CIS Fedora 40 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /tmp Is a Separate Partition:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set /tmp Is a Separate Partition:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that nodev Option Is Set on /tmp Partition on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nodev Option Is Set on /tmp Partition:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set nodev Option Is Set on /tmp Partition:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that nosuid Option Is Set on /tmp Partition on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nosuid Option Is Set on /tmp Partition:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set nosuid Option Is Set on /tmp Partition:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that noexec Option Is Set on /tmp Partition on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that noexec Option Is Set on /tmp Partition:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set noexec Option Is Set on /tmp Partition:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that /var Is a Separate Partition on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var Is a Separate Partition:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set /var Is a Separate Partition:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that /var/tmp Is a Separate Partition on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/tmp Is a Separate Partition:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set /var/tmp Is a Separate Partition:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that GPG Keys Are Configured for DNF on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that GPG Keys Are Configured for DNF:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set GPG Keys Are Configured for DNF:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that gpgcheck Is Globally Activated on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that gpgcheck Is Globally Activated:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set gpgcheck Is Globally Activated:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Automatic Updates Are Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Automatic Updates Are Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Automatic Updates Are Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Package Integrity Is Verified on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Package Integrity Is Verified:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Package Integrity Is Verified:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that xinetd Is Not Installed on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that xinetd Is Not Installed:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set xinetd Is Not Installed:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Avahi Server Is Not Running on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Avahi Server Is Not Running:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Avahi Server Is Not Running:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that CUPS Is Not Running Unless Required on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that CUPS Is Not Running Unless Required:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set CUPS Is Not Running Unless Required:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that DHCP Server Is Not Running Unless Required on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DHCP Server Is Not Running Unless Required:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set DHCP Server Is Not Running Unless Required:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that DNS Server Is Not Running Unless Required on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DNS Server Is Not Running Unless Required:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set DNS Server Is Not Running Unless Required:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that NIS Client Is Not Installed on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that NIS Client Is Not Installed:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set NIS Client Is Not Installed:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that rsh Client Is Not Installed on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that rsh Client Is Not Installed:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set rsh Client Is Not Installed:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that telnet Client Is Not Installed on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that telnet Client Is Not Installed:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set telnet Client Is Not Installed:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that LDAP Client Is Not Installed Unless Required on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that LDAP Client Is Not Installed Unless Required:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set LDAP Client Is Not Installed Unless Required:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that IP Forwarding Is Disabled on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that IP Forwarding Is Disabled:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set IP Forwarding Is Disabled:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Packet Redirect Sending Is Disabled on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Packet Redirect Sending Is Disabled:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Packet Redirect Sending Is Disabled:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Source Routed Packets Are Not Accepted on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Source Routed Packets Are Not Accepted:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Source Routed Packets Are Not Accepted:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that ICMP Redirects Are Not Accepted on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that ICMP Redirects Are Not Accepted:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set ICMP Redirects Are Not Accepted:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Secure ICMP Redirects Are Not Accepted on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Secure ICMP Redirects Are Not Accepted:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Secure ICMP Redirects Are Not Accepted:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that firewalld Is Installed and Running on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that firewalld Is Installed and Running:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set firewalld Is Installed and Running:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Default Zone Is Set to Drop or Block on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Default Zone Is Set to Drop or Block:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Default Zone Is Set to Drop or Block:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Unnecessary Services Are Removed from Zones on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Unnecessary Services Are Removed from Zones:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Unnecessary Services Are Removed from Zones:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that nftables Backend Is Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nftables Backend Is Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set nftables Backend Is Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that auditd Is Installed and Enabled on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that auditd Is Installed and Enabled:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set auditd Is Installed and Enabled:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Audit Log Storage Size Is Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Log Storage Size Is Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Audit Log Storage Size Is Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that System Administration Actions Are Audited on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that System Administration Actions Are Audited:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set System Administration Actions Are Audited:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Login and Logout Events Are Collected on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Login and Logout Events Are Collected:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Login and Logout Events Are Collected:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Session Initiation Information Is Collected on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Session Initiation Information Is Collected:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Session Initiation Information Is Collected:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that journald Is Configured to Write to Persistent Storage on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that journald Is Configured to Write to Persistent Storage:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set journald Is Configured to Write to Persistent Storage:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that journald Is Configured to Compress Large Log Files on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that journald Is Configured to Compress Large Log Files:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set journald Is Configured to Compress Large Log Files:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Remote Logging Is Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Remote Logging Is Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Remote Logging Is Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Log File Permissions Are Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Log File Permissions Are Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Log File Permissions Are Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that SSH Protocol Is Set to 2 on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH Protocol Is Set to 2:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set SSH Protocol Is Set to 2:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that SSH Root Login Is Disabled on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH Root Login Is Disabled:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set SSH Root Login Is Disabled:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH PermitEmptyPasswords Is Disabled:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set SSH PermitEmptyPasswords Is Disabled:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH MaxAuthTries Is Set to 4 or Less:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set SSH MaxAuthTries Is Set to 4 or Less:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that SSH Idle Timeout Interval Is Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH Idle Timeout Interval Is Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set SSH Idle Timeout Interval Is Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that SSH X11 Forwarding Is Disabled on the Fedora 40 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Fedora 40 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH X11 Forwarding Is Disabled:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set SSH X11 Forwarding Is Disabled:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Password Creation Requirements Are Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Creation Requirements Are Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Password Creation Requirements Are Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This setting ensures that Password Reuse Is Limited on the Fedora 40 Linux operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Fedora 40 Linux operating system is essential for defense in depth.

Run the following command and verify that Password Reuse Is Limited:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Password Reuse Is Limited:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Password Hashing Algorithm Is SHA-512 or Yescrypt on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Hashing Algorithm Is SHA-512 or Yescrypt:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Password Hashing Algorithm Is SHA-512 or Yescrypt:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Lockout for Failed Password Attempts Is Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Lockout for Failed Password Attempts Is Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Lockout for Failed Password Attempts Is Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Permissions on /etc/passwd Are Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/passwd Are Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Permissions on /etc/passwd Are Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Permissions on /etc/shadow Are Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/shadow Are Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Permissions on /etc/shadow Are Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Permissions on /etc/group Are Configured on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/group Are Configured:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Permissions on /etc/group Are Configured:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that No World-Writable Files Exist on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No World-Writable Files Exist:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set No World-Writable Files Exist:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that No Accounts Have Empty Passwords on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Accounts Have Empty Passwords:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set No Accounts Have Empty Passwords:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that Root Is the Only UID 0 Account on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Root Is the Only UID 0 Account:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set Root Is the Only UID 0 Account:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that All Users Home Directories Exist on the Fedora 40 Linux operating system. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Fedora 40 Linux operating system uses the correct component aligns with industry best practices and standards.

Run the following command and verify that All Users Home Directories Exist:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set All Users Home Directories Exist:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.

This recommendation verifies that No Duplicate UIDs Exist on the Fedora 40 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Fedora 40 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Duplicate UIDs Exist:

grep -r ... /etc/
stat /path/to/file

Alternatively, use systemctl status for service-based checks.

Edit the appropriate configuration file and set No Duplicate UIDs Exist:

vi /etc/...
systemctl restart ...

Alternatively, apply the change via Ansible or a configuration management tool.