Skybox version 11.7.100
63
Chapter 17
CIS benchmarks for CentOS 7
All new Skybox Appliances meet the following CIS benchmark recommendations for CentOS
7. Appliances updated to the new ISO also meet the recommendations.
RECOMMENDATION
SCORED
DESCRIPTION
1.1.1.1 – 1.1.1.8
ü
Ensure that mounting of the following file systems is
disabled:
l
cramfs
l
freevxfs
l
JFFS2
l
HFS
l
HFS+
l
SquashFS
l
UDF
l
FAT
Rationale: Removing support for unneeded file system
types reduces the local attack surface of the system. If this
file system type is not needed, disable it.
1.3.1
ü
Ensure that AIDE is installed. AIDE takes a snapshot of the
file system state including modification times, permissions,
and file hashes, which can then be used to compare
against the current state of the file system to detect
modifications to the system.
Rationale: By monitoring the file system state,
compromised files can be detected to prevent or limit the
exposure of accidental or malicious misconfigurations or
modified binaries.
1.3.2
ü
Ensure that file system integrity is regularly checked.
Periodic checking of the file system integrity is needed to
detect changes to the file system.
Rationale: Periodic file checking enables the system
administrator to determine on a regular basis if critical files
have been changed in an unauthorized fashion.
1.4.1
ü
Ensure that permissions on bootloader config are
configured. The
grub
configuration file contains
information about boot settings and passwords for
unlocking boot options. The
grub
configuration is usually
located at
/boot/grub2/grub.cfg
and linked as
/etc/grub2.conf
Rationale: Setting the permissions to read and write for
root only prevents non-root users from seeing the boot
parameters or changing them. Non-root users who read
the boot parameters may be able to identify weaknesses in
boot security and be able to exploit them.
