CIS CentOS Linux 7 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /tmp Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /tmp Is a Separate Partition:

remediate_partition

This recommendation verifies that nodev Option Set on /tmp on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nodev Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure nodev Option Set on /tmp:

remediate_/tmp

This recommendation verifies that nosuid Option Set on /tmp on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nosuid Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure nosuid Option Set on /tmp:

remediate_/tmp

This recommendation verifies that noexec Option Set on /tmp on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that noexec Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure noexec Option Set on /tmp:

remediate_/tmp

This recommendation verifies that /var Is a Separate Partition on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/tmp Is a Separate Partition on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/tmp Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/tmp Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/log Is a Separate Partition on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/log Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/log Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/log/audit Is a Separate Partition on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/log/audit Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/log/audit Is a Separate Partition:

remediate_partition

This recommendation verifies that /home Is a Separate Partition on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /home Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /home Is a Separate Partition:

remediate_partition

This recommendation verifies that GPG Keys Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that GPG Keys Are Configured:

audit_check_configured

Apply the following configuration to ensure GPG Keys Are Configured:

remediate_configured

This recommendation verifies that Package Manager Repositories Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Package Manager Repositories Are Configured:

audit_check_configured

Apply the following configuration to ensure Package Manager Repositories Are Configured:

remediate_configured

This recommendation verifies that gpgcheck Is Globally Activated on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that gpgcheck Is Globally Activated:

audit_check_activated

Apply the following configuration to ensure gpgcheck Is Globally Activated:

remediate_activated

This recommendation verifies that xinetd Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that xinetd Is Not Installed:

audit_check_installed

Apply the following configuration to ensure xinetd Is Not Installed:

remediate_installed

This recommendation verifies that chargen Services Are Not Enabled on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that chargen Services Are Not Enabled:

audit_check_enabled

Apply the following configuration to ensure chargen Services Are Not Enabled:

remediate_enabled

This recommendation verifies that daytime Services Are Not Enabled on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that daytime Services Are Not Enabled:

audit_check_enabled

Apply the following configuration to ensure daytime Services Are Not Enabled:

remediate_enabled

This recommendation verifies that echo Services Are Not Enabled on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that echo Services Are Not Enabled:

audit_check_enabled

Apply the following configuration to ensure echo Services Are Not Enabled:

remediate_enabled

This recommendation verifies that X Window System Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that X Window System Is Not Installed:

audit_check_installed

Apply the following configuration to ensure X Window System Is Not Installed:

remediate_installed

This recommendation verifies that Avahi Server Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Avahi Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure Avahi Server Is Not Installed:

remediate_installed

This recommendation verifies that CUPS Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that CUPS Is Not Installed:

audit_check_installed

Apply the following configuration to ensure CUPS Is Not Installed:

remediate_installed

This recommendation verifies that DHCP Server Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DHCP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure DHCP Server Is Not Installed:

remediate_installed

This recommendation verifies that NFS and RPC Are Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that NFS and RPC Are Not Installed:

audit_check_installed

Apply the following configuration to ensure NFS and RPC Are Not Installed:

remediate_installed

This recommendation verifies that DNS Server Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DNS Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure DNS Server Is Not Installed:

remediate_installed

This recommendation verifies that FTP Server Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that FTP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure FTP Server Is Not Installed:

remediate_installed

This recommendation verifies that HTTP Server Is Not Installed on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that HTTP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure HTTP Server Is Not Installed:

remediate_installed

This recommendation verifies that IP Forwarding Is Disabled on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that IP Forwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure IP Forwarding Is Disabled:

remediate_disabled

This recommendation verifies that Packet Redirect Sending Is Disabled on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Packet Redirect Sending Is Disabled:

audit_check_disabled

Apply the following configuration to ensure Packet Redirect Sending Is Disabled:

remediate_disabled

This recommendation verifies that Source Routed Packets Are Not Accepted on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Source Routed Packets Are Not Accepted:

audit_check_accepted

Apply the following configuration to ensure Source Routed Packets Are Not Accepted:

remediate_accepted

This recommendation verifies that ICMP Redirects Are Not Accepted on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that ICMP Redirects Are Not Accepted:

audit_check_accepted

Apply the following configuration to ensure ICMP Redirects Are Not Accepted:

remediate_accepted

This recommendation verifies that Broadcast ICMP Requests Are Ignored on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Broadcast ICMP Requests Are Ignored:

audit_check_ignored

Apply the following configuration to ensure Broadcast ICMP Requests Are Ignored:

remediate_ignored

This recommendation verifies that firewalld Is Installed on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that firewalld Is Installed:

audit_check_installed

Apply the following configuration to ensure firewalld Is Installed:

remediate_installed

This recommendation verifies that iptables-services Package Is Not Installed with firewalld on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that iptables-services Package Is Not Installed with firewalld:

audit_check_firewalld

Apply the following configuration to ensure iptables-services Package Is Not Installed with firewalld:

remediate_firewalld

This recommendation verifies that firewalld Service Is Enabled and Running on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that firewalld Service Is Enabled and Running:

audit_check_running

Apply the following configuration to ensure firewalld Service Is Enabled and Running:

remediate_running

This recommendation verifies that Default Zone Is Set on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Default Zone Is Set:

audit_check_set

Apply the following configuration to ensure Default Zone Is Set:

remediate_set

This recommendation verifies that rsyslog Is Installed on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Is Installed:

audit_check_installed

Apply the following configuration to ensure rsyslog Is Installed:

remediate_installed

This recommendation verifies that rsyslog Service Is Enabled on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Service Is Enabled:

audit_check_enabled

Apply the following configuration to ensure rsyslog Service Is Enabled:

remediate_enabled

This recommendation verifies that rsyslog Default File Permissions Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Default File Permissions Are Configured:

audit_check_configured

Apply the following configuration to ensure rsyslog Default File Permissions Are Configured:

remediate_configured

This recommendation verifies that Logging Is Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Logging Is Configured:

audit_check_configured

Apply the following configuration to ensure Logging Is Configured:

remediate_configured

This recommendation verifies that rsyslog Is Configured to Send Logs to a Remote Host on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Is Configured to Send Logs to a Remote Host:

audit_check_host

Apply the following configuration to ensure rsyslog Is Configured to Send Logs to a Remote Host:

remediate_host

This recommendation verifies that auditd Is Installed on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that auditd Is Installed:

audit_check_installed

Apply the following configuration to ensure auditd Is Installed:

remediate_installed

This recommendation verifies that auditd Service Is Enabled and Running on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that auditd Service Is Enabled and Running:

audit_check_running

Apply the following configuration to ensure auditd Service Is Enabled and Running:

remediate_running

This recommendation verifies that Audit Log Storage Size Is Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Log Storage Size Is Configured:

audit_check_configured

Apply the following configuration to ensure Audit Log Storage Size Is Configured:

remediate_configured

This recommendation verifies that System Is Disabled When Audit Logs Are Full on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that System Is Disabled When Audit Logs Are Full:

audit_check_full

Apply the following configuration to ensure System Is Disabled When Audit Logs Are Full:

remediate_full

This recommendation verifies that Events That Modify Date and Time Are Collected on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Events That Modify Date and Time Are Collected:

audit_check_collected

Apply the following configuration to ensure Events That Modify Date and Time Are Collected:

remediate_collected

This recommendation verifies that Events That Modify User/Group Information Are Collected on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Events That Modify User/Group Information Are Collected:

audit_check_collected

Apply the following configuration to ensure Events That Modify User/Group Information Are Collected:

remediate_collected

This recommendation verifies that Successful and Unsuccessful Login Events Are Collected on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Successful and Unsuccessful Login Events Are Collected:

audit_check_collected

Apply the following configuration to ensure Successful and Unsuccessful Login Events Are Collected:

remediate_collected

This recommendation verifies that SSH Root Login Is Disabled on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH Root Login Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH Root Login Is Disabled:

remediate_disabled

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH PermitEmptyPasswords Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH PermitEmptyPasswords Is Disabled:

remediate_disabled

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH MaxAuthTries Is Set to 4 or Less:

audit_check_less

Apply the following configuration to ensure SSH MaxAuthTries Is Set to 4 or Less:

remediate_less

This recommendation verifies that SSH Protocol Is Set to 2 on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH Protocol Is Set to 2:

audit_check_2

Apply the following configuration to ensure SSH Protocol Is Set to 2:

remediate_2

This recommendation verifies that SSH Idle Timeout Is Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH Idle Timeout Is Configured:

audit_check_configured

Apply the following configuration to ensure SSH Idle Timeout Is Configured:

remediate_configured

This recommendation verifies that SSH X11 Forwarding Is Disabled on the CentOS Linux 7 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the CentOS Linux 7 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH X11 Forwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH X11 Forwarding Is Disabled:

remediate_disabled

This recommendation verifies that Password Quality Requirements Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Quality Requirements Are Configured:

audit_check_configured

Apply the following configuration to ensure Password Quality Requirements Are Configured:

remediate_configured

This recommendation verifies that Password Hashing Algorithm Is SHA-512 on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Hashing Algorithm Is SHA-512:

audit_check_sha-512

Apply the following configuration to ensure Password Hashing Algorithm Is SHA-512:

remediate_sha-512

This setting ensures that Password Reuse Is Limited on the CentOS Linux 7 server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the CentOS Linux 7 server is essential for defense in depth.

Run the following command and verify that Password Reuse Is Limited:

audit_check_limited

Apply the following configuration to ensure Password Reuse Is Limited:

remediate_limited

This recommendation verifies that Account Lockout Policy Is Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Account Lockout Policy Is Configured:

audit_check_configured

Apply the following configuration to ensure Account Lockout Policy Is Configured:

remediate_configured

This recommendation verifies that Password Expiration Is Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Expiration Is Configured:

audit_check_configured

Apply the following configuration to ensure Password Expiration Is Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/passwd Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/passwd Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/passwd Are Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/shadow Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/shadow Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/shadow Are Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/group Are Configured on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/group Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/group Are Configured:

remediate_configured

This recommendation verifies that No World-Writable Files Exist on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No World-Writable Files Exist:

audit_check_exist

Apply the following configuration to ensure No World-Writable Files Exist:

remediate_exist

This recommendation verifies that No SUID Executables Exist on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No SUID Executables Exist:

audit_check_exist

Apply the following configuration to ensure No SUID Executables Exist:

remediate_exist

This recommendation verifies that root Is the Only UID 0 Account on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that root Is the Only UID 0 Account:

audit_check_account

Apply the following configuration to ensure root Is the Only UID 0 Account:

remediate_account

This recommendation verifies that No Legacy Entries Exist in /etc/passwd on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Legacy Entries Exist in /etc/passwd:

audit_check_/etc/passwd

Apply the following configuration to ensure No Legacy Entries Exist in /etc/passwd:

remediate_/etc/passwd

This recommendation verifies that All Users Have a Valid Home Directory on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that All Users Have a Valid Home Directory:

audit_check_directory

Apply the following configuration to ensure All Users Have a Valid Home Directory:

remediate_directory

This recommendation verifies that No Duplicate UIDs Exist on the CentOS Linux 7 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the CentOS Linux 7 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Duplicate UIDs Exist:

audit_check_exist

Apply the following configuration to ensure No Duplicate UIDs Exist:

remediate_exist