Skybox Appliance 8000 Quick Start Guide
Skybox version 10.1.200
64
Recommend
ation
Scored Description
•
Ensure that permissions on
/etc/crontab
are configured
•
Ensure that permissions on
/etc/cron.hourly
are
configured
•
Ensure that permissions on
/etc/cron.daily
are
configured
•
Ensure that permissions on
/etc/cron.weekly
are
configured
•
Ensure that permissions on
/etc/cron.monthly
are
configured
•
Ensure that permissions on
/etc/cron.d
are configured
Rationale: Granting write access to these directories for non-
privileged users could provide them the means for gaining
unauthorized elevated privileges. Granting read access to
these directories could give an unprivileged user insight in
how to gain elevated privileges or circumvent auditing
controls.
5.2.5
Ensure that SSH
MaxAuthTries
is set to 4 or less. The
MaxAuthTries
parameter specifies the maximum number of
authentication attempts permitted per connection. When the
login failure count reaches half the number, error messages
are written to the
syslog
file detailing the login failure.
Rationale: Setting the
MaxAuthTries
parameter to a low
number minimizes the risk of successful brute force attacks to
the SSH server.
5.2.6
Ensure that SSH
IgnoreRhosts
is enabled. The
IgnoreRhosts
parameter specifies that
.rhosts
and
.shosts
files are not
used in
RhostsRSAAuthentication
or
HostbasedAuthentication
.
Rationale: Setting this parameter forces users to enter a
password when authenticating with SSH.
5.2.7
Ensure that SSH
HostbasedAuthentication
is disabled. The
HostbasedAuthentication
parameter specifies whether
authentication is permitted through trusted hosts via the user
of
.rhosts
, or
/etc/hosts.equiv
, along with successful
public key client host authentication. This option only applies
to SSH Protocol Version 2.
Rationale: Even though the
.rhosts
files are ineffective if
support is disabled in
/etc/pam.conf
, disabling the ability to
use
.rhosts
files in SSH provides an additional layer of
protection.
5.2.15
Ensure that SSH access is limited. There are several options
available to limit the users and groups that can access the
system via SSH.
•
AllowUsers: The
AllowUsers
variable gives the system
administrator the option of permitting specific users to SSH
into the system. The list consists of space-separated user
names. Numeric user IDs are not recognized with this
variable. If a system administrator wants to restrict user
access further by only permitting these users to log in from
a particular host, the entry can be specified in the form of
user@host
.
