Chapter 17 CIS benchmarks for CentOS 7
Skybox version 10.1.200
61
Recommend
ation
Scored Description
boot parameters
Rationale: Requiring a boot password on execution of the boot
loader prevents an unauthorized user from entering boot
parameters or changing the boot partition. This prevents users
from weakening security (for example, turning off SELinux at
boot time).
1.5.1
Ensure that core dumps are restricted. A core dump is the
memory of an executable program. It is generally used to
determine why a program aborted. It can also be used to
glean confidential information from a core file. The system
provides the ability to set a soft limit for core dumps, but this
can be overridden by the user.
Rationale: Setting a hard limit on core dumps prevents users
from overriding the soft variable. If core dumps are required,
consider setting limits for user groups. In addition, setting the
fs.suid_dumpable
variable to
0
prevents
setuid
programs
from dumping core.
1.6.1.5
Ensure that the MCS Translation Service (
mcstrans
) is not
installed. The
mcstransd
daemon provides category label
information to client processes requesting information. The
label translations are defined in
/etc/selinux/targeted/setrans.conf
Rationale: Since this service is not used very often, remove it
to reduce the amount of potentially vulnerable code running
on the system.
1.7.1.3
Ensure that the remote login warning banner is configured
properly. The content of the
/etc/issue.net
file is displayed
to users prior to login for remote connections from configured
services.
Unix-based systems have typically displayed information
about the OS release and patch level when a user logs in to
the system. This information can be useful to developers who
are developing software for a particular OS platform. If
mingetty(8)
supports the following options, they display
operating system information:
•
\m
: Machine architecture (
uname -m
)
•
\r
: Operating system release (
uname -r
)
•
\s
: Operating system name
•
\v
: Operating system version (
uname -v
)
Rationale: Warning messages inform users who are
attempting to log in to the system of their legal status
regarding the system and must include the name of the
organization that owns the system and any monitoring policies
that are in place. Displaying OS and patch level information in
login banners also has the side effect of providing detailed
system information to attackers attempting to target specific
exploits of a system. Authorized users can get this information
by running
uname -a
after they log in.
3.1.2
Ensure that packet redirect sending is disabled
Rationale: An attacker could use a compromised host to send
invalid ICMP redirects to other router devices in an attempt to
