_video_services_policy.json +671 -0
- data/standards/stig_voice_video_session_management_security_requirements_guide.json +329 -0
- data/standards/stig_voicevideo_over_internet_protocol.json +419 -0
- data/standards/stig_voicevideo_over_internet_protocol_vvoip.json +263 -0
- data/standards/stig_voicevideo_services_policy.json +569 -0
- data/standards/stig_web_policy.json +95 -0
- data/standards/stig_web_server.json +317 -0
- data/standards/stig_web_server_security_requirements_guide.json +587 -0
- data/standards/stig_win2k3_audit.json +761 -0
- data/standards/stig_win2k8_audit.json +1085 -0
- data/standards/stig_win2k8_r2_audit.json +1637 -0
- data/standards/stig_win7_audit.json +1613 -0
- data/standards/stig_windows_10.json +1691 -0
- data/standards/stig_windows_2003_domain_controller.json +893 -0
- data/standards/stig_windows_2003_member_server.json +845 -0
- data/standards/stig_windows_2008_domain_controller.json +1475 -0
- data/standards/stig_windows_2008_member_server.json +1301 -0
- data/standards/stig_windows_7.json +1781 -0
- data/standards/stig_windows_8.json +2399 -0
- data/standards/stig_windows_88.1.json +2273 -0
- data/standards/stig_windows_8_8.1.json +2297 -0
- data/standards/stig_windows_defender_antivirus.json +239 -0
- data/standards/stig_windows_dns.json +185 -0
- data/standards/stig_windows_firewall_with_advanced_security.json +137 -0
- data/standards/stig_windows_paw.json +155 -0
- data/standards/stig_windows_phone_6.5_with_good_mobility_suite.json +65 -0
- data/standards/stig_windows_server_2008_r2_domain_controller.json +1961 -0
- data/standards/stig_windows_server_2008_r2_member_server.json +1745 -0
- data/standards/stig_windows_server_20122012_r2_domain_controller.json +2255 -0
- data/standards/stig_windows_server_20122012_r2_member_server.json +2045 -0
- data/standards/stig_windows_server_2012_2012_r2_domain_controller.json +2279 -0
- data/standards/stig_windows_server_2012_2012_r2_member_server.json +2075 -0
- data/standards/stig_windows_server_2012_domain_controller.json +2471 -0
- data/standards/stig_windows_server_2012_member_server.json +2249 -0
- data/standards/stig_windows_server_2016.json +1661 -0
- data/standards/stig_windows_vista.json +1517 -0
- data/standards/stig_windows_xp.json +893 -0
- data/standards/stig_wireless_keyboard_and_mouse.json +23 -0
- data/standards/stig_wireless_management_server_policy.json +53 -0
- data/standards/stig_wireless_remote_access_policy_security_implementation_guide.json +29 -0
- data/standards/stig_wlan_access_point_enclave-niprnet_connected.json +227 -0
- data/standards/stig_wlan_access_point_internet_gateway_only_connection.json +209 -0
- data/standards/stig_wlan_access_point_policy.json +17 -0
- data/standards/stig_wlan_authentication_server.json +29 -0
- data/standards/stig_wlan_bridge.json +209 -0
- data/standards/stig_wlan_client.json +65 -0
- data/standards/stig_wlan_controller.json +215 -0
- data/standards/stig_wlan_ids_sensorserver.json +23 -0
- data/standards/stig_wman_access_point.json +263 -0
- data/standards/stig_wman_bridge.json +209 -0
- data/standards/stig_wman_subscriber.json +65 -0
- data/standards/stig_zos_acf2.json +1451 -0
- data/standards/stig_zos_bmc_control-dacf2.json +53 -0
- data/standards/stig_zos_bmc_control-dracf.json +59 -0
- data/standards/stig_zos_bmc_control-dtss.json +65 -0
- data/standards/stig_zos_bmc_control-macf2.json +59 -0
- data/standards/stig_zos_bmc_control-mracf.json +65 -0
- data/standards/stig_zos_bmc_control-mrestartacf2.json +23 -0
- data/standards/stig_zos_bmc_control-mrestartracf.json +23 -0
- data/standards/stig_zos_bmc_control-mrestarttss.json +23 -0
- data/standards/stig_zos_bmc_control-mtss.json +71 -0
- data/standards/stig_zos_bmc_control-oacf2.json +53 -0
- data/standards/stig_zos_bmc_control-oracf.json +59 -0
- data/standards/stig_zos_bmc_control-otss.json +65 -0
- data/standards/stig_zos_bmc_ioaacf2.json +53 -0
- data/standards/stig_zos_bmc_ioaracf.json +59 -0
- data/standards/stig_zos_bmc_ioatss.json +65 -0
- data/standards/stig_zos_bmc_mainviewzosacf2.json +47 -0
- data/standards/stig_zos_bmc_mainviewzosracf.json +53 -0
- data/standards/stig_zos_bmc_mainviewzostss.json +59 -0
- data/standards/stig_zos_ca_1_tape_managementacf2.json +65 -0
- data/standards/stig_zos_ca_1_tape_managementracf.json +77 -0
- data/standards/stig_zos_ca_1_tape_managementtss.json +77 -0
- data/standards/stig_zos_ca_auditoracf2.json +29 -0
- data/standards/stig_zos_ca_auditorracf.json +29 -0
- data/standards/stig_zos_ca_auditortss.json +29 -0
- data/standards/stig_zos_ca_common_servicesacf2.json +23 -0
- data/standards/stig_zos_ca_common_servicesracf.json +29 -0
- data/standards/stig_zos_ca_common_servicestss.json +29 -0
- data/standards/stig_zos_ca_micsacf2.json +23 -0
- data/standards/stig_zos_ca_micsracf.json +23 -0
- data/standards/stig_zos_ca_micstss.json +23 -0
- data/standards/stig_zos_ca_mimacf2.json +41 -0
- data/standards/stig_zos_ca_mimracf.json +47 -0
- data/standards/stig_zos_ca_mimtss.json +47 -0
- data/standards/stig_zos_ca_vtapeacf2.json +29 -0
- data/standards/stig_zos_ca_vtaperacf.json +35 -0
- data/standards/stig_zos_ca_vtapetss.json +35 -0
- data/standards/stig_zos_catalog_solutionsacf2.json +23 -0
- data/standards/stig_zos_catalog_solutionsracf.json +23 -0
- data/standards/stig_zos_catalog_solutionstss.json +23 -0
- data/standards/stig_zos_clsupersessionacf2.json +53 -0
- data/standards/stig_zos_clsupersessionracf.json +65 -0
- data/standards/stig_zos_clsupersessiontss.json +71 -0
- data/standards/stig_zos_compuware_abend-aidacf2.json +47 -0
- data/standards/stig_zos_compuware_abend-aidracf.json +53 -0
- data/standards/stig_zos_compuware_abend-aidtss.json +53 -0
- data/standards/stig_zos_cssmtpacf2.json +23 -0
- data/standards/stig_zos_cssmtpracf.json +29 -0
- data/standards/stig_zos_cssmtptss.json +29 -0
- data/standards/stig_zos_fdracf2.json +23 -0
- data/standards/stig_zos_fdrracf.json +23 -0
- data/standards/stig_zos_fdrtss.json +23 -0
- data/standards/stig_zos_hcdacf2.json +29 -0
- data/standards/stig_zos_hcdracf.json +29 -0
- data/standards/stig_zos_hcdtss.json +29 -0
- data/standards/stig_zos_ibm_cics_transaction_serveracf2.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_serverracf.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_servertss.json +17 -0
- data/standards/stig_zos_ibm_health_checkeracf2.json +23 -0
- data/standards/stig_zos_ibm_health_checkerracf.json +29 -0
- data/standards/stig_zos_ibm_health_checkertss.json +29 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfacf2.json +53 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfracf.json +59 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsftss.json +53 -0
- data/standards/stig_zos_icsfacf2.json +29 -0
- data/standards/stig_zos_icsfracf.json +35 -0
- data/standards/stig_zos_icsftss.json +35 -0
- data/standards/stig_zos_netviewacf2.json +41 -0
- data/standards/stig_zos_netviewracf.json +47 -0
- data/standards/stig_zos_netviewtss.json +53 -0
- data/standards/stig_zos_quest_nc-passacf2.json +35 -0
- data/standards/stig_zos_quest_nc-passracf.json +41 -0
- data/standards/stig_zos_quest_nc-passtss.json +47 -0
- data/standards/stig_zos_racf.json +1415 -0
- data/standards/stig_zos_roscoeacf2.json +47 -0
- data/standards/stig_zos_roscoeracf.json +53 -0
- data/standards/stig_zos_roscoetss.json +59 -0
- data/standards/stig_zos_srrauditacf2.json +23 -0
- data/standards/stig_zos_srrauditracf.json +23 -0
- data/standards/stig_zos_srraudittss.json +23 -0
- data/standards/stig_zos_tadzacf2.json +29 -0
- data/standards/stig_zos_tadzracf.json +35 -0
- data/standards/stig_zos_tadztss.json +35 -0
- data/standards/stig_zos_tdmfacf2.json +23 -0
- data/standards/stig_zos_tdmfracf.json +23 -0
- data/standards/stig_zos_tdmftss.json +23 -0
- data/standards/stig_zos_tss.json +1523 -0
- data/standards/stig_zos_vssracf.json +29 -0
- metadata +691 -0
|
@@ -0,0 +1,1319 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_mac_osx_10.6_workstation_draft",
|
|
3
|
+
"date": "2013-01-10",
|
|
4
|
+
"description": "MAC OSX 10.6 Workstation \nSecurity Technical Implementation Guide Draft",
|
|
5
|
+
"title": "MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft",
|
|
6
|
+
"version": "1",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-1027",
|
|
12
|
+
"title": "The /etc/smb.conf file must be owned by root.",
|
|
13
|
+
"description": "The /etc/smb.conf file allows access to other machines on the network and grants permissions to certain users. If it is owned by another user, the file may be maliciously modified and the Samba configuration could be compromised.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-1028",
|
|
18
|
+
"title": "The /etc/smb.conf file must have mode 0644 or less permissive.",
|
|
19
|
+
"description": "If the smb.conf file has excessive permissions, the file may be maliciously modified and the Samba configuration could be compromised.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-11981",
|
|
24
|
+
"title": "All global initialization files must have mode 0644 or less permissive.",
|
|
25
|
+
"description": "Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-11982",
|
|
30
|
+
"title": "All global initialization files must be owned by root.",
|
|
31
|
+
"description": "Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-11983",
|
|
36
|
+
"title": "All global initialization files must be group-owned by wheel.",
|
|
37
|
+
"description": "Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to the group wheel provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-12023",
|
|
42
|
+
"title": "IP forwarding for IPv4 must not be enabled, unless the system is a router.",
|
|
43
|
+
"description": "If the system is configured for IP forwarding and is not a designated router, it could be used to bypass network security by providing a path for communication not filtered by network devices.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-12024",
|
|
48
|
+
"title": "The system must not have a public Instant Messaging (IM) client installed.",
|
|
49
|
+
"description": "Public IM systems are not approved for use and may result in the unauthorized distribution of information. IM clients provide a way for a user to send a message to one or more users in real time. Additional capabilities may include file transfer and support for distributed game playing. Communication between clients and associated directory services are managed through messaging servers. Commercial IM clients include AOL Instant Messenger (AIM), MSN Messenger, and Yahoo! Messenger.\n\nIM clients present a security issue when the clients route messages through public servers. The obvious implication is for potentially sensitive information to be intercepted or altered in the course of transmission. This same issue is associated with the use of public email servers. In order to reduce the potential for disclosure of sensitive Government information and to ensure the validity of official Government information, IM clients connecting to public IM services will not be installed. Clients used to access internal or DoD-controlled IM services are permitted.\n",
|
|
50
|
+
"severity": "medium"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-12025",
|
|
54
|
+
"title": "The system must not have any peer-to-peer file-sharing application installed.",
|
|
55
|
+
"description": "Peer-to-peer file-sharing software can result in the unintentional exfiltration of information. There are also many legal issues associated with these types of utilities including copyright infringement or other intellectual property issues. The ASD Memo \"Use of Peer-to-Peer (P2P) File-Sharing Applications across the DoD\" states the following:\n\n“P2P file-sharing applications are authorized for use on DOD networks with approval by the appropriate Designated Approval Authority (DAA). Documented requirements, security architecture, configuration management process, and a training program for users are all requirements within the approval process. The unauthorized use of application or services, including P2P applications, is prohibited, and such applications or services must be eliminated.”\n\nPeer-to-peer applications include, but are not limited to:\n\n-Napster,\n-Kazaa,\n-ARES,\n-Limewire,\n-IRC Chat Relay, and\n-BitTorrent.",
|
|
56
|
+
"severity": "medium"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-22312",
|
|
60
|
+
"title": "All files and directories must have a valid group owner.",
|
|
61
|
+
"description": "Files without a valid group owner may be unintentionally inherited if a group is assigned the same GID as the GID of the files without a valid group owner.",
|
|
62
|
+
"severity": "medium"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-22313",
|
|
66
|
+
"title": "All network services daemon files must not have extended ACLs.",
|
|
67
|
+
"description": "Restricting permission on daemons will protect them from unauthorized modification and possible system compromise.",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-22314",
|
|
72
|
+
"title": "System command files must not have extended ACLs.",
|
|
73
|
+
"description": "Restricting permissions will protect system command files from unauthorized modification. System command files include files present in directories used by the operating system for storing default system executables and files present in directories included in the system's default executable search paths.\n",
|
|
74
|
+
"severity": "medium"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-22315",
|
|
78
|
+
"title": "System log files must not have extended ACLs, except as needed to support authorized software.",
|
|
79
|
+
"description": "If the system log files are not protected, unauthorized users could change the logged data, eliminating its forensic value. Authorized software may be given log file access through the use of extended ACLs when needed and configured to provide the least privileges required.",
|
|
80
|
+
"severity": "medium"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-22316",
|
|
84
|
+
"title": "All manual page files must not have extended ACLs.",
|
|
85
|
+
"description": "If manual pages are compromised, misleading information could be inserted causing actions to possibly compromise the system.",
|
|
86
|
+
"severity": "low"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-22317",
|
|
90
|
+
"title": "All library files must not have extended ACLs.",
|
|
91
|
+
"description": "Unauthorized access could destroy the integrity of the library files.",
|
|
92
|
+
"severity": "medium"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-22319",
|
|
96
|
+
"title": "The /etc/resolv.conf file must be owned by root.",
|
|
97
|
+
"description": "The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions, such as time synchronization, centralized authentication, and remote system logging.\n",
|
|
98
|
+
"severity": "medium"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-22320",
|
|
102
|
+
"title": "The /etc/resolv.conf file must be group-owned by wheel.",
|
|
103
|
+
"description": "The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions, such as time synchronization, centralized authentication, and remote system logging.",
|
|
104
|
+
"severity": "medium"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-22321",
|
|
108
|
+
"title": "The /etc/resolv.conf file must have mode 0644 or less permissive.",
|
|
109
|
+
"description": "The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions, such as time synchronization, centralized authentication, and remote system logging.",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-22322",
|
|
114
|
+
"title": "The /etc/resolv.conf file must not have an extended ACL.",
|
|
115
|
+
"description": "The resolv.conf (or equivalent) file configures the system's DNS resolver. DNS is used to resolve host names to IP addresses. If DNS configuration is modified maliciously, host name resolution may fail or return incorrect information. DNS may be used by a variety of system security functions, such as time synchronization, centralized authentication, and remote system logging.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-22323",
|
|
120
|
+
"title": "The /etc/hosts file must be owned by root.",
|
|
121
|
+
"description": "The /etc/hosts file (or equivalent) configures local host name to IP address mappings typically taking precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.",
|
|
122
|
+
"severity": "medium"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-22324",
|
|
126
|
+
"title": "The /etc/hosts file must be group-owned by wheel.",
|
|
127
|
+
"description": "The /etc/hosts file (or equivalent) configures local host name to IP address mappings typically taking precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, such as time synchronization, centralized authentication, and remote system logging.",
|
|
128
|
+
"severity": "medium"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-22325",
|
|
132
|
+
"title": "The /etc/hosts file must have mode 0644 or less permissive.",
|
|
133
|
+
"description": "The /etc/hosts file (or equivalent) configures local host name to IP address mappings typically taking precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, such as time synchronization, centralized authentication, and remote system logging.",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-22326",
|
|
138
|
+
"title": "The /etc/hosts file must not have an extended ACL.",
|
|
139
|
+
"description": "The /etc/hosts file (or equivalent) configures local host name to IP address mappings typically taking precedence over DNS resolution. If this file is maliciously modified, it could cause the failure or compromise of security functions requiring name resolution, such as time synchronization, centralized authentication, and remote system logging.",
|
|
140
|
+
"severity": "medium"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-22331",
|
|
144
|
+
"title": "For systems using DNS resolution, at least two name servers must be configured.",
|
|
145
|
+
"description": "To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.",
|
|
146
|
+
"severity": "low"
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"id": "V-22332",
|
|
150
|
+
"title": "The /etc/passwd file must be owned by root.",
|
|
151
|
+
"description": "The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.",
|
|
152
|
+
"severity": "medium"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "V-22333",
|
|
156
|
+
"title": "The /etc/passwd file must be group-owned by wheel.",
|
|
157
|
+
"description": "The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.",
|
|
158
|
+
"severity": "medium"
|
|
159
|
+
},
|
|
160
|
+
{
|
|
161
|
+
"id": "V-22334",
|
|
162
|
+
"title": "The /etc/passwd file must not have an extended ACL.",
|
|
163
|
+
"description": "File system ACLs can provide access to files beyond what is allowed by the mode numbers of the files. The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.",
|
|
164
|
+
"severity": "medium"
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "V-22335",
|
|
168
|
+
"title": "The /etc/group file must be owned by root.",
|
|
169
|
+
"description": "The /etc/group file is critical to system security and must be owned by a privileged user. The group file contains a list of system groups and associated information.",
|
|
170
|
+
"severity": "medium"
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
"id": "V-22336",
|
|
174
|
+
"title": "The /etc/group file must be group-owned by wheel.",
|
|
175
|
+
"description": "The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.",
|
|
176
|
+
"severity": "medium"
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"id": "V-22337",
|
|
180
|
+
"title": "The /etc/group file must have mode 0644 or less permissive.",
|
|
181
|
+
"description": "The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.",
|
|
182
|
+
"severity": "medium"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"id": "V-22338",
|
|
186
|
+
"title": "The /etc/group file must not have an extended ACL.",
|
|
187
|
+
"description": "The /etc/group file is critical to system security and must be protected from unauthorized modification. The group file contains a list of system groups and associated information.",
|
|
188
|
+
"severity": "medium"
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
"id": "V-22350",
|
|
192
|
+
"title": "User home directories must not have extended ACLs.",
|
|
193
|
+
"description": "Excessive permissions on home directories allow unauthorized access to user files.",
|
|
194
|
+
"severity": "low"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "V-22351",
|
|
198
|
+
"title": "All files and directories contained in user home directories must be group-owned by a group where the home directory's owner is a member.",
|
|
199
|
+
"description": "If a user's files are group-owned by a group where the user is not a member, unintended users may be able to access them.",
|
|
200
|
+
"severity": "medium"
|
|
201
|
+
},
|
|
202
|
+
{
|
|
203
|
+
"id": "V-22352",
|
|
204
|
+
"title": "All files and directories contained in user home directories must not have extended ACLs.",
|
|
205
|
+
"description": "Excessive permissions allow unauthorized access to user files.",
|
|
206
|
+
"severity": "medium"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"id": "V-22353",
|
|
210
|
+
"title": "Launch control scripts must not have extended ACLs.",
|
|
211
|
+
"description": "If the launch control scripts are writable by other users, they could modify to insert malicious commands into the startup files.",
|
|
212
|
+
"severity": "medium"
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"id": "V-22366",
|
|
216
|
+
"title": "All shell files must not have extended ACLs.",
|
|
217
|
+
"description": "Shells with world/group-write permissions give the ability to maliciously modify the shell to obtain unauthorized access.",
|
|
218
|
+
"severity": "medium"
|
|
219
|
+
},
|
|
220
|
+
{
|
|
221
|
+
"id": "V-22369",
|
|
222
|
+
"title": "All system audit files must not have extended ACLs.",
|
|
223
|
+
"description": "If a user can write to the audit logs, then audit trails can be modified or destroyed and system intrusion may not be detected.",
|
|
224
|
+
"severity": "medium"
|
|
225
|
+
},
|
|
226
|
+
{
|
|
227
|
+
"id": "V-22373",
|
|
228
|
+
"title": "System audit tool executables must not have extended ACLs.",
|
|
229
|
+
"description": "To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.",
|
|
230
|
+
"severity": "low"
|
|
231
|
+
},
|
|
232
|
+
{
|
|
233
|
+
"id": "V-22384",
|
|
234
|
+
"title": "The cron.allow file must not have an extended ACL.",
|
|
235
|
+
"description": "A cron.allow file that is readable and/or writable by other than root could allow potential intruders and malicious users to use the file contents to help discern information, such as who is allowed to execute cron programs, which could be harmful to overall system and network security.",
|
|
236
|
+
"severity": "medium"
|
|
237
|
+
},
|
|
238
|
+
{
|
|
239
|
+
"id": "V-22385",
|
|
240
|
+
"title": "Crontab files must be group-owned by wheel, cron, or the crontab creator's primary group.",
|
|
241
|
+
"description": "To protect the integrity of scheduled system jobs and prevent malicious modification to these jobs, crontab files must be secured.",
|
|
242
|
+
"severity": "medium"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "V-22386",
|
|
246
|
+
"title": "Crontab files must not have extended ACLs.",
|
|
247
|
+
"description": "To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured. ACLs on crontab files may provide unauthorized access to the files.",
|
|
248
|
+
"severity": "medium"
|
|
249
|
+
},
|
|
250
|
+
{
|
|
251
|
+
"id": "V-22387",
|
|
252
|
+
"title": "Cron and crontab directories must not have extended ACLs.",
|
|
253
|
+
"description": "To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured. ACLs on cron and crontab directories may provide unauthorized access to these directories. Unauthorized modifications to these directories or their contents may result in the addition of unauthorized cron jobs or deny service to authorized cron jobs.\n\n",
|
|
254
|
+
"severity": "medium"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"id": "V-22389",
|
|
258
|
+
"title": "The cron.deny file must not have an extended ACL.",
|
|
259
|
+
"description": "If there are excessive file permissions for the cron.deny file, sensitive information could be viewed or edited by unauthorized users.",
|
|
260
|
+
"severity": "medium"
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"id": "V-22391",
|
|
264
|
+
"title": "The cron.allow file must be group-owned by wheel.",
|
|
265
|
+
"description": "If the group of the cron.allow is not set to wheel, the possibility exists for an unauthorized user to view or edit the list of users permitted to use cron. Unauthorized modification of this file could cause Denial of Service to authorized cron users or provide unauthorized users with the ability to run cron jobs.",
|
|
266
|
+
"severity": "medium"
|
|
267
|
+
},
|
|
268
|
+
{
|
|
269
|
+
"id": "V-22394",
|
|
270
|
+
"title": "The cron.deny file must be group-owned by wheel.",
|
|
271
|
+
"description": "The cron daemon control files and restricts the scheduling of automated tasks and must be protected. Unauthorized modification of the cron.deny file could result in Denial of Service to authorized cron users or could provide unauthorized users with the ability to run cron jobs.",
|
|
272
|
+
"severity": "medium"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "V-22404",
|
|
276
|
+
"title": "Kernel core dumps must be disabled unless needed.",
|
|
277
|
+
"description": " Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in Denial of Service by exhausting the available space on the target file system. The kernel core dump process may increase the amount of time a system is unavailable due to a crash. Kernel core dumps can be useful for kernel debugging.",
|
|
278
|
+
"severity": "medium"
|
|
279
|
+
},
|
|
280
|
+
{
|
|
281
|
+
"id": "V-22409",
|
|
282
|
+
"title": "The system must not process Internet Control Message Protocol (ICMP) timestamp requests.",
|
|
283
|
+
"description": "The processing of ICMP timestamp requests increases the attack surface of the system.",
|
|
284
|
+
"severity": "low"
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
"id": "V-22410",
|
|
288
|
+
"title": "The system must not respond to Internet Control Message Protocol (ICMPv4) echoes sent to a broadcast address.",
|
|
289
|
+
"description": "Responding to broadcast ICMP echoes facilitates network mapping and provides a vector for amplification attacks.",
|
|
290
|
+
"severity": "medium"
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"id": "V-22413",
|
|
294
|
+
"title": "The system must prevent local applications from generating source-routed packets.",
|
|
295
|
+
"description": "Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.",
|
|
296
|
+
"severity": "medium"
|
|
297
|
+
},
|
|
298
|
+
{
|
|
299
|
+
"id": "V-22414",
|
|
300
|
+
"title": "The system must not accept source-routed IPv4 packets.",
|
|
301
|
+
"description": "Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the handling of source-routed traffic destined to the system itself, not to traffic forwarded by the system to another, such as when IPv4 forwarding is enabled and the system is functioning as a router.",
|
|
302
|
+
"severity": "medium"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"id": "V-22416",
|
|
306
|
+
"title": "The system must ignore IPv4 ICMP redirect messages.",
|
|
307
|
+
"description": "ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.",
|
|
308
|
+
"severity": "medium"
|
|
309
|
+
},
|
|
310
|
+
{
|
|
311
|
+
"id": "V-22417",
|
|
312
|
+
"title": "The system must not send IPv4 ICMP redirects.",
|
|
313
|
+
"description": "ICMP redirect messages are used by routers to inform hosts of a more direct route existing for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology.",
|
|
314
|
+
"severity": "medium"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"id": "V-22427",
|
|
318
|
+
"title": "The services file must be group-owned by wheel.",
|
|
319
|
+
"description": "Failure to give ownership of system configuration files to a system group provides the designated owner and unauthorized users with the potential to change the system configuration which could weaken the system's security posture.",
|
|
320
|
+
"severity": "medium"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"id": "V-22428",
|
|
324
|
+
"title": "The services file must not have an extended ACL.",
|
|
325
|
+
"description": "The services file is critical to the proper operation of network services and must be protected from unauthorized modification. If the services file has an extended ACL, it may be possible for unauthorized users to modify the file. Unauthorized modification could result in the failure of network services.",
|
|
326
|
+
"severity": "medium"
|
|
327
|
+
},
|
|
328
|
+
{
|
|
329
|
+
"id": "V-22437",
|
|
330
|
+
"title": "The traceroute file must not have an extended ACL.",
|
|
331
|
+
"description": "If an extended ACL exists on the traceroute executable file, it may provide unauthorized users with access to the file. Malicious code could be inserted by an attacker and triggered whenever the traceroute command is executed by authorized users. Additionally, if an unauthorized user is granted executable permissions to the traceroute command, it could be used to gain information about the network topology behind the firewall. This information may allow an attacker to determine trusted routers and other network information potentially leading to system and network compromise.",
|
|
332
|
+
"severity": "medium"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"id": "V-22438",
|
|
336
|
+
"title": "The aliases file must be group-owned by wheel.",
|
|
337
|
+
"description": "If the alias file is not group-owned by a system group, an unauthorized user may modify the file to add aliases to run malicious code or redirect email.",
|
|
338
|
+
"severity": "medium"
|
|
339
|
+
},
|
|
340
|
+
{
|
|
341
|
+
"id": "V-22439",
|
|
342
|
+
"title": "The alias file must not have an extended ACL.",
|
|
343
|
+
"description": "Excessive permissions on the aliases file may permit unauthorized modification. If the alias file is modified by an unauthorized user, they may modify the file to run malicious code or redirect email.",
|
|
344
|
+
"severity": "medium"
|
|
345
|
+
},
|
|
346
|
+
{
|
|
347
|
+
"id": "V-22454",
|
|
348
|
+
"title": "The /etc/syslog.conf file must not have an extended ACL.",
|
|
349
|
+
"description": "Unauthorized users must not be allowed to access or modify the /etc/syslog.conf file.",
|
|
350
|
+
"severity": "medium"
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
"id": "V-22458",
|
|
354
|
+
"title": "The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.",
|
|
355
|
+
"description": "DoD information systems are required to use FIPS 140-2 approved ciphers. SSHv2 ciphers meeting this requirement are 3DES and AES.",
|
|
356
|
+
"severity": "medium"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": "V-22459",
|
|
360
|
+
"title": "The SSH daemon must be configured to not use CBC ciphers.",
|
|
361
|
+
"description": "The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plaintext attacks and must not be used.",
|
|
362
|
+
"severity": "medium"
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"id": "V-22460",
|
|
366
|
+
"title": "The SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.",
|
|
367
|
+
"description": "DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.",
|
|
368
|
+
"severity": "medium"
|
|
369
|
+
},
|
|
370
|
+
{
|
|
371
|
+
"id": "V-22461",
|
|
372
|
+
"title": "The SSH client must be configured to only use FIPS 140-2 approved ciphers.",
|
|
373
|
+
"description": "DoD information systems are required to use FIPS 140-2 approved ciphers. SSHv2 ciphers meeting this requirement are 3DES and AES.",
|
|
374
|
+
"severity": "medium"
|
|
375
|
+
},
|
|
376
|
+
{
|
|
377
|
+
"id": "V-22462",
|
|
378
|
+
"title": "The SSH client must be configured to not use CBC-based ciphers.",
|
|
379
|
+
"description": "The Cipher-Block Chaining (CBC) mode of encryption as implemented in the SSHv2 protocol is vulnerable to chosen plaintext attacks and must not be used.",
|
|
380
|
+
"severity": "medium"
|
|
381
|
+
},
|
|
382
|
+
{
|
|
383
|
+
"id": "V-22463",
|
|
384
|
+
"title": "The SSH client must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.",
|
|
385
|
+
"description": "DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.",
|
|
386
|
+
"severity": "medium"
|
|
387
|
+
},
|
|
388
|
+
{
|
|
389
|
+
"id": "V-22497",
|
|
390
|
+
"title": "The /etc/smb.conf file must not have an extended ACL.",
|
|
391
|
+
"description": "Excessive permissions could endanger the security of the Samba configuration file and, ultimately, the system and network.",
|
|
392
|
+
"severity": "medium"
|
|
393
|
+
},
|
|
394
|
+
{
|
|
395
|
+
"id": "V-22506",
|
|
396
|
+
"title": "The system package management tool must be used to verify system software periodically.",
|
|
397
|
+
"description": "Verification using the system package management tool can be used to determine that system software has not been tampered with.\n\nThis requirement is not applicable to systems not using package management tools.\n",
|
|
398
|
+
"severity": "medium"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"id": "V-22507",
|
|
402
|
+
"title": "The file integrity tool must be configured to verify ACLs.",
|
|
403
|
+
"description": "ACLs can provide permissions beyond those permitted through the file mode and must be verified by file integrity tools.",
|
|
404
|
+
"severity": "low"
|
|
405
|
+
},
|
|
406
|
+
{
|
|
407
|
+
"id": "V-22508",
|
|
408
|
+
"title": "The file integrity tool must be configured to verify extended attributes.",
|
|
409
|
+
"description": "Extended attributes in file systems are used to contain arbitrary data and file metadata potentially having security implications.",
|
|
410
|
+
"severity": "low"
|
|
411
|
+
},
|
|
412
|
+
{
|
|
413
|
+
"id": "V-22559",
|
|
414
|
+
"title": "If the system is using LDAP for authentication or account information the /etc/openldap/ldap.conf (or equivalent) file must have mode 0644 or less permissive.",
|
|
415
|
+
"description": "LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.",
|
|
416
|
+
"severity": "medium"
|
|
417
|
+
},
|
|
418
|
+
{
|
|
419
|
+
"id": "V-22560",
|
|
420
|
+
"title": "If the system is using LDAP for authentication or account information, the /etc/openldap/ldap.conf (or equivalent) file must be owned by root.",
|
|
421
|
+
"description": "LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.",
|
|
422
|
+
"severity": "medium"
|
|
423
|
+
},
|
|
424
|
+
{
|
|
425
|
+
"id": "V-22561",
|
|
426
|
+
"title": "If the system is using LDAP for authentication or account information, the /etc/openldap/ldap.conf (or equivalent) file must be group-owned by wheel.",
|
|
427
|
+
"description": "LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.",
|
|
428
|
+
"severity": "medium"
|
|
429
|
+
},
|
|
430
|
+
{
|
|
431
|
+
"id": "V-22562",
|
|
432
|
+
"title": "If the system is using LDAP for authentication or account information, the /etc/openldap/ldap.conf (or equivalent) file must not have an extended ACL.",
|
|
433
|
+
"description": "LDAP can be used to provide user authentication and account information, which are vital to system security. The LDAP client configuration must be protected from unauthorized modification.",
|
|
434
|
+
"severity": "medium"
|
|
435
|
+
},
|
|
436
|
+
{
|
|
437
|
+
"id": "V-22583",
|
|
438
|
+
"title": "The system's local firewall must implement a deny-all, allow-by-exception policy.",
|
|
439
|
+
"description": "A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.",
|
|
440
|
+
"severity": "medium"
|
|
441
|
+
},
|
|
442
|
+
{
|
|
443
|
+
"id": "V-22702",
|
|
444
|
+
"title": "System audit logs must be group-owned by wheel.",
|
|
445
|
+
"description": "Sensitive system and user information could provide a malicious user with enough information to penetrate further into the system.",
|
|
446
|
+
"severity": "medium"
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
"id": "V-24386",
|
|
450
|
+
"title": "The telnet daemon must not be running.",
|
|
451
|
+
"description": "The telnet daemon provides a typically unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised.",
|
|
452
|
+
"severity": "high"
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
"id": "V-25187",
|
|
456
|
+
"title": "Unnecessary packages must not be installed.",
|
|
457
|
+
"description": "Removing unused packages frees disk space and reduces the risk of attackers finding vulnerabilities in unused components.",
|
|
458
|
+
"severity": "medium"
|
|
459
|
+
},
|
|
460
|
+
{
|
|
461
|
+
"id": "V-25200",
|
|
462
|
+
"title": "Administrator accounts must be created with difficult-to-guess names.",
|
|
463
|
+
"description": "The administrator account has unlimited privileges to the system. Creating a complex name improves the protection of this account and the system. Do not use administrator; do not use the name of the machine, etc.",
|
|
464
|
+
"severity": "medium"
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"id": "V-25204",
|
|
468
|
+
"title": "A maximum password age must be set.",
|
|
469
|
+
"description": "The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.",
|
|
470
|
+
"severity": "medium"
|
|
471
|
+
},
|
|
472
|
+
{
|
|
473
|
+
"id": "V-25230",
|
|
474
|
+
"title": "A minimum password length must be set.",
|
|
475
|
+
"description": "Information systems not protected with strong password schemes including passwords of minimum length provide the opportunity for anyone to crack the password and gain access to the system, and cause the device, information, or the local network to be compromised or a Denial of Service.",
|
|
476
|
+
"severity": "medium"
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
"id": "V-25238",
|
|
480
|
+
"title": "Newly created password content must be checked.",
|
|
481
|
+
"description": "Configure the local system to verify newly created passwords do not contain user's account name or parts of the user's full name exceeding two consecutive characters.",
|
|
482
|
+
"severity": "medium"
|
|
483
|
+
},
|
|
484
|
+
{
|
|
485
|
+
"id": "V-25240",
|
|
486
|
+
"title": "Account lockout duration must be properly configured.",
|
|
487
|
+
"description": "This parameter specifies the amount of time that must pass between two successive login attempts to ensure a lockout will occur. The smaller this value is, the less effective the account lockout feature will be in protecting the local system.\n",
|
|
488
|
+
"severity": "medium"
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"id": "V-25241",
|
|
492
|
+
"title": "Account lockout threshold must be properly configured.",
|
|
493
|
+
"description": "The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of incorrect logon attempts should be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.\n",
|
|
494
|
+
"severity": "medium"
|
|
495
|
+
},
|
|
496
|
+
{
|
|
497
|
+
"id": "V-25251",
|
|
498
|
+
"title": "All application software must be current.",
|
|
499
|
+
"description": "Major software vendors release security patches and hot fixes to their products when security vulnerabilities are discovered. It is essential these updates be applied in a timely manner to prevent unauthorized persons from exploiting identified vulnerabilities. If the application software is no longer supported it should be updated or removed.",
|
|
500
|
+
"severity": "medium"
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"id": "V-25252",
|
|
504
|
+
"title": "Wi-Fi support software must be disabled.",
|
|
505
|
+
"description": "Many organizations restrict the use of wireless technology in their network environment. However, most Mac computers have wireless capability built-in and simply turning it off may not meet the organization’s wireless technology restrictions. Components may need to be removed from Mac OS X to disable them from being turned on in System Preferences. Although wireless technology gives a network more flexibility with its users, it can also cause security vulnerabilities most may be unaware of. It is recommended wherever possible, wireless access is disabled for security reasons. IMPORTANT: Repeat these instructions every time a system update is installed.",
|
|
506
|
+
"severity": "medium"
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
"id": "V-25253",
|
|
510
|
+
"title": "Bluetooth support software must be disabled.\n",
|
|
511
|
+
"description": "Bluetooth technology and associated devices are susceptible to general wireless networking threats, such as Denial of Service attacks, eavesdropping, man-in-the-middle attacks, message modification, and resource misappropriation. Remove Bluetooth support for peripherals such as keyboards, mice, or phones. This task requires administrator privileges. IMPORTANT: Repeat these instructions every time a system update is installed. Support should be removed at kext level.",
|
|
512
|
+
"severity": "medium"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"id": "V-25254",
|
|
516
|
+
"title": "Audio recording support software must be disabled.\n\n",
|
|
517
|
+
"description": "A computer might be in an environment where recording devices, such as cameras or microphones are not permitted. Protect the organization’s privacy by disabling these devices. Remove support for the audio subsystem. This may disable audio playback. IMPORTANT: Repeat these instructions every time a system update is installed.",
|
|
518
|
+
"severity": "medium"
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"id": "V-25255",
|
|
522
|
+
"title": "Video recording support software must be disabled. ",
|
|
523
|
+
"description": "A computer might be in an environment where recording devices, such as cameras or microphones, are not permitted. Protect the organization’s privacy by disabling these devices. Remove support for an external or built-in iSight camera.\nNOTE: The support for external iSight cameras should be removed on all machines. Removing only support for internal iSight cameras would still leave support for external cameras available. An Apple Authorized Technician can also remove the built-in video camera hardware from an Apple computer.\nIMPORTANT: Repeat these instructions every time a system update is installed.\n",
|
|
524
|
+
"severity": "medium"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "V-25258",
|
|
528
|
+
"title": "Infrared (IR) support must be removed.",
|
|
529
|
+
"description": "To prevent unauthorized users from controlling a computer through the infrared receiver, remove IR hardware support. This task requires administrator privileges. An Apple Authorized Technician can also remove IR hardware from an Apple computer.\nIMPORTANT: Repeat these instructions every time a system update is installed.\n",
|
|
530
|
+
"severity": "medium"
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"id": "V-25259",
|
|
534
|
+
"title": "An Extensible Firmware Interface (EFI) password must be used.\n",
|
|
535
|
+
"description": "When a computer starts up, it first starts Extensible Firmware Interface (EFI). EFI is the\nsoftware link between the motherboard hardware and the software operating system.\nEFI determine which partition or disk to load Mac OS X from. It also determines\nwhether the user can enter single-user mode. Not setting a password for EFI is a possible point of intrusion. Protecting it from unauthorized access can prevent attackers from gaining access to a computer.",
|
|
536
|
+
"severity": "high"
|
|
537
|
+
},
|
|
538
|
+
{
|
|
539
|
+
"id": "V-25260",
|
|
540
|
+
"title": "Access warning for the login window must be present.\n",
|
|
541
|
+
"description": "Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. A login window or Terminal access warning can be used to provide notice of a computer’s ownership, to warn against unauthorized access, or to remind authorized users of their consent to monitoring.",
|
|
542
|
+
"severity": "medium"
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"id": "V-25261",
|
|
546
|
+
"title": "Access warning for the command line must be present.\n",
|
|
547
|
+
"description": "Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. When a user opens a terminal locally or connects to the computer remotely, the user sees the access warning.",
|
|
548
|
+
"severity": "medium"
|
|
549
|
+
},
|
|
550
|
+
{
|
|
551
|
+
"id": "V-25262",
|
|
552
|
+
"title": "sudo usage must be restricted to a single terminal, and for only one sudo instance at a time.",
|
|
553
|
+
"description": "Do not allow direct root login because the logs cannot identify which administrator logged in. Instead, log in using accounts with administrator privileges, and then use the sudo command to perform actions as root. These limit the use of the sudo command to a single command per authentication and also ensure, even if a timeout is activated, that later sudo commands are limited to the terminal in which authentication occurred. \n",
|
|
554
|
+
"severity": "high"
|
|
555
|
+
},
|
|
556
|
+
{
|
|
557
|
+
"id": "V-25263",
|
|
558
|
+
"title": "LDAPv3 access must be securely configured (if it is used).\n",
|
|
559
|
+
"description": "When configuring LDAPv3, do not add DHCP supplied LDAP servers to automatic search policies if the network the computer is running on is not secure. If the network is unsecure, someone can create a rogue DHCP.",
|
|
560
|
+
"severity": "medium"
|
|
561
|
+
},
|
|
562
|
+
{
|
|
563
|
+
"id": "V-25264",
|
|
564
|
+
"title": "LDAP Authentication must use authentication when connecting to LDAPv3.\n",
|
|
565
|
+
"description": "When configuring LDAPv3, do not add DHCP-supplied LDAP servers to automatic search policies if the network the computer is running on is not secure. If the network is unsecure, someone can create a rogue DHCP. Use authentication when connecting to LDAPv3 directories; disable clear text passwords for all LDAPv3 directories; digitally sign all LDAPv3 packets (requires Kerberos); encrypt all LDAPv3 packets (requires SSL or Kerberos); and block man-in-the-middle attacks (requires Kerberos).",
|
|
566
|
+
"severity": "medium"
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"id": "V-25265",
|
|
570
|
+
"title": "Active Directory Access must be securely configured.\n",
|
|
571
|
+
"description": "The “Allow administration by” setting should not be used in sensitive environments. It can cause unintended privilege escalation issues because any member of the group specified will have administrator privileges on a computer.",
|
|
572
|
+
"severity": "high"
|
|
573
|
+
},
|
|
574
|
+
{
|
|
575
|
+
"id": "V-25267",
|
|
576
|
+
"title": "POSIX access permissions must be assigned based on user categories.\n",
|
|
577
|
+
"description": "POSIX access permissions must be assigned based on user categories. Changing permissions on a user's home directory from 750 to 700 will disable Apple file sharing. User's home directory POSIX permissions should be set to 700.\n",
|
|
578
|
+
"severity": "medium"
|
|
579
|
+
},
|
|
580
|
+
{
|
|
581
|
+
"id": "V-25268",
|
|
582
|
+
"title": "Security auditing must be enabled.\n\n",
|
|
583
|
+
"description": "Auditing is the capture and maintenance of information about security-related events. Auditing helps determine the causes and the methods used for successful and failed access attempts.",
|
|
584
|
+
"severity": "medium"
|
|
585
|
+
},
|
|
586
|
+
{
|
|
587
|
+
"id": "V-25269",
|
|
588
|
+
"title": "Security auditing must be configured.\n",
|
|
589
|
+
"description": "Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises or attacks that have occurred, has begun, or is about to begin. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Without an audit trail providing information as to what occurred and if it was successful or unsuccessful, it is difficult to analyze a series of events to determine the steps used by an attacker to compromise a system or network, or what exactly happened that led to a Denial of Service. Collecting data such as the successful and unsuccessful events is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.",
|
|
590
|
+
"severity": "medium"
|
|
591
|
+
},
|
|
592
|
+
{
|
|
593
|
+
"id": "V-25270",
|
|
594
|
+
"title": "Local logging must be enabled.\n",
|
|
595
|
+
"description": "Logging is essential for tracking system events, in the event of unauthorized access, logs may contain information about how and when the access occurred. Ensure logging is enabled and log files are properly rotated. The default configuration in /etc/newsyslog.conf is used to configure local logging in the /var/log folder. The computer is set to rotate log files using the periodic launchd job according to time intervals specified in the /etc/newsyslog.conf file.",
|
|
596
|
+
"severity": "medium"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "V-25271",
|
|
600
|
+
"title": "Remote logging must be enabled.\n",
|
|
601
|
+
"description": "In addition to local logging, remote logging must also be enabled. Local logs can be altered if the computer is compromised. Remote logging mitigates the risk of having the logs altered. ",
|
|
602
|
+
"severity": "medium"
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
"id": "V-25272",
|
|
606
|
+
"title": "An antivirus tool must be installed.\n",
|
|
607
|
+
"description": "Installing antivirus tools helps prevent virus infection on a computer, and helps prevent a computer from becoming a host used to spread viruses to other computers. These tools quickly identify suspicious content and compare them to known malicious content. See the https://www.cybercom.mil web site for approved antivirus tools.",
|
|
608
|
+
"severity": "high"
|
|
609
|
+
},
|
|
610
|
+
{
|
|
611
|
+
"id": "V-25273",
|
|
612
|
+
"title": "Prevent root login must be securely configured in /etc/sshd_config.\n",
|
|
613
|
+
"description": "Prevents logging in as root through SSH. This should be set for all SSH methods of authenticating.\n",
|
|
614
|
+
"severity": "medium"
|
|
615
|
+
},
|
|
616
|
+
{
|
|
617
|
+
"id": "V-25274",
|
|
618
|
+
"title": "Login Grace Time must be securely configured in /etc/sshd_config.\n",
|
|
619
|
+
"description": "This setting controls the time allowed to authenticate over an ssh connection. It is recommended the value be set to 30 seconds or less. By allowing a connection to stay open for longer periods of time could allow an attacker to take advantage of the port.",
|
|
620
|
+
"severity": "low"
|
|
621
|
+
},
|
|
622
|
+
{
|
|
623
|
+
"id": "V-25275",
|
|
624
|
+
"title": "/etc/sshd_config - Protocol version must be securely configured.\n",
|
|
625
|
+
"description": "Restricts OpenSSH so it uses only SSH Protocol 2. This should be set for all SSH methods of authenticating.\n",
|
|
626
|
+
"severity": "medium"
|
|
627
|
+
},
|
|
628
|
+
{
|
|
629
|
+
"id": "V-25276",
|
|
630
|
+
"title": "OSX00180-SSH must not allow empty passwords.\n",
|
|
631
|
+
"description": "Denies access to accounts without passwords. This should be set for all SSH methods of authenticating.",
|
|
632
|
+
"severity": "high"
|
|
633
|
+
},
|
|
634
|
+
{
|
|
635
|
+
"id": "V-25278",
|
|
636
|
+
"title": "The MobileMe preference pane must be removed from System Preferences.\n",
|
|
637
|
+
"description": "Remove the MobileMe preference pane from System Preferences. MobileMe is a suite of Internet tools capable of synchronizing data and other important information while an individual is away from the computer, sensitive environments do not use MobileMe. If critical data must be stored, only store it on a local computer. Data should only be transferred over a secure network connection to a secure internal server. If MobileMe is used, enable it only for user accounts without access to critical data. It is not recommended to enable MobileMe for administrator or root user accounts. ",
|
|
638
|
+
"severity": "medium"
|
|
639
|
+
},
|
|
640
|
+
{
|
|
641
|
+
"id": "V-25279",
|
|
642
|
+
"title": "The Software Update Server URL must be assigned to an organizational value.\n",
|
|
643
|
+
"description": "A computer can look for software updates on an internal software update server (SUS). Using an internal software update server reduces the amount of data transferred outside of the network. The organization can control which updates can be installed on a computer.",
|
|
644
|
+
"severity": "medium"
|
|
645
|
+
},
|
|
646
|
+
{
|
|
647
|
+
"id": "V-25280",
|
|
648
|
+
"title": "The ability for administrative accounts to unlock screen saver must be disabled.",
|
|
649
|
+
"description": "The default setting creates a possible point of attack, because the more users in the admin group the more dependent on those users to protect their user names and passwords. By changing the rule in “system.login.screensaver” to “authenticatesession-owner”, users of the admin group cannot unlock the screen saver.",
|
|
650
|
+
"severity": "medium"
|
|
651
|
+
},
|
|
652
|
+
{
|
|
653
|
+
"id": "V-25283",
|
|
654
|
+
"title": "Setuid bit must be removed from Apple Remote Desktop.\n",
|
|
655
|
+
"description": "Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.\n",
|
|
656
|
+
"severity": "medium"
|
|
657
|
+
},
|
|
658
|
+
{
|
|
659
|
+
"id": "V-25291",
|
|
660
|
+
"title": "The setuid bit must be removed from the IPC Statistics.\n",
|
|
661
|
+
"description": "Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.\n",
|
|
662
|
+
"severity": "medium"
|
|
663
|
+
},
|
|
664
|
+
{
|
|
665
|
+
"id": "V-25292",
|
|
666
|
+
"title": "The setuid bit from Remote Access (unsecure) must be removed.\n",
|
|
667
|
+
"description": "Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.\n",
|
|
668
|
+
"severity": "medium"
|
|
669
|
+
},
|
|
670
|
+
{
|
|
671
|
+
"id": "V-25293",
|
|
672
|
+
"title": "The setuid bit from rlogin must be removed.\n",
|
|
673
|
+
"description": "Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.\n",
|
|
674
|
+
"severity": "medium"
|
|
675
|
+
},
|
|
676
|
+
{
|
|
677
|
+
"id": "V-25294",
|
|
678
|
+
"title": "The setuid bit from Remote Access shell (unsecure) must be removed.\n",
|
|
679
|
+
"description": "Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.\n",
|
|
680
|
+
"severity": "medium"
|
|
681
|
+
},
|
|
682
|
+
{
|
|
683
|
+
"id": "V-25295",
|
|
684
|
+
"title": "The setuid bit from System Activity Reporting must be removed.\n",
|
|
685
|
+
"description": "Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.\n",
|
|
686
|
+
"severity": "medium"
|
|
687
|
+
},
|
|
688
|
+
{
|
|
689
|
+
"id": "V-25296",
|
|
690
|
+
"title": "The correct date and time must be set.\n",
|
|
691
|
+
"description": "Correct date and time settings are required for authentication protocols, like Kerberos. Incorrect date and time settings can cause security issues. ",
|
|
692
|
+
"severity": "low"
|
|
693
|
+
},
|
|
694
|
+
{
|
|
695
|
+
"id": "V-25297",
|
|
696
|
+
"title": "A secure time server must be referenced.\n",
|
|
697
|
+
"description": "Correct date and time settings are required for authentication protocols, like Kerberos. Incorrect date and time settings can cause security issues. Date and time preferences can be used to set the date and time based on a Network Time Protocol (NTP) server. If you require automatic date and time, use a trusted, internal NTP server. ",
|
|
698
|
+
"severity": "low"
|
|
699
|
+
},
|
|
700
|
+
{
|
|
701
|
+
"id": "V-25298",
|
|
702
|
+
"title": "The Auto Update feature must be disabled. ",
|
|
703
|
+
"description": "By disabling automatic updates, updates can be downloaded and tested in a non production environment before they are distributed to the production workstations. This reduces the risk of accidental or malicious software updates being applied before they are properly tested.",
|
|
704
|
+
"severity": "medium"
|
|
705
|
+
},
|
|
706
|
+
{
|
|
707
|
+
"id": "V-25299",
|
|
708
|
+
"title": "The guest account must be disabled.",
|
|
709
|
+
"description": "The guest account is used to give a user temporary access to a computer. The guest account should be disabled by default because it does not require a password to login on the computer. If this account is enabled and is not securely configured malicious users can gain access to a computer without the use of a password. ",
|
|
710
|
+
"severity": "medium"
|
|
711
|
+
},
|
|
712
|
+
{
|
|
713
|
+
"id": "V-25300",
|
|
714
|
+
"title": "Shared folders must be disabled.",
|
|
715
|
+
"description": "Whether or not the guest account itself is enabled, disable guest account access to shared files and folders by deselecting the “Allow guest to connect to shared folders” checkbox. If the guest account is permitted to access shared folders, an attacker can easily attempt to access shared folders without a password.",
|
|
716
|
+
"severity": "medium"
|
|
717
|
+
},
|
|
718
|
+
{
|
|
719
|
+
"id": "V-25302",
|
|
720
|
+
"title": "Login window must be properly configured.",
|
|
721
|
+
"description": "If not properly configured, the logon screen provides a list of local user names available for logon. A user could use this information to attempt to login as a different user. ",
|
|
722
|
+
"severity": "medium"
|
|
723
|
+
},
|
|
724
|
+
{
|
|
725
|
+
"id": "V-25304",
|
|
726
|
+
"title": "Input menu must not be shown in login window.\n",
|
|
727
|
+
"description": "Showing input in the login window could compromise the integrity of the information, and could also allow someone shoulder surfing to gain unauthorized access to the system.",
|
|
728
|
+
"severity": "high"
|
|
729
|
+
},
|
|
730
|
+
{
|
|
731
|
+
"id": "V-25305",
|
|
732
|
+
"title": "The system must be configured to not show password hints.",
|
|
733
|
+
"description": "Providing information in the password hint field could compromise the integrity of the password. Showing password hint could allow someone shoulder surfing to gain information leading to unauthorized access to the system. ",
|
|
734
|
+
"severity": "high"
|
|
735
|
+
},
|
|
736
|
+
{
|
|
737
|
+
"id": "V-25306",
|
|
738
|
+
"title": "Fast User Switching must be disabled.\n",
|
|
739
|
+
"description": "Fast User Switching allows multiple users to log in simultaneously. This makes it difficult to track user actions and allows users to run malicious applications in the background while another user is using the computer.",
|
|
740
|
+
"severity": "medium"
|
|
741
|
+
},
|
|
742
|
+
{
|
|
743
|
+
"id": "V-25307",
|
|
744
|
+
"title": "The password-related hint field must not be used.\n",
|
|
745
|
+
"description": "If a hint is provided, the user is presented with the hint after three failed authentication attempts. Password-related information provided in the field could compromise the integrity of the password. Adding contact information for your organization’s technical support is convenient and does not compromise password integrity.",
|
|
746
|
+
"severity": "high"
|
|
747
|
+
},
|
|
748
|
+
{
|
|
749
|
+
"id": "V-25308",
|
|
750
|
+
"title": "Automatic actions must be disabled for blank CDs.",
|
|
751
|
+
"description": "To secure CDs and DVDs, do not allow the computer to perform automatic actions when the user inserts a disc. When disabling automatic actions in System Preferences, these actions must be disabled for every user account on the computer.",
|
|
752
|
+
"severity": "high"
|
|
753
|
+
},
|
|
754
|
+
{
|
|
755
|
+
"id": "V-25309",
|
|
756
|
+
"title": "Automatic actions must be disabled for music CDs.\n",
|
|
757
|
+
"description": "To secure CDs and DVDs (music), do not allow the computer to perform automatic actions when the user inserts a disc. When disabling automatic actions in System Preferences, these actions must be disabled for every user account on the computer.",
|
|
758
|
+
"severity": "high"
|
|
759
|
+
},
|
|
760
|
+
{
|
|
761
|
+
"id": "V-25310",
|
|
762
|
+
"title": "Automatic actions must be disabled for picture CDs.",
|
|
763
|
+
"description": "To secure CDs and DVDs, do not allow the computer to perform automatic actions when the user inserts a disc. When disabling automatic actions in System Preferences, these actions must be disabled for every user account on the computer.",
|
|
764
|
+
"severity": "high"
|
|
765
|
+
},
|
|
766
|
+
{
|
|
767
|
+
"id": "V-25311",
|
|
768
|
+
"title": "Automatic actions must be disabled for video DVDs.",
|
|
769
|
+
"description": "To secure CDs and DVDs, do not allow the computer to perform automatic actions when the user inserts a disc. When disabling automatic actions in System Preferences, these actions must be disabled for every user account on the computer.",
|
|
770
|
+
"severity": "high"
|
|
771
|
+
},
|
|
772
|
+
{
|
|
773
|
+
"id": "V-25312",
|
|
774
|
+
"title": "System must have a password-protected screen saver configured to DoD requirements. ",
|
|
775
|
+
"description": "User needs to configure a password-protected screen saver to prevent unauthorized users from accessing unattended computers. A short inactivity interval should also be set to decrease the amount of time the unattended computer is unlocked. ",
|
|
776
|
+
"severity": "medium"
|
|
777
|
+
},
|
|
778
|
+
{
|
|
779
|
+
"id": "V-25317",
|
|
780
|
+
"title": "The ability to use corners to disable the screen saver must be disabled.",
|
|
781
|
+
"description": "A computer should require authentication when waking from sleep or screen saver. Exposé & Spaces preferences can be configured to disable the screen saver by moving the mouse cursor to a corner of the screen. Do not configure a corner to disable the screen saver.",
|
|
782
|
+
"severity": "medium"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
"id": "V-25318",
|
|
786
|
+
"title": "Bluetooth devices must not be allowed to wake the computer.\n",
|
|
787
|
+
"description": "If Bluetooth is not required, turn it off. If Bluetooth is necessary, disable allowing Bluetooth devices to awake the computer.\n",
|
|
788
|
+
"severity": "medium"
|
|
789
|
+
},
|
|
790
|
+
{
|
|
791
|
+
"id": "V-25320",
|
|
792
|
+
"title": "Unused hardware devices must be disabled for AirPort.",
|
|
793
|
+
"description": "It is recommended to disable unused hardware devices listed in Network preferences. Enabled, unused devices (such as AirPort and Bluetooth) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer.",
|
|
794
|
+
"severity": "medium"
|
|
795
|
+
},
|
|
796
|
+
{
|
|
797
|
+
"id": "V-25321",
|
|
798
|
+
"title": "Unused hardware devices must be disabled for Bluetooth.\n",
|
|
799
|
+
"description": "It is recommended to disable unused hardware devices listed in Network preferences. Enabled, unused devices (such as AirPort and Bluetooth) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer.",
|
|
800
|
+
"severity": "medium"
|
|
801
|
+
},
|
|
802
|
+
{
|
|
803
|
+
"id": "V-25323",
|
|
804
|
+
"title": "Unused hardware devices must be disabled for Firewire.\n",
|
|
805
|
+
"description": "It is recommended to disable unused hardware devices listed in Network preferences. Enabled, unused devices (Firewire) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer.",
|
|
806
|
+
"severity": "medium"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"id": "V-25324",
|
|
810
|
+
"title": "System Preferences must be securely configured so IPv6 is turned off if not being used.",
|
|
811
|
+
"description": "It is recommended to disable unused hardware devices listed in Network preferences. Enabled, unused devices are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer.",
|
|
812
|
+
"severity": "medium"
|
|
813
|
+
},
|
|
814
|
+
{
|
|
815
|
+
"id": "V-25328",
|
|
816
|
+
"title": "A password must be required to wake a computer from sleep or screen saver. ",
|
|
817
|
+
"description": "Require a password to wake a computer from sleep or screen saver. This helps prevent unauthorized access on unattended computers. Although there is a lock button for Security references, users do not need to be authorized as an administrator to make changes. Enable this password requirement for every user account on the computer.",
|
|
818
|
+
"severity": "medium"
|
|
819
|
+
},
|
|
820
|
+
{
|
|
821
|
+
"id": "V-25329",
|
|
822
|
+
"title": "Automatic login must be disabled.",
|
|
823
|
+
"description": "Disabling automatic login is necessary for any level of security. If automatic login is enabled, an intruder can log in without authenticating. Even automatically logging in with a restricted user account, it is still easier to perform malicious actions on the computer.",
|
|
824
|
+
"severity": "high"
|
|
825
|
+
},
|
|
826
|
+
{
|
|
827
|
+
"id": "V-25330",
|
|
828
|
+
"title": "A password must be required to unlock each System Preference Pane.\n",
|
|
829
|
+
"description": "Some system preferences are unlocked when logged in with an administrator account. By requiring a password, digital token, smart card, or biometric reader to unlock secure system preferences, this requires extra authentication. ",
|
|
830
|
+
"severity": "medium"
|
|
831
|
+
},
|
|
832
|
+
{
|
|
833
|
+
"id": "V-25331",
|
|
834
|
+
"title": "Automatic logout due to inactivity must be disabled.",
|
|
835
|
+
"description": "Although some might want to enable automatic logout based on inactivity, there are reasons why this feature should be disabled. First, it can disrupt workflow. Second, it can close applications or processes without approval (but a password-protected screen saver will not close applications). Third, because automatic logout can be interrupted, it provides a false sense of security. ",
|
|
836
|
+
"severity": "low"
|
|
837
|
+
},
|
|
838
|
+
{
|
|
839
|
+
"id": "V-25332",
|
|
840
|
+
"title": "Secure virtual memory must be used.",
|
|
841
|
+
"description": "Use secure virtual memory. The system’s virtual memory swap file stores inactive physical memory contents, freeing physical memory. By default on some systems, the swap file is unencrypted. This file can contain confidential data, such as documents and passwords. Using secure virtual memory will secure the swap file at a cost of slightly slower speed (because Mac OS X must encrypt and decrypt the secure swap file).",
|
|
842
|
+
"severity": "medium"
|
|
843
|
+
},
|
|
844
|
+
{
|
|
845
|
+
"id": "V-25333",
|
|
846
|
+
"title": "Remote control infrared receiver must be disabled.\n",
|
|
847
|
+
"description": "If not using a remote control, disable the infrared receiver. This prevents unauthorized users from controlling a computer through the infrared receiver.",
|
|
848
|
+
"severity": "medium"
|
|
849
|
+
},
|
|
850
|
+
{
|
|
851
|
+
"id": "V-25335",
|
|
852
|
+
"title": "Only essential services must be allowed through firewall.\n",
|
|
853
|
+
"description": "Allowing only essential services through the firewall alleviates the potential for unwanted services to run on the system, and cuts down on system usage. \n",
|
|
854
|
+
"severity": "medium"
|
|
855
|
+
},
|
|
856
|
+
{
|
|
857
|
+
"id": "V-25337",
|
|
858
|
+
"title": "Stealth Mode must be enabled on the firewall.",
|
|
859
|
+
"description": "Enable Stealth Mode to prevent the computer from sending responses to uninvited traffic.\n",
|
|
860
|
+
"severity": "medium"
|
|
861
|
+
},
|
|
862
|
+
{
|
|
863
|
+
"id": "V-25338",
|
|
864
|
+
"title": "DVD or CD Sharing must be disabled.\n",
|
|
865
|
+
"description": "DVD or CD sharing must be disabled because it allows users of other computers to remotely use the DVD or CD drive on a computer.\n",
|
|
866
|
+
"severity": "medium"
|
|
867
|
+
},
|
|
868
|
+
{
|
|
869
|
+
"id": "V-25339",
|
|
870
|
+
"title": "Screen Sharing must be disabled.",
|
|
871
|
+
"description": "Screen sharing must be disabled because it allows users of other computers to remotely view and control the computer. \n",
|
|
872
|
+
"severity": "medium"
|
|
873
|
+
},
|
|
874
|
+
{
|
|
875
|
+
"id": "V-25340",
|
|
876
|
+
"title": "File Sharing must be disabled.",
|
|
877
|
+
"description": "File sharing must be disabled because it gives users of other computers access to each user’s Public folder.",
|
|
878
|
+
"severity": "medium"
|
|
879
|
+
},
|
|
880
|
+
{
|
|
881
|
+
"id": "V-25341",
|
|
882
|
+
"title": "Printer Sharing must be disabled.",
|
|
883
|
+
"description": "Printer sharing must be disabled because it allows other computers to access a printer connected to the computer.",
|
|
884
|
+
"severity": "medium"
|
|
885
|
+
},
|
|
886
|
+
{
|
|
887
|
+
"id": "V-25342",
|
|
888
|
+
"title": "Web Sharing must be disabled.",
|
|
889
|
+
"description": "Web Sharing must be disabled because it allows a network user to view websites located in /Sites. ",
|
|
890
|
+
"severity": "medium"
|
|
891
|
+
},
|
|
892
|
+
{
|
|
893
|
+
"id": "V-25343",
|
|
894
|
+
"title": "Remote Login must be disabled.",
|
|
895
|
+
"description": "Remote Login must be disabled because it allows users to access the computer remotely.",
|
|
896
|
+
"severity": "medium"
|
|
897
|
+
},
|
|
898
|
+
{
|
|
899
|
+
"id": "V-25346",
|
|
900
|
+
"title": "Apple Remote Desktop must be disabled.",
|
|
901
|
+
"description": "Apple Remote Desktop must be disabled because it allows the computer to be accessed using Apple Remote Desktop.",
|
|
902
|
+
"severity": "medium"
|
|
903
|
+
},
|
|
904
|
+
{
|
|
905
|
+
"id": "V-25348",
|
|
906
|
+
"title": "Remote Apple Events must be disabled.",
|
|
907
|
+
"description": "Remote Apple Events must be disabled because it allows the computer to receive Apple events from other computers.",
|
|
908
|
+
"severity": "medium"
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
"id": "V-25349",
|
|
912
|
+
"title": "Xgrid Sharing must be disabled.",
|
|
913
|
+
"description": "Xgrid Sharing must be disabled because it allows computers on a network to work together in a grid to process a job.",
|
|
914
|
+
"severity": "medium"
|
|
915
|
+
},
|
|
916
|
+
{
|
|
917
|
+
"id": "V-25350",
|
|
918
|
+
"title": "Internet Sharing must be disabled.\n",
|
|
919
|
+
"description": "Internet Sharing must be disabled because it allows other users to connect with computers on your local network, through your internet connection.",
|
|
920
|
+
"severity": "medium"
|
|
921
|
+
},
|
|
922
|
+
{
|
|
923
|
+
"id": "V-25351",
|
|
924
|
+
"title": "Bluetooth Sharing must be disabled.\n",
|
|
925
|
+
"description": "Bluetooth Sharing must be disabled because it allows other Bluetooth-enabled computers and devices to share files with your computer.",
|
|
926
|
+
"severity": "medium"
|
|
927
|
+
},
|
|
928
|
+
{
|
|
929
|
+
"id": "V-25354",
|
|
930
|
+
"title": "Mail must be configured using SSL.\n",
|
|
931
|
+
"description": "When setting up user mail accounts, select \"use SSL\" in advanced options. This setting is for the Mail app included with OS X. Instructions will be different for other mail applications, but all mail applications should be set up secured using some form of encryption. \n\n",
|
|
932
|
+
"severity": "medium"
|
|
933
|
+
},
|
|
934
|
+
{
|
|
935
|
+
"id": "V-25355",
|
|
936
|
+
"title": "iTunes Store must be disabled.",
|
|
937
|
+
"description": "iTunes store allows a user to purchase and download music, videos, and podcasts, which could inadvertently introduce malware on the system. NOTE: The fix must be performed for each user.",
|
|
938
|
+
"severity": "low"
|
|
939
|
+
},
|
|
940
|
+
{
|
|
941
|
+
"id": "V-25356",
|
|
942
|
+
"title": "Finder must be set to always empty Trash securely.\n",
|
|
943
|
+
"description": "In Mac OS X Finder can be configured to always securely erase items placed in the Trash. This prevents data placed in the Trash from being restored.",
|
|
944
|
+
"severity": "low"
|
|
945
|
+
},
|
|
946
|
+
{
|
|
947
|
+
"id": "V-25358",
|
|
948
|
+
"title": "iDisk must be removed from Finder sidebar.\n",
|
|
949
|
+
"description": "iDisk data is stored on Internet servers and is protected by MobileMe account. However, if MobileMe account is accessed by an unauthorized user, data can be compromised. Do not store sensitive data on iDisk. Keep sensitive data local and encrypted on a computer.",
|
|
950
|
+
"severity": "medium"
|
|
951
|
+
},
|
|
952
|
+
{
|
|
953
|
+
"id": "V-25371",
|
|
954
|
+
"title": "The root account must be disabled.\n",
|
|
955
|
+
"description": "The most powerful user account in Mac OS X is the system administrator or root account. By default, the root account on Mac OS X is disabled and it is recommended to not enable it. The root account is primarily used for performing UNIX commands. Generally, actions involving critical system files require performing those actions as root.",
|
|
956
|
+
"severity": "high"
|
|
957
|
+
},
|
|
958
|
+
{
|
|
959
|
+
"id": "V-25372",
|
|
960
|
+
"title": "Physical security of the system must meet DoD requirements.\n",
|
|
961
|
+
"description": "Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security of the AIS is the first line protection of any system.\nPhysical security of the Automated Information System (AIS) must meet DoD requirements.\n",
|
|
962
|
+
"severity": "medium"
|
|
963
|
+
},
|
|
964
|
+
{
|
|
965
|
+
"id": "V-25373",
|
|
966
|
+
"title": "Shared User Accounts must be disabled.\n",
|
|
967
|
+
"description": "Shared accounts do not provide individual accountability for system access and resource usage.\nShared user accounts are not permitted on the system.\n",
|
|
968
|
+
"severity": "medium"
|
|
969
|
+
},
|
|
970
|
+
{
|
|
971
|
+
"id": "V-25374",
|
|
972
|
+
"title": "The Operating System must be current and at the latest release level.",
|
|
973
|
+
"description": "Failure to install the most current Operating System (OS) updates leaves a system vulnerable to exploitation. Current OS updates and patches correct known security and system vulnerabilities. If an OS is not at a supported level this will be upgraded to a Category I finding.",
|
|
974
|
+
"severity": "medium"
|
|
975
|
+
},
|
|
976
|
+
{
|
|
977
|
+
"id": "V-25375",
|
|
978
|
+
"title": "System Recovery Backup procedures must be configured to comply with DoD requirements.",
|
|
979
|
+
"description": "Recovery of a damaged or compromised system in a timely basis is difficult without a system information backup. A system backup will usually include sensitive information, such as user accounts that could be used in an attack. As a valuable system resource, the system backup should be protected and stored in a physically secure location.",
|
|
980
|
+
"severity": "low"
|
|
981
|
+
},
|
|
982
|
+
{
|
|
983
|
+
"id": "V-25376",
|
|
984
|
+
"title": "An Emergency Administrator Account must be created.",
|
|
985
|
+
"description": "This check verifies an emergency administrator account has been created to ensure system availability in the event no administrators are able or available to access the system.",
|
|
986
|
+
"severity": "medium"
|
|
987
|
+
},
|
|
988
|
+
{
|
|
989
|
+
"id": "V-25377",
|
|
990
|
+
"title": "Default and Emergency Administrator passwords must be changed when necessary. \n",
|
|
991
|
+
"description": "This check verifies the passwords for the default and emergency administrator accounts are changed at least annually or when any member of the administrative team leaves the organization.",
|
|
992
|
+
"severity": "medium"
|
|
993
|
+
},
|
|
994
|
+
{
|
|
995
|
+
"id": "V-25378",
|
|
996
|
+
"title": "Application/service account passwords must be changed at least annually or whenever a system administrator with knowledge of the password leaves the organization. \n",
|
|
997
|
+
"description": "Setting application accounts to expire may cause applications to stop functioning. The site will have a policy for application account passwords manually generated and entered by a system administrator to be changed at least annually or when a system administrator with knowledge of the password leaves the organization. Application/service account passwords will be at least 15 characters and follow complexity requirements for all passwords.",
|
|
998
|
+
"severity": "medium"
|
|
999
|
+
},
|
|
1000
|
+
{
|
|
1001
|
+
"id": "V-25379",
|
|
1002
|
+
"title": "Automatic Screen Saver initiation must be enabled when smart card is removed from machine.\n",
|
|
1003
|
+
"description": "When using a smart card for authentication the system must be configured to automatically lock the system when the smart card is removed.",
|
|
1004
|
+
"severity": "medium"
|
|
1005
|
+
},
|
|
1006
|
+
{
|
|
1007
|
+
"id": "V-25380",
|
|
1008
|
+
"title": "Access to audit configuration files must be restricted. ",
|
|
1009
|
+
"description": "Audit configuration files are susceptible to unauthorized, and possibly anonymous, tampering if proper permissions are not applied.\n",
|
|
1010
|
+
"severity": "medium"
|
|
1011
|
+
},
|
|
1012
|
+
{
|
|
1013
|
+
"id": "V-25413",
|
|
1014
|
+
"title": "Spotlight Panel must be securely configured.",
|
|
1015
|
+
"description": "Spotlight can be used to search a computer for files. Spotlight searches the name, the meta-information associated with each file, and the contents of each file. Spotlight finds files regardless of their placement in the file system. This still must be properly set access permissions on folders containing confidential files.",
|
|
1016
|
+
"severity": "medium"
|
|
1017
|
+
},
|
|
1018
|
+
{
|
|
1019
|
+
"id": "V-25557",
|
|
1020
|
+
"title": "Clear text passwords for all LDAPv3 directories must be disabled.\n",
|
|
1021
|
+
"description": "Allowing passwords to be transmitted over the network in clear text could allow an attacker to monitor the network and capture the password packets. This clear text function must be disabled when accessing LDAPv3 directories.",
|
|
1022
|
+
"severity": "high"
|
|
1023
|
+
},
|
|
1024
|
+
{
|
|
1025
|
+
"id": "V-25559",
|
|
1026
|
+
"title": "All LDAPv3 packets must be digitally signed.\n",
|
|
1027
|
+
"description": "To protect the data between the client and LDAPv3 directory the traffic should be digitally signed.",
|
|
1028
|
+
"severity": "medium"
|
|
1029
|
+
},
|
|
1030
|
+
{
|
|
1031
|
+
"id": "V-25561",
|
|
1032
|
+
"title": "All LDAPv3 packets must be encrypted.\n",
|
|
1033
|
+
"description": "All traffic between the client and the LDAPv3 should be encrypted to ensure confidentiality of data.",
|
|
1034
|
+
"severity": "medium"
|
|
1035
|
+
},
|
|
1036
|
+
{
|
|
1037
|
+
"id": "V-25563",
|
|
1038
|
+
"title": "LDAPv3 must block man-in-the-middle attacks.\n\n\n",
|
|
1039
|
+
"description": "To prevent LDAPv3 man-in-the middle attacks the system must be properly configured.",
|
|
1040
|
+
"severity": "medium"
|
|
1041
|
+
},
|
|
1042
|
+
{
|
|
1043
|
+
"id": "V-25606",
|
|
1044
|
+
"title": "Automatic actions must be disabled for blank DVDs.",
|
|
1045
|
+
"description": "To secure CDs and DVDs (blank), do not allow the computer to perform automatic actions when the user inserts a disc. When disabling automatic actions in System Preferences, these actions must be disabled for every user account on the computer.",
|
|
1046
|
+
"severity": "high"
|
|
1047
|
+
},
|
|
1048
|
+
{
|
|
1049
|
+
"id": "V-25882",
|
|
1050
|
+
"title": "Bonjour must be disabled.\n\n\n",
|
|
1051
|
+
"description": "Bonjour is unnecessary in a managed environment and presents an attack surface. Its behavior, which trusts the local network, is especially inappropriate on portable devices which may connect to untrusted networks.",
|
|
1052
|
+
"severity": "medium"
|
|
1053
|
+
},
|
|
1054
|
+
{
|
|
1055
|
+
"id": "V-29437",
|
|
1056
|
+
"title": "Complex passwords must contain Alphabetic Character.",
|
|
1057
|
+
"description": "Configure the local system to verify newly created passwords conform to DoD password complexity policy. Passwords must contain 1 character from the following 4 classes: English uppercase letters, English lowercase letters, Westernized Arabic numerals, and non-alphanumeric characters. Sites are responsible for installing password complexity software complying with the current DoD requirements.",
|
|
1058
|
+
"severity": "medium"
|
|
1059
|
+
},
|
|
1060
|
+
{
|
|
1061
|
+
"id": "V-29439",
|
|
1062
|
+
"title": "Complex passwords must contain a Symbolic Character.",
|
|
1063
|
+
"description": "Configure the local system to verify newly created passwords conform to the DoD password complexity policy. Passwords must contain 1 character from the following 4 classes: English uppercase letters, English lowercase letters, Westernized Arabic numerals, and non-alphanumeric characters. Sites are responsible for installing password complexity software that complies with current DoD requirements.",
|
|
1064
|
+
"severity": "medium"
|
|
1065
|
+
},
|
|
1066
|
+
{
|
|
1067
|
+
"id": "V-4084",
|
|
1068
|
+
"title": "The system must prohibit the reuse of passwords to 15 iterations.",
|
|
1069
|
+
"description": "If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at the user's password until it was guessed correctly.",
|
|
1070
|
+
"severity": "medium"
|
|
1071
|
+
},
|
|
1072
|
+
{
|
|
1073
|
+
"id": "V-4089",
|
|
1074
|
+
"title": "All system start-up files must be owned by root.",
|
|
1075
|
+
"description": "System start-up files not owned by root could lead to system compromise by allowing malicious users or applications to modify them for unauthorized purposes. This could lead to system and network compromise.",
|
|
1076
|
+
"severity": "medium"
|
|
1077
|
+
},
|
|
1078
|
+
{
|
|
1079
|
+
"id": "V-4090",
|
|
1080
|
+
"title": "All system start-up files must be group-owned by root, sys, bin, other, or system.",
|
|
1081
|
+
"description": "If system start-up files do not have a group owner of root or a system group, the files may be modified by malicious users or intruders.",
|
|
1082
|
+
"severity": "medium"
|
|
1083
|
+
},
|
|
1084
|
+
{
|
|
1085
|
+
"id": "V-4364",
|
|
1086
|
+
"title": "The \"at\" directory must have mode 0755 or less permissive.",
|
|
1087
|
+
"description": "If the \"at\" directory has a mode more permissive than 0755, unauthorized users could be allowed to view or to edit files containing sensitive information within the \"at\" directory. Unauthorized modifications could result in Denial of Service to authorized \"at\" jobs.",
|
|
1088
|
+
"severity": "medium"
|
|
1089
|
+
},
|
|
1090
|
+
{
|
|
1091
|
+
"id": "V-4365",
|
|
1092
|
+
"title": "The \"at\" directory must be owned by root, bin, or sys.",
|
|
1093
|
+
"description": "If the owner of the \"at\" directory is not root, bin, or sys, unauthorized users could be allowed to view or edit files containing sensitive information within the directory.",
|
|
1094
|
+
"severity": "medium"
|
|
1095
|
+
},
|
|
1096
|
+
{
|
|
1097
|
+
"id": "V-4366",
|
|
1098
|
+
"title": "\"At\" jobs must not set the umask to a value less restrictive than 077.",
|
|
1099
|
+
"description": "The umask controls the default access mode assigned to newly created files. An umask of 077 limits new files to mode 700 or less permissive. Although umask is often represented as a 4-digit number, the first digit representing special access modes is typically ignored or required to be “0”.",
|
|
1100
|
+
"severity": "medium"
|
|
1101
|
+
},
|
|
1102
|
+
{
|
|
1103
|
+
"id": "V-4368",
|
|
1104
|
+
"title": "The at.deny file must be owned by root, bin, or sys.",
|
|
1105
|
+
"description": "If the owner of the at.deny file is not set to root, bin, or sys, unauthorized users could be allowed to view or edit sensitive information contained within the file.",
|
|
1106
|
+
"severity": "medium"
|
|
1107
|
+
},
|
|
1108
|
+
{
|
|
1109
|
+
"id": "V-4369",
|
|
1110
|
+
"title": "The traceroute command owner must be root.",
|
|
1111
|
+
"description": "If the traceroute command owner has not been set to root, an unauthorized user could use this command to obtain knowledge of the network topology inside the firewall. This information may allow an attacker to determine trusted routers and other network information potentially leading to system and network compromise.",
|
|
1112
|
+
"severity": "medium"
|
|
1113
|
+
},
|
|
1114
|
+
{
|
|
1115
|
+
"id": "V-4370",
|
|
1116
|
+
"title": "The traceroute command must be group-owned by wheel.",
|
|
1117
|
+
"description": "If the group owner of the traceroute command has not been set to a system group, unauthorized users could have access to the command and use it to gain information regarding a network's topology inside of the firewall. This information may allow an attacker to determine trusted routers and other network information potentially leading to system and network compromise.",
|
|
1118
|
+
"severity": "medium"
|
|
1119
|
+
},
|
|
1120
|
+
{
|
|
1121
|
+
"id": "V-4371",
|
|
1122
|
+
"title": "The traceroute file must have mode 0700 or less permissive.",
|
|
1123
|
+
"description": "If the mode of the traceroute executable is more permissive than 0700, malicious code could be inserted by an attacker and triggered whenever the traceroute command is executed by authorized users. Additionally, if an unauthorized user is granted executable permissions to the traceroute command, it could be used to gain information about the network topology behind the firewall. This information may allow an attacker to determine trusted routers and other network information potentially leading to system and network compromise.",
|
|
1124
|
+
"severity": "medium"
|
|
1125
|
+
},
|
|
1126
|
+
{
|
|
1127
|
+
"id": "V-4385",
|
|
1128
|
+
"title": "The system must not use .forward files.",
|
|
1129
|
+
"description": "The .forward file allows users to automatically forward mail to another system. Use of .forward files could allow the unauthorized forwarding of mail and could potentially create mail loops which could degrade system performance.",
|
|
1130
|
+
"severity": "medium"
|
|
1131
|
+
},
|
|
1132
|
+
{
|
|
1133
|
+
"id": "V-4393",
|
|
1134
|
+
"title": "The /etc/syslog.conf file must be owned by root.",
|
|
1135
|
+
"description": "If the /etc/syslog.conf file is not owned by root, unauthorized users could be allowed to view, edit, or delete important system messages handled by the syslog facility.",
|
|
1136
|
+
"severity": "medium"
|
|
1137
|
+
},
|
|
1138
|
+
{
|
|
1139
|
+
"id": "V-4394",
|
|
1140
|
+
"title": "The /etc/syslog.conf file must be group-owned by wheel.",
|
|
1141
|
+
"description": "If the group owner of /etc/syslog.conf is not root, bin, or sys, unauthorized users could be permitted to view, edit, or delete important system messages handled by the syslog facility.",
|
|
1142
|
+
"severity": "medium"
|
|
1143
|
+
},
|
|
1144
|
+
{
|
|
1145
|
+
"id": "V-4687",
|
|
1146
|
+
"title": "The rsh daemon must not be running.",
|
|
1147
|
+
"description": "The rshd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.",
|
|
1148
|
+
"severity": "high"
|
|
1149
|
+
},
|
|
1150
|
+
{
|
|
1151
|
+
"id": "V-4688",
|
|
1152
|
+
"title": "The rexec daemon must not be running.",
|
|
1153
|
+
"description": "The rexecd process provides a typically unencrypted, host-authenticated remote access service. SSH should be used in place of this service.",
|
|
1154
|
+
"severity": "high"
|
|
1155
|
+
},
|
|
1156
|
+
{
|
|
1157
|
+
"id": "V-4696",
|
|
1158
|
+
"title": "The system must not have the UUCP service active.",
|
|
1159
|
+
"description": "The UUCP utility is designed to assist in transferring files, executing remote commands, and sending email between UNIX systems over phone lines and direct connections between systems. The UUCP utility is a primitive and arcane system with many security issues. There are alternate data transfer utilities/products that can be configured to more securely transfer data by providing for authentication, as well as encryption.",
|
|
1160
|
+
"severity": "medium"
|
|
1161
|
+
},
|
|
1162
|
+
{
|
|
1163
|
+
"id": "V-4701",
|
|
1164
|
+
"title": "The system must not have the finger service active.",
|
|
1165
|
+
"description": "The finger service provides information about the system's users to network clients. This information could expose information to be used in subsequent attacks.",
|
|
1166
|
+
"severity": "low"
|
|
1167
|
+
},
|
|
1168
|
+
{
|
|
1169
|
+
"id": "V-773",
|
|
1170
|
+
"title": "The root account must be the only account having a UID of “0”.",
|
|
1171
|
+
"description": "If an account has a UID of “0”, it has root authority. Multiple accounts with a UID of “0” afford more opportunity for potential intruders to guess a password for a privileged account.",
|
|
1172
|
+
"severity": "medium"
|
|
1173
|
+
},
|
|
1174
|
+
{
|
|
1175
|
+
"id": "V-784",
|
|
1176
|
+
"title": "System files and directories must not have uneven access permissions.",
|
|
1177
|
+
"description": "Discretionary access control is undermined if users, other than a file owner, have greater access permissions to system files and directories than the owner.",
|
|
1178
|
+
"severity": "medium"
|
|
1179
|
+
},
|
|
1180
|
+
{
|
|
1181
|
+
"id": "V-785",
|
|
1182
|
+
"title": "All files and directories must have a valid owner.",
|
|
1183
|
+
"description": "Non-ownership files and directories may be unintentionally inherited if a user is assigned the same UID as the UID of the non-ownership files.",
|
|
1184
|
+
"severity": "medium"
|
|
1185
|
+
},
|
|
1186
|
+
{
|
|
1187
|
+
"id": "V-786",
|
|
1188
|
+
"title": "All network services daemon files must have mode 0755 or less permissive.",
|
|
1189
|
+
"description": "Restricting permission on daemons will protect them from unauthorized modification and possible system compromise.",
|
|
1190
|
+
"severity": "medium"
|
|
1191
|
+
},
|
|
1192
|
+
{
|
|
1193
|
+
"id": "V-787",
|
|
1194
|
+
"title": "System log files must have mode 644 or less permissive.",
|
|
1195
|
+
"description": "If the system log files are not protected, unauthorized users could change the logged data, eliminating its forensic value.",
|
|
1196
|
+
"severity": "medium"
|
|
1197
|
+
},
|
|
1198
|
+
{
|
|
1199
|
+
"id": "V-792",
|
|
1200
|
+
"title": "Manual page files must have mode 0644 or less permissive.",
|
|
1201
|
+
"description": "If manual pages are compromised, misleading information could be inserted causing actions to possibly compromise the system.",
|
|
1202
|
+
"severity": "low"
|
|
1203
|
+
},
|
|
1204
|
+
{
|
|
1205
|
+
"id": "V-793",
|
|
1206
|
+
"title": "Library files must have mode 0755 or less permissive.",
|
|
1207
|
+
"description": "Unauthorized access could destroy the integrity of the library files.",
|
|
1208
|
+
"severity": "medium"
|
|
1209
|
+
},
|
|
1210
|
+
{
|
|
1211
|
+
"id": "V-794",
|
|
1212
|
+
"title": "All system command files must have mode 0755 or less permissive.",
|
|
1213
|
+
"description": "Restricting permissions will protect system command files from unauthorized modification. System command files include files present in directories used by the operating system for storing default system executables and files present in directories included in the system's default executable search paths.",
|
|
1214
|
+
"severity": "medium"
|
|
1215
|
+
},
|
|
1216
|
+
{
|
|
1217
|
+
"id": "V-795",
|
|
1218
|
+
"title": "All system files, programs, and directories must be owned by a system account.",
|
|
1219
|
+
"description": "Restricting permissions will protect the files from unauthorized modification.",
|
|
1220
|
+
"severity": "medium"
|
|
1221
|
+
},
|
|
1222
|
+
{
|
|
1223
|
+
"id": "V-796",
|
|
1224
|
+
"title": "System files, programs, and directories must be group-owned by a system group.",
|
|
1225
|
+
"description": "Restricting permissions will protect the files from unauthorized modification.",
|
|
1226
|
+
"severity": "medium"
|
|
1227
|
+
},
|
|
1228
|
+
{
|
|
1229
|
+
"id": "V-798",
|
|
1230
|
+
"title": "The /etc/passwd file must have mode 0644 or less permissive.",
|
|
1231
|
+
"description": "If the password file is writable by a group owner or the world, the risk of password file compromise is increased. The password file contains the list of accounts on the system and associated information.",
|
|
1232
|
+
"severity": "medium"
|
|
1233
|
+
},
|
|
1234
|
+
{
|
|
1235
|
+
"id": "V-806",
|
|
1236
|
+
"title": "The sticky bit must be set on all public directories.",
|
|
1237
|
+
"description": "Failing to set the sticky bit on the public directories allows unauthorized users to delete files in the directory structure.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage (e.g., /tmp) and for directories requiring global read/write access.\n",
|
|
1238
|
+
"severity": "low"
|
|
1239
|
+
},
|
|
1240
|
+
{
|
|
1241
|
+
"id": "V-807",
|
|
1242
|
+
"title": "All public directories must be owned by root or an application account.",
|
|
1243
|
+
"description": "If a public directory has the sticky bit set and is not owned by a privileged UID, unauthorized users may be able to modify files created by others.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage (e.g., /tmp) and for directories requiring global read/write access.\n",
|
|
1244
|
+
"severity": "medium"
|
|
1245
|
+
},
|
|
1246
|
+
{
|
|
1247
|
+
"id": "V-812",
|
|
1248
|
+
"title": "System audit logs must be owned by root.",
|
|
1249
|
+
"description": "Failure to give ownership of system audit log files to root provides the designated owner and unauthorized users with the potential to access sensitive information.",
|
|
1250
|
+
"severity": "medium"
|
|
1251
|
+
},
|
|
1252
|
+
{
|
|
1253
|
+
"id": "V-813",
|
|
1254
|
+
"title": "System audit logs must have mode 640 or less permissive.",
|
|
1255
|
+
"description": "If a user can write to the audit logs, audit trails can be modified or destroyed and system intrusion may not be detected. System audit logs are those files generated from the audit system and do not include activity, error, or other log files created by application software.",
|
|
1256
|
+
"severity": "medium"
|
|
1257
|
+
},
|
|
1258
|
+
{
|
|
1259
|
+
"id": "V-823",
|
|
1260
|
+
"title": "The services file must be owned by root or bin.",
|
|
1261
|
+
"description": "Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.",
|
|
1262
|
+
"severity": "medium"
|
|
1263
|
+
},
|
|
1264
|
+
{
|
|
1265
|
+
"id": "V-824",
|
|
1266
|
+
"title": "The services file must have mode 0644 or less permissive.",
|
|
1267
|
+
"description": "The services file is critical to the proper operation of network services and must be protected from unauthorized modification. Unauthorized modification could result in the failure of network services.",
|
|
1268
|
+
"severity": "medium"
|
|
1269
|
+
},
|
|
1270
|
+
{
|
|
1271
|
+
"id": "V-904",
|
|
1272
|
+
"title": "All local initialization files must be owned by the user or root.",
|
|
1273
|
+
"description": "Local initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.",
|
|
1274
|
+
"severity": "medium"
|
|
1275
|
+
},
|
|
1276
|
+
{
|
|
1277
|
+
"id": "V-906",
|
|
1278
|
+
"title": "All run control scripts must have mode 0755 or less permissive.",
|
|
1279
|
+
"description": "If the startup files are writable by other users, they could modify to insert malicious commands into the startup files.",
|
|
1280
|
+
"severity": "medium"
|
|
1281
|
+
},
|
|
1282
|
+
{
|
|
1283
|
+
"id": "V-913",
|
|
1284
|
+
"title": "There must be no .netrc files on the system.\n",
|
|
1285
|
+
"description": "Unencrypted passwords for remote FTP servers may be stored in .netrc files. Policy requires passwords be encrypted in storage and not used in access scripts.",
|
|
1286
|
+
"severity": "medium"
|
|
1287
|
+
},
|
|
1288
|
+
{
|
|
1289
|
+
"id": "V-914",
|
|
1290
|
+
"title": "All files and directories contained in interactive user home directories must be owned by the home directory's owner.",
|
|
1291
|
+
"description": "If users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.",
|
|
1292
|
+
"severity": "low"
|
|
1293
|
+
},
|
|
1294
|
+
{
|
|
1295
|
+
"id": "V-921",
|
|
1296
|
+
"title": "All shell files must be owned by root.",
|
|
1297
|
+
"description": "If shell files are owned by users other than root or bin, they could be modified by intruders or malicious users to perform unauthorized actions.",
|
|
1298
|
+
"severity": "medium"
|
|
1299
|
+
},
|
|
1300
|
+
{
|
|
1301
|
+
"id": "V-922",
|
|
1302
|
+
"title": "All shell files must have mode 0755 or less permissive.",
|
|
1303
|
+
"description": "Shells with world/group write permissions give the ability to maliciously modify the shell to obtain unauthorized access.",
|
|
1304
|
+
"severity": "high"
|
|
1305
|
+
},
|
|
1306
|
+
{
|
|
1307
|
+
"id": "V-924",
|
|
1308
|
+
"title": "Device files and directories must only be writable by users with a system account or as configured by the vendor.",
|
|
1309
|
+
"description": "System device files in writable directories could be modified, removed, or used by an unprivileged user to control system hardware.",
|
|
1310
|
+
"severity": "medium"
|
|
1311
|
+
},
|
|
1312
|
+
{
|
|
1313
|
+
"id": "V-936",
|
|
1314
|
+
"title": "The nosuid option must be enabled on all NFS client mounts.",
|
|
1315
|
+
"description": "Enabling the nosuid mount option prevents the system from granting owner or group-owner privileges to programs with the suid or sgid bit set. If the system does not restrict this access, users with unprivileged access to the local system may be able to acquire privileged access by executing suid or sgid files located on the mounted NFS file system.",
|
|
1316
|
+
"severity": "medium"
|
|
1317
|
+
}
|
|
1318
|
+
]
|
|
1319
|
+
}
|