192 matches found
Configuring the SSH Service Port Properly
A server typically has multiple NICs and IP addresses. You need to plan IP addresses to determine which ones are used for services or management. Not all IP addresses need to listen on SSH connections. You can specify only some IP addresses to perform SSH connections to reduce the attack surface...
Configure the Core Dump Properly
A core dump records the memory status when a program stops abnormally or breaks down. It helps locate faults but may contain sensitive information in the process memory. In some cases, the core dump function needs to be enabled to record problem causes. When enabling the core dump function,...
Ensure That the PATH User Variable Is Strictly Defined
In Linux, the PATH variable defines the path for searching for executable files in the user context of the current user. For example, if a user runs the ls command in any directory, the system searches for the ls command in the directories specified by PATH and executes the command. The PATH...
Ensure That the LD_LIBRARY_PATH Environment Variable Is Correctly Defined
LDLIBRARYPATH is an environmental variable in Linux. When loading a dynamic link library, the program preferentially obtains the library from the path specified by LDLIBRARYPATH. Generally, LDLIBRARYPATH should not be set, because a maliciously set value will make the program link to an incorrect...
Do Not Use auditctl to Set auditd Rules
auditd service rules can be configured using either rule files in the /etc/audit/rules.d/ directory applied after server restart or the auditctl command for immediate effect. The permission of the /etc/audit/rules.d/ directory is 750, while that of the auditctl command is 755. Therefore,...
Ensure That the Password Protection Is Configured for GRUB
GRUB is the default bootloader of Linux. The bootloader can set the startup mode of the system. By setting the GRUB password, you can prevent attackers from modifying the GRUB setting to enter the single-user mode. If the GRUB password is not set, attackers can easily access the GRUB editing menu...
Do Not Allow Non-root Users with UID 0
The user with UID 0 is the super administrator user in the Linux system. By convention, the user name is root. The UID of a non-root user cannot be 0. If the UID of the root user is changed to another value and the UID of another user for example, the test user is changed to 0, the test user is...
Ensure That the Password Validity Is Set Correctly
If a password is not changed for a long time, the password is vulnerable to brute force cracking, which compromises system security. If the password validity period is set too short, the password needs to be changed frequently, increasing management costs. In addition, users may fail to log in...
Enable PAM Authentication
Pluggable Authentication Modules PAM on the Linux platform provides a series of open source shared library files .so files. You can flexibly control the authentication process by configuring parameters. After PAM authentication is configured for SSH, the user authentication management module of t...
Configure Audit Rules for File Access Failures
System calls, such as open, truncate, ftruncate, create and openat, are audited and monitored. If the -EACCES or -EPERM error is returned, you lack the permission to access the files. In this case, audit logs need to be recorded. File access failures due to a lack of proper permissions are common...
Ensure That the umask Value Is Correct
The umask value is the mask for default file or directory permissions. When a file or directory is created, its default permission is set to 777 minus the umask value. For a file, its execute permission is also removed. If the umask value is set improperly, the permission of new files may be too...
Configure Proper Key Algorithms for User Authentication
If the public and private key authentication mode is used, the public and private key algorithms on the client must be restricted to avoid using insecure algorithms that have been phased out in the industry. The recommended security algorithms are sorted by priority as follows. The algorithms hav...
Do Not Install Insecure SNMP Versions
Simple Network Management Protocol SNMP is a standard protocol designed to manage network nodes in IP networks. This protocol allows the exchange of network management and control data between network elements NEs. If SNMP is installed in scenarios where SNMP is not required, additional system...
Azure Linux 3.0 Security Update: giflib (CVE-2025-31344)
The version of giflib installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-31344 advisory. - Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with...
ALPINE-CVE-2025-31344
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2...
CVE-2025-31344
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2...
AZL-60246 CVE-2025-31344 affecting package giflib for versions less than 5.2.1-9
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2...
AZL-60261 CVE-2025-31344 affecting package giflib for versions less than 5.2.1-10
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2...