Enable Reverse Path Filtering

Setting net.ipv4.conf.all.rpfilter and net.ipv4.conf.default.rpfilter to 1 forces the Linux kernel to perform reverse path filtering on a received packet and check the validity of its source address. If the Linux kernel queries the routing table in which the source address is included and finds...

Configure a Proper SSH Service Authentication Mode

A proper authentication mode helps ensure user and system data security. Typically, the user/password authentication mode is suitable for human-machine users. In non-interactive login scenarios, the public and private keys are suitable for authentication. In high-risk scenarios, only the public a...

Do Not Enable the Avahi Service

Avahi is a zero-configuration networking implementation, including a system for multicast DNS/DNS-SD service discovery and automatic broadcast. For example, you can connect a server to the network and use Avahi to automatically broadcast network services running on the server for other user to...

Ensure That User Group and Password File Permissions Are Correct

In the Linux OS-related information, such as users, passwords, and user groups, is recorded in the configuration files in the /etc directory. Proper permissions must be set for accessing these files. Otherwise, the files may be stolen or tampered with by attackers. The owner and owner group of...

Disable PermitUserEnvironment

PermitUserEnvironment allows users to set SSH environment variables, which may be exploited by attackers to launch attacks. If PermitUserEnvironment is set to yes, attackers can modify SSH environment variables to evade the security mechanism or execute attack code. This configuration must be...

Disable tcp_timestamps

tcptimestamps is used to record the time when TCP data packets are sent. It can be used for RTT measurement RTTM and protection against wrapped sequence number PAWS. It is a bidirectional option and takes effect only when it is enabled on both the client and server. If this option is enabled, the...

Ensure That Partitions That Do Not Need to Be Mounted with Devices Are Mounted Using nodev

The nodev option specifies that the file system cannot contain device files. It is used to reduce the attack surface and improve security. If a directory is mounted with the nodev option, all device files, such as files of block devices and character devices in the directory, are parsed as common...

Enable IMA Measurement

Integrity Measurement Architecture IMA is an integrity protection function of the kernel. When IMA is enabled, integrity measurement is provided for important system files based on user-defined policies. The measurement results can be used for local and remote integrity attestation. If IMA is...

Ensure That Old Passwords Are Verified When Users Change Them

To prevent a third party from maliciously changing the password of another user, the old password must be verified when a user changes the password. According to the common practice in the industry, the old password does not need to be verified when the root user changes its own password. The roo...

Avoid Using the root User to Access the System Locally

Users with the root permission can access all Linux resources. If the root user is used to log in to the Linux OS to perform operations, there are many potential security risks. To avoid the risks, do not use the root user to log in to the Linux OS. If necessary, indirectly use the root user...

Ensure That Soft and Hard Link Protection Is Correctly Configured

In Linux, a soft or hard link is a file pointing to another file target. In other words, the target is opened once the link file is opened. Therefore, an attacker can forge a soft link as a common user for a privileged user to execute, causing security issues such as privilege escalation. The sam...

Disable the Source Packet Routing

In a network, source routing allows the sender to specify some or all routes for data packets to pass through the network. In regular routing, routers in the network determine the path based on the destination of the data packets. If a large number of packets are tampered with and pass through th...

Configure Audit Rules for Privilege-Escalated Commands

Users can call privilege-escalated commands that is, commands with SUID/SGID bits to obtain the super administrator permissions. This operation is risky and often exploited by attackers. You are advised to audit and monitor privilege-escalated commands for future tracing. By default, audit rules...

Do Not Configure the Encryption Algorithm Overwriting Policy for the SSH Service

The configuration files of the SSH encryption algorithms are /etc/ssh/sshdconfig and /etc/sysconfig/sshd. When the SSH service is running, you can edit the /etc/sysconfig/sshd file to overwrite the encryption algorithm policy. If the encryption algorithm overwriting policy is configured, users ar...

Ensure That Partitions without Executable Files Are Mounted Using noexec

A data drive only stores data generated during service running. No command is executed in the data drive. Therefore, you can mount the drive or partition using noexec to improve security and reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be...

Configure the Kernel Parameter ptrace_scope Properly

ptrace is a system call used for process tracing. It provides the capability for a parent process to observe and control child processes. Linux Kernel 3.4 and later versions support completely restricting or disabling the ptrace function. According to the Linux Kernel Yama Documentation, the...

Configure sudoers Audit Rules

The sudo command allows common users to perform privileged operations as the root user, which is highly risky. Though attackers cannot access the root user easily, they can escalate the privilege using the sudo command. You are advised to configure audit for the /etc/sudoers file and the...

Ensure That a Common User Cannot Use pkexec for Privilege Escalation

The pkexec command enables a common user to have the permissions of the superuser or other users. After the authentication is successful, the common user runs the corresponding program with the permissions of the superuser. The pkexec command provides a convenient way for users to change their...

Set the User Validity Period Correctly

The life cycle of a user must be managed based on the application scenario. For example, the life cycle of a temporarily created management or maintenance user or a user required by a periodic service ends when the service life cycle ends. These users should be deleted when their life cycles end...

Configure Audit Rules for File Access Failures

System calls, such as open, truncate, ftruncate, create and openat, are audited and monitored. If the -EACCES or -EPERM error is returned, you lack the permission to access the files. In this case, audit logs need to be recorded. File access failures due to a lack of proper permissions are common...

Disable SysRq

SysRq enables users with physical access to access dangerous system-level commands in a computer. Therefore, it is advised to restrict the usage of the SysRq function. If SysRq is not disabled, you can use the keyboard to trigger SysRq. As a result, commands may be directly sent to the kernel,...

Configure Dumping journald Logs for rsyslog

The system uses journald to collect logs. Logs may be stored on volatile or persistent storage devices. As a result, logs may be lost or the drive space may be used up. In this case, logs need to be dumped in a timely manner to ensure the security of logs and the system. SPDX-FileCopyrightText:...

Configure Audit Rules for Time Changes

The system time is essential for the normal running of services. The system time can be changed through synchronization with the time server and manual operations of administrators. The latter is prone to attacks because attackers can change the system time to invalidate some protection policies...

Ensure That Partitions That Do Not Require SUID/SGID Bits Are Mounted Using nosuid

After the SUID bit is set for an executable file, the user who executes the file not the file owner is temporarily granted the permission of the file owner. For example, common user test executes a program whose permission is 755 and owner is root. In this case, if the SUID bit is not set,only th...

Do Not Enable the DHCP Service

The Dynamic Host Configuration Protocol DHCP service provides dynamic allocation of IP addresses to machines. Unless a system is the designated DHCP server, you are advised to disable its DHCP service to reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions...

Configure Login Audit Rules

The /var/log/lastlog file is updated when a user successfully logs in to the system. Therefore, user login events can be recorded by auditing and monitoring the file. If login audit is not configured, the administrator cannot trace login events from audit logs. By default, login audit rules are n...

Configure Audit Rules for File Deletion

Generally, it is highly risky to delete files in the OS. Misoperations by administrators or attacks may cause severe system faults. You are advised to audit and monitor system calls, such as rename, unlink, unlinkat, and renameat, and record deletion operation logs. Deleting system or service fil...

Avoid Using Uncommon Network Services

Some protocols are seldom used and their communities develop slowly. Therefore, related security issues cannot be quickly resolved. If these protocols are not disabled, attackers may exploit the protocols or code vulnerabilities to launch attacks. Stream Control Transmission Protocol SCTP is used...

Do Not Enable the NFS Service

The Network File System NFS is one of the earliest and most widely used file systems in UNIX environments. It allows a system to mount file systems of other servers over the network. If the system does not share content through NFS, you are advised to disable NFS to reduce the remote attack...

Do Not Install the X Window System

X Window System X for short provides a GUI for users to log in and perform operations in Linux. Generally, servers do not require a GUI. Administrators can configure and modify a server through the CLI. X SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a...

Log Spoofing Source Routing and Redirect Packets

Logging spoofing, source routing, and redirect packets sent to the system helps discover attack sources and formulate protection measures. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Configure Proper Policies for INPUT of nftables

The INPUT chain is used to filter packets received from external systems. For any service provided for external systems, configure the corresponding INPUT policy and enable the related port so that external clients can access the service through the port. If the policy is not set, all packets tha...

Configure Audit Rules for File Access Control Permissions

File access permission control is the basic permission management in Linux. Different users can access different files after being authorized. This prevents sensitive information leakage or file data tampering between users and prevents common users from accessing high-permission files or...

Do Not Allow Files or Directories Without Owners or Owner Groups

Files or directories without owners or owner groups are not allowed in the system. Generally, these files or directories refer to those whose previous owners are deleted. These files are security risks and may cause information leakage, occupy unnecessary drive space and system resources, and...

Ensure That the Weak Password Dictionary Is Set Correctly

If a user password is weak, it is easy for attackers to guess the password or crack it through dictionary attacks in a short period of time. A weak password dictionary is a collection of passwords that are not strong enough and can be easily cracked through guesses. Weak passwords include default...

Do Not Install the Print Service

A server running Common Unix Printing System CUPS provides print services to other devices on the network. Running the CUPS service requires additional system resources and expands the attack surface. Therefore, do not start the CUPS service in the scenario where the CUPS service is not required...

Disable the ARP Proxy

The ARP proxy allows the system to respond to ARP requests on another interface on behalf of a host connected to an interface. Disabling the ARP proxy not only prevents unauthorized information sharing, but also prevents addressing information leakage between connected network segments. Therefore...

Ensure a Firewall Service is Enabled

A firewall is a fundamental security control that enforces mandatory access between networks or systems. Without a firewall, systems are exposed to unauthorized access, data theft, tampering, bandwidth abuse, and malicious traffic. Linux commonly provides three firewall services: firewalld defaul...

Configure the Default Policies of iptables to DROP Properly

Generally, iptables policies can be configured in allowlist or blocklist mode. You are advised to configure iptables policies in allowlist mode. Connections that do not comply with the rules in the allowlist are prohibited. Therefore, you can configure the DROP or REJECT policy for the INPUT,...

Configure the chronyd Service Properly

If the time server is incorrectly configured, the time of the local server may be inconsistent with that of other servers or the standard time. If time is incorrect, services that strongly depend on time synchronization, such as market transactions, may be interrupted, and attackers may exploit t...

Do Not Install the LDAP Service

Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. The LDAP service increases system resource usage and expands the attack surface. If the LDAP service is not required, do not install the LDAP service. T...

Enable Kernel SMAP

Supervisor Mode Access Prevention SMAP can be enabled to prevent the kernel from accessing data in user space. If SMAP is not enabled, attackers can access data in user space through kernel-mode code redirection, which increases the attack surface and reduces system security. SMAP is enabled by...

Ensure That Partitions That Do Not Need to Be Modified Are Mounted as Read-Only

Mounting a file system that does not need to be modified as read-only can prevent unintentional or malicious data tampering and reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Configure Kernel Parameter kptr_restrict Properly

kptrrestrict is used to protect kernel symbol addresses. When the protection level is low, common users can obtain kernel symbol addresses, which are easy to be exploited by attackers. This increases the attack surface and reduces system security. Currently, kptrrestrict can be set to any of the...

Do Not Install Debugging Tools

Debugging scripts and tools in the service environment may be exploited by attackers to launch attacks. Therefore, do not install any debugging tools or files in the production environment. Such tools or files include but not limited to: code debugging tool privilege escalation commands, scripts,...

Ensure That the PATH User Variable Is Strictly Defined

In Linux, the PATH variable defines the path for searching for executable files in the user context of the current user. For example, if a user runs the ls command in any directory, the system searches for the ls command in the directories specified by PATH and executes the command. The PATH...

Configure a Proper Value for LoginGraceTime

LoginGraceTime is used to limit the login time of a user. If a user does not complete the login within the time specified by LoginGraceTime, the connection is automatically disconnected. You are advised to set this field to a value less than or equal to 60, in seconds. If this field is set to a...

Configure Proper Policies for OUTPUT of iptables

There are two occasions in which a server sends outgoing packets: 1. The local host process proactively connects to an external server, for example, performing an HTTP access, or sending data to a log server. 2. The local host responds to the external access to the local services. If no policy is...

Ensure That Scripts Writable by Low-Privilege Users Cannot Be Configured in the sudoers Configuration File

The sudo command enables a specified common user to execute certain programs with the root permission. The corresponding configuration file is /etc/sudoers. The administrator can configure rules to enable some scripts or binary files to run with the root permission. Therefore, only the root user...

Ensure That Passwords Are Encrypted Using Strong Hash Algorithms

For system security, passwords cannot be stored in plaintext in the system and must be encrypted. Irreversible cryptographic algorithms must be used in scenarios where passwords do not need to be recovered. If a password is encrypted with a weak algorithm, attackers can increase the computing pow...