CIS Red Hat Enterprise Linux 8 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp
systemctl is-enabled tmp.mount
# Verify /tmp is a separate partition/mount

systemctl unmask tmp.mount
systemctl enable --now tmp.mount

# Or add to /etc/fstab:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0

This recommendation verifies that nodev Option Is Set on /tmp Partition on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep nodev
# Verify nodev is set on /tmp

# Edit /etc/fstab — add nodev to /tmp options:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec 0 0
mount -o remount /tmp

This recommendation verifies that nosuid Option Is Set on /tmp Partition on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep nosuid

# Edit /etc/fstab — add nosuid to /tmp options
mount -o remount /tmp

This recommendation verifies that noexec Option Is Set on /tmp Partition on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep noexec

# Edit /etc/fstab — add noexec to /tmp options
mount -o remount /tmp

This recommendation verifies that /var Is a Separate Partition on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /var
# Verify /var is a separate partition

# Partition /var at install time or migrate:
lvcreate -L 10G -n var_lv rhel_vg
mkfs.xfs /dev/rhel_vg/var_lv
# Update /etc/fstab:
# /dev/rhel_vg/var_lv /var xfs defaults 0 0

This recommendation verifies that /var/log Is a Separate Partition on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /var/log
# Verify /var/log is a separate partition

# Partition /var/log at install time or create LV:
lvcreate -L 5G -n varlog_lv rhel_vg
mkfs.xfs /dev/rhel_vg/varlog_lv
# Update /etc/fstab

This recommendation verifies that GPG Check Is Globally Activated on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dnf repolist
# Verify all repos use gpgcheck
grep -r 'gpgcheck' /etc/yum.repos.d/

# Ensure gpgcheck=1 in all repo files:
sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/yum.repos.d/*.repo

# In /etc/dnf/dnf.conf:
sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/dnf/dnf.conf

This recommendation verifies that Red Hat Subscription Manager Is Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q subscription-manager
subscription-manager identity
subscription-manager status

subscription-manager register --username <user> --password <pass>
subscription-manager attach --auto

This recommendation verifies that Security Updates Are Applied on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dnf check-update --security
# Review pending security updates

dnf update -y --security
# Or full update:
dnf update -y

This recommendation verifies that System-Wide Crypto Policy Is Not Legacy on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

update-crypto-policies --show
# Should return DEFAULT, FUTURE, or FIPS (not LEGACY)

update-crypto-policies --set DEFAULT
# Or for higher security:
update-crypto-policies --set FUTURE

This recommendation verifies that SHA1 Is Not Used in Crypto Policy on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

grep -i '\bsha1\b' /etc/crypto-policies/back-ends/*.config 2>/dev/null
# Should return empty — SHA1 not allowed for signing

update-crypto-policies --set DEFAULT:NO-SHA1
# Or use FUTURE policy which excludes SHA1:
update-crypto-policies --set FUTURE

This recommendation verifies that autofs Is Not Installed or Disabled on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active autofs
systemctl is-enabled autofs
# Both should be inactive/disabled

systemctl stop autofs
systemctl disable autofs
systemctl mask autofs

This recommendation verifies that Avahi Server Is Not Running on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active avahi-daemon
systemctl is-enabled avahi-daemon

systemctl stop avahi-daemon
systemctl disable avahi-daemon
systemctl mask avahi-daemon
dnf remove -y avahi

This recommendation verifies that CUPS Is Not Running Unless Required on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active cups
systemctl is-enabled cups

systemctl stop cups
systemctl disable cups
# If not needed:
dnf remove -y cups

This recommendation verifies that NFS Is Not Running Unless Required on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q nfs-utils
systemctl is-enabled nfs-server
systemctl is-active nfs-server

systemctl stop nfs-server
systemctl disable nfs-server
systemctl mask nfs-server

This recommendation verifies that rpcbind Is Not Running Unless Required on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q rpcbind
systemctl is-enabled rpcbind
systemctl is-active rpcbind

systemctl stop rpcbind
systemctl disable rpcbind
systemctl mask rpcbind

This recommendation verifies that vsftpd Is Not Running Unless Required on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q vsftpd
systemctl is-enabled vsftpd
systemctl is-active vsftpd

systemctl stop vsftpd
systemctl disable vsftpd
dnf remove -y vsftpd

This recommendation verifies that NIS Client Is Not Installed on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q ypbind
# Should return: package ypbind is not installed

dnf remove -y ypbind

This recommendation verifies that telnet Client Is Not Installed on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q telnet
# Should return: package telnet is not installed

dnf remove -y telnet

This recommendation verifies that LDAP Client Is Not Installed on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q openldap-clients
# Should return: package openldap-clients is not installed

dnf remove -y openldap-clients

This recommendation verifies that IP Forwarding Is Disabled on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sysctl net.ipv4.ip_forward
# Should be 0
sysctl net.ipv6.conf.all.forwarding
# Should be 0

echo 'net.ipv4.ip_forward = 0' > /etc/sysctl.d/60-netipv4.conf
echo 'net.ipv6.conf.all.forwarding = 0' > /etc/sysctl.d/60-netipv6.conf
sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv6.conf.all.forwarding=0

This recommendation verifies that Packet Redirect Sending Is Disabled on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sysctl net.ipv4.conf.all.send_redirects
sysctl net.ipv4.conf.default.send_redirects
# Both should return 0

printf 'net.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.default.send_redirects = 0\n' >> /etc/sysctl.d/60-netipv4.conf
sysctl -w net.ipv4.conf.all.send_redirects=0
sysctl -w net.ipv4.conf.default.send_redirects=0

This recommendation verifies that ICMP Redirects Are Not Accepted on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
sysctl net.ipv6.conf.all.accept_redirects
sysctl net.ipv6.conf.default.accept_redirects
# All should return 0

printf 'net.ipv4.conf.all.accept_redirects = 0\nnet.ipv4.conf.default.accept_redirects = 0\n' >> /etc/sysctl.d/60-netipv4.conf
printf 'net.ipv6.conf.all.accept_redirects = 0\nnet.ipv6.conf.default.accept_redirects = 0\n' >> /etc/sysctl.d/60-netipv6.conf
sysctl --system

This recommendation verifies that Suspicious Packets Are Logged on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.log_martians
sysctl net.ipv4.conf.default.log_martians
# Both should return 1

printf 'net.ipv4.conf.all.log_martians = 1\nnet.ipv4.conf.default.log_martians = 1\n' >> /etc/sysctl.d/60-netipv4.conf
sysctl -w net.ipv4.conf.all.log_martians=1
sysctl -w net.ipv4.conf.default.log_martians=1

This recommendation verifies that firewalld Is Installed and Running on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q firewalld
systemctl is-enabled firewalld
systemctl is-active firewalld
firewall-cmd --state

dnf install -y firewalld
systemctl enable --now firewalld

This recommendation verifies that Default Zone Is Set to Drop or Block on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

firewall-cmd --get-default-zone
firewall-cmd --list-all
# Verify default zone is drop or block for public

firewall-cmd --set-default-zone=drop
firewall-cmd --runtime-to-permanent

This recommendation verifies that Unnecessary Services Are Removed on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

firewall-cmd --list-services
firewall-cmd --list-ports
# Review and remove unnecessary services/ports

firewall-cmd --remove-service=<service_name> --permanent
firewall-cmd --remove-port=<port/protocol> --permanent
firewall-cmd --reload

This recommendation verifies that Only Necessary Services Are Allowed on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

firewall-cmd --list-all --zone=public
# Verify only necessary services are allowed

# Add only required services:
firewall-cmd --add-service=ssh --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --reload

This recommendation verifies that auditd Is Installed and Enabled on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q audit
systemctl is-enabled auditd
systemctl is-active auditd

dnf install -y audit
systemctl enable --now auditd

This recommendation verifies that Audit Log Size Is Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^max_log_file\s*=' /etc/audit/auditd.conf
grep -E '^max_log_file_action' /etc/audit/auditd.conf

sed -i 's/^max_log_file\s*=.*/max_log_file = 8/' /etc/audit/auditd.conf
sed -i 's/^max_log_file_action.*/max_log_file_action = keep_logs/' /etc/audit/auditd.conf
systemctl restart auditd

This recommendation verifies that Date and Time Changes Are Collected on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'time-change|adjtimex|settimeofday|clock_settime'
grep time-change /etc/audit/rules.d/*.rules

cat >> /etc/audit/rules.d/50-time.rules << 'EOF'
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
EOF
augenrules --load

This recommendation verifies that User/Group Modification Events Are Collected on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep identity
grep identity /etc/audit/rules.d/*.rules

cat >> /etc/audit/rules.d/50-identity.rules << 'EOF'
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
EOF
augenrules --load

This recommendation verifies that Sudoers Changes Are Collected on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep scope
grep scope /etc/audit/rules.d/*.rules

cat >> /etc/audit/rules.d/50-scope.rules << 'EOF'
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
EOF
augenrules --load

This recommendation verifies that rsyslog Is Installed and Running on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q rsyslog
systemctl is-enabled rsyslog
systemctl is-active rsyslog

dnf install -y rsyslog
systemctl enable --now rsyslog

This recommendation verifies that Remote Logging Is Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\*\.\*\s+@@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null
# Verify remote log host is configured

echo '*.* @@loghost.example.com:514' >> /etc/rsyslog.d/50-remote.conf
systemctl restart rsyslog

This recommendation verifies that Log File Permissions Are Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find /var/log -type f -perm /037 -ls 2>/dev/null
stat -c '%a %U %G' /var/log/messages /var/log/secure

chmod 640 /var/log/messages
chmod 640 /var/log/secure
find /var/log -type f -perm /037 -exec chmod 640 {} \;

This recommendation verifies that SSH Root Login Is Disabled on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitrootlogin
# Should return: permitrootlogin no

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep maxauthtries
# Should return: maxauthtries 4 (or less)

sed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the RHEL 8 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RHEL 8 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitemptypasswords
# Should return: permitemptypasswords no

sed -i 's/^#\?PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that Only Strong SSH Ciphers Are Used on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep -i 'ciphers'
# Verify only strong ciphers are listed
# Expected: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

echo 'Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH Idle Timeout Is Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep -E 'clientaliveinterval|clientalivecountmax'
# clientaliveinterval <= 300, clientalivecountmax <= 3

sed -i 's/^#\?ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config
sed -i 's/^#\?ClientAliveCountMax.*/ClientAliveCountMax 3/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH Warning Banner Is Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep banner
# Should return: banner /etc/issue.net

sed -i 's/^#\?Banner.*/Banner \/etc\/issue.net/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation ensures that Password Creation Requirements Are Configured on the RHEL 8 Linux operating system. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the RHEL 8 Linux operating system may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

grep -E '^\s*minlen|dcredit|ucredit|ocredit|lcredit' /etc/security/pwquality.conf
# minlen >= 14; dcredit, ucredit, ocredit, lcredit <= -1

sed -i 's/^#\? *minlen.*/minlen = 14/' /etc/security/pwquality.conf
sed -i 's/^#\? *dcredit.*/dcredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *ucredit.*/ucredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *ocredit.*/ocredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *lcredit.*/lcredit = -1/' /etc/security/pwquality.conf

This setting ensures that Password Reuse Is Limited on the RHEL 8 Linux operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the RHEL 8 Linux operating system is essential for defense in depth.

grep -E 'pam_pwhistory|remember' /etc/pam.d/system-auth
# Verify remember is set to 5 or more

# Edit /etc/pam.d/system-auth:
# password requisite pam_pwhistory.so use_authtok remember=5 retry=3
authselect create-profile hardening -b sssd
authselect select custom/hardening with-faillock with-mkhomedir

This recommendation verifies that Lockout for Failed Password Attempts Is Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
# Verify deny=5, unlock_time=900

grep -E '^deny|^unlock_time|^fail_interval' /etc/security/faillock.conf

# Configure /etc/security/faillock.conf:
sed -i 's/^#\? *deny.*/deny = 5/' /etc/security/faillock.conf
sed -i 's/^#\? *unlock_time.*/unlock_time = 900/' /etc/security/faillock.conf
sed -i 's/^#\? *fail_interval.*/fail_interval = 900/' /etc/security/faillock.conf
authselect enable-feature with-faillock
authselect apply-changes

This recommendation verifies that Permissions on /etc/passwd Are Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/passwd
# Should return: 644 root root

chmod 644 /etc/passwd
chown root:root /etc/passwd

This recommendation verifies that Permissions on /etc/shadow Are Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/shadow
# Should return: 0 root root

chmod 0000 /etc/shadow
chown root:root /etc/shadow

This recommendation verifies that Permissions on /etc/group Are Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/group
# Should return: 644 root root

chmod 644 /etc/group
chown root:root /etc/group

This recommendation verifies that Permissions on /etc/gshadow Are Configured on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/gshadow
# Should return: 0 root root

chmod 0000 /etc/gshadow
chown root:root /etc/gshadow

This recommendation verifies that No World-Writable Files Exist on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -type f -perm -0002 -ls 2>/dev/null
# Should return empty

find / -xdev -type f -perm -0002 -exec chmod o-w {} \;

This recommendation verifies that No Accounts Have Empty Passwords on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "") {print $1}' /etc/shadow
# Should return empty — no empty passwords

awk -F: '($2 == "") {print $1}' /etc/shadow | while read user; do
  passwd -l "$user"
done

This recommendation verifies that Root Is the Only UID 0 Account on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 == 0) {print $1}' /etc/passwd
# Should return only: root

# Change UID of non-root UID 0 accounts:
usermod -u <new_uid> <username>

This recommendation verifies that No Legacy '+' Entries Exist on the RHEL 8 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RHEL 8 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\+' /etc/passwd /etc/shadow /etc/group
# Should return empty — no legacy '+' entries

# Remove any '+' entries from:
# /etc/passwd, /etc/shadow, /etc/group
sed -i '/^+/d' /etc/passwd
sed -i '/^+/d' /etc/shadow
sed -i '/^+/d' /etc/group