Skybox Appliance 7000 Quick Start Guide
Skybox version 11.7.100
64
RECOMMENDATION
SCORED
DESCRIPTION
1.4.2
ü
Ensure that the bootloader password is set. Setting the
boot loader password requires that anyone rebooting the
system must enter a password before being able to set
command line boot parameters
Rationale: Requiring a boot password on execution of the
boot loader prevents an unauthorized user from entering
boot parameters or changing the boot partition. This
prevents users from weakening security (for example,
turning off SELinux at boot time).
1.5.1
ü
Ensure that core dumps are restricted. A core dump is the
memory of an executable program. It is generally used to
determine why a program aborted. It can also be used to
glean confidential information from a core file. The system
provides the ability to set a soft limit for core dumps, but
this can be overridden by the user.
Rationale: Setting a hard limit on core dumps prevents
users from overriding the soft variable. If core dumps are
required, consider setting limits for user groups. In
addition, setting the
fs.suid_dumpable
variable to
0
prevents
setuid
programs from dumping core.
1.6.1.5
ü
Ensure that the MCS Translation Service (
mcstrans
) is
not installed. The
mcstransd
daemon provides category
label information to client processes requesting
information. The label translations are defined in
/etc/selinux/targeted/setrans.conf
Rationale: Because this service is not used very often,
remove it to reduce the amount of potentially vulnerable
code running on the system.
1.7.1.3
ü
Ensure that the remote login warning banner is configured
properly. The content of the
/etc/issue.net
file is
displayed to users prior to login for remote connections
from configured services.
Unix-based systems have typically displayed information
about the OS release and patch level when a user logs in
to the system. This information can be useful to developers
who are developing software for a particular OS platform. If
mingetty(8)
supports the following options, they display
operating system information:
l
\m
: Machine architecture (
uname -m
)
l
\r
: Operating system release (
uname -r
)
l
\s
: Operating system name
l
\v
: Operating system version (
uname -v
)
Rationale: Warning messages inform users who are
attempting to log in to the system of their legal status
regarding the system and must include the name of the
organization that owns the system and any monitoring
policies that are in place. Displaying OS and patch level
information in login banners also has the side effect of
providing detailed system information to attackers
