Chapter 17
CIS benchmarks for CentOS 7
Skybox version 11.7.100
67
RECOMMENDATION
SCORED
DESCRIPTION
changes in scope. The file
/etc/sudoers
is written to
when the file or its attributes have changed. The audit
records are tagged with the identifier ‘scope’.
Rationale: Changes in the
/etc/sudoers
file can
indicate that an unauthorized change has been made to
scope of system administrator activity.
4.2.2.3
ü
Ensure that
syslog-ng
default file permissions are
configured.
syslog-ng
creates log files that do not
already exist on the system. This setting controls the
permissions that are applied to these newly created files.
Rationale: It is important to ensure that log files exist and
have the correct permissions to ensure that sensitive
syslog-ng data is archived and protected.
5.1.1 – 5.1.7
ü
Configuration of
cron
:
l
Ensure that the
cron
daemon is enabled
l
Ensure that permissions on
/etc/crontab
are
configured
l
Ensure that permissions on
/etc/cron.hourly
are
configured
l
Ensure that permissions on
/etc/cron.daily
are
configured
l
Ensure that permissions on
/etc/cron.weekly
are
configured
l
Ensure that permissions on
/etc/cron.monthly
are
configured
l
Ensure that permissions on
/etc/cron.d
are
configured
Rationale: Granting write access to these directories for
non-privileged users could provide them the means for
gaining unauthorized elevated privileges. Granting read
access to these directories could give an unprivileged user
insight in how to gain elevated privileges or circumvent
auditing controls.
5.2.5
ü
Ensure that SSH
MaxAuthTries
is set to 4 or less. The
MaxAuthTries
parameter specifies the maximum
number of authentication attempts permitted per
connection. When the login failure count reaches half the
number, error messages are written to the
syslog
file
detailing the login failure.
Rationale: Setting the
MaxAuthTries
parameter to a low
number minimizes the risk of successful brute force
attacks to the SSH server.
5.2.6
ü
Ensure that SSH
IgnoreRhosts
is enabled. The
IgnoreRhosts
parameter specifies that
.rhosts
and
.shosts
files are not used in
RhostsRSAAuthentication
or
HostbasedAuthentication
.
Rationale: Setting this parameter forces users to enter a
