CIS SUSE Linux Enterprise 15 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /tmp Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /tmp Is a Separate Partition:

remediate_partition

This recommendation verifies that nodev Option Set on /tmp on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nodev Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure nodev Option Set on /tmp:

remediate_/tmp

This recommendation verifies that nosuid Option Set on /tmp on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nosuid Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure nosuid Option Set on /tmp:

remediate_/tmp

This recommendation verifies that noexec Option Set on /tmp on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that noexec Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure noexec Option Set on /tmp:

remediate_/tmp

This recommendation verifies that /var Is a Separate Partition on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/tmp Is a Separate Partition on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/tmp Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/tmp Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/log Is a Separate Partition on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/log Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/log Is a Separate Partition:

remediate_partition

This recommendation verifies that /home Is a Separate Partition on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /home Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /home Is a Separate Partition:

remediate_partition

This recommendation verifies that GPG Keys Are Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that GPG Keys Are Configured:

audit_check_configured

Apply the following configuration to ensure GPG Keys Are Configured:

remediate_configured

This recommendation verifies that Zypper Repositories Are Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Zypper Repositories Are Configured:

audit_check_configured

Apply the following configuration to ensure Zypper Repositories Are Configured:

remediate_configured

This recommendation verifies that Software Patches Are Applied on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Software Patches Are Applied:

audit_check_applied

Apply the following configuration to ensure Software Patches Are Applied:

remediate_applied

This recommendation verifies that X Window System Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that X Window System Is Not Installed:

audit_check_installed

Apply the following configuration to ensure X Window System Is Not Installed:

remediate_installed

This recommendation verifies that Avahi Server Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Avahi Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure Avahi Server Is Not Installed:

remediate_installed

This recommendation verifies that CUPS Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that CUPS Is Not Installed:

audit_check_installed

Apply the following configuration to ensure CUPS Is Not Installed:

remediate_installed

This recommendation verifies that DHCP Server Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DHCP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure DHCP Server Is Not Installed:

remediate_installed

This recommendation verifies that DNS Server Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DNS Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure DNS Server Is Not Installed:

remediate_installed

This recommendation verifies that FTP Server Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that FTP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure FTP Server Is Not Installed:

remediate_installed

This recommendation verifies that HTTP Server Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that HTTP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure HTTP Server Is Not Installed:

remediate_installed

This recommendation verifies that Samba Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Samba Is Not Installed:

audit_check_installed

Apply the following configuration to ensure Samba Is Not Installed:

remediate_installed

This recommendation verifies that NIS Client Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that NIS Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure NIS Client Is Not Installed:

remediate_installed

This recommendation verifies that rsh Client Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that rsh Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure rsh Client Is Not Installed:

remediate_installed

This recommendation verifies that telnet Client Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that telnet Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure telnet Client Is Not Installed:

remediate_installed

This recommendation verifies that LDAP Client Is Not Installed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that LDAP Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure LDAP Client Is Not Installed:

remediate_installed

This recommendation verifies that IP Forwarding Is Disabled on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that IP Forwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure IP Forwarding Is Disabled:

remediate_disabled

This recommendation verifies that Packet Redirect Sending Is Disabled on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Packet Redirect Sending Is Disabled:

audit_check_disabled

Apply the following configuration to ensure Packet Redirect Sending Is Disabled:

remediate_disabled

This recommendation verifies that Source Routed Packets Are Not Accepted on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Source Routed Packets Are Not Accepted:

audit_check_accepted

Apply the following configuration to ensure Source Routed Packets Are Not Accepted:

remediate_accepted

This recommendation verifies that ICMP Redirects Are Not Accepted on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that ICMP Redirects Are Not Accepted:

audit_check_accepted

Apply the following configuration to ensure ICMP Redirects Are Not Accepted:

remediate_accepted

This recommendation verifies that Broadcast ICMP Requests Are Ignored on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Broadcast ICMP Requests Are Ignored:

audit_check_ignored

Apply the following configuration to ensure Broadcast ICMP Requests Are Ignored:

remediate_ignored

This recommendation verifies that firewalld Is Installed and Running on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that firewalld Is Installed and Running:

audit_check_running

Apply the following configuration to ensure firewalld Is Installed and Running:

remediate_running

This recommendation verifies that Default Zone Is Set on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Default Zone Is Set:

audit_check_set

Apply the following configuration to ensure Default Zone Is Set:

remediate_set

This recommendation verifies that Unnecessary Services Are Removed on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Unnecessary Services Are Removed:

audit_check_removed

Apply the following configuration to ensure Unnecessary Services Are Removed:

remediate_removed

This recommendation verifies that nftables Base Chains Exist on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nftables Base Chains Exist:

audit_check_exist

Apply the following configuration to ensure nftables Base Chains Exist:

remediate_exist

This recommendation verifies that rsyslog Is Installed and Enabled on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Is Installed and Enabled:

audit_check_enabled

Apply the following configuration to ensure rsyslog Is Installed and Enabled:

remediate_enabled

This recommendation verifies that Logging Is Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Logging Is Configured:

audit_check_configured

Apply the following configuration to ensure Logging Is Configured:

remediate_configured

This recommendation verifies that rsyslog Default File Permissions Are Set on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Default File Permissions Are Set:

audit_check_set

Apply the following configuration to ensure rsyslog Default File Permissions Are Set:

remediate_set

This recommendation verifies that Remote Log Host Is Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Remote Log Host Is Configured:

audit_check_configured

Apply the following configuration to ensure Remote Log Host Is Configured:

remediate_configured

This recommendation verifies that auditd Is Installed and Enabled on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that auditd Is Installed and Enabled:

audit_check_enabled

Apply the following configuration to ensure auditd Is Installed and Enabled:

remediate_enabled

This recommendation verifies that Audit Log Storage Size Is Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Log Storage Size Is Configured:

audit_check_configured

Apply the following configuration to ensure Audit Log Storage Size Is Configured:

remediate_configured

This recommendation verifies that System Is Disabled When Audit Logs Are Full on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that System Is Disabled When Audit Logs Are Full:

audit_check_full

Apply the following configuration to ensure System Is Disabled When Audit Logs Are Full:

remediate_full

This recommendation verifies that Audit Logs Are Not Automatically Deleted on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Logs Are Not Automatically Deleted:

audit_check_deleted

Apply the following configuration to ensure Audit Logs Are Not Automatically Deleted:

remediate_deleted

This recommendation verifies that Events That Modify Date and Time Are Collected on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Events That Modify Date and Time Are Collected:

audit_check_collected

Apply the following configuration to ensure Events That Modify Date and Time Are Collected:

remediate_collected

This recommendation verifies that Events That Modify User/Group Information Are Collected on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Events That Modify User/Group Information Are Collected:

audit_check_collected

Apply the following configuration to ensure Events That Modify User/Group Information Are Collected:

remediate_collected

This recommendation verifies that SSH Root Login Is Disabled on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH Root Login Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH Root Login Is Disabled:

remediate_disabled

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH PermitEmptyPasswords Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH PermitEmptyPasswords Is Disabled:

remediate_disabled

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH MaxAuthTries Is Set to 4 or Less:

audit_check_less

Apply the following configuration to ensure SSH MaxAuthTries Is Set to 4 or Less:

remediate_less

This recommendation verifies that SSH Idle Timeout Is Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH Idle Timeout Is Configured:

audit_check_configured

Apply the following configuration to ensure SSH Idle Timeout Is Configured:

remediate_configured

This recommendation verifies that SSH X11 Forwarding Is Disabled on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH X11 Forwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH X11 Forwarding Is Disabled:

remediate_disabled

This recommendation verifies that SSH AllowTcpForwarding Is Disabled on the SUSE Linux Enterprise 15 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SUSE Linux Enterprise 15 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH AllowTcpForwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH AllowTcpForwarding Is Disabled:

remediate_disabled

This recommendation verifies that Password Quality Requirements Are Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Quality Requirements Are Configured:

audit_check_configured

Apply the following configuration to ensure Password Quality Requirements Are Configured:

remediate_configured

This recommendation verifies that Password Hashing Algorithm Is SHA-512 on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Hashing Algorithm Is SHA-512:

audit_check_sha-512

Apply the following configuration to ensure Password Hashing Algorithm Is SHA-512:

remediate_sha-512

This setting ensures that Password Reuse Is Limited on the SUSE Linux Enterprise 15 server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SUSE Linux Enterprise 15 server is essential for defense in depth.

Run the following command and verify that Password Reuse Is Limited:

audit_check_limited

Apply the following configuration to ensure Password Reuse Is Limited:

remediate_limited

This recommendation verifies that Account Lockout Policy Is Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Account Lockout Policy Is Configured:

audit_check_configured

Apply the following configuration to ensure Account Lockout Policy Is Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/passwd Are Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/passwd Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/passwd Are Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/shadow Are Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/shadow Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/shadow Are Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/group Are Configured on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/group Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/group Are Configured:

remediate_configured

This recommendation verifies that No World-Writable Files Exist on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No World-Writable Files Exist:

audit_check_exist

Apply the following configuration to ensure No World-Writable Files Exist:

remediate_exist

This recommendation verifies that root Is the Only UID 0 Account on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that root Is the Only UID 0 Account:

audit_check_account

Apply the following configuration to ensure root Is the Only UID 0 Account:

remediate_account

This recommendation verifies that No Legacy Entries Exist in /etc/passwd on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Legacy Entries Exist in /etc/passwd:

audit_check_/etc/passwd

Apply the following configuration to ensure No Legacy Entries Exist in /etc/passwd:

remediate_/etc/passwd

This recommendation verifies that All Users Have a Valid Home Directory on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that All Users Have a Valid Home Directory:

audit_check_directory

Apply the following configuration to ensure All Users Have a Valid Home Directory:

remediate_directory

This recommendation verifies that No Duplicate UIDs Exist on the SUSE Linux Enterprise 15 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SUSE Linux Enterprise 15 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Duplicate UIDs Exist:

audit_check_exist

Apply the following configuration to ensure No Duplicate UIDs Exist:

remediate_exist