Missing from SSG (195/634) or roughly 31% remaining to meet milestone 1 Section numbers are from the NSA Guidance Installing and Maintaining Software (9) 2.1.1.2 Boot Loader Configuration - This check is duplicated 2.1.1.3 Network devices 2.1.1.4 Root P/w complexity 2.1.1.5 Software Packages 2.1.1.6 First Boot Config 2.1.2.1 Configure Connection to the RHN RPM Repositories 2.1.2.3.2 Configure Automatic Update Retrieval and Installation with Cron 2.1.3.1.2 Customize Configuration File 2.1.3.1.5 Manually Verify Integrity of AIDE File Permissions and Masks (4) 2.2.2.1 Restrict Console Device Access 2.2.2.4 Disable GNOME Automounting if Possible 2.2.4.4.3 Enable NX or XD Support in the BIOS 2.2.4.5 Configure Prelink Account and Access Control (12) 2.3.1.2 Limit su Access to the Root Account 2.3.1.3 Configure sudo to Improve Auditing of Root Access 2.3.1.7.1 Remove Password Parameters from libuser.conf 2.3.1.9 Set Accounts to Disable After Password Expiration 2.3.2.1 Create a Unique Default Group for Each User 2.3.2.2 Create and Maintain a Group Containing All Human Users 2.3.3.4 Restrict Execution of userhelper to Console Users 2.3.3.7 Remove the pam ccreds Package if Possible 2.3.4.3 Ensure that User Dot-Files are not World-writable 2.3.4.5 Ensure that Users do not Have .netrc Files 2.3.5.1 Set BIOS Password (this section is referenced elsewhere) 2.3.5.5 Implement Inactivity Time-out for Login Shells SELinux (3) 2.4.1.3. Set Password Expiration Parameters - Numbers aren't aligned, 180 day expirations? 2.4.3.1 Disable and Remove SETroubleshoot if Possible 2.4.3.2 Disable MCS Translation Service (mcstrans) if Possible Network Configuration and Firewalls (18) 2.5.1.3 Ensure System is Not Acting as a Network Sniffer 2.5.2.1 Remove Wireless Hardware if Possible 2.5.2.2.1 Disable Wireless in BIOS 2.5.2.2.3 Disable Wireless Drivers 2.5.3.1.1 Disable Automatic Loading of IPv6 Kernel Module - This is depreciated 2.5.3.1.2 Disable Interface Usage of IPv6 2.5.3.2.2 Manually Assign Global IPv6 Address 2.5.3.2.3 Use Privacy Extensions for Address if Necessary 2.5.3.2.4 Manually Assign IPv6 Router Address 2.5.3.2.5 Limit Network-Transmitted Configuration 2.5.4.2 Reject All Connections From Other Hosts if Appropriate 2.5.4.3 Allow Connections Only From Hosts in This Domain if Appropriate 2.5.4.4 Monitor Syslog for Relevant Connections and Failures 2.5.5.3.2 Restrict ICMP Message Types 2.5.5.3.3 Remove IPsec Rules 2.5.5.3.4 Log and Drop Packets with Suspicious Source Addresses 2.5.5.3.5 Log and Drop All Other Packets 2.5.6 Secure Sockets Layer Support - This section only has a placeholder in the current SSG Logging and Auditing (6) 2.6.1.2.3 Ensure Important Messages are Captured 2.6.1.4.2 Configure Logwatch on the Central Log Server 2.6.1.4.3 Disable Logwatch on Clients if a Logserver Exists 2.6.2.2 Configure auditd Data Retention 2.6.2.4.5 Record Attempts to Alter Logon and Logout Events 2.6.2.4.6 Record Attempts to Alter Process and Session Initiation Information Base Services (20) 3.2.6 Talk - This section is non-existant 3.3.1 Installation Helper Service (firstboot) 3.3.2 Console Mouse Service (gpm) 3.3.4 ISDN Support (isdn) 3.3.4.1 Remove the isdn4k-utils Package if Possible 3.3.6 Kudzu Hardware Probing Utility (kudzu) 3.3.8 IA32 Microcode Utility (microcode ctl) 3.3.9.1 Disable All Networking if Not Needed - This is such a rare case it should be dropped 3.3.9.2 Disable All External Network Interfaces if Not Needed 3.3.9.3 Disable Zeroconf Networking 3.3.10 Smart Card Support (pcscd) 3.3.12 Boot Caching (readahead early/readahead later) 3.3.14.1 Bluetooth Host Controller Interface Daemon (bluetooth) 3.3.14.2 Bluetooth Input Devices (hidd) 3.3.14.3 Disable Bluetooth Kernel Modules 3.3.15.1 Advanced Power Management Subsystem (apmd) 3.3.16.1 Disable the irda Service if Possible 3.3.16.2 Remove the irda-utils Package if Possible 3.3.17.1 Disable the Raw Devices Daemon if Possible 3.4.2 Restrict Permissions on Files Used by cron SSH (3) 3.5.1.2 Remove SSH Server iptables Firewall Exception 3.5.2.2 Limit Users’ SSH Access 3.5.2.11 Strengthen Firewall Configuration if Possible X Window System (1) 3.6.1.3.1 Disable X Font Server Avahi (1) 3.7.1.2 Remove Avahi Server iptables Firewall Exception DHCP (6) 3.9.2.1 Minimize the DHCP-Configured Options 3.9.4.1 Do Not Use Dynamic DNS 3.9.4.2 Deny Decline Messages 3.9.4.3 Deny BOOTP Queries 3.9.4.4 Minimize Served Information 3.9.4.5 Configure Logging NTP (5) 3.10.2.1 Configure an NTP Client 3.10.2.1.1 Set Up Client NTP Configuration File 3.10.2.1.2 Run ntpd using Cron 3.10.2.2.2 Deny All Access to ntpd by Default 3.10.2.2.4 Allow Legitimate NTP Clients to Access the Server LDAP (2) 3.12.2.1 Configure the Appropriate LDAP Parameters for the Domain 3.12.2.3 Configure Authentication Services to Use OpenLDAP NFS (9) 3.13.2.1 Make Each Machine a Client or a Server, not Both 3.13.2.2 Restrict Access to the Portmapper 3.13.2.3 Configure NFS Services to Use Fixed Ports 3.13.4.1 Configure the Exports File Restrictively 3.13.4.1.1 Use Access Lists to Enforce Authorization Restrictions on Mounts 3.13.4.1.2 Use Root-Squashing on All Exports 3.13.4.1.3 Restrict NFS Clients to Privileged Ports 3.13.4.1.4 Export Filesystems Read-Only if Possible 3.13.4.2 Allow Legitimate NFS Clients to Access the Server DNS (9) 3.14.3.1 Run DNS Software on Dedicated Servers if Possible 3.14.3.2 Run DNS Software in a chroot Jail 3.14.3.3 Configure Firewalls to Protect the DNS Server 3.14.4 Protect DNS Data from Tampering or Attack 3.14.4.1 Run Separate DNS Servers for External and Internal Queries if Possible 3.14.4.2 Use Views to Partition External and Internal Information if Necessary 3.14.4.3 Disable Zone Transfers from the Nameserver if Possible 3.14.4.4 Authenticate Zone Transfers if Necessary 3.14.4.5 Disable Dynamic Updates if Possible FTP (10) 3.15.2 Use vsftpd to Provide FTP Service if Necessary 3.15.3 Configure vsftpd Securely 3.15.3.1 Enable Logging of All FTP Transactions 3.15.3.2 Create Warning Banners for All FTP Users 3.15.3.3 Restrict the Set of Users Allowed to Access FTP 3.15.3.3.1 Restrict Access to Anonymous Users if Possible 3.15.3.3.2 Limit Users Allowed FTP Access if Necessary 3.15.3.4 Disable FTP Uploads if Possible 3.15.3.5 Place the FTP Home Directory on its Own Partition 3.15.3.6 Configure Firewalls to Protect the FTP Server Web Server (44) 3.16.2 Install Apache if Necessary 3.16.2.1 Install Apache Software Safely 3.16.2.2 Confirm Minimal Built-in Modules 3.16.3 Secure the Apache Configuration 3.16.3.1 Restrict Information Leakage 3.16.3.2 Minimize Loadable Modules 3.16.3.2.1 Apache Core Modules 3.16.3.2.2 HTTP Basic Authentication 3.16.3.2.3 HTTP Digest Authentication 3.16.3.2.4 mod rewrite 3.16.3.2.5 LDAP Support 3.16.3.2.6 Server Side Includes 3.16.3.2.7 MIME Magic 3.16.3.2.8 WebDAV (Distributed Authoring and Versioning) 3.16.3.2.9 Server Activity Status 3.16.3.2.10 Web Server Configuration Display 3.16.3.2.11 URL Correction on Misspelled Entries 3.16.3.2.12 User-specific directories 3.16.3.2.13 Proxy Support 3.16.3.2.14 Cache Support 3.16.3.2.15 CGI Support (and Related Modules) 3.16.3.2.16 Various Optional Components 3.16.3.3 Minimize Configuration Files Included 3.16.3.4 Directory Restrictions 3.16.3.4.1 Restrict Root Directory 3.16.3.4.2 Restrict Web Directory 3.16.3.4.3 Restrict Other Critical Directories 3.16.3.5 Configure Authentication if Applicable 3.16.3.6 Limit Available Methods 3.16.4 Use Appropriate Modules to Improve Apache’s Security 3.16.4.1 Deploy mod ssl 3.16.4.1.1 Install mod ssl 3.16.4.1.2 Create an SSL Certificate 3.16.4.1.3 Install SSL Certificate 3.16.4.2 Deploy mod security 3.16.4.2.1 Install mod security 3.16.4.2.2 Configure mod security Filtering 3.16.4.3 Use Denial-of-Service Protection Modules 3.16.4.4 Configure Supplemental Modules Appropriately 3.16.4.4.1 Configure PHP Securely 3.16.5 Configure Operating System to Protect Web Server 3.16.5.1 Restrict File and Directory Access 3.16.5.2 Configure iptables to Allow Access to the Web Server 3.16.5.3 Run Apache in a chroot Jail if Possible IMAP and POP3 Server (8) 3.17.2.1 Support Only the Necessary Protocols 3.17.2.2 Enable SSL Support 3.17.2.2.1 Create an SSL Certificate 3.17.2.2.2 Install the SSL Certificate 3.17.2.2.3 Configure Dovecot to Use the SSL Certificate 3.17.2.2.4 Disable Plaintext Authentication 3.17.2.3 Enable Dovecot Options to Protect Against Code Flaws 3.17.2.4 Allow IMAP Clients to Access the Server Samba (12) 3.18.2.2.1 Use user Security for Servers Not in a Domain Context 3.18.2.2.2 Use domain Security for Servers in a Domain Context 3.18.2.2.3 Use ads (Active Directory Service) Security For Servers in an ADS Domain Context 3.18.2.3 Disable Guest Access and Local Login Support 3.18.2.4 Disable Root Access 3.18.2.5 Set the Allowed Authentication Negotiation Levels 3.18.2.6 Let Domain Controllers Create Machine Trust Accounts On-the-Fly 3.18.2.7 Restrict Access to the [IPC$] Share 3.18.2.8 Restrict File Sharing 3.18.2.12 Restrict Printer Sharing 3.18.2.13 Configure iptables to Allow Access to the Samba Server 3.18.3 Avoid the Samba Web Administration Tool (SWAT) Proxy (12) 3.19.2 Configure Squid if Necessary 3.19.2.1 Listen on Uncommon Port 3.19.2.2 Verify Default Secure Settings 3.19.2.3 Change Default Insecure Settings 3.19.2.4 Configure Authentication if Applicable 3.19.2.5 Access Control Lists (ACL) 3.19.2.6 Configure Internet Cache Protocol (ICP) if Necessary 3.19.2.7 Configure iptables to Allow Access to the Proxy Server 3.19.2.8 Forward Log Messages to Syslog Daemon 3.19.2.9 Do Not Run as Root 3.19.2.9.1 Run Squid in a chroot Jail 3.19.2.9.2 Modify Service Entry to Lower Privileges SNMP (1) 3.20.2 Configure SNMP Server if Necessary