Below table provides the sections of CIS hardening benchmark for RedHat Enterprise Linux (RHEL) 7.x that are covered by the script and the files being created/modified to address the recommendations.
NOTE: Screenshots are included for sections where the difference can be noticed to verify the implementation of CIS script. |
CIS Sections |
File Created/Modified |
Section 1 | |
1.1.1.1 Ensure mounting of cramfs filesystems is disabled | /etc/modprobe.d/CIS.conf |
1.1.1.2 Ensure mounting of squashfs filesystems is disabled | /etc/modprobe.d/CIS.conf |
1.1.1.3 Ensure mounting of udf filesystems is disabled | /etc/modprobe.d/CIS.conf |
Pre-CIS |
Post-CIS |
1.1.3 Ensure noexec option set on /tmp partition | /etc/fstab |
1.1.4 Ensure nodev option set on /tmp partition | /etc/fstab |
1.1.5 Ensure nosuid option set on /tmp partition | /etc/fstab |
1.1.23 Disable Automounting | |
1.2.1 Ensure GPG keys are configured | Just checks the current configuration and provides results in the output. No modification. |
1.4.3 Ensure authentication required for single user mode | /etc/sysconfig/init |
1.5.1 Ensure core dumps are restricted | /etc/sysconfig/init |
Pre-CIS |
Post-CIS |
1.5.4 Ensure prelink is not installed | Remove prelink package (if installed) using ‘yum’ command. |
1.7.1 Ensure message of the day is | /etc/motd |
1.7.2 Ensure local login warning banner is configured properly | /etc/issue |
1.7.3 Ensure remote login warning banner is /etc/issue.net configured properly | /etc/issue.net |
1.7.4 Ensure permissions on /etc/motd are configured | /etc/motd |
1.7.6 Ensure permissions on /etc/issue.net are configured | /etc/issue |
Section 2 | |
2.2.2 Ensure X11 Server components are not Remove xorg-x11 packages using ‘yum’ installed | Remove xorg-x11 packages using ‘yum’ command. |
Pre-CIS |
Post-CIS |
2.2.18 Ensure rpcbind is not installed or the rpcbind services are masked | Disable rpmcbind service. |
2.3.1 Ensure NIS Client is not installed | Remove ypbind package using ‘yum’ command. |
Section 3 | |
3.2.1 Ensure IP forwarding is disabled | /etc/sysctl.conf |
3.2.2 Ensure packet redirect sending is disabled | /etc/sysctl.conf |
Pre-CIS |
Post-CIS |
3.3.1 Ensure source routed packets are not accepted | /etc/sysctl.conf |
3.3.2 Ensure ICMP redirects are not accepted | /etc/sysctl.conf |
Pre-CIS |
Post-CIS |
3.3.3 Ensure secure ICMP redirects are not accepted | /etc/sysctl.conf |
3.3.4 Ensure suspicious packets are logged | /etc/sysctl.conf |
3.3.5 Ensure broadcast ICMP requests are ignored | /etc/sysctl.conf |
3.3.6 Ensure bogus ICMP responses are ignored | /etc/sysctl.conf |
3.3.7 Ensure Reverse Path Filtering is enabled | /etc/sysctl.conf |
3.3.8 Ensure TCP SYN Cookies is enabled | /etc/sysctl.conf |
3.3.9 Ensure IPv6 router advertisements are not accepted | /etc/sysctl.conf |
3.4.1 Ensure DCCP is disabled | /etc/modprobe.d/CIS.conf |
3.4.2 Ensure SCTP is disabled | /etc/modprobe.d/CIS.conf |
Pre-CIS |
Post-CIS |
Section 4 |
|
4.1.1.2 Ensure auditd service is enabled and running | Enable auditd service. |
4.1.2.1 Ensure audit log storage size is configured | /etc/audit/auditd.conf |
4.1.2.2 Ensure audit logs are not automatically deleted | /etc/audit/auditd.conf |
Pre-CIS |
Post-CIS |
4.1.2.3 Ensure system is disabled when audit /etc/audit/auditd.conf logs are full | /etc/audit/auditd.conf |
Pre-CIS |
Post-CIS |
4.1.2.4 Ensure audit_backlog_limit is sufficient | /etc/default/grub |
4.1.3 Ensure events that modify date and time information are collected | /etc/audit/audit.rules |
4.1.4 Ensure events that modify user/group information are collected | /etc/audit/audit.rules |
4.1.5 Ensure events that modify the system's /etc/audit/audit.rules network environment are collected | /etc/audit/audit.rules |
4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected | /etc/audit/audit.rules |
4.1.7 Ensure login and logout events are collected | /etc/audit/audit.rules |
4.1.8 Ensure session initiation information is collected | /etc/audit/audit.rules |
4.1.9 Ensure discretionary access control permission modification events are collected | /etc/audit/audit.rules |
4.1.10 Ensure unsuccessful unauthorized file access attempts are collected | /etc/audit/audit.rules |
4.1.11 Ensure use of privileged commands is collected | /etc/audit/audit.rules |
4.1.12 Ensure successful file system mounts are collected | /etc/audit/audit.rules |
4.1.13 Ensure file deletion events by users are collected | /etc/audit/audit.rules |
4.1.14 Ensure changes to system command executions (sudo) are collected | /etc/audit/audit.rules |
4.1.15 Ensure system administrator command executions (sudo) are collected | /etc/audit/audit.rules |
4.1.16 Ensure kernel module loading and unloading is collected | /etc/audit/audit.rules |
4.1.17 Ensure the audit configuration is immutable | /etc/audit/audit.rules |
4.2.1.2 Ensure rsyslog Service is enabled and running | Enable rsyslog service. |
4.2.1.4 Ensure logging is configured | /etc/rsyslog.conf |
4.2.1.3 Ensure rsyslog default file permissions configured | /etc/rsyslog.conf |
4.2.1.5 Ensure rsyslog is configured to send logs to a remote log host | /etc/rsyslog.conf |
4.2.1.6 Ensure remote rsyslog messages are /etc/rsyslog.conf only accepted on designated log hosts | /etc/rsyslog.conf |
4.2.3 Ensure permissions on all logfiles are configured | /var/log |
4.2.4 Ensure logrotate is configured | /etc/logrotate.conf and /etc/logrotate.d/ NOTE: Not modified by script. The script points out that customer should make necessary changes as per internal policy. |
Section 5 |
|
5.1.1 Ensure cron daemon is enabled and running | Enable crond service. |
5.1.2 Ensure permissions on /etc/crontab are configured | /etc/crontab |
5.1.3 Ensure permissions on /etc/cron.hourly are configured | /etc/cron.hourly |
5.1.4 Ensure permissions on /etc/cron.daily are configured | /etc/cron.daily |
Pre-CIS |
Post-CIS |
5.1.5 Ensure permissions on /etc/cron.weekly are configured | /etc/cron.weekly |
5.1.6 Ensure permissions on /etc/cron.monthly are configured | /etc/cron.monthly |
5.1.7 Ensure permissions on /etc/cron.d are configured | /etc/cron.d |
Pre-CIS |