Configure Audit Rules for Privilege Escalation Operations

In openEuler, logs of privilege escalation operations using the sudo command are recorded in the /var/log/secure file by default. This file also records other authentication-related security logs. If you want to audit privilege escalation operations using sudo, you are advised to record logs...

Do Not Enable Login Capabilities for Users Who Are Not Meant for Direct Login

Typically, a Linux system has multiple users, not all of which are used for login. For instance, some users are automatically created during the installation of software packages like systemd and dhcp. These users serve specific purposes, such as running related software services. It is essential...

Ensure That a User Has Its Own Home Directory

Each user must have its own home directory for storing user-related data. The owner of the home directory must be the user. If the owner of the home directory is not the user, the user cannot read or write the home directory, or the user data stored in the home directory can be read or tampered...

Ensure That the Log Size Limit Is Correct

The size of an audit log file must be limited. The log rotation mechanism can be used to create new log files once the file size limit is reached. If the upper limit is too high, the size of a single log file may be too large, which is inconvenient for management. If the upper limit is too low, t...

Configure Audit Rules for File Access Control Permissions

File access permission control is the basic permission management in Linux. Different users can access different files after being authorized. This prevents sensitive information leakage or file data tampering between users and prevents common users from accessing high-permission files or...

Configure Audit Rules for SELinux

SELinux is a mandatory access control function component of Linux. It is used to implement fine-grained permission control on processes and files. You are advised to audit configurations of SELinux configuration files and policy files and record modification logs. If SELinux audit is not...

Configure the chronyd Service Properly

If the time server is incorrectly configured, the time of the local server may be inconsistent with that of other servers or the standard time. If time is incorrect, services that strongly depend on time synchronization, such as market transactions, may be interrupted, and attackers may exploit t...

Configure a Proper Number of Concurrent Sessions Allowed for a Single SSH Connection

SSH allows a client that supports multiplexing to establish multiple sessions based on a network connection. MaxSessions limits the number of concurrent SSH sessions that can be established for each network connection. This prevents system resources from being occupied by a single connection or a...

Do Not Preset authorized_keys for the SSH Service

authorizedkeys specifies the public key of the remote host. You can store the public key in the $HOME/.ssh/authorizedkeys file in the home directory for public key authentication. Then you can directly log in to the system. If authorizedkeys is preset in the system and public and private key...

Configure Proper MACs Algorithms for the SSH Service

In cryptography, a message authentication code MAC is an authentication mechanism used by communication entities to check message integrity. If the configured algorithms are insecure, security risks increase because weak algorithms have been or are about to be cracked in the industry. The...

Ensure That auditd Is Enabled

The auditd component is a user-space component of the Linux audit framework, providing the auditctl, ausearch, and aureport programs to audit and view logs. Audit rules are configured using the auditctl program. When getting started, auditctl reads these rules from /etc/audit/audit.rules. The aud...

Configure Audit Rules for Network Environment

Attackers may change the system domain name and host name to launch attacks, such as host spoofing. It is recommended that the user set the audit of system calls setdomainname and sethostname and the audit of the /etc/hosts file to monitor changes in the system domain name and host name. You can...

Do Not Preset known_hosts for the SSH Service

knownhosts stores the public keys of the computers that the host has accessed. After a user successfully logs in to another computer, the public key information is automatically saved in $HOME/.ssh/knownhosts. When the same computer is accessed next time, its public key is verified. If the...

Configure the Kernel Parameter ptrace_scope Properly

ptrace is a system call used for process tracing. It provides the capability for a parent process to observe and control child processes. Linux Kernel 3.4 and later versions support completely restricting or disabling the ptrace function. According to the Linux Kernel Yama Documentation, the...

Do Not Enable the DNS Service

The Domain Name System DNS is a hierarchical naming system that maps names to IP addresses of computers, services, and other network resources. Unless a system is the designated DNS server, you are advised to disable its DNS service to reduce the attack surface. SPDX-FileCopyrightText: 2025...

Ensure a Firewall Service is Enabled

A firewall is a fundamental security control that enforces mandatory access between networks or systems. Without a firewall, systems are exposed to unauthorized access, data theft, tampering, bandwidth abuse, and malicious traffic. Linux commonly provides three firewall services: firewalld defaul...

Do Not Start the debug-shell Service

The debug-shell service is used to locate faults that occur during system boot. This service is installed with systemd. The debug-shell service requires no authentication, that is, attackers can access the root shell by simply pressing Ctrl+Alt+F9 during systemd startup when the OS is booting. Th...

Configure a Proper SSH Service Authentication Mode

A proper authentication mode helps ensure user and system data security. Typically, the user/password authentication mode is suitable for human-machine users. In non-interactive login scenarios, the public and private keys are suitable for authentication. In high-risk scenarios, only the public a...

Ensure That the su Command Inherits the User Environment Variables Without Escalating Privileges

The su command enables a common user to have the permissions of the superuser or other users. It is often used for switching the user from a common user to the root user. The su command provides a convenient way for users to change their identities. However, if the su command is run without...

Configure Session Audit Rules

You are advised to audit and monitor the /var/run/utmp, /var/log/wtmp, and /var/log/btmp files. /var/run/utmp records all login events, /var/log/wtmp records all login, logout, shutdown, and restart events, and /var/log/btmp records login failure events. If session audit is not configured,...