177629 matches found
Ubuntu: Security Advisory (USN-7491-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2025-1422)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2025-1440)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for dhcp (EulerOS-SA-2025-1409)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7497-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2025:1452-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2025:1451-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
openSUSE Security Advisory (SUSE-SU-2025:1450-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ensure That Partitions That Do Not Require SUID/SGID Bits Are Mounted Using nosuid
After the SUID bit is set for an executable file, the user who executes the file not the file owner is temporarily granted the permission of the file owner. For example, common user test executes a program whose permission is 755 and owner is root. In this case, if the SUID bit is not set,only th...
Configure Login Audit Rules
The /var/log/lastlog file is updated when a user successfully logs in to the system. Therefore, user login events can be recorded by auditing and monitoring the file. If login audit is not configured, the administrator cannot trace login events from audit logs. By default, login audit rules are n...
Record System Authentication-related Events in Logs
System authentication-related events must be recorded to help analyze users SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Do Not Allow Files or Directories Without Owners or Owner Groups
Files or directories without owners or owner groups are not allowed in the system. Generally, these files or directories refer to those whose previous owners are deleted. These files are security risks and may cause information leakage, occupy unnecessary drive space and system resources, and...
Do Not Install Development and Compilation Tools
Compilation tools in the service environment may be exploited by attackers to edit, tamper with, and perform reverse analysis on key files in the environment. Therefore, in the production environment, do not install compilation, decompilation, binary analysis tools, and compilation environments...
Ensure That the Security Level of the Global Encryption Policy Is Not Lower than DEFAULT
The global encryption/decryption policy of the system is used to specify the algorithms supported by the encryption and decryption components. You can change the preset security policy level by modifying the /etc/crypto-policies/config configuration file to change the algorithm set that can be us...
Avoid Using Programs Labeled unconfined_service_t
The purpose of setting the unconfinedservicet label for SELinux is to enable some third-party service processes not configured with SELinux policies to run without restrictions. By default, when systemd runs a third-party application whose label is bint or usrt generally located in directories su...
Ensure That User Group and Password File Permissions Are Correct
In the Linux OS-related information, such as users, passwords, and user groups, is recorded in the configuration files in the /etc directory. Proper permissions must be set for accessing these files. Otherwise, the files may be stolen or tampered with by attackers. The owner and owner group of...
Discard Forged ICMP Packets and Do Not Record Logs
Setting icmpignoreboguserrorresponses to 1 prevents the kernel from recording responses to duplicate broadcast packets, which prevents useless log information from filling in the file system. Some attackers send ICMP packets that violate RFC-1122 and attempt to fill the log file system with a lar...
Do Not Install the Telnet Client
Telnet is an application-layer protocol and is usually used for remote login, operation control, and system modification of servers. Telnet data is not encrypted, and user names, passwords, and transmitted data can be easily stolen by attackers. Therefore, do not install or use Telnet clients. Us...
Configure Audit Rules for User Information Changes
Generally, for deployed services, users and user groups do not change. Passwords, however, are changed periodically but not frequently due to validity periods. It is recommended that key authentication and authorization data be audited and monitored so that changes can be traced. Performing attac...
Ensure That the Group Names Are Unique
The user group names in /etc/group must be unique. If user group names in /etc/group are duplicate, only the GID of the first user group in /etc/group is valid. If the administrator runs commands such as useradd or groupadd to add users or user groups, duplicate user group names typically do not...
Enable Kernel SMAP
Supervisor Mode Access Prevention SMAP can be enabled to prevent the kernel from accessing data in user space. If SMAP is not enabled, attackers can access data in user space through kernel-mode code redirection, which increases the attack surface and reduces system security. SMAP is enabled by...
Ensure That Users Are Required to Change Their Passwords Upon the First Login
If a password, such as one reset by an administrator, is not promptly changed in the service environment when it is not set by the user, it may lead to low-cost attacks. Therefore, it is necessary for users to change their password upon their initial login. However, the root user...
Ensure That Mounting for Unnecessary File System Is Removed
Linux supports multiple file systems through kernel objects loaded to the kernel. As a universal OS platform, openEuler provides various kernel object files in the /lib/modules/kernel version/kernel/fs/ directory to support different file systems. You can run the insmod or modprobe command to loa...
Ensure That the Password Protection Is Configured in Single-User Mode
You can edit the GRUB startup menu and add the s or single command to the Linux startup command line to enter the single-user mode, which is an emergency rescue mode. In this mode, system data can be modified. For example, users can change the password of the root user. In this case, the password...
Ensure That the Sticky Bit Is Set for Globally Writable Directories
The sticky bit of a common file is ignored by the kernel. The sticky bit shows up as the execute permission flag of a directory and is indicated with t. If the sticky bit set is for a directory, a user who is not root or the directory owner cannot delete files or directories in the directory,...
Do Not Install Python 2
The EOL for Python 2 was reached on January 1, 2020, and there will be no updates and maintenance. If you continue to use Python 2, the system attack surface may be expanded, and system vulnerabilities and attack risks may increase. Therefore, do not use Python 2. If Python is required, you are...
Do Not Allow Unused Users
If service-irrelevant users exist in the system, attackers may use them to launch attacks. Only users required by services are retained in the system. Other users used for installation, deployment, commissioning, verification, and fault locating must be deleted. By default, unused users do not...
Ensure That Soft and Hard Link Protection Is Correctly Configured
In Linux, a soft or hard link is a file pointing to another file target. In other words, the target is opened once the link file is opened. Therefore, an attacker can forge a soft link as a common user for a privileged user to execute, causing security issues such as privilege escalation. The sam...
Receive Remote rsyslog Messages Only on A Specified Log Host
By default, rsyslog does not listen on log messages from a remote system. Log message listening via TCP is performed in a similar way to log message listening via UDP, both requiring rsyslog to load a module, that is, the imtcp.so module and the imudp.so module respectively. The TCP/UDP port to b...
Ensure That Common Users Run Privileged Programs Using the sudo Command
The sudo command enables a specified common user to execute certain programs with the root permission. Most system management commands need to be executed by the root user. For the system administrator, properly authorizing other users can reduce the burden of the system administrator. However,...
Configure the dmesg Access Permission Properly
The permission to access dmesg information is restricted. Unprivileged users cannot view system information. This prevents any one from obtaining sensitive information and attacking the system. Only processes with the CAPSYSLOG capability are allowed to access kernel logs. In this way, the least...
Do Not Use auditctl to Set auditd Rules
auditd service rules can be configured using either rule files in the /etc/audit/rules.d/ directory applied after server restart or the auditctl command for immediate effect. The permission of the /etc/audit/rules.d/ directory is 750, while that of the auditctl command is 755. Therefore,...
Do Not Install the Print Service
A server running Common Unix Printing System CUPS provides print services to other devices on the network. Running the CUPS service requires additional system resources and expands the attack surface. Therefore, do not start the CUPS service in the scenario where the CUPS service is not required...
Do Not Configure the Encryption Algorithm Overwriting Policy for the SSH Service
The configuration files of the SSH encryption algorithms are /etc/ssh/sshdconfig and /etc/sysconfig/sshd. When the SSH service is running, you can edit the /etc/sysconfig/sshd file to overwrite the encryption algorithm policy. If the encryption algorithm overwriting policy is configured, users ar...
Disable the ARP Proxy
The ARP proxy allows the system to respond to ARP requests on another interface on behalf of a host connected to an interface. Disabling the ARP proxy not only prevents unauthorized information sharing, but also prevents addressing information leakage between connected network segments. Therefore...
Enable the rsyslog Service
System logs are stored in the memory by default. If the rsyslog service is disabled, system logs cannot be dumped to persistent storage devices and will be lost after the system is restarted. The rsyslog service is used to dump and distribute system logs, supporting the following functions: 1...
Ensure That the umask Value Is Correct
The umask value is the mask for default file or directory permissions. When a file or directory is created, its default permission is set to 777 minus the umask value. For a file, its execute permission is also removed. If the umask value is set improperly, the permission of new files may be too...
Ensure That Different Group IDs Are Initially Assigned to Different Users
The initial login groups of different users must be different. If a user needs to access files in another group, you need to run a command to add the user to the group. In most cases, if the file permission and the folder permission are set to 640 and 750, respectively, users in the same group ca...
Ensure That the su Command Is Restricted
The su command enables a common user to have the permissions of the superuser or other users. It is often used for switching the user from a common user to the root user. The su command provides a convenient way for users to change their identities. However, if the su command is run without...
Ubuntu: Security Advisory (USN-7494-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7488-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2025-1442)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2025-1417)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for proftpd (EulerOS-SA-2025-1434)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for emacs (EulerOS-SA-2025-1413)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2025-1436)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7495-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7481-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7485-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7494-3)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...