Chapter 17 CIS benchmarks for CentOS 7
Skybox version 10.1.200
65
Recommend
ation
Scored Description
•
AllowGroups: The
AllowGroups
variable gives the system
administrator the option of permitting specific groups of
users to SSH into the system. The list consists of space
separated group names. Numeric group IDs are not
recognized with this variable.
Rationale: Restricting the users who can remotely access the
system via SSH helps ensure that only authorized users
access the system.
5.2.16
Ensure that the SSH warning banner is configured. The
Banner
parameter specifies a file whose contents must be sent
to the remote user before authentication is permitted. By
default, no banner is displayed.
Rationale: Banners are used to warn connecting users of the
particular site’s policy regarding connection. Presenting a
warning message prior to the normal user login may assist the
prosecution of trespassers on the computer system.
5.3.1
Ensure that password creation requirements are configured.
The
pam_pwquality.so
module checks the strength of
passwords. It performs checks including making sure that a
password:
•
Is not a dictionary word
•
Is a certain length
•
Contains a mix of characters (for example, alphabet,
numeric, other)
•
And more
The following options are set in the
/etc/security/pwquality.conf
file:
•
minlen=14
: Password must be at least 14 characters
•
dcredit=-1
: Provide at least one digit
•
ucredit=-1
: Provide at least one uppercase character
•
ocredit=-1
: Provide at least one special character
•
lcredit=-1
: Provide at least one lowercase character
Note: The values shown are sample values.
Rationale: Strong passwords protect systems from being
hacked through brute force methods.
5.4.4
Ensure that the default user
umask
is
027
or more restrictive.
The default umask determines the permissions of files created
by users. The user creating the file has the discretion of
making their files and directories readable by others via the
chmod
command. Users who wish to permit their files and
directories to be readable by others by default may choose a
different default umask by inserting the
umask
command into
the standard shell configuration files (
.profile
,
.bashrc
, and
so on) in their home directories.
Rationale: Setting a very secure default value for
umask
ensures that users make a conscious choice about their file
permissions. A default
umask
setting of
077
causes files and
directories created by users to not be readable by any other
user on the system. A
umask
of
027
would make files and
directories readable by users in the same Unix group; a
umask
of
022
would make files readable by every user on the system.
