CIS Oracle Solaris 11.4 Benchmark

This recommendation verifies that Package Integrity Is Verified on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

pkg verify
# Verify package integrity — check for modified files

pkg verify -v 2>&1 | head -30

# Reinstall packages with integrity errors:
pkg fix <package_name>

# Full system verification and fix:
pkg verify 2>&1 | awk '/ERROR/ {print $2}' | xargs -I{} pkg fix {}

This recommendation verifies that Only Trusted Publishers Are Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

pkg publisher
# Verify configured publishers
# Ensure only trusted publishers are listed

pkg publisher -P

# Remove untrusted publishers:
pkg unset-publisher <publisher_name>

# Set approved publisher:
pkg set-publisher -G '*' -g https://pkg.oracle.com/solaris/support/ solaris

This recommendation verifies that Boot Environments Are Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

beadm list
# Verify boot environments are configured
# Check for recovery boot environment

# Create a boot environment before changes:
beadm create pre-hardening-$(date +%Y%m%d)
beadm activate pre-hardening-$(date +%Y%m%d)

This recommendation verifies that ZFS Encryption Is Used for Sensitive Data on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

zfs get encryption rpool
zfs get encryption rpool/ROOT
# Verify ZFS encryption is enabled on sensitive datasets

# Enable encryption on new datasets:
zfs create -o encryption=aes-256-ccm -o keysource=passphrase,prompt rpool/encrypted_data

# Note: Cannot encrypt existing datasets in place — must create new and migrate

This recommendation verifies that Console Login Restrictions Are Set on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^CONSOLE=' /etc/default/login
# Should return: CONSOLE=/dev/console

grep 'SUPATH\|PATH' /etc/default/login

# Edit /etc/default/login:
gsed -i 's/^#\?CONSOLE=.*/CONSOLE=\/dev\/console/' /etc/default/login

This recommendation verifies that Login Retry Limits Are Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep 'RETRIES' /etc/default/login
# Should show RETRIES=3 or less

grep 'SYSLOG_FAILED_LOGINS' /etc/default/login

# Edit /etc/default/login:
gsed -i 's/^#\?RETRIES=.*/RETRIES=3/' /etc/default/login
gsed -i 's/^#\?SYSLOG_FAILED_LOGINS=.*/SYSLOG_FAILED_LOGINS=0/' /etc/default/login

This recommendation verifies that Root Account Is Secured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

passwd -s root
# Verify root password status (PS = password set)

rolemod -K type=role root 2>/dev/null
getent user_attr root

# Set root as a role (requires sudo for access):
rolemod -K type=role root

# Or enforce root password aging:
passwd -x 90 -n 7 -w 14 root

This recommendation verifies that Telnet Service Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

svcs -a | grep telnet
# Should show disabled or not found

inetadm -l svc:/network/telnet:default 2>/dev/null

svcadm disable svc:/network/telnet:default
inetadm -d svc:/network/telnet:default

This recommendation verifies that FTP Service Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

svcs -a | grep ftp
# Should show disabled

inetadm -l svc:/network/ftp:default 2>/dev/null

svcadm disable svc:/network/ftp:default
inetadm -d svc:/network/ftp:default

This recommendation verifies that rlogin/rsh/rexec Services Are Disabled on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

svcs -a | grep rlogin
svcs -a | grep rsh
svcs -a | grep rexec
# All should be disabled or not found

svcadm disable svc:/network/login:rlogin
svcadm disable svc:/network/shell:default
svcadm disable svc:/network/rexec:default

This recommendation verifies that Sendmail Is Local-Only or Disabled on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

svcs -a | grep sendmail
# Check if sendmail is running

svcs -p svc:/network/smtp:sendmail

# If not a mail server:
svcadm disable svc:/network/smtp:sendmail

# If needed, restrict to local only:
svccfg -s svc:/network/smtp:sendmail setprop config/local_only = true
svcadm refresh svc:/network/smtp:sendmail
svcadm restart svc:/network/smtp:sendmail

This recommendation verifies that NFS Server Is Disabled Unless Required on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

svcs -a | grep nfs/server
svcs -a | grep nfs/client
# Review NFS status

# Disable NFS server if not required:
svcadm disable svc:/network/nfs/server:default
svcadm disable svc:/network/nfs/mapid:default
svcadm disable svc:/network/nfs/status:default

This recommendation verifies that SNMP Is Disabled Unless Required on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

svcs -a | grep -i snmp
svcs -a | grep sma
# Should be disabled unless SNMP is required

svcadm disable svc:/application/management/net-snmp:default
svcadm disable svc:/application/management/sma:default

This recommendation verifies that IP Forwarding Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

ipadm show-prop -p forwarding -o CURRENT ipv4
ipadm show-prop -p forwarding -o CURRENT ipv6
# Both should return: off

ipadm set-prop -p forwarding=off ipv4
ipadm set-prop -p forwarding=off ipv6

This recommendation verifies that Broadcast Echo Responses Are Disabled on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ipadm show-prop -p _respond_to_echo_broadcast -o CURRENT ipv4
# Should return: 0

ipadm set-prop -p _respond_to_echo_broadcast=0 ipv4

This recommendation verifies that ICMP Redirects Are Ignored on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ipadm show-prop -p _ignore_redirect -o CURRENT ipv4
ipadm show-prop -p _ignore_redirect -o CURRENT ipv6
# Both should return: 1

ipadm set-prop -p _ignore_redirect=1 ipv4
ipadm set-prop -p _ignore_redirect=1 ipv6

This recommendation verifies that Strict Multihoming Is Enabled on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ipadm show-prop -p _strict_dst_multihoming -o CURRENT ipv4
# Should return: 1

ipadm set-prop -p _strict_dst_multihoming=1 ipv4
ipadm set-prop -p _strict_dst_multihoming=1 ipv6

This recommendation verifies that Send Redirects Are Disabled on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ipadm show-prop -p _send_redirects -o CURRENT ipv4
# Should return: 0

ipadm set-prop -p _send_redirects=0 ipv4

This recommendation verifies that IP Filter Is Enabled with Rules on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

svcs -a | grep ipfilter
pfctl -s rules 2>/dev/null || ipfstat -io 2>/dev/null
# Verify packet filter is running with rules

# Enable IP Filter:
svcadm enable svc:/network/ipfilter:default

# Configure rules in /etc/ipf/ipf.conf:
echo 'block in all' >> /etc/ipf/ipf.conf
echo 'pass in on lo0 all' >> /etc/ipf/ipf.conf
echo 'pass in proto tcp from any to any port = 22' >> /etc/ipf/ipf.conf
ipf -Fa -f /etc/ipf/ipf.conf

This recommendation verifies that Default Deny Policy Is Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

cat /etc/ipf/ipf.conf
# Verify default deny rule exists
# Should contain: block in all

# Add default deny to /etc/ipf/ipf.conf:
echo 'block in all' > /etc/ipf/ipf.conf
echo 'block out all' >> /etc/ipf/ipf.conf
# Then add specific allow rules
ipf -Fa -f /etc/ipf/ipf.conf

This recommendation verifies that Audit Service Is Enabled on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

svcs -a | grep audit
auditconfig -getpolicy
# Verify auditing is enabled with proper policy

svcadm enable svc:/system/auditd:default
auditconfig -setpolicy +cnt,+argv,+arge

This recommendation verifies that Audit Flags Are Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditconfig -getflags
# Review audit flags — should include lo,ad,ft,ex,fm

auditconfig -getnaflags

auditconfig -setflags lo,ad,ft,ex,fm,fw,fc,fd
auditconfig -setnaflags lo,ad,ft,ex

This recommendation verifies that Audit Storage Is Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditconfig -getplugin audit_binfile
# Verify audit log storage is configured

ls -la /var/audit/

# Configure audit binary file plugin:
auditconfig -setplugin audit_binfile active p_dir=/var/audit

# Set audit log size:
auditconfig -setplugin audit_binfile active p_fsize=4M

This recommendation verifies that Audit Syslog Plugin Is Active on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditconfig -getplugin audit_syslog
# Check if audit events are sent to syslog

auditconfig -setplugin audit_syslog active p_flags=lo,ad,ft
svcadm refresh svc:/system/auditd:default

This recommendation verifies that Remote Log Reception Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

svcs -a | grep system-log
svcprop -p config/log_from_remote svc:/system/system-log:default
# Should return: false (unless log server)

svccfg -s svc:/system/system-log:default setprop config/log_from_remote = false
svcadm refresh svc:/system/system-log:default
svcadm restart svc:/system/system-log:default

This recommendation verifies that Remote Log Forwarding Is Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -v '^#' /etc/syslog.conf | grep '@'
# Verify remote log host is configured

# Add to /etc/syslog.conf:
echo '*.warning;auth.info\t\t@loghost.example.com' >> /etc/syslog.conf
svcadm restart svc:/system/system-log:default

This recommendation verifies that Log File Permissions Are Restrictive on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find /var/log -type f -perm /037 -ls 2>/dev/null
find /var/adm -type f -perm /037 -ls 2>/dev/null
ls -la /var/log/syslog /var/adm/messages

chmod 640 /var/log/syslog
chmod 640 /var/adm/messages
find /var/log -type f -perm /037 -exec chmod 640 {} \;

This recommendation verifies that SSH Root Login Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitrootlogin
# Should return: no

grep -i '^PermitRootLogin' /etc/ssh/sshd_config

gsed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
svcadm restart svc:/network/ssh:default

This recommendation ensures that SSH Protocol 2 Is Enforced on the Oracle Solaris 11.4 Unix operating system. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Oracle Solaris 11.4 Unix operating system may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

sshd -T | grep protocol
# SSH on Solaris 11.4 defaults to Protocol 2

gsed -i 's/^#\?Protocol.*/Protocol 2/' /etc/ssh/sshd_config
svcadm restart svc:/network/ssh:default

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitemptypasswords
# Should return: no

gsed -i 's/^#\?PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
svcadm restart svc:/network/ssh:default

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep maxauthtries
# Should return 4 or less

gsed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config
svcadm restart svc:/network/ssh:default

This recommendation verifies that SSH X11 Forwarding Is Disabled on the Oracle Solaris 11.4 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Oracle Solaris 11.4 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep x11forwarding
# Should return: no

gsed -i 's/^#\?X11Forwarding.*/X11Forwarding no/' /etc/ssh/sshd_config
svcadm restart svc:/network/ssh:default

This recommendation verifies that Password Length and Complexity Are Set on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^PASSLENGTH' /etc/default/passwd
# Should be >= 14
grep '^MINDIGIT\|^MINUPPER\|^MINLOWER\|^MINSPECIAL' /etc/default/passwd

gsed -i 's/^#\?PASSLENGTH=.*/PASSLENGTH=14/' /etc/default/passwd
gsed -i 's/^#\?MINDIGIT=.*/MINDIGIT=1/' /etc/default/passwd
gsed -i 's/^#\?MINUPPER=.*/MINUPPER=1/' /etc/default/passwd
gsed -i 's/^#\?MINLOWER=.*/MINLOWER=1/' /etc/default/passwd
gsed -i 's/^#\?MINSPECIAL=.*/MINSPECIAL=1/' /etc/default/passwd

This recommendation verifies that Password History and Aging Are Configured on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^HISTORY' /etc/default/passwd
# Should be >= 10

grep '^MAXWEEKS\|^MINWEEKS\|^WARNWEEKS' /etc/default/passwd

gsed -i 's/^#\?HISTORY=.*/HISTORY=10/' /etc/default/passwd
gsed -i 's/^#\?MAXWEEKS=.*/MAXWEEKS=13/' /etc/default/passwd
gsed -i 's/^#\?MINWEEKS=.*/MINWEEKS=1/' /etc/default/passwd
gsed -i 's/^#\?WARNWEEKS=.*/WARNWEEKS=2/' /etc/default/passwd

This recommendation verifies that Account Lockout After Failed Attempts on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '^LOCK_AFTER_RETRIES' /etc/security/policy.conf
# Should return: LOCK_AFTER_RETRIES=YES

grep '^RETRIES' /etc/default/login

gsed -i 's/^#\?LOCK_AFTER_RETRIES=.*/LOCK_AFTER_RETRIES=YES/' /etc/security/policy.conf
gsed -i 's/^#\?RETRIES=.*/RETRIES=3/' /etc/default/login

This recommendation verifies that Core System File Permissions Are Set on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ls -l /etc/passwd /etc/shadow /etc/group
# /etc/passwd: 644, /etc/shadow: 400, /etc/group: 644

chmod 644 /etc/passwd
chmod 400 /etc/shadow
chmod 644 /etc/group
chown root:root /etc/passwd /etc/group
chown root:sys /etc/shadow

This recommendation verifies that No World-Writable Files Exist on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -type f -perm -0002 -ls 2>/dev/null
# Should return empty

find / -xdev -type f -perm -0002 -exec chmod o-w {} \;

This recommendation verifies that No Unowned Files or Directories Exist on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -nouser -o -nogroup 2>/dev/null | head -20
# Should return empty — no unowned files

# For each unowned file, assign proper ownership:
chown root:root <file>
# Or remove if unnecessary:
rm <file>

This recommendation verifies that No Accounts Have Empty Passwords on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

logins -p
# Lists accounts without passwords — should return empty

# Lock accounts without passwords:
logins -p | awk '{print $1}' | while read user; do
  passwd -l "$user"
done

This recommendation verifies that Root Is the Only UID 0 Account on the Oracle Solaris 11.4 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Oracle Solaris 11.4 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 == 0) {print $1}' /etc/passwd
# Should return only: root

usermod -u <new_uid> <non_root_uid0_user>