Skybox version 10.1.200
60
Chapter 17
Starting from version 9.0.800, all new Skybox Appliances meet the following CIS
benchmark recommendations for CentOS 7. Appliances updated to the new ISO
also meet the recommendations.
Recommend
ation
Scored Description
1.1.1.1 –
1.1.1.8
Ensure that mounting of the following file systems is disabled:
•
cramfs
•
freevxfs
•
JFFS2
•
HFS
•
HFS+
•
SquashFS
•
UDF
•
FAT
Rationale: Removing support for unneeded file system types
reduces the local attack surface of the system. If this file
system type is not needed, disable it.
1.3.1
Ensure that AIDE is installed. AIDE takes a snapshot of the file
system state including modification times, permissions, and
file hashes, which can then be used to compare against the
current state of the file system to detect modifications to the
system.
Rationale: By monitoring the file system state, compromised
files can be detected to prevent or limit the exposure of
accidental or malicious misconfigurations or modified binaries.
1.3.2
Ensure that file system integrity is regularly checked. Periodic
checking of the file system integrity is needed to detect
changes to the file system.
Rationale: Periodic file checking enables the system
administrator to determine on a regular basis if critical files
have been changed in an unauthorized fashion.
1.4.1
Ensure that permissions on bootloader config are configured.
The
grub
configuration file contains information about boot
settings and passwords for unlocking boot options. The
grub
configuration is usually located at
/boot/grub2/grub.cfg
and
linked as
/etc/grub2.conf
Rationale: Setting the permissions to read and write for root
only prevents non-root users from seeing the boot parameters
or changing them. Non-root users who read the boot
parameters may be able to identify weaknesses in boot
security and be able to exploit them.
1.4.2
Ensure that the bootloader password is set. Setting the boot
loader password requires that anyone rebooting the system
must enter a password before being able to set command line
CIS benchmarks for CentOS 7