Disable the Root User from Logging in to the System Using SSH

The PermitRootLogin parameter in the SSH configuration file /etc/ssh/sshdconfig specifies whether the root user can log in to the system using SSH. The root user is not allowed to log in to the system using SSH. System administrators must use their own user to log in to the system using SSH and r...

Do Not Install the X Window System

X Window System X for short provides a GUI for users to log in and perform operations in Linux. Generally, servers do not require a GUI. Administrators can configure and modify a server through the CLI. X SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a...

Do Not Configure Deprecated Options for the SSH Service

Currently, the SSH service communication protocols are classified into the first generation and the second generation. The configuration options of the SSH service of different versions are incompatible. In addition, the configuration options of some earlier versions are deprecated in the new...

Ensure That the Password Protection Is Configured in Single-User Mode

You can edit the GRUB startup menu and add the s or single command to the Linux startup command line to enter the single-user mode, which is an emergency rescue mode. In this mode, system data can be modified. For example, users can change the password of the root user. In this case, the password...

Avoid Using USB Storage

USB storage devices are usually used to transfer data between servers. However, in most cases, data on USB storage devices cannot be protected by technical methods, thereby increasing the risk of attacks. Viruses and Trojan horses on USB devices may infect and damage the server. If the USB storag...

Enable the rsyslog Service

System logs are stored in the memory by default. If the rsyslog service is disabled, system logs cannot be dumped to persistent storage devices and will be lost after the system is restarted. The rsyslog service is used to dump and distribute system logs, supporting the following functions: 1...

Ensure That the GIDs Are Unique

The group IDs GIDs in /etc/group must be unique. In the Linux system, user group permissions are determined based on GIDs. If multiple user groups use the same GID, these user groups have the same permissions and can access each other SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptio...

Ensure That Soft and Hard Link Protection Is Correctly Configured

In Linux, a soft or hard link is a file pointing to another file target. In other words, the target is opened once the link file is opened. Therefore, an attacker can forge a soft link as a common user for a privileged user to execute, causing security issues such as privilege escalation. The sam...

Do Not Allow Login with an Empty Password

Login with an empty password means that a user can log in to a system without a password. If an empty password is allowed for login, the user with an empty password may be attacked or may be used by attackers. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted fro...

Ensure That Users Are Required to Change Their Passwords Upon the First Login

If a password, such as one reset by an administrator, is not promptly changed in the service environment when it is not set by the user, it may lead to low-cost attacks. Therefore, it is necessary for users to change their password upon their initial login. However, the root user...

Ensure That the User Names Are Unique

The users in /etc/passwd must be unique. If user names in /etc/passwd are duplicate, only the UID of the first user in /etc/passwd is valid. If the administrator runs commands such as useradd to add users, duplicate usernames typically do not exist. However, if the administrator directly modifies...

Avoid the .netrc File in the Home Directory

The .netrc file stores the passwords for logging in to the remote FTP server. If there are no FTP-related scenarios, you are advised to delete the .netrc file. Passwords stored in the .netrc file are in plaintext and can be easily stolen by attackers. As a result, sensitive data on the FTP server...

Configure the Authentication Blocklist and Allowlist Properly

SSH provides the blocklist and allowlist function. You can set a list of users or user groups to allow or deny SSH login for them. By default, this function is not configured in openEuler. The related fields are as follows: AllowUsers userlist specifies the space-separated users who are allowed t...

Do Not Install Insecure SNMP Versions

Simple Network Management Protocol SNMP is a standard protocol designed to manage network nodes in IP networks. This protocol allows the exchange of network management and control data between network elements NEs. If SNMP is installed in scenarios where SNMP is not required, additional system...

Configure the Core Dump Properly

A core dump records the memory status when a program stops abnormally or breaks down. It helps locate faults but may contain sensitive information in the process memory. In some cases, the core dump function needs to be enabled to record problem causes. When enabling the core dump function,...

Ensure That Scripts Writable by Low-Privilege Users Cannot Be Configured in the sudoers Configuration File

The sudo command enables a specified common user to execute certain programs with the root permission. The corresponding configuration file is /etc/sudoers. The administrator can configure rules to enable some scripts or binary files to run with the root permission. Therefore, only the root user...

Disable the Source Packet Routing

In a network, source routing allows the sender to specify some or all routes for data packets to pass through the network. In regular routing, routers in the network determine the path based on the destination of the data packets. If a large number of packets are tampered with and pass through th...

Do Not Install the NIS Client

Network Information Service NIS works in client-server mode. NIS clients running the ypbind daemon obtain information from a server. NIS is inherently insecure and is vulnerable to DoS and buffer overflow attacks. Therefore, do not install the NIS client in the service scenario where NIS is not...

Ensure a Firewall Service is Enabled

A firewall is a fundamental security control that enforces mandatory access between networks or systems. Without a firewall, systems are exposed to unauthorized access, data theft, tampering, bandwidth abuse, and malicious traffic. Linux commonly provides three firewall services: firewalld defaul...

Do Not Configure the Encryption Algorithm Overwriting Policy for the SSH Service

The configuration files of the SSH encryption algorithms are /etc/ssh/sshdconfig and /etc/sysconfig/sshd. When the SSH service is running, you can edit the /etc/sysconfig/sshd file to overwrite the encryption algorithm policy. If the encryption algorithm overwriting policy is configured, users ar...

Ensure That Warning Banners Contain Proper Information

Warning banners contain warning information added on the system login page. Security warnings are displayed for all users who log in to the system. The security warnings must include information about the organization to which the system belongs, monitoring or records of login behavior, and legal...

Ensure That the Password Protection Is Configured for GRUB

GRUB is the default bootloader of Linux. The bootloader can set the startup mode of the system. By setting the GRUB password, you can prevent attackers from modifying the GRUB setting to enter the single-user mode. If the GRUB password is not set, attackers can easily access the GRUB editing menu...

Restrict the Number of Historical Command Records

HISTSIZE is an environment variable used to control the size of the command history. Specifically, HISTSIZE defines the number of command entries that can be stored in the command history. By setting the value of HISTSIZE, you can limit or increase the size of the command history, thus controllin...

Configure Audit Rules for File Access Failures

System calls, such as open, truncate, ftruncate, create and openat, are audited and monitored. If the -EACCES or -EPERM error is returned, you lack the permission to access the files. In this case, audit logs need to be recorded. File access failures due to a lack of proper permissions are common...

Disable the ARP Proxy

The ARP proxy allows the system to respond to ARP requests on another interface on behalf of a host connected to an interface. Disabling the ARP proxy not only prevents unauthorized information sharing, but also prevents addressing information leakage between connected network segments. Therefore...

Do Not Allow Files or Directories Without Owners or Owner Groups

Files or directories without owners or owner groups are not allowed in the system. Generally, these files or directories refer to those whose previous owners are deleted. These files are security risks and may cause information leakage, occupy unnecessary drive space and system resources, and...

Ensure That the PATH User Variable Is Strictly Defined

In Linux, the PATH variable defines the path for searching for executable files in the user context of the current user. For example, if a user runs the ls command in any directory, the system searches for the ls command in the directories specified by PATH and executes the command. The PATH...

Start the cron Daemon Properly

The cron daemon is used to execute batch processing jobs on the system. Even if the OS does not have user jobs that need to be run, some system jobs need to be run, including important jobs such as security monitoring. The cron daemon is used to execute these jobs. If the cron daemon is not start...

Configure The ntpd Service Properly

In the cluster scenario, the time of servers must be accurate and consistent. For example, if the server time is inconsistent, the data generated by different servers may be sorted or compared inaccurately. Even if you run the date command to set the time of all servers to the same value, the tim...

Ensure That GPG Verification Is Configured for the Yum Repositories

Software packages may be tampered with by attackers during network transmission or local storage. If the integrity verification is not performed on the software packages, software tampered with by attackers may be installed. As a result, the server or even the entire network cluster is attacked. ...

Ensure That the Weak Password Dictionary Is Set Correctly

If a user password is weak, it is easy for attackers to guess the password or crack it through dictionary attacks in a short period of time. A weak password dictionary is a collection of passwords that are not strong enough and can be easily cracked through guesses. Weak passwords include default...

Do Not Install the Print Service

A server running Common Unix Printing System CUPS provides print services to other devices on the network. Running the CUPS service requires additional system resources and expands the attack surface. Therefore, do not start the CUPS service in the scenario where the CUPS service is not required...

Enable Reverse Path Filtering

Setting net.ipv4.conf.all.rpfilter and net.ipv4.conf.default.rpfilter to 1 forces the Linux kernel to perform reverse path filtering on a received packet and check the validity of its source address. If the Linux kernel queries the routing table in which the source address is included and finds...

Correctly Configure the Default File Permission For rsyslog

Log files record system behaviors. The rsyslog log tool records logs in specified files. When the specified log file does not exist in the system, rsyslog creates a log file. The permission of the created log file can be configured in the rsyslog configuration file. The configuration of the defau...

Enable auditd to Start upon System Startup

By enabling auditd to start upon system startup, you can audit the events generated during system startup before the auditd service is started. If audit is not enabled during system startup, you may not be able to audit attacks during the startup procedure. By default, audit is not enabled during...

Ensure That the Sticky Bit Is Set for Globally Writable Directories

The sticky bit of a common file is ignored by the kernel. The sticky bit shows up as the execute permission flag of a directory and is indicated with t. If the sticky bit set is for a directory, a user who is not root or the directory owner cannot delete files or directories in the directory,...

Configure Audit Rules for Network Environment

Attackers may change the system domain name and host name to launch attacks, such as host spoofing. It is recommended that the user set the audit of system calls setdomainname and sethostname and the audit of the /etc/hosts file to monitor changes in the system domain name and host name. You can...

Ensure That the umask Value Is Correct

The umask value is the mask for default file or directory permissions. When a file or directory is created, its default permission is set to 777 minus the umask value. For a file, its execute permission is also removed. If the umask value is set improperly, the permission of new files may be too...

Do Not Allow Hidden Executable Files

In Linux, the name of a hidden file starts with a dot .. Hidden executable files are not allowed in the system. Note that . and . are not hidden files. They refer to the current directory and upper-level directory, respectively. The .bashrc, .bashprofile, and .bashlogout files are script files us...

Configure Proper Policies for OUTPUT of iptables

There are two occasions in which a server sends outgoing packets: 1. The local host process proactively connects to an external server, for example, performing an HTTP access, or sending data to a log server. 2. The local host responds to the external access to the local services. If no policy is...

Configure TIME_WAIT for TCP

TIMEWAIT indicates the time for TCP to wait for connection destruction. If this parameter is set to a large value, a large number of TCP connections are not closed and DoS attacks occur. You are advised to set this parameter to a value less than or equal to 60. SPDX-FileCopyrightText: 2025...

Ensure That the su Command Inherits the User Environment Variables Without Escalating Privileges

The su command enables a common user to have the permissions of the superuser or other users. It is often used for switching the user from a common user to the root user. The su command provides a convenient way for users to change their identities. However, if the su command is run without...

Configure the Scripts Executed by crontab to Be Writable Only by Their Owners

crontab is the configuration file used by the system to execute scheduled tasks. The path of the configuration file is /etc/crontab. With crontab, the OS automatically executes the tasks defined by the administrator based on service requirements. Therefore, the execution scripts or programs...

Ensure That Partitions without Executable Files Are Mounted Using noexec

A data drive only stores data generated during service running. No command is executed in the data drive. Therefore, you can mount the drive or partition using noexec to improve security and reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be...

Configure the chronyd Service Properly

If the time server is incorrectly configured, the time of the local server may be inconsistent with that of other servers or the standard time. If time is incorrect, services that strongly depend on time synchronization, such as market transactions, may be interrupted, and attackers may exploit t...

Do Not Install the LDAP Service

Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. The LDAP service increases system resource usage and expands the attack surface. If the LDAP service is not required, do not install the LDAP service. T...

Do Not Preset known_hosts for the SSH Service

knownhosts stores the public keys of the computers that the host has accessed. After a user successfully logs in to another computer, the public key information is automatically saved in $HOME/.ssh/knownhosts. When the same computer is accessed next time, its public key is verified. If the...

Ensure That a Common User Cannot Use pkexec for Privilege Escalation

The pkexec command enables a common user to have the permissions of the superuser or other users. After the authentication is successful, the common user runs the corresponding program with the permissions of the superuser. The pkexec command provides a convenient way for users to change their...

Configure a Proper SSH Service Authentication Mode

A proper authentication mode helps ensure user and system data security. Typically, the user/password authentication mode is suitable for human-machine users. In non-interactive login scenarios, the public and private keys are suitable for authentication. In high-risk scenarios, only the public a...

Do Not Enable the Avahi Service

Avahi is a zero-configuration networking implementation, including a system for multicast DNS/DNS-SD service discovery and automatic broadcast. For example, you can connect a server to the network and use Avahi to automatically broadcast network services running on the server for other user to...