Ensure That Partitions without Executable Files Are Mounted Using noexec

A data drive only stores data generated during service running. No command is executed in the data drive. Therefore, you can mount the drive or partition using noexec to improve security and reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be...

Configure a Correct SSH Service Version

SSH1 contains known issues and is no longer maintained in a routine manner, which poses risks such as information leakage and command data tampering on the system. The OpenSSH component inherited by openEuler uses the SSH protocol for remote control or file transfer between servers. The SSH1.3,...

Ensure That Passwords Do Not Contain User Names

To ensure user security, you must configure passwords that do not contain user names. If a password is the same as the user name or the user name in reverse order, or contains the user name, attackers can guess the password easily. This requirement is not exerted on passwords of users whose names...

Configure Audit Rules for Privilege-Escalated Commands

Users can call privilege-escalated commands that is, commands with SUID/SGID bits to obtain the super administrator permissions. This operation is risky and often exploited by attackers. You are advised to audit and monitor privilege-escalated commands for future tracing. By default, audit rules...

Configure Audit Rules for File System Mounting

Generally, for deployed services, the file system mounting does not change. Therefore, any change in the file system mounting may indicate attacks. For file systems with changes in mounting, audit and monitor their mounting conditions for tracing. By default, audit rules for file system mounting...

Ignore All ICMP Requests

Ignoring all ICMP requests to prohibit external systems from running the ping command to detect the system location. Attackers can detect the URL of the system based on the returned result of the ping command. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted fro...

Do Not Use X11 Forwarding

The X11 forwarding function of SSH allows the GUI program of the remote host to be executed on the local host. If the X11 forwarding function is enabled, the attack surface is expanded and other users on the X11 server may attack the local host. If the function is not required in the service...

Enable the rsyslog Service

System logs are stored in the memory by default. If the rsyslog service is disabled, system logs cannot be dumped to persistent storage devices and will be lost after the system is restarted. The rsyslog service is used to dump and distribute system logs, supporting the following functions: 1...

Configure Proper Association Policies for INPUT and OUTPUT of iptables

Although you can configure protocols, IP addresses, and port numbers to add policies for packets entering and leaving a server to the INPUT and OUTPUT chains, it is difficult to configure suitable policies using the sport parameter due to complicated situations. For example, a client accesses the...

Configure Dumping journald Logs for rsyslog

The system uses journald to collect logs. Logs may be stored on volatile or persistent storage devices. As a result, logs may be lost or the drive space may be used up. In this case, logs need to be dumped in a timely manner to ensure the security of logs and the system. SPDX-FileCopyrightText:...

Do Not Install Network Sniffing Tools

If network sniffing tools exist in the production environment, attackers may use them for network analysis and attacks. Therefore, in the production environment, do not install network sniffing, packet capturing, or analysis tools, such as tcpdump, Ethereal, and Wireshark. SPDX-FileCopyrightText:...

Ensure That the Log Size Limit Is Correct

The size of an audit log file must be limited. The log rotation mechanism can be used to create new log files once the file size limit is reached. If the upper limit is too high, the size of a single log file may be too large, which is inconvenient for management. If the upper limit is too low, t...

Ensure That Rotation Is Enabled for Audit Logs

maxlogfileaction decides the action taken when the size of a log file reaches the upper limit. By default, ROTATE is configured in openEuler, indicating that a new log file is created when the size of a log file reaches the upper limit and the original log file is not deleted. numlogs specifies t...

Do Not Allow Files or Directories Without Owners or Owner Groups

Files or directories without owners or owner groups are not allowed in the system. Generally, these files or directories refer to those whose previous owners are deleted. These files are security risks and may cause information leakage, occupy unnecessary drive space and system resources, and...

Enable IMA Measurement

Integrity Measurement Architecture IMA is an integrity protection function of the kernel. When IMA is enabled, integrity measurement is provided for important system files based on user-defined policies. The measurement results can be used for local and remote integrity attestation. If IMA is...

Disable the System from Responding to ICMP Broadcast Packets

Internet Control Message Protocol ICMP transmits query packets and error packets. You can configure a policy of not receiving ICMP broadcast packets to defend against ICMP packet attacks. This parameter determines whether a device needs to respond to the ICMP echo messages and timestamp requests...

Avoid Using Wireless Networks

If the hardware device contains wireless modules such as Wi-Fi and Wi-Fi is enabled in the system, the server may connect to the network wirelessly. If the connection is not managed, the network may be unstable and the attack surface increases. If no wireless network is used, you are advised to...

Do Not Allow Login with an Empty Password

Login with an empty password means that a user can log in to a system without a password. If an empty password is allowed for login, the user with an empty password may be attacked or may be used by attackers. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted fro...

Start the cron Daemon Properly

The cron daemon is used to execute batch processing jobs on the system. Even if the OS does not have user jobs that need to be run, some system jobs need to be run, including important jobs such as security monitoring. The cron daemon is used to execute these jobs. If the cron daemon is not start...

Configure a Proper Value for MaxAuthTries

MaxAuthTries indicates the maximum number of user authentication failures allowed in a single connection. If the number of user authentication failures exceeds the value, the connection is automatically disconnected. You are advised to set this field to a value less than or equal to 3. If this...

Configure Audit Rules for SELinux

SELinux is a mandatory access control function component of Linux. It is used to implement fine-grained permission control on processes and files. You are advised to audit configurations of SELinux configuration files and policy files and record modification logs. If SELinux audit is not...

Do Not Install the rsync Service

The rsync service can synchronize data between servers or between local drive partitions. However, information leakage risks exist because rsync uses non-encrypted transmission protocols. If the rsync service is enabled and data is transmitted between servers over the network, attackers can...

Disable the ARP Proxy

The ARP proxy allows the system to respond to ARP requests on another interface on behalf of a host connected to an interface. Disabling the ARP proxy not only prevents unauthorized information sharing, but also prevents addressing information leakage between connected network segments. Therefore...

Configure Proper MACs Algorithms for the SSH Service

In cryptography, a message authentication code MAC is an authentication mechanism used by communication entities to check message integrity. If the configured algorithms are insecure, security risks increase because weak algorithms have been or are about to be cracked in the industry. The...

Configure Proper Association Policies for INPUT and OUTPUT of nftables

Although you can configure protocols, IP addresses, and port numbers to add policies for packets entering and leaving a server to the INPUT and OUTPUT chains, it is difficult to configure suitable policies using the sport parameter due to complicated situations. For example, a client accesses the...

Configure The ntpd Service Properly

In the cluster scenario, the time of servers must be accurate and consistent. For example, if the server time is inconsistent, the data generated by different servers may be sorted or compared inaccurately. Even if you run the date command to set the time of all servers to the same value, the tim...

Ensure That Mounting for Unnecessary File System Is Removed

Linux supports multiple file systems through kernel objects loaded to the kernel. As a universal OS platform, openEuler provides various kernel object files in the /lib/modules/kernel version/kernel/fs/ directory to support different file systems. You can run the insmod or modprobe command to loa...

Configure the dmesg Access Permission Properly

The permission to access dmesg information is restricted. Unprivileged users cannot view system information. This prevents any one from obtaining sensitive information and attacking the system. Only processes with the CAPSYSLOG capability are allowed to access kernel logs. In this way, the least...

Ensure That the Session Timeout Period Is Set Correctly

Setting a proper timeout duration of sessions can reduce the risk of system attacks caused by manual operations of the administrator. To ensure ease of use of the community version in different scenarios, the session timeout interval is not configured in openEuler distributions by default...

Do Not Allow Unused Users

If service-irrelevant users exist in the system, attackers may use them to launch attacks. Only users required by services are retained in the system. Other users used for installation, deployment, commissioning, verification, and fault locating must be deleted. By default, unused users do not...

Configure the nftables Policies for Loopback Properly

The loopback address 127.0.0.0/8 is a special address on a server. It is irrelevant to NICs and is mainly used for the inter-process communication of a local device. Packets with the source address 127.0.0.0/8 from NICs should be discarded. If policies related to the loopback address are improper...

Do Not Install the X Window System

X Window System X for short provides a GUI for users to log in and perform operations in Linux. Generally, servers do not require a GUI. Administrators can configure and modify a server through the CLI. X SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a...

Ensure That the Weak Password Dictionary Is Set Correctly

If a user password is weak, it is easy for attackers to guess the password or crack it through dictionary attacks in a short period of time. A weak password dictionary is a collection of passwords that are not strong enough and can be easily cracked through guesses. Weak passwords include default...

Do Not Install Python 2

The EOL for Python 2 was reached on January 1, 2020, and there will be no updates and maintenance. If you continue to use Python 2, the system attack surface may be expanded, and system vulnerabilities and attack risks may increase. Therefore, do not use Python 2. If Python is required, you are...

Avoid Using Programs Labeled unconfined_service_t

The purpose of setting the unconfinedservicet label for SELinux is to enable some third-party service processes not configured with SELinux policies to run without restrictions. By default, when systemd runs a third-party application whose label is bint or usrt generally located in directories su...

Do Not Enable the LDAP Service

Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. The LDAP service increases system resource usage and expands the attack surface. If the LDAP service is not required, do not install the LDAP service. T...

Ensure That Warning Banners Contain Proper Information

Warning banners contain warning information added on the system login page. Security warnings are displayed for all users who log in to the system. The security warnings must include information about the organization to which the system belongs, monitoring or records of login behavior, and legal...

Configure the SELinux Policy Correctly

SELinux policies are classified into basic policies and user-defined policies. Basic policies: policies defined in the basic policy package, including selinux-policy, selinux-policy-targeted, and selinux-policy-mls. User-defined policies: policies modified or added by users. SELinux can implement...

Record the cron Logs

Generally, cron is used to schedule tasks in Linux. Because cron can be exploited by hackers to load malicious code, all the cron logs need to be recorded to trace system exceptions. Otherwise, the exception information cannot be displayed in logs when there are malicious operations. As a result,...

Configure Login Audit Rules

The /var/log/lastlog file is updated when a user successfully logs in to the system. Therefore, user login events can be recorded by auditing and monitoring the file. If login audit is not configured, the administrator cannot trace login events from audit logs. By default, login audit rules are n...

Enable Kernel SMAP

Supervisor Mode Access Prevention SMAP can be enabled to prevent the kernel from accessing data in user space. If SMAP is not enabled, attackers can access data in user space through kernel-mode code redirection, which increases the attack surface and reduces system security. SMAP is enabled by...

Do Not Install Development and Compilation Tools

Compilation tools in the service environment may be exploited by attackers to edit, tamper with, and perform reverse analysis on key files in the environment. Therefore, in the production environment, do not install compilation, decompilation, binary analysis tools, and compilation environments...

Enable AIDE

Advanced intrusion detection environment AIDE is an intrusion detection tool that checks the integrity of system files and directories and identifies those maliciously tampered with. In principle, the integrity check can be performed only after an AIDE benchmark database is constructed, which...

Drive Data Should Be Managed in Partitions

When installing the OS, plan different partitions for OS data and service data based on the scenario. Do not store all data in the same drive or partition. Properly planning drive partitions avoids or reduces the following risks: 1. Log files are too large and use up the space of the service driv...

Do Not Install the LDAP Client

Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. Running the LDAP service requires additional system resources and expands the attack surface. Therefore, do not install the LDAP client in the service...

Ensure That the LD_LIBRARY_PATH Environment Variable Is Correctly Defined

LDLIBRARYPATH is an environmental variable in Linux. When loading a dynamic link library, the program preferentially obtains the library from the path specified by LDLIBRARYPATH. Generally, LDLIBRARYPATH should not be set, because a maliciously set value will make the program link to an incorrect...

Ensure That a User Has Its Own Home Directory

Each user must have its own home directory for storing user-related data. The owner of the home directory must be the user. If the owner of the home directory is not the user, the user cannot read or write the home directory, or the user data stored in the home directory can be read or tampered...

Configure a Proper Number of Queues in the SYN_RECV State

The SYNRECV queue stores the TCP connection requests that have not been confirmed by the peer end. A larger value indicates more waiting network connections. If the value is too small, the system is vulnerable to TCP SYN flood attacks. As a result, normal connections are denied. If the value is t...

Ensure That User Group and Password File Permissions Are Correct

In the Linux OS-related information, such as users, passwords, and user groups, is recorded in the configuration files in the /etc directory. Proper permissions must be set for accessing these files. Otherwise, the files may be stolen or tampered with by attackers. The owner and owner group of...

Avoid Using Uncommon Network Services

Some protocols are seldom used and their communities develop slowly. Therefore, related security issues cannot be quickly resolved. If these protocols are not disabled, attackers may exploit the protocols or code vulnerabilities to launch attacks. Stream Control Transmission Protocol SCTP is used...