# # This script is Copyright (C) 2004-2021 and is owned by Tenable, Inc. or an Affiliate thereof. # # This script is released under the Tenable Subscription License and # may not be used from within scripts released under another license # without authorization from Tenable, Inc. # # See the following licenses for details: # # http://static.tenable.com/prod_docs/Nessus_6_SLA_and_Subscription_Agreement.pdf # # @PROFESSIONALFEED@ # $Revision: 1.4 $ # $Date: 2021/06/17 $ # # Description : This document implements the security configuration as recommended by the # CIS Oracle Solaris 11.4 Benchmark v1.0.0 # # #CIS Oracle Solaris 11.4 L1 v1.0.0 # # CIS # Oracle Solaris 11.4 L1 # 1.0.0 # https://workbench.cisecurity.org/files/2582 # #unix,cis,solaris,solaris_11,solaris_11.4 #LEVEL,CSCv7,CIS_Recommendation # # # BANNER_TEXT # All activities performed on this system will be monitored. # Banner Text # This is the text for the warning a user receives when logging onto the system. # # # PKG_CMD_TIMEOUT # 900 # pkg timeout (secs) # The pkg command can run quite long. # # # HOSTS_ALLOW_NETWORK # 192.168.1.0/255.255.255.0 # Hosts.allow network # The IP address and network mask allowed access to the system as it appears in hosts.allow. If all systems are allowed use 'ALL'. # # # CIS_AUDIT_CLASS # cis # CIS audit class name # The audit class name for the CIS specific auditing. # # # PASSLENGTH # (1[4-9]|[2-9][0-9]) # Password length # The default value listed is range 14-99 # # # NAMECHECK # YES # Checking of the login name # The default value listed is YES # # # HISTORY # (1[4-9]|[2-9][0-9]) # Password reuse history # The default value listed is range 10-99 # # # MINDIFF # ([3-9]|[1-9][0-9]) # Password minimum character differences # The default value listed is range 3-99 # # # MINUPPER # ([1-9]|[1-9][0-9]) # Password minimum upper characters # The default value listed is range 1-99 # # # MINLOWER # ([1-9]|[1-9][0-9]) # Password minimum lower characters # The default value listed is range 1-99 # # # MINSPECIAL # ([1-9]|[1-9][0-9]) # Password minimum special characters # The default value listed is range 1-99 # # # MINDIGIT # ([1-9]|[1-9][0-9]) # Password minimum digit characters # The default value listed is range 1-99 # # # MAXREPEATS # ([1-9]|[1-9][0-9]) # Password maximum repeating characters # The default value listed is range 1-99 # # # WHITESPACE # YES # Password whitespace characters allowed # The default value listed is YES # # # DICTIONDBDIR # /var/passwd # Generated dictionary database location # The directory where the generated dictionary databases reside. Defaults to /var/passwd. # # # DICTIONLIST # /usr/share/lib/dict/words # Dictionary list for password comparison # The words from these files are used to determine if a password is based on a dictionary word. # # # type : FILE_CONTENT_CHECK description : "Solaris 11.4 is installed" file : "/etc/release" regex : "^[\\s]+Oracle[\\s]+Solaris[\\s]" expect : "^[\\s]+Oracle[\\s]+Solaris[\\s]+11\\.4" description : "CIS_Oracle_Solaris_11.4_L1_v1.0.0.audit from CIS Oracle Solaris 11.4 Benchmark v1.0.0" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : CMD_EXEC description : "1.1 Use the Latest Package Updates" info : "The Solaris 11 OS should be periodically updated to install or upgrade software packages that will enhance the security, reliability, and performance of the system. Rationale: For the Solaris 11 OS, there will be no more software patches issued, but rather security and other improvements will be installed by updating one or more software packages." solution : "Run the following command to refresh the package catalog, download and apply any available updates: # pkg update" reference : "800-171|3.14.1,800-53|SI-2c.,CIS_Recommendation|1.1,CN-L3|8.1.4.4(e),CN-L3|8.1.10.5(a),CN-L3|8.1.10.5(b),CN-L3|8.5.4.1(b),CN-L3|8.5.4.1(d),CN-L3|8.5.4.1(e),CSCv7|3.4,CSF|ID.RA-1,CSF|PR.IP-12,ITSG-33|SI-2,LEVEL|1NS,NESA|T7.6.2,NESA|T7.7.1,NIAv2|AM38,NIAv2|AM39,NIAv2|SS14b,QCSC-v1|11.2,SWIFT-CSCv1|2.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/pkg update -n" expect : "^[\\s]*No[\\s]+updates[\\s]+available[\\s]+for[\\s]+this[\\s]+image\\.[\\s]*$" # Note: Variable @PKG_CMD_TIMEOUT@ replaced with "900" in field "timeout". timeout : "1800" system : "SunOS" type : CMD_EXEC description : "2.1 Configure TCP Wrappers - inetadm" info : "TCP Wrappers is a host-based access control system that allows administrators to control who has access to various network services based on the IP address of the remote end of the connection. TCP Wrappers also provide logging information via syslog about both successful and unsuccessful connections. Rationale: TCP Wrappers provides granular control over what services can be accessed over the network. Its logs show attempted access to services from non-authorized systems, which can help identify unauthorized access attempts." solution : "To enable TCP Wrappers, run the following commands: 1. Create and customize your policy in /etc/hosts.allow: # echo \"ALL: /, , ...\" > /etc/hosts.allow where each / combination (for example, the Class C address block \"192.168.1.0/255.255.255.0\") can represent one network block in use by your organization that requires access to this system. 2. Create a default deny policy in /etc/hosts.deny: # echo \"ALL: ALL\" >/etc/hosts.deny 3. Enable TCP Wrappers for all services started by inetd: # inetadm -M tcp_wrappers=TRUE To protect only specific inetdservices, use the command: # inetadm -m [FMRI] tcp_wrappers=TRUE where [FMRI] is the service to protect. To enable TCP Wrappers for the RPC port mapping service, use the commands: # svccfg -s rpc/bind setprop config/enable_tcpwrappers=true # svcadm refresh rpc/bind To protect UDP and RPC-based services that are spawned from inetd, consider implementing a host-based firewall. Oracle Solaris PF firewall (a.k.a. PF) has replaced Solaris IP Filter (IPF) in Solaris 11.4. See firewall(5)for more information." reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|2.1,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1NS,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/inetadm -p" expect : "^[\\s]*tcp_wrappers[\\s]*=[\\s]*[Tt][Rr][Uu][Ee]" system : "SunOS" type : FILE_CONTENT_CHECK description : "2.1 Configure TCP Wrappers - hosts.allow" info : "TCP Wrappers is a host-based access control system that allows administrators to control who has access to various network services based on the IP address of the remote end of the connection. TCP Wrappers also provide logging information via syslog about both successful and unsuccessful connections. Rationale: TCP Wrappers provides granular control over what services can be accessed over the network. Its logs show attempted access to services from non-authorized systems, which can help identify unauthorized access attempts." solution : "To enable TCP Wrappers, run the following commands: 1. Create and customize your policy in /etc/hosts.allow: # echo \"ALL: /, , ...\" > /etc/hosts.allow where each / combination (for example, the Class C address block \"192.168.1.0/255.255.255.0\") can represent one network block in use by your organization that requires access to this system. 2. Create a default deny policy in /etc/hosts.deny: # echo \"ALL: ALL\" >/etc/hosts.deny 3. Enable TCP Wrappers for all services started by inetd: # inetadm -M tcp_wrappers=TRUE To protect only specific inetdservices, use the command: # inetadm -m [FMRI] tcp_wrappers=TRUE where [FMRI] is the service to protect. To enable TCP Wrappers for the RPC port mapping service, use the commands: # svccfg -s rpc/bind setprop config/enable_tcpwrappers=true # svcadm refresh rpc/bind To protect UDP and RPC-based services that are spawned from inetd, consider implementing a host-based firewall. Oracle Solaris PF firewall (a.k.a. PF) has replaced Solaris IP Filter (IPF) in Solaris 11.4. See firewall(5)for more information." reference : "800-171|3.13.1,800-171|3.13.6,800-53|SC-7(5),CIS_Recommendation|2.1,CN-L3|7.1.2.2(c),CSCv7|9.4,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(5),LEVEL|1NS,NESA|T4.5.4,NIAv2|GS7b,NIAv2|NS25,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/hosts.allow" regex : "^[\\s]*ALL[\\s]*:" # Note: Variable @HOSTS_ALLOW_NETWORK@ replaced with "192.168.1.0/255.255.255.0" in field "expect". expect : "^[\\s]*ALL[\\s]*: 192.168.1.0/255.255.255.0" system : "SunOS" type : FILE_CONTENT_CHECK description : "2.1 Configure TCP Wrappers - hosts.deny" info : "TCP Wrappers is a host-based access control system that allows administrators to control who has access to various network services based on the IP address of the remote end of the connection. TCP Wrappers also provide logging information via syslog about both successful and unsuccessful connections. Rationale: TCP Wrappers provides granular control over what services can be accessed over the network. Its logs show attempted access to services from non-authorized systems, which can help identify unauthorized access attempts." solution : "To enable TCP Wrappers, run the following commands: 1. Create and customize your policy in /etc/hosts.allow: # echo \"ALL: /, , ...\" > /etc/hosts.allow where each / combination (for example, the Class C address block \"192.168.1.0/255.255.255.0\") can represent one network block in use by your organization that requires access to this system. 2. Create a default deny policy in /etc/hosts.deny: # echo \"ALL: ALL\" >/etc/hosts.deny 3. Enable TCP Wrappers for all services started by inetd: # inetadm -M tcp_wrappers=TRUE To protect only specific inetdservices, use the command: # inetadm -m [FMRI] tcp_wrappers=TRUE where [FMRI] is the service to protect. To enable TCP Wrappers for the RPC port mapping service, use the commands: # svccfg -s rpc/bind setprop config/enable_tcpwrappers=true # svcadm refresh rpc/bind To protect UDP and RPC-based services that are spawned from inetd, consider implementing a host-based firewall. Oracle Solaris PF firewall (a.k.a. PF) has replaced Solaris IP Filter (IPF) in Solaris 11.4. See firewall(5)for more information." reference : "800-171|3.13.1,800-171|3.13.6,800-53|SC-7(5),CIS_Recommendation|2.1,CN-L3|7.1.2.2(c),CSCv7|9.4,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(5),LEVEL|1NS,NESA|T4.5.4,NIAv2|GS7b,NIAv2|NS25,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/hosts.deny" regex : "^ *[^#]*ALL.*" expect : "ALL: ALL" system : "SunOS" type : SVC_PROP description : "2.1 Configure TCP Wrappers - rpc/bind" info : "TCP Wrappers is a host-based access control system that allows administrators to control who has access to various network services based on the IP address of the remote end of the connection. TCP Wrappers also provide logging information via syslog about both successful and unsuccessful connections. Rationale: TCP Wrappers provides granular control over what services can be accessed over the network. Its logs show attempted access to services from non-authorized systems, which can help identify unauthorized access attempts." solution : "To enable TCP Wrappers, run the following commands: 1. Create and customize your policy in /etc/hosts.allow: # echo \"ALL: /, , ...\" > /etc/hosts.allow where each / combination (for example, the Class C address block \"192.168.1.0/255.255.255.0\") can represent one network block in use by your organization that requires access to this system. 2. Create a default deny policy in /etc/hosts.deny: # echo \"ALL: ALL\" >/etc/hosts.deny 3. Enable TCP Wrappers for all services started by inetd: # inetadm -M tcp_wrappers=TRUE To protect only specific inetdservices, use the command: # inetadm -m [FMRI] tcp_wrappers=TRUE where [FMRI] is the service to protect. To enable TCP Wrappers for the RPC port mapping service, use the commands: # svccfg -s rpc/bind setprop config/enable_tcpwrappers=true # svcadm refresh rpc/bind To protect UDP and RPC-based services that are spawned from inetd, consider implementing a host-based firewall. Oracle Solaris PF firewall (a.k.a. PF) has replaced Solaris IP Filter (IPF) in Solaris 11.4. See firewall(5)for more information." reference : "800-171|3.13.1,800-53|SC-7(12),CIP|007-6-R1,CIS_Recommendation|2.1,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1NS,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" service : "rpc/bind" property : "config/enable_tcpwrappers" value : "true" type : CMD_EXEC description : "Gnome installed" cmd : "/usr/bin/pkg list consolidation/desktop/gnome-incorporation" expect : "^consolidation/desktop/gnome-incorporation" system : "SunOS" type : CMD_EXEC description : "2.2 Disable Local-only Graphical Login Environment" info : "The graphical login service provides the capability of logging into the system using an X- windows type interface from the console. If graphical login access for the console is required, leave the service in local-only mode. Rationale: This service should be disabled if it is not required." solution : "To disable this service, run the following command: # svcadm disable svc:/application/graphical-login/gdm:default" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.2,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/svcs -Ho state svc:/application/graphical-login/gdm:default" expect : "disabled" description : "2.2 Disable Local-only Graphical Login Environment" info : "The graphical login service provides the capability of logging into the system using an X- windows type interface from the console. If graphical login access for the console is required, leave the service in local-only mode. Rationale: This service should be disabled if it is not required." solution : "To disable this service, run the following command: # svcadm disable svc:/application/graphical-login/gdm:default" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.2,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : SVC_PROP description : "2.3 Configure sendmail Service for Local-Only Mode" info : "In Solaris 11, the sendmail service is set to local only mode by default. This means that users on remote systems cannot connect to the sendmail service, eliminating the possibility of a remote exploit attack against some future sendmail vulnerability. Leaving sendmail in local-only mode permits mail to be sent out from the local system. If the local system will not be processing or sending any mail, this service can be disabled. However, if sendmail is disabled completely, email messages sent to the root account (such as cron job output or audit service warnings) will fail to be delivered. An alternative approach is to disable the sendmail service and create a cron job to process all mail that is queued on the local system, sending it to a relay host defined in the sendmail.cf file. It is recommended that sendmail be left in local-only mode unless there is a specific requirement to completely disable it. Rationale: The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems." solution : "To disable this service, run the following command: # svcadm disable svc:/application/graphical-login/gdm:default" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.3,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "/network/smtp:sendmail" regex : "true" property : "config/local_only" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.4 Disable RPC Encryption Key" info : "The keyserv service is only required for sites that are using the Secure RPC mechanism. The most common use for Secure RPC on Solaris machines is \"secure NFS\", which uses the Secure RPC mechanism to provide higher levels of security than the standard NFS protocols. (\"Secure NFS\" is unrelated to Kerberos authentication as a mechanism for providing higher levels of NFS security. \"Kerberized\" NFS does not require the keyserv service to be running.) Rationale: This service should be disabled if it is not required." solution : "Run the following to set sendmail to listen only local interfaces: # svccfg -v -s svc:/network/smtp:sendmail setprop config/local_only=true # svcadm refresh sendmail # svcadm restart sendmail" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.4,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/rpc/keyserv:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.5 Disable Generic Security Services (GSS)" info : "The GSS API is a security abstraction layer that is designed to make it easier for developers to integrate with different authentication schemes. It is most commonly used in applications for sites that use Kerberos for network authentication, though it can also allow applications to interoperate with other authentication schemes. Rationale: GSS does not expose anything external to the system as it is configured to use TLI (protocol = ticotsord) by default. This service should be disabled if it is not required." solution : "To disable this service, run the following command: # svcadm disable svc:/network/rpc/gss" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.5,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/rpc/gss:default" regex : "(disabled|uninitialized)" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.6 Disable Apache Service" info : "The Apache service provides an instance of the Apache web server. Rationale: This service should be disabled if it is not required." solution : "To disable this service, run the following command: # svcadm disable svc:/network/http:apache24" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.6,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/http:apache24" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.7 Disable Kerberos TGT Expiration Warning" info : "The Kerberos TGT warning service is used to warn users when their Kerberos tickets are about expire or to renew those tickets before they expire. This service is not used if Kerberos has not been configured. This service is configured to be \"local only\" by default. Rationale: This service should be disabled if it is not required." solution : "To disable this service, run the following command: # svcadm disable svc:/network/security/ktkt_warn" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.7,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/security/ktkt_warn:default" regex : "(disabled|uninitialized)" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.8 Disable NIS Client Services - nis client" info : "If the local site is not using the NIS naming service to distribute system and user configuration information, this service may be disabled. This service is disabled by default unless the NIS service has been installed and configured on the system. Rationale: As RPC-based services such as NIS may use non-secure authentication and share sensitive network object information with systems and applications using RPC-based service, NIS client daemons should be disabled. Users are encouraged to use LDAP as a name service in place of NIS." solution : "To disable this service, run the following commands: # svcadm disable svc:/network/nis/client Check to see if LDAP Client is in use: # svcs -a | grep ldap | awk -F\" \" '{if ($1 ~ /disabled/ && $3 ~ /client/) print \"LDAP Client is disabled - svc:/network/nfs/domain can be disabled.\";}' If LDAP is not in use also disable nis/domain: # svcadm disable svc:/network/nis/domain" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.8,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/nis/client:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.8 Disable NIS Client Services - nis domain" info : "If the local site is not using the NIS naming service to distribute system and user configuration information, this service may be disabled. This service is disabled by default unless the NIS service has been installed and configured on the system. Rationale: As RPC-based services such as NIS may use non-secure authentication and share sensitive network object information with systems and applications using RPC-based service, NIS client daemons should be disabled. Users are encouraged to use LDAP as a name service in place of NIS." solution : "To disable this service, run the following commands: # svcadm disable svc:/network/nis/client Check to see if LDAP Client is in use: # svcs -a | grep ldap | awk -F\" \" '{if ($1 ~ /disabled/ && $3 ~ /client/) print \"LDAP Client is disabled - svc:/network/nfs/domain can be disabled.\";}' If LDAP is not in use also disable nis/domain: # svcadm disable svc:/network/nis/domain" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.8,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/nis/domain:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.9 Disable NIS Server Services - nis server" info : "The NIS server software is not installed by default and is only required on systems that are acting as an NIS server for the local site. Typically there are only a small number of NIS servers on any given network. These services are disabled by default unless the system has been previously configured to act as a NIS server. Rationale: As RPC-based services such as NIS may use non-secure authentication and share sensitive network object information with systems and applications using RPC-based services, this service should be disabled. Users are encouraged to use LDAP as a name service in place of NIS." solution : "To disable this service, run the following commands: # svcadm disable svc:/network/nis/server Check to see if LDAP Client is in use: # svcs -a | grep ldap | awk -F\" \" '{if ($1 ~ /disabled/ && $3 ~ /client/) print \"LDAP Client is disabled - svc:/network/nfs/domain can be disabled.\";}' If LDAP is not in use also disable nis/domain: # svcadm disable svc:/network/nis/domain Notes: It is possible that the svc:/network/nis/server package may not be installed by default on some systems. In this case, the above commands will indicate that the software is not installed." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.9,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/nis/server:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.9 Disable NIS Server Services - nis domain" info : "The NIS server software is not installed by default and is only required on systems that are acting as an NIS server for the local site. Typically there are only a small number of NIS servers on any given network. These services are disabled by default unless the system has been previously configured to act as a NIS server. Rationale: As RPC-based services such as NIS may use non-secure authentication and share sensitive network object information with systems and applications using RPC-based services, this service should be disabled. Users are encouraged to use LDAP as a name service in place of NIS." solution : "To disable this service, run the following commands: # svcadm disable svc:/network/nis/server Check to see if LDAP Client is in use: # svcs -a | grep ldap | awk -F\" \" '{if ($1 ~ /disabled/ && $3 ~ /client/) print \"LDAP Client is disabled - svc:/network/nfs/domain can be disabled.\";}' If LDAP is not in use also disable nis/domain: # svcadm disable svc:/network/nis/domain Notes: It is possible that the svc:/network/nis/server package may not be installed by default on some systems. In this case, the above commands will indicate that the software is not installed." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.9,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/nis/domain:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.10 Disable Removable Volume Manager - rmvolmgr" info : "The HAL-aware removable volume manager in the Solaris 11 OS automatically mounts external devices for users whenever the device is attached to the system. These devices include CD-R, CD-RW, floppies, DVD, USB and 1394 mass storage devices. See the rmvolmgr(1M) manual page for more details. Rationale: Allowing users to mount and access data from removable media devices makes it easier for malicious programs and data to be imported onto the network. It also introduces the risk that sensitive data may be transferred off the system without a log record. By adding rmvolmgr to the .xinitrc file, user-isolated instances of rmvolmgr can be run via a session startup script. In such cases, the rmvolmgr instance will not allow management of volumes that belong to other than the owner of the startup script. When a user logs onto the workstation console ( /dev/console), any instance of user-initiated rmvolmgr will only own locally connected devices, such as CD-ROMs or flash memory hardware, locally connected to USB or FireWire ports." solution : "To disable this service, run the following commands: # svcadm disable svc:/system/filesystem/rmvolmgr # svcadm disable svc:/network/rpc/smserver Notes: rmformat is a rpc.smserverd client. If you need to support this service, but still want to disable rmvolmgr, then do not disable smserver in the action above." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.10,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "system/filesystem/rmvolmgr:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.10 Disable Removable Volume Manager - smserver" info : "The HAL-aware removable volume manager in the Solaris 11 OS automatically mounts external devices for users whenever the device is attached to the system. These devices include CD-R, CD-RW, floppies, DVD, USB and 1394 mass storage devices. See the rmvolmgr(1M) manual page for more details. Rationale: Allowing users to mount and access data from removable media devices makes it easier for malicious programs and data to be imported onto the network. It also introduces the risk that sensitive data may be transferred off the system without a log record. By adding rmvolmgr to the .xinitrc file, user-isolated instances of rmvolmgr can be run via a session startup script. In such cases, the rmvolmgr instance will not allow management of volumes that belong to other than the owner of the startup script. When a user logs onto the workstation console ( /dev/console), any instance of user-initiated rmvolmgr will only own locally connected devices, such as CD-ROMs or flash memory hardware, locally connected to USB or FireWire ports." solution : "To disable this service, run the following commands: # svcadm disable svc:/system/filesystem/rmvolmgr # svcadm disable svc:/network/rpc/smserver Notes: rmformat is a rpc.smserverd client. If you need to support this service, but still want to disable rmvolmgr, then do not disable smserver in the action above." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.10,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "network/rpc/smserver:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.11 Disable automount Service" info : "The automount daemon is normally used to automatically mount NFS file systems from remote file servers when needed. However, the automount daemon can also be configured to mount local (loopback) file systems as well, which may include local user home directories, depending on the system configuration. Rationale: This service should be disabled if it is not required." solution : "To disable this service, run the following command: # svcadm disable svc:/system/filesystem/autofs Notes: By default, the Solaris 11 OS uses the automount service for local user home directories, so it should not be disabled without adjusting the home directory setting of each local user." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.11,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "system/filesystem/autofs:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "2.12 Disable Telnet Service" info : "The telnet daemon, which accepts connections from users from other systems via the telnet protocol and can be used for remote shell access. Rationale: The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow a user with access to sniff network traffic the ability to steal credentials. The ssh protocol provides an encrypted session and stronger security." solution : "Disable telnet server if enabled: # svcadm disable svc:/network/telnet" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|2.12,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "/network/telnet:default" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : CMD_EXEC description : "3.1 Disable Response to Broadcast ICMPv4 Echo Request" info : "This setting controls whether Solaris responds to broadcast ICMPv4 echo requests. Rationale: Reduce attack surface by restricting this vector used for host discovery and to prevent denial of service attacks." solution : "To enforce this setting, use the command: # ipadm set-prop -p _respond_to_echo_broadcast=0 ip" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.1,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _respond_to_echo_broadcast -co persistent,default ip | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.2 Disable Response to ICMP Broadcast Netmask Requests" info : "This setting controls whether Solaris will respond to ICMP broadcast netmask requests. Rationale: Reduce attack surface by restricting this vector used for host and network discovery and to prevent denial of service attacks." solution : "To enforce this setting, use the command: # ipadm set-prop -p _respond_to_address_mask_broadcast=0 ip" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.2,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _respond_to_address_mask_broadcast -co persistent,default ip | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : FILE_CONTENT_CHECK description : "3.3 Enable Strong TCP Sequence Number Generation - /etc/default/inetinit" info : "The variable TCP_STRONG_ISS defines the mechanism used for TCP initial sequence number generation. If an attacker can predict the next sequence number, it is possible to inject fraudulent packets into the data stream to hijack the session. Rationale: The RFC 1948 method is widely accepted as the strongest mechanism for TCP packet generation. This makes remote session hijacking attacks more difficult, as well as any other network-based attack that relies on predicting TCP sequence number information. It is theoretically possible that there may be a small performance hit in connection setup time when this setting is used, but there are no publicly available benchmarks that establish this." solution : "Run the following commands to set the TCP_STRONG_ISS parameter to use RFC 1948 sequence number generation in the /etc/default/inetinit file: # cd /etc/default # awk '/TCP_STRONG_ISS=/ { $1 = \"TCP_STRONG_ISS=2\" }; { print }' inetinit > inetinit.CIS # mv inetinit.CIS inetinit To set the TCP_STRONG_ISS parameter on a running system, use the command: # ipadm set-prop -p _strong_iss=2 tcp" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.3,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/inetinit" regex : "^[\\s]*TCP_STRONG_ISS[\\s]*=" expect : "^[\\s]*TCP_STRONG_ISS[\\s]*=[\\s]*2[\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.3 Enable Strong TCP Sequence Number Generation - ipadm" info : "The variable TCP_STRONG_ISS defines the mechanism used for TCP initial sequence number generation. If an attacker can predict the next sequence number, it is possible to inject fraudulent packets into the data stream to hijack the session. Rationale: The RFC 1948 method is widely accepted as the strongest mechanism for TCP packet generation. This makes remote session hijacking attacks more difficult, as well as any other network-based attack that relies on predicting TCP sequence number information. It is theoretically possible that there may be a small performance hit in connection setup time when this setting is used, but there are no publicly available benchmarks that establish this." solution : "Run the following commands to set the TCP_STRONG_ISS parameter to use RFC 1948 sequence number generation in the /etc/default/inetinit file: # cd /etc/default # awk '/TCP_STRONG_ISS=/ { $1 = \"TCP_STRONG_ISS=2\" }; { print }' inetinit > inetinit.CIS # mv inetinit.CIS inetinit To set the TCP_STRONG_ISS parameter on a running system, use the command: # ipadm set-prop -p _strong_iss=2 tcp" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.3,CN-L3|8.1.10.6(j),CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _strong_iss -co current tcp" expect : "^2$" system : "SunOS" type : CMD_EXEC description : "3.4 Disable Response to ICMP Broadcast Timestamp Requests" info : "This setting controls whether Solaris will respond to ICMP broadcast timestamp requests. Rationale: Reduce attack surface by restricting this vector used for host discovery and to prevent denial of service attacks." solution : "To enforce this setting, use the command: # ipadm set-prop -p _respond_to_timestamp_broadcast=0 ip" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.4,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _respond_to_timestamp_broadcast -co persistent,default ip | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.5 Disable Source Packet Forwarding - ipv4" info : "This setting controls whether the IPv4 or IPv6 configuration will forward packets with IPv4 routing options or IPv6 routing headers. Rationale: Keep this parameter disabled to prevent denial of service attacks through spoofed packets." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _forward_src_routed=0 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _forward_src_routed=0 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.5,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _forward_src_routed -co persistent,default ipv4 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.5 Disable Source Packet Forwarding - ipv6" info : "This setting controls whether the IPv4 or IPv6 configuration will forward packets with IPv4 routing options or IPv6 routing headers. Rationale: Keep this parameter disabled to prevent denial of service attacks through spoofed packets." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _forward_src_routed=0 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _forward_src_routed=0 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.5,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _forward_src_routed -co persistent,default ipv6 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.6 Disable Directed Broadcast Packet Forwarding" info : "This setting controls whether Solaris forwards broadcast packets for a specific network if it is directly connected to the machine. Rationale: Keep this parameter disabled to prevent denial of service attacks." solution : "To enforce this setting, use the command: # ipadm set-prop -p _forward_directed_broadcasts=0 ip" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.6,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _forward_directed_broadcasts -co persistent,default ip | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.7 Enable Stack Protection - nxheap" info : "Buffer overflow exploits have been the basis for many highly publicized compromises and defacements of large numbers of Internet connected systems. Many of the automated tools in use by system attackers exploit well-known buffer overflow problems in vendor- supplied and third party software. Rationale: Enabling stack protection prevents certain classes of buffer overflow attacks and is a significant security enhancement. However, this does not protect against buffer overflow attacks that do not execute code on the stack (such as return-to-libc exploits). While most of the Solaris OS is already configured to employ a non-executable stack, this setting is still recommended to provide a more comprehensive solution for both Solaris and other software that may be installed." solution : "To enable stack protection and block stack-smashing attacks, run the following: # sxadm delcust nxheap # sxadm delcust nxstack" reference : "800-53|SI-16.,CIS_Recommendation|3.7,CSCv7|9.4,ITSG-33|SI-16,LEVEL|1S" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/sxadm status -po extension,status,configuration nxheap" expect : "^[\\s]*nxheap:enabled\\.tagged-files:default\\.default" system : "SunOS" type : CMD_EXEC description : "3.7 Enable Stack Protection - nxstack" info : "Buffer overflow exploits have been the basis for many highly publicized compromises and defacements of large numbers of Internet connected systems. Many of the automated tools in use by system attackers exploit well-known buffer overflow problems in vendor- supplied and third party software. Rationale: Enabling stack protection prevents certain classes of buffer overflow attacks and is a significant security enhancement. However, this does not protect against buffer overflow attacks that do not execute code on the stack (such as return-to-libc exploits). While most of the Solaris OS is already configured to employ a non-executable stack, this setting is still recommended to provide a more comprehensive solution for both Solaris and other software that may be installed." solution : "To enable stack protection and block stack-smashing attacks, run the following: # sxadm delcust nxheap # sxadm delcust nxstack" reference : "800-53|SI-16.,CIS_Recommendation|3.7,CSCv7|9.4,ITSG-33|SI-16,LEVEL|1S" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/sxadm status -po extension,status,configuration nxstack" expect : "^[\\s]*nxstack:enabled\\.all:default\\.default" system : "SunOS" type : FILE_CHECK description : "3.8 Restrict Core Dumps to Protected Directory - /var/share/cores" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|3.8,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|13.2,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/var/share/cores" owner : "root" mask : "0077" group : "root" || "sys" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - global core file pattern" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'global core file pattern'" expect : "/var/share/cores/core_%n_%f_%u_%g_%t_%p" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - global core file content" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'global core file content'" expect : "[\\s:]default[\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - kernel zone core file pattern" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'kernel zone core file pattern'" expect : "[\\s:][\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - init core file pattern" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'init core file pattern'" expect : "[\\s:]core[\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - init core file content" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'init core file content'" expect : "[\\s:]default[\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - global core dumps" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'global core dumps'" expect : "enabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - kernel zone core dumps" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'kernel zone core dumps'" expect : "disabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - per-process core dumps" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'per-process core dumps'" expect : "disabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - global setid core dumps" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'global setid core dumps'" expect : "enabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - per-process setid core dumps" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'per-process setid core dumps'" expect : "disabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - global core dump logging" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'global core dump logging'" expect : "enabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - diagnostic core dumps" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'diagnostic core dumps'" expect : "enabled" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - retention policy" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'retention policy'" expect : "summary" system : "SunOS" type : CMD_EXEC description : "3.8 Restrict Core Dumps to Protected Directory - core diagnostic alert" info : "The action described in this section creates a protected directory to store core dumps and also causes the system to create a log entry whenever a regular process dumps core. Rationale: Core dumps, particularly those from set-UID and set-GID processes, may contain sensitive data." solution : "To implement the recommendation, run the commands: # chmod 700 /var/share/cores # coreadm -g /var/share/cores/core_%n_%f_%u_%g_%t_%p \ -e log -e global -e global-setid \ -d process -d proc-setid If the local site chooses, dumping of core files can be completely disabled with the following command: # coreadm -d global -d global-setid -d process -d proc-setid" reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|3.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|13.2,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/coreadm | /usr/bin/egrep -e 'core diagnostic alert'" expect : "enabled" system : "SunOS" type : CMD_EXEC description : "3.9 Disable Response to ICMP Timestamp Requests" info : "This setting controls whether Solaris will respond to ICMP timestamp requests. Rationale: Reduce attack surface by restricting this vector used for host discovery." solution : "To enforce this setting, use the command: # ipadm set-prop -p _respond_to_timestamp=0 ip" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.9,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _respond_to_timestamp -co persistent,default ip | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.10 Disable Response to Multicast Echo Request - ipv4" info : "These settings control whether Solaris responds to multicast IPv4 and IPv6 echo requests. Rationale: Reduce attack surface by restricting this vector used for host discovery and to prevent denial of service attacks." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _respond_to_echo_multicast=0 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _respond_to_echo_multicast=0 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.10,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _respond_to_echo_multicast -co persistent,default ipv4 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.10 Disable Response to Multicast Echo Request - ipv6" info : "These settings control whether Solaris responds to multicast IPv4 and IPv6 echo requests. Rationale: Reduce attack surface by restricting this vector used for host discovery and to prevent denial of service attacks." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _respond_to_echo_multicast=0 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _respond_to_echo_multicast=0 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.10,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _respond_to_echo_multicast -co persistent,default ipv6 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.11 Ignore ICMP Redirect Messages - ipv4" info : "These settings control whether Solaris will ignore ICMP redirect messages. Rationale: IP redirects should not be necessary in a well-designed and maintained network. Set to a value of 1 if there is a high risk for a DoS attack. Otherwise, the default value of 0 is sufficient." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _ignore_redirect=1 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _ignore_redirect=1 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.11,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _ignore_redirect -co persistent,default ipv4 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^1[\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.11 Ignore ICMP Redirect Messages - ipv6" info : "These settings control whether Solaris will ignore ICMP redirect messages. Rationale: IP redirects should not be necessary in a well-designed and maintained network. Set to a value of 1 if there is a high risk for a DoS attack. Otherwise, the default value of 0 is sufficient." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _ignore_redirect=1 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _ignore_redirect=1 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.11,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _ignore_redirect -co persistent,default ipv6 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^1[\\s]*$" system : "SunOS" type : CMD_EXEC description : "3.12 Set Strict Multihoming - ipv4" info : "These settings control whether a packet arriving on a non-forwarding interface can be accepted for an IP address that is not explicitly configured on that interface. Rationale: Enable this setting for systems that have interfaces that cross strict networking domains (for example, a firewall or a VPN node)." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _strict_dst_multihoming=1 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _strict_dst_multihoming=1 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.12,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _strict_dst_multihoming -co persistent,default ipv4 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^1$" system : "SunOS" type : CMD_EXEC description : "3.12 Set Strict Multihoming - ipv6" info : "These settings control whether a packet arriving on a non-forwarding interface can be accepted for an IP address that is not explicitly configured on that interface. Rationale: Enable this setting for systems that have interfaces that cross strict networking domains (for example, a firewall or a VPN node)." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p _strict_dst_multihoming=1 ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p _strict_dst_multihoming=1 ipv6" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.12,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _strict_dst_multihoming -co persistent,default ipv6 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^1$" system : "SunOS" type : CMD_EXEC description : "3.13 Disable ICMP Redirect Messages - ipv4" info : "These setting controls whether Solaris sends ICMPv4 and ICMPv6 redirect messages. Rationale: A malicious user can exploit the ability of the system to send ICMP redirects by continually sending packets to the system, forcing the system to respond with ICMP redirect messages, resulting in an adverse impact on the CPU performance of the system." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p send_redirects=off ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p send_redirects=off ipv6" reference : "800-53|SC-5.,CIS_Recommendation|3.13,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.DS-4,ITSG-33|SC-5,ITSG-33|SC-5a.,LEVEL|1S,NESA|T3.3.1,NIAv2|GS8e,NIAv2|GS10c,QCSC-v1|8.2.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p send_redirects -co persistent,default ipv4 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^off$" system : "SunOS" type : CMD_EXEC description : "3.13 Disable ICMP Redirect Messages - ipv6" info : "These setting controls whether Solaris sends ICMPv4 and ICMPv6 redirect messages. Rationale: A malicious user can exploit the ability of the system to send ICMP redirects by continually sending packets to the system, forcing the system to respond with ICMP redirect messages, resulting in an adverse impact on the CPU performance of the system." solution : "To enforce this setting for IPv4 packets, use the command: # ipadm set-prop -p send_redirects=off ipv4 To enforce this setting for IPv6 packets, use the command: # ipadm set-prop -p send_redirects=off ipv6" reference : "800-53|SC-5.,CIS_Recommendation|3.13,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.DS-4,ITSG-33|SC-5,ITSG-33|SC-5a.,LEVEL|1S,NESA|T3.3.1,NIAv2|GS8e,NIAv2|GS10c,QCSC-v1|8.2.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p send_redirects -co persistent,default ipv6 | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^off$" system : "SunOS" type : CMD_EXEC description : "3.14 Disable TCP Reverse IP Source Routing" info : "This setting controls whether TCP reverses the IP source routing option for incoming connections. Rationale: If IP source routing is needed for diagnostic purposes, enable it. Otherwise disable it." solution : "To enforce this setting, use the command: # ipadm set-prop -p _rev_src_routes=0 tcp" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.14,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _rev_src_routes -co persistent,default tcp | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^0$" system : "SunOS" type : CMD_EXEC description : "3.15 Set Maximum Number of Half-open TCP Connections" info : "This setting controls how many half-open connections can exist for a TCP port. Rationale: It is necessary to control the number of completed connections to the system to provide some protection against Denial of Service attacks. Note that the value of 4096 is a minimum to establish a good security posture for this setting. In environments where connections numbers are high, such as a busy webserver, this value may need to be increased." solution : "To enforce this setting, use the command: # ipadm set-prop -p _conn_req_max_q0=4096 tcp" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.15,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _conn_req_max_q0 -co persistent,default tcp | /usr/bin/awk -F: '{ if ($1 != \"\") { print $1 } else { print $2 } }'" expect : "^(409[6-9]|4[1-9][0-9]{2}|[5-9][0-9]{3}|[1-9][0-9]{4,})$" system : "SunOS" type : CMD_EXEC description : "3.16 Set Maximum Number of Incoming Connections" info : "This setting controls the maximum number of incoming connections that can be accepted on a TCP port. Rationale: Note that the value of 1024 is a minimum to establish a good security posture for this setting. In environments where connections numbers are high, such as a busy webserver, this value may need to be increased." solution : "To enforce this setting, use the command: # ipadm set-prop -p _conn_req_max_q=1024 tcp" reference : "800-171|3.13.1,800-53|SC-7(12),CIS_Recommendation|3.16,CN-L3|8.1.10.6(j),CSCv6|9.2,CSCv7|9.4,CSF|DE.CM-1,CSF|PR.AC-5,CSF|PR.DS-5,CSF|PR.PT-4,ISO/IEC-27001|A.13.1.3,ITSG-33|SC-7(12),LEVEL|1S,NESA|T4.5.4,NIAv2|AM38,NIAv2|SS13d,NIAv2|SS26,QCSC-v1|5.2.1,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|8.2.1,TBA-FIISB|43.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/ipadm show-prop -p _conn_req_max_q -co persistent,default tcp | /usr/bin/sed -e 's/^\\([1-9][0-9]*\\):.*$/\\1/' -e 's/://'" expect : "^(102[4-9]|10[3-9][0-9]|1[1-9][0-9]{2}|[2-9][0-9]{3}|[1-9][0-9]{4,})$" system : "SunOS" type : CMD_EXEC description : "3.17 Disable Network Routing" info : "The network routing daemon, in.routed, manages network routing tables. If enabled, it periodically supplies copies of the system's routing tables to any directly connected hosts and networks and picks up routes supplied to it from other networks and hosts. Rationale: Routing Internet Protocol (RIP) is a legacy protocol with a number of security weaknesses including a lack of authentication, zoning, pruning, etc." solution : "To enforce this setting and disable IPv4 routing, use the command: # routeadm -d ipv4-forwarding -d ipv4-routing To enforce this setting and disable IPv6 routing, use the command: # routeadm -d ipv6-forwarding -d ipv6-routing To apply these changes to the running system, use the command: # routeadm -u" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIS_Recommendation|3.17,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/routeadm -p | /usr/bin/egrep \'routing |forwarding\' | /usr/bin/egrep \'(persistent|current)=enabled\' | /usr/bin/awk \'{ print } END { if (NR == 0) print \"pass\" }\'" expect : "pass" system : "SunOS" type : CMD_EXEC description : "4.1 Create CIS Audit Class" info : "To group a set of related audit events, the Solaris Audit service provides the ability for sites to define their own audit classes that contain just those events that the site wants to audit. Rationale: To simplify administration, a CIS specific audit class should be created." solution : "To create the CIS audit class, edit the /etc/security/audit_class file and add the following entry before the last line of the file: 0x0100000000000000:cis:CIS Solaris Benchmark" reference : "800-171|3.1.11,800-53|AC-12c.,CIS_Recommendation|4.1,CN-L3|7.1.2.2(d),CN-L3|7.1.3.7(b),CN-L3|8.1.4.1(b),CSCv7|6.2,ITSG-33|AC-12,LEVEL|1S,NIAv2|NS49" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/awk '{ print l; l=\$0 }' /etc/security/audit_class" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "^0x0100000000000000:cis:CIS[\\s]+Solaris[\\s]+Benchmark[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.2 Enable Auditing of Incoming Network Connections - AUE_ACCEPT" info : "The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system. Rationale: This recommendation will provide an audit trail that contains information related to incoming network connections. While this functionality can be enabled using service- specific mechanisms, using the Solaris Audit service provides a more centralized and complete window into incoming network activity." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4\",cis\";} {print} ' etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.2,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_ACCEPT:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.2 Enable Auditing of Incoming Network Connections - AUE_CONNECT" info : "The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system. Rationale: This recommendation will provide an audit trail that contains information related to incoming network connections. While this functionality can be enabled using service- specific mechanisms, using the Solaris Audit service provides a more centralized and complete window into incoming network activity." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4\",cis\";} {print} ' etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.2,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_CONNECT:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.2 Enable Auditing of Incoming Network Connections - AUE_SOCKACCEPT" info : "The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system. Rationale: This recommendation will provide an audit trail that contains information related to incoming network connections. While this functionality can be enabled using service- specific mechanisms, using the Solaris Audit service provides a more centralized and complete window into incoming network activity." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4\",cis\";} {print} ' etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.2,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SOCKACCEPT:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.2 Enable Auditing of Incoming Network Connections - AUE_SOCKCONNECT" info : "The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system. Rationale: This recommendation will provide an audit trail that contains information related to incoming network connections. While this functionality can be enabled using service- specific mechanisms, using the Solaris Audit service provides a more centralized and complete window into incoming network activity." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4\",cis\";} {print} ' etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.2,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SOCKCONNECT:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.2 Enable Auditing of Incoming Network Connections - AUE_inetd_connect" info : "The Solaris Audit service can be configured to record incoming network connections to any listening service running on the system. Rationale: This recommendation will provide an audit trail that contains information related to incoming network connections. While this functionality can be enabled using service- specific mechanisms, using the Solaris Audit service provides a more centralized and complete window into incoming network activity." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # cp /etc/security/audit_event /etc/security/audit_event.orig # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/) $4=$4\",cis\";} {print} ' etc/security/audit_event > /etc/security/audit_event.out # cp /etc/security/audit_event.out /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.2,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_inetd_connect:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_CHMOD" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_CHMOD:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_CHOWN" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_CHOWN:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_FCHOWN" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_FCHOWN:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_FCHMOD" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_FCHMOD:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_LCHOWN" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_LCHOWN:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_ACLSET" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_ACLSET:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.3 Enable Auditing of ob体育 Metadata Modification Events - AUE_FACLSET" info : "The Solaris Audit service can be configured to record file metadata modification events for every process running on the system. This will allow the auditing service to determine when file ownership, permissions and related information is changed. Rationale: This recommendation will provide an audit trail that contains information related to changes of file metadata. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/ ) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.3,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_FACLSET:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_CHROOT" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_CHROOT:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETREUID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETREUID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETREGID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETREGID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_FCHROOT" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_FCHROOT:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_PFEXEC" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_PFEXEC:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETUID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETUID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_NICE" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_NICE:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETGID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETGID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_PRIOCNTLSYS" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_PRIOCNTLSYS:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETEGID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETEGID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETEUID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETEUID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETPPRIV" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETPPRIV:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETSID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETSID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "4.4 Enable Auditing of Process and Privilege Events - AUE_SETPGID" info : "The Solaris Audit service can be configured to record the use of privileges by processes running on the system. This will capture events such as the setting of UID and GID values, setting of privileges, as well as the use of functionality such as chroot(2). Rationale: This recommendation will provide an audit trail that contains information related to the use of privileges by processes running on the system. The Solaris Audit service is used to provide a more centralized and complete window into activities such as these." solution : "To enforce this setting, use the commands to modify the /etc/security/audit_event file and add the cis audit class to the following audit events: # awk 'BEGIN{FS=\":\"; OFS=\":\"} {if ($2 ~ /AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_N ICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSI D|AUE_SETPGID/) $4=$4\",cis\";} {print} ' /etc/security/audit_event > /etc/security/audit_event.CIS # cp /etc/security/audit_event.CIS /etc/security/audit_event" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.4,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSCv7|6.3,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/audit_event" regex : "^[\\s]*[0-9]+:AUE_SETPGID:" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "[:,]cis(,.*+)*[\\s]*$" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - audit condition" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getcond" expect : "^[\\s]*audit[\\s]+condition[\\s]*=[\\s]*auditing[\\s]*$" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - configured audit policies" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getpolicy | /usr/bin/grep \"configured audit policies *=\"" expect : "^[\\s]*configured[\\s]+audit[\\s]+policies[\\s]*=[\\s]*argv,cnt,zonename[\\s]*$" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - active audit policies" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getpolicy | /usr/bin/grep \"active audit policies *=\"" expect : "^[\\s]*active[\\s]+audit[\\s]+policies[\\s]*=[\\s]*argv,cnt,zonename[\\s]*$" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - configured user default audit flags" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getflags | /usr/bin/grep \"configured user default audit flags *=\"" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "^[\\s]*configured[\\s]+user[\\s]+default[\\s]+audit[\\s]+flags[\\s]*=[\\s]*ad,ft,lo,ex,cis\\(" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - active user default audit flags" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getflags | /usr/bin/grep \"active user default audit flags *=\"" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "^[\\s]*active[\\s]+user[\\s]+default[\\s]+audit[\\s]+flags[\\s]*=[\\s]*ad,ft,lo,ex,cis\\(" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - configured non-attributable audit flags" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getnaflags | /usr/bin/grep \"configured non-attributable audit flags *=\"" expect : "^[\\s]*configured[\\s]+non-attributable[\\s]+audit[\\s]+flags[\\s]*=[\\s]*lo\\(" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - active non-attributable audit flags" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getnaflags | /usr/bin/grep \"active non-attributable audit flags *=\"" expect : "^[\\s]*active[\\s]+non-attributable[\\s]+audit[\\s]+flags[\\s]*=[\\s]*lo\\(" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - audit_binfile active" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getplugin audit_binfile" expect : "^[\\s]*Plugin:[\\s]+audit_binfile[\\s]+\\(active\\)[\\s]*$" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - audit_binfile p_minfree" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/auditconfig -getplugin audit_binfile | /usr/bin/grep \"Attributes:\"" expect : "[\\s;]p_minfree[\\s]*=[\\s]*[1-9][0-9]*[;\\s]*" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - audit_flags" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/userattr audit_flags root" # Note: Variable @CIS_AUDIT_CLASS@ replaced with "cis" in field "expect". expect : "^[\\s]*lo,ad,ft,ex,cis:no[\\s]*$" system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - /var/share/audit/ files" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-12c.,CIS_Recommendation|4.5,CN-L3|7.1.3.3(a),CN-L3|7.1.3.3(b),CN-L3|7.1.3.3(c),CN-L3|8.1.3.5(a),CN-L3|8.1.3.5(b),CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|DE.CM-1,CSF|DE.CM-3,CSF|DE.CM-7,CSF|PR.PT-1,ISO/IEC-27001|A.12.4.1,ITSG-33|AU-12c.,LEVEL|1S,NESA|T3.6.2,NESA|T3.6.5,NESA|T3.6.6,NIAv2|SM8,QCSC-v1|3.2,QCSC-v1|6.2,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4,TBA-FIISB|45.1.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/ls -l /var/share/audit/*.not_terminated.* | /usr/bin/awk '{ print } END { if (NR == 0) print \"none\" }'" expect : "\.not_terminated\." system : "SunOS" type : CMD_EXEC description : "4.5 Configure Solaris Auditing - crontab audit" info : "Solaris auditing service keeps a record of how a system is being used. Solaris auditing can be configured to record different classes of events based upon site policy. This recommendation will set and verify a consensus-developed auditing policy. That said, all organizations are encouraged to tailor this policy based upon their specific needs. For more information on the Solaris auditing service including how to filter and view events, see the Oracle Solaris product documentation. The \"cis\" class is a \"custom class\" that CIS recommends creating that includes specifically those events that are of interest (defined in the sections above). In addition to those events, this recommendation also includes auditing of login and logout (lo) events, administrative (ad) events, file transfer (ft) events, and command execution (ex) events. This recommendation also configures the Solaris auditing service to capture and report command line arguments (for command execution events) and the zone name in which a command was executed (for global and non-global zones). Further, this recommendation sets a disk utilization threshold of 1%. If this threshold is crossed (for the volume that includes /var/shares/audit), then a warning e-mail will be sent to advise the system administrators that audit events may be lost if the disk becomes full. Finally, this recommendation will also ensure that new audit trails are created at the start of each new day (to help keep the size of the files small to facilitate analysis). Rationale: The consensus settings described in this section are an effort to log interesting system events without consuming excessive amounts of resources logging significant but usually uninteresting system calls." solution : "To enforce this setting, use the commands: # auditconfig -conf # auditconfig -setflags lo,ad,ft,ex,cis # auditconfig -setnaflags lo # auditconfig -setpolicy cnt,argv,zonename # auditconfig -setplugin audit_binfile active p_minfree=1 # audit -s # rolemod -K audit_flags=lo,ad,ft,ex,cis:no root # EDITOR=ed crontab -e root << END_CRON $ a 0 0 * * * /usr/sbin/audit -n . w q END_CRON # chown root:root /var/shares/audit # chmod 750 /var/shares/audit" reference : "800-171|3.3.1,800-171|3.3.2,800-53|AU-2.,CIS_Recommendation|4.5,CN-L3|8.1.4.3(a),CSCv7|6.2,CSF|PR.PT-1,ITSG-33|AU-2,LEVEL|1S,NESA|M1.2.2,NESA|M5.5.1,NIAv2|AM7,NIAv2|AM11a,NIAv2|AM11b,NIAv2|AM11c,NIAv2|AM11d,NIAv2|AM11e,NIAv2|SS30,NIAv2|VL8,QCSC-v1|8.2.1,QCSC-v1|13.2,SWIFT-CSCv1|6.4" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/crontab -l root | /usr/bin/grep '/usr/sbin/audit' | /usr/bin/awk '{ print } END { if (NR == 0) print \"not found\" }'" expect : "^[\\s]*[0-9]+[\\s]*[0-9+]+[\\s]*\\*[\\s]*\\*[\\s]*\\*[\\s]*/usr/sbin/audit[\\s]*-n[\\s]*$" system : "SunOS" description : "5.1 Set Sticky Bit on World Writable Directories" info : "When the so-called sticky bit (set with chmod +t) is set on a directory, then only the owner of a file may remove that file from the directory (as opposed to the usual behavior where anybody with write access to that directory may remove the file). Rationale: ob体育s in directories that have had the 'sticky bit' set, can only be deleted by users that have both write permissions for the directory in which the file resides, as well as ownership of the file or directory, or has sufficient privilege. As this prevents users from overwriting each other's files, whether it be accidental or malicious, it is generally appropriate for most world-writable directories (e.g., /tmp). However, consult appropriate vendor documentation before blindly applying the sticky bit to any world writable directories found, in order to avoid breaking any application dependencies on a given directory." solution : "To set the sticky bit on a directory, run the following command: # chmod +t [directory name]" reference : "800-171|3.1.5,800-53|AC-6.,CIS_Recommendation|5.1,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|14.6,CSF|PR.AC-4,CSF|PR.DS-5,ITSG-33|AC-6,LEVEL|1NS,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|7.1.2,PCI-DSSv3.2|7.1.2,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|13.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "find_world_writeable_directories" system : "SunOS" type : SVC_PROP description : "6.1 Disable login: Services on Serial Ports - terma" info : "The svccfg command provides service administration for the lower level of the Service Access Facility hierarchy and can be used to disable the ability to login on a particular port. Rationale: Login services should not be enabled on any serial ports that are not strictly required to support the mission of the system. This action can be safely performed even when console access is provided using a serial port." solution : "Perform the following to implement the recommended state: # svcadm disable svc:/system/console-login:terma # svcadm disable svc:/system/console-login:termb" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|6.1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "/system/console-login:terma" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL system : "SunOS" type : SVC_PROP description : "6.1 Disable login: Services on Serial Ports - termb" info : "The svccfg command provides service administration for the lower level of the Service Access Facility hierarchy and can be used to disable the ability to login on a particular port. Rationale: Login services should not be enabled on any serial ports that are not strictly required to support the mission of the system. This action can be safely performed even when console access is provided using a serial port." solution : "Perform the following to implement the recommended state: # svcadm disable svc:/system/console-login:terma # svcadm disable svc:/system/console-login:termb" reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|6.1,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|9.2,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" service : "/system/console-login:termb" regex : "disabled" property : "restarter/state" svcprop_option : CAN_BE_NULL type : CMD_EXEC description : "Check for SPARC" cmd : "/usr/sbin/uname -p" expect : "[Ss][Pp][Aa][Rr][Cc]" system : "SunOS" type : CMD_EXEC description : "6.2 Set EEPROM Security Mode and Log Failed Access (SPARC) - security-mode" info : "Oracle SPARC systems support the use of an EEPROM password for the console. Rationale: Setting the EEPROM password helps prevent attackers who gain physical access to the system console from booting from an external device (such as a CD-ROM or floppy)." solution : "Perform the following to implement the recommended state: # eeprom security-mode=command # eeprom security-#badlogins=0 After entering the last command above, the administrator will be prompted for a password. This password will be required to authorize any future command issued at boot-level on the system (the ok or > prompt) except for the normal multi-user boot command (i.e., the system will be able to reboot unattended). Write down the password and store it in a sealed envelope in a secure location (note that locked desk drawers are typically not secure). If the password is lost or forgotten, simply log into the system and run the command: # eeprom security-mode=none This will erase the forgotten password. If the password is lost or forgotten and this action cannot be completed, then the EEPROM must be replaced to gain access to the system. To set a new password, run the command: # eeprom security-mode=command Impact: If the EEPROM password is lost or forgotten and # eeprom security-mode=none cannot be completed, then the EEPROM must be replaced to gain access to the system" reference : "800-53|SI-7(9),CIS_Recommendation|6.2,CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|5.1,CSF|PR.DS-6,ITSG-33|SI-7,ITSG-33|SI-7a.,LEVEL|1NS,NESA|T3.4.1,NESA|T7.3.2,NESA|T7.3.3,QCSC-v1|3.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/eeprom security-mode" expect : "^security-mode=(command|full)$" system : "SunOS" type : CMD_EXEC description : "6.2 Set EEPROM Security Mode and Log Failed Access (SPARC) - security-#badlogins" info : "Oracle SPARC systems support the use of an EEPROM password for the console. Rationale: Setting the EEPROM password helps prevent attackers who gain physical access to the system console from booting from an external device (such as a CD-ROM or floppy)." solution : "Perform the following to implement the recommended state: # eeprom security-mode=command # eeprom security-#badlogins=0 After entering the last command above, the administrator will be prompted for a password. This password will be required to authorize any future command issued at boot-level on the system (the ok or > prompt) except for the normal multi-user boot command (i.e., the system will be able to reboot unattended). Write down the password and store it in a sealed envelope in a secure location (note that locked desk drawers are typically not secure). If the password is lost or forgotten, simply log into the system and run the command: # eeprom security-mode=none This will erase the forgotten password. If the password is lost or forgotten and this action cannot be completed, then the EEPROM must be replaced to gain access to the system. To set a new password, run the command: # eeprom security-mode=command Impact: If the EEPROM password is lost or forgotten and # eeprom security-mode=none cannot be completed, then the EEPROM must be replaced to gain access to the system" reference : "800-53|SI-7(9),CIS_Recommendation|6.2,CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|5.1,CSF|PR.DS-6,ITSG-33|SI-7,ITSG-33|SI-7a.,LEVEL|1NS,NESA|T3.4.1,NESA|T7.3.2,NESA|T7.3.3,QCSC-v1|3.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/eeprom security-#badlogins" expect : "^security-#badlogins=0$" description : "6.2 Set EEPROM Security Mode and Log Failed Access (SPARC) - security-mode" info : "Oracle SPARC systems support the use of an EEPROM password for the console. Rationale: Setting the EEPROM password helps prevent attackers who gain physical access to the system console from booting from an external device (such as a CD-ROM or floppy). NOTE: Nessus has not identified that this is a SPARC target. This check is not applicable." solution : "Perform the following to implement the recommended state: # eeprom security-mode=command # eeprom security-#badlogins=0 After entering the last command above, the administrator will be prompted for a password. This password will be required to authorize any future command issued at boot-level on the system (the ok or > prompt) except for the normal multi-user boot command (i.e., the system will be able to reboot unattended). Write down the password and store it in a sealed envelope in a secure location (note that locked desk drawers are typically not secure). If the password is lost or forgotten, simply log into the system and run the command: # eeprom security-mode=none This will erase the forgotten password. If the password is lost or forgotten and this action cannot be completed, then the EEPROM must be replaced to gain access to the system. To set a new password, run the command: # eeprom security-mode=command Impact: If the EEPROM password is lost or forgotten and # eeprom security-mode=none cannot be completed, then the EEPROM must be replaced to gain access to the system" reference : "800-53|SI-7(9),CIS_Recommendation|6.2,CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|5.1,CSF|PR.DS-6,ITSG-33|SI-7,ITSG-33|SI-7a.,LEVEL|1NS,NESA|T3.4.1,NESA|T7.3.2,NESA|T7.3.3,QCSC-v1|3.2" see_also : "https://workbench.cisecurity.org/files/2582" description : "6.2 Set EEPROM Security Mode and Log Failed Access (SPARC) - security-#badlogins" info : "Oracle SPARC systems support the use of an EEPROM password for the console. Rationale: Setting the EEPROM password helps prevent attackers who gain physical access to the system console from booting from an external device (such as a CD-ROM or floppy). NOTE: Nessus has not identified that this is a SPARC target. This check is not applicable." solution : "Perform the following to implement the recommended state: # eeprom security-mode=command # eeprom security-#badlogins=0 After entering the last command above, the administrator will be prompted for a password. This password will be required to authorize any future command issued at boot-level on the system (the ok or > prompt) except for the normal multi-user boot command (i.e., the system will be able to reboot unattended). Write down the password and store it in a sealed envelope in a secure location (note that locked desk drawers are typically not secure). If the password is lost or forgotten, simply log into the system and run the command: # eeprom security-mode=none This will erase the forgotten password. If the password is lost or forgotten and this action cannot be completed, then the EEPROM must be replaced to gain access to the system. To set a new password, run the command: # eeprom security-mode=command Impact: If the EEPROM password is lost or forgotten and # eeprom security-mode=none cannot be completed, then the EEPROM must be replaced to gain access to the system" reference : "800-53|SI-7(9),CIS_Recommendation|6.2,CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|5.1,CSF|PR.DS-6,ITSG-33|SI-7,ITSG-33|SI-7a.,LEVEL|1NS,NESA|T3.4.1,NESA|T7.3.2,NESA|T7.3.3,QCSC-v1|3.2" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : FILE_CHECK_NOT description : "6.3 Restrict at/cron to Authorized Users - cron.deny" info : "The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. Rationale: On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs. Much more effective access controls for the cron system can be obtained by using Role-Based Access Controls (RBAC)." solution : "Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow." reference : "800-171|3.1.7,800-53|AC-6(10),CIP|007-6-R1,CIS_Recommendation|6.3,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv6|9.1,CSCv7|14.6,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/cron.d/cron.deny" system : "SunOS" type : FILE_CHECK_NOT description : "6.3 Restrict at/cron to Authorized Users - at.deny" info : "The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. Rationale: On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs. Much more effective access controls for the cron system can be obtained by using Role-Based Access Controls (RBAC)." solution : "Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow." reference : "800-171|3.1.7,800-53|AC-6(10),CIP|007-6-R1,CIS_Recommendation|6.3,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv6|9.1,CSCv7|14.6,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/at.deny" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.3 Restrict at/cron to Authorized Users - cron.allow" info : "The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. Rationale: On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs. Much more effective access controls for the cron system can be obtained by using Role-Based Access Controls (RBAC)." solution : "Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow." reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|6.3,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|14.6,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/cron.d/cron.allow" regex : "^root[\\s]*$" expect : "^root[\\s]*$" file_required : YES system : "SunOS" type : CMD_EXEC description : "6.3 Restrict at/cron to Authorized Users" info : "The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. Rationale: On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs. Much more effective access controls for the cron system can be obtained by using Role-Based Access Controls (RBAC)." solution : "Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow." reference : "800-171|3.1.5,800-53|AC-6,CIS_Recommendation|6.3,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|14.6,CSF|PR.AC-4,CSF|PR.DS-5,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|13.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/wc -l /etc/cron.d/at.allow | /usr/bin/awk '{ print $1 }'" expect : "0" system : "SunOS" type : FILE_CHECK description : "6.3 Restrict at/cron to Authorized Users - cron.allow permissions" info : "The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. Rationale: On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs. Much more effective access controls for the cron system can be obtained by using Role-Based Access Controls (RBAC)." solution : "Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow." reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|6.3,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv6|3.1,CSCv7|14.6,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/cron.d/cron.allow" owner : "root" mask : "377" group : "root" system : "SunOS" type : FILE_CHECK description : "6.3 Restrict at/cron to Authorized Users - at.allow permissions" info : "The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. Rationale: On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs. Much more effective access controls for the cron system can be obtained by using Role-Based Access Controls (RBAC)." solution : "Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow." reference : "800-171|3.1.7,800-53|AC-6(10),CIS_Recommendation|6.3,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv6|3.1,CSCv7|14.6,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/cron.d/at.allow" owner : "root" mask : "377" group : "root" type : CMD_EXEC description : "Gnome installed" cmd : "/usr/bin/pkg list consolidation/desktop/gnome-incorporation" expect : "^consolidation/desktop/gnome-incorporation" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.4 Set Default Screen Lock for GNOME Users - timeout" info : "The timeout parameter dictates the invocation of a password-protected screen saver after a specified time of keyboard and mouse inactivity, specific to the xscreensaver application used in the GNOME windowing environment. Rationale: As a screensaver timeout provides protection for a desktop that has not been locked by the user upon his/her departure, to help prevent session hijacking, this value should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /usr/share/X11/app-defaults # cp XScreenSaver XScreenSaver.orig # awk '/^\*timeout:/ { $2 = \"0:10:00\" } /^\*lockTimeout:/ { $2 = \"0:00:00\" } /^\*lock:/ { $2 = \"True\" } { print }' xScreenSaver > xScreenSaver.CIS # mv xScreenSaver.CIS xScreenSaver" reference : "800-171|3.1.10,800-53|AC-11.,CIS_Recommendation|6.4,CN-L3|8.1.4.1(b),CSCv6|16.5,CSCv7|16.11,ISO/IEC-27001|A.11.2.8,ITSG-33|AC-11,LEVEL|1S,NIAv2|AM23c,NIAv2|AM23d" see_also : "https://workbench.cisecurity.org/files/2582" file : "/usr/share/X11/app-defaults/XScreenSaver" regex : "^[\\s]*\\*timeout[\\s]*:" expect : "^[\\s]*\\*timeout[\\s]*:[\\s]*0:(0[0-9]|10):00[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.4 Set Default Screen Lock for GNOME Users - lockTimeout" info : "The timeout parameter dictates the invocation of a password-protected screen saver after a specified time of keyboard and mouse inactivity, specific to the xscreensaver application used in the GNOME windowing environment. Rationale: As a screensaver timeout provides protection for a desktop that has not been locked by the user upon his/her departure, to help prevent session hijacking, this value should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /usr/share/X11/app-defaults # cp XScreenSaver XScreenSaver.orig # awk '/^\*timeout:/ { $2 = \"0:10:00\" } /^\*lockTimeout:/ { $2 = \"0:00:00\" } /^\*lock:/ { $2 = \"True\" } { print }' xScreenSaver > xScreenSaver.CIS # mv xScreenSaver.CIS xScreenSaver" reference : "800-171|3.1.10,800-53|AC-11.,CIS_Recommendation|6.4,CN-L3|8.1.4.1(b),CSCv6|16.5,CSCv7|16.11,ISO/IEC-27001|A.11.2.8,ITSG-33|AC-11,LEVEL|1S,NIAv2|AM23c,NIAv2|AM23d" see_also : "https://workbench.cisecurity.org/files/2582" file : "/usr/share/X11/app-defaults/XScreenSaver" regex : "^[\\s]*\\*lockTimeout[\\s]*:" expect : "^[\\s]*\\*lockTimeout[\\s]*:[\\s]*0:00:00[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.4 Set Default Screen Lock for GNOME Users - lock true" info : "The timeout parameter dictates the invocation of a password-protected screen saver after a specified time of keyboard and mouse inactivity, specific to the xscreensaver application used in the GNOME windowing environment. Rationale: As a screensaver timeout provides protection for a desktop that has not been locked by the user upon his/her departure, to help prevent session hijacking, this value should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /usr/share/X11/app-defaults # cp XScreenSaver XScreenSaver.orig # awk '/^\*timeout:/ { $2 = \"0:10:00\" } /^\*lockTimeout:/ { $2 = \"0:00:00\" } /^\*lock:/ { $2 = \"True\" } { print }' xScreenSaver > xScreenSaver.CIS # mv xScreenSaver.CIS xScreenSaver" reference : "800-171|3.1.10,800-53|AC-11.,CIS_Recommendation|6.4,CN-L3|8.1.4.1(b),CSCv6|16.5,CSCv7|16.11,ISO/IEC-27001|A.11.2.8,ITSG-33|AC-11,LEVEL|1S,NIAv2|AM23c,NIAv2|AM23d" see_also : "https://workbench.cisecurity.org/files/2582" file : "/usr/openwin/lib/app-defaults/XScreenSaver" regex : "^\\*lock:\\s*" expect : "^\\*lock:\\s*([Tt][Rr][Uu][Ee])" system : "SunOS" type : FILE_CONTENT_CHECK_NOT description : "6.5 Remove Autologin Capabilities from the GNOME desktop" info : "The GNOME Display Manager is used for login session management. See the manual page gdm(1) for more information. By default, GNOME automatic login is defined in /etc/pam.d/gdm-autologin to allow users to access the system without a password. Rationale: As automatic logins are a known security risk for other than \"kiosk\" types of systems, GNOME automatic login should be disabled in /etc/pam.d/gdm-autologin." solution : "Comment out or remove all lines from /etc/pam.d/gdm-autologin: # cp /etc/pam.d/gdm-autologin /etc/pam.d/gdm-autologin.orig # awk '{ if ( $1 ~ /auth/ || $1 ~ /account/) $1 = \"#\"$1 } { print };' /etc/pam.d/gdm-autologin > /etc/pam.d/gdm-autologin.CIS # cp /etc/pam.d/gdm-autologin.CIS /etc/pam.d/gdm-autologin" reference : "800-53|AC-14a.,CIS_Recommendation|6.5,CSCv7|16.8,ITSG-33|AC-14a.,LEVEL|1S,NESA|T5.6.1,QCSC-v1|5.2.2,QCSC-v1|13.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/pam.d/gdm-autologin" regex : ".*" expect : "^[\\s]*[^#]" file_required : NO description : "6.4 Set Default Screen Lock for GNOME Users - timeout" info : "The timeout parameter dictates the invocation of a password-protected screen saver after a specified time of keyboard and mouse inactivity, specific to the xscreensaver application used in the GNOME windowing environment. Rationale: As a screensaver timeout provides protection for a desktop that has not been locked by the user upon his/her departure, to help prevent session hijacking, this value should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /usr/share/X11/app-defaults # cp XScreenSaver XScreenSaver.orig # awk '/^\*timeout:/ { $2 = \"0:10:00\" } /^\*lockTimeout:/ { $2 = \"0:00:00\" } /^\*lock:/ { $2 = \"True\" } { print }' xScreenSaver > xScreenSaver.CIS # mv xScreenSaver.CIS xScreenSaver" reference : "800-171|3.1.10,800-53|AC-11.,CIS_Recommendation|6.4,CN-L3|8.1.4.1(b),CSCv6|16.5,CSCv7|16.11,ISO/IEC-27001|A.11.2.8,ITSG-33|AC-11,LEVEL|1S,NIAv2|AM23c,NIAv2|AM23d" see_also : "https://workbench.cisecurity.org/files/2582" description : "6.4 Set Default Screen Lock for GNOME Users - lockTimeout" info : "The timeout parameter dictates the invocation of a password-protected screen saver after a specified time of keyboard and mouse inactivity, specific to the xscreensaver application used in the GNOME windowing environment. Rationale: As a screensaver timeout provides protection for a desktop that has not been locked by the user upon his/her departure, to help prevent session hijacking, this value should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /usr/share/X11/app-defaults # cp XScreenSaver XScreenSaver.orig # awk '/^\*timeout:/ { $2 = \"0:10:00\" } /^\*lockTimeout:/ { $2 = \"0:00:00\" } /^\*lock:/ { $2 = \"True\" } { print }' xScreenSaver > xScreenSaver.CIS # mv xScreenSaver.CIS xScreenSaver" reference : "800-171|3.1.10,800-53|AC-11.,CIS_Recommendation|6.4,CN-L3|8.1.4.1(b),CSCv6|16.5,CSCv7|16.11,ISO/IEC-27001|A.11.2.8,ITSG-33|AC-11,LEVEL|1S,NIAv2|AM23c,NIAv2|AM23d" see_also : "https://workbench.cisecurity.org/files/2582" description : "6.4 Set Default Screen Lock for GNOME Users - lock true" info : "The timeout parameter dictates the invocation of a password-protected screen saver after a specified time of keyboard and mouse inactivity, specific to the xscreensaver application used in the GNOME windowing environment. Rationale: As a screensaver timeout provides protection for a desktop that has not been locked by the user upon his/her departure, to help prevent session hijacking, this value should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /usr/share/X11/app-defaults # cp XScreenSaver XScreenSaver.orig # awk '/^\*timeout:/ { $2 = \"0:10:00\" } /^\*lockTimeout:/ { $2 = \"0:00:00\" } /^\*lock:/ { $2 = \"True\" } { print }' xScreenSaver > xScreenSaver.CIS # mv xScreenSaver.CIS xScreenSaver" reference : "800-171|3.1.10,800-53|AC-11.,CIS_Recommendation|6.4,CN-L3|8.1.4.1(b),CSCv6|16.5,CSCv7|16.11,ISO/IEC-27001|A.11.2.8,ITSG-33|AC-11,LEVEL|1S,NIAv2|AM23c,NIAv2|AM23d" see_also : "https://workbench.cisecurity.org/files/2582" description : "6.5 Remove Autologin Capabilities from the GNOME desktop" info : "The GNOME Display Manager is used for login session management. See the manual page gdm(1) for more information. By default, GNOME automatic login is defined in /etc/pam.d/gdm-autologin to allow users to access the system without a password. Rationale: As automatic logins are a known security risk for other than \"kiosk\" types of systems, GNOME automatic login should be disabled in /etc/pam.d/gdm-autologin." solution : "Comment out or remove all lines from /etc/pam.d/gdm-autologin: # cp /etc/pam.d/gdm-autologin /etc/pam.d/gdm-autologin.orig # awk '{ if ( $1 ~ /auth/ || $1 ~ /account/) $1 = \"#\"$1 } { print };' /etc/pam.d/gdm-autologin > /etc/pam.d/gdm-autologin.CIS # cp /etc/pam.d/gdm-autologin.CIS /etc/pam.d/gdm-autologin" reference : "800-53|AC-14a.,CIS_Recommendation|6.5,CSCv7|16.8,ITSG-33|AC-14a.,LEVEL|1S,NESA|T5.6.1,QCSC-v1|5.2.2,QCSC-v1|13.2" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.6 Set Delay between Failed Login Attempts to 4" info : "The SLEEPTIME variable in the /etc/default/login file controls the number of seconds to wait before printing the \"login incorrect\" message when a bad password is provided. The default value for SLEEPTIME is 4 seconds. Rationale: As an immediate return of an error message, coupled with the capability to try again may facilitate automatic and rapid-fire brute-force password attacks by a malicious user, this delay time should be set as appropriate to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /etc/default # cp login login.orig # awk '/SLEEPTIME=/ { $1 = \"SLEEPTIME=4\" } { print }' login > login.CIS # mv login.CIS login" reference : "800-171|3.1.8,800-53|AC-7a.,CIS_Recommendation|6.6,CN-L3|8.1.4.1(b),CSCv6|16.7,CSCv7|5.1,ITSG-33|AC-7a.,LEVEL|1S,NESA|T5.5.1,NIAv2|AM24,TBA-FIISB|45.1.2,TBA-FIISB|45.2.1,TBA-FIISB|45.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/login" regex : "^[\\s]*SLEEPTIME[\\s]*=" expect : "^[\\s]*SLEEPTIME[\\s]*=[\\s]*[4][\\s]*$" string_required : NO system : "SunOS" type : FILE_CONTENT_CHECK description : "6.7 Disable Rhost-based Authentication for SSH" info : "The IgnoreRhosts parameter specifies that existing .rhosts and .shosts files, which may apply to application rather than user logins, will not be used in RhostsRSAAuthentication or HostbasedAuthentication. Rationale: Setting this parameter forces users to enter a password when authenticating with SSH." solution : "Perform the following to implement the recommended state: # awk '/^IgnoreRhosts/ { $2 = \"yes\" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh This action will only set the IgnoreRhosts line if it already exists in the file to ensure that it is set to the proper value. If the IgnoreRhosts line does not exist in the file, the default setting of Yes is automatically used, so no additional changes are needed." reference : "800-171|3.5.2,800-53|AC-14a.,800-53|IA-5.,CIS_Recommendation|6.7,CSCv7|9.2,CSF|PR.AC-1,ITSG-33|AC-14a.,ITSG-33|IA-5,LEVEL|1S,NESA|T5.2.3,NESA|T5.6.1,QCSC-v1|5.2.2,QCSC-v1|13.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/ssh/sshd_config" regex : "^[\\s]*IgnoreRhosts[\\s]" expect : "^[\\s]*IgnoreRhosts[\\s]+[yY][eE][sS][\\s]*$" system : "SunOS" type : CMD_EXEC description : "6.8 Restrict FTP Use" info : "If FTP is permitted to be used on the system, the file /etc/ftpd/ftpusers is used to specify a list of users who are not allowed to access the system via FTP. Rationale: FTP is an old and insecure protocol that transfers files and credentials in clear text and can be replaced by using sftp. However, if FTP is permitted for use in your environment, it is important to ensure that the default \"system\" accounts are not permitted to transfer files via FTP, especially the root role. Consider also adding the names of other privileged or shared accounts that may exist on your system such as user oracle and the account which your Web server process runs under. It should be reminded that the Solaris FTP service is disabled by default." solution : "Perform the following to implement the recommended state: # cd /etc/ftpd # cp ftpusers ftpusers.orig # for user in `logins -s | awk '{ print $1 }'` aiuser noaccess nobody nobody4; do $(echo $user >> ftpusers) done # sort -u ftpusers > ftpusers.CIS # mv ftpusers.CIS ftpusers If your site policy states that users have to be authorized to use FTP, consider placing all users in the /etc/ftpd/ftpusers file and then explicitly removing those who are permitted to use the service. To accomplish this, use the command: # getent passwd | cut -f1 -d\":\" > /etc/ftpd/ftpusers This prohibits any user on the system from using ftp unless they are explicitly removed from the file. Note that this file will need to be updated as users are added to or removed from the system." reference : "800-171|3.1.6,800-53|AC-6(2),CIS_Recommendation|6.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|9.2,CSF|PR.AC-4,ITSG-33|AC-6(2),LEVEL|1S,NESA|T5.1.1,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/logins -s | /usr/bin/awk '{ print $1 } END { print \"aiuser\\\\nnoaccess\\\\nnobody\\\\nnobody4\" }' | /usr/bin/egrep -vf /etc/ftpd/ftpusers | /usr/bin/awk '{ print } END { if (NR == 0) print \"none\" }'" expect : "^none$" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.9 Disable root login for SSH" info : "The PermitRootLogin value (in /etc/ssh/sshd_config) allows for direct root login by a remote user/application to resources on the local host. Rationale: By default, it is not possible for the root account to log directly into the system console because the account is configured as a role. This setting therefore does not significantly alter the security posture of the system unless the root account is changed from this default and configured to be a normal user." solution : "Perform the following to implement the recommended state: # awk '/^PermitRootLogin/ { $2 = \"no\" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh" reference : "800-171|3.1.2,800-171|3.1.15,800-53|AC-17(4),CIS_Recommendation|6.9,CN-L3|8.1.4.4(c),CN-L3|8.1.10.6(i),CSCv7|16.8,CSF|PR.AC-3,CSF|PR.PT-4,ISO/IEC-27001|A.6.2.2,ITSG-33|AC-17(4),LEVEL|1S,NESA|T5.4.5,QCSC-v1|3.2,QCSC-v1|5.2.1,QCSC-v1|5.2.2,SWIFT-CSCv1|5.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/ssh/sshd_config" regex : "^[\\s]*PermitRootLogin[\\s]" expect : "^[\\s]*PermitRootLogin[\\s]+[nN][oO][\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK_NOT description : "6.10 Disable Host-based Authentication for Login-based Services" info : "The .rhosts files are used for automatic login to remote hosts and contain username and hostname combinations. The .rhosts files are unencrypted (usually group- or world- readable) and present a serious risk in that a malicious user could use the information within to gain access to a remote host with the privileges of the original application or user. Rationale: The use of .rhosts authentication is an old and insecure protocol and can be replaced with public-key authentication using Secure Shell. As automatic authentication settings in the .rhosts files can provide a malicious user with sensitive system credentials, the use of .rhosts files should be disabled. It should be noted that by default the Solaris services that use this file, including rsh and rlogin, are disabled by default." solution : "Edit /etc/pam.conf and any /etc/pam.d/* results from audit procedure and comment out or remove any pam_rhosts_auth lines: #rlogin auth sufficient pam_rhosts_auth.so.1 #rsh auth sufficient pam_rhosts_auth.so.1" reference : "800-53|AC-14a.,CIS_Recommendation|6.10,CSCv7|16.5,ITSG-33|AC-14a.,LEVEL|1S,NESA|T5.6.1,QCSC-v1|5.2.2,QCSC-v1|13.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/pam.conf" regex : "^[\\s]*[^#]*[\\s]*pam_rhosts_auth" expect : "^[\\s]*[^#]*[\\s]*pam_rhosts_auth" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.11 Blocking Authentication Using Empty/Null Passwords for SSH" info : "The PermitEmptyPasswords value allows for direct login through SSH without a password by a remote user/application to resources on the local host in the same way a standard remote login would. Rationale: Permitting login without a password is inherently risky." solution : "Perform the following to implement the recommended state: # awk '/^.PermitEmptyPasswords/ { $1 = \"PermitEmptyPasswords\" ; $2 = \"no\" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh" reference : "800-171|3.5.2,800-53|IA-5.,CIS_Recommendation|6.11,CSCv7|4.4,CSF|PR.AC-1,ITSG-33|IA-5,LEVEL|1S,NESA|T5.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/ssh/sshd_config" regex : "^[\\s]*PermitEmptyPasswords[\\s]" expect : "^[\\s]*PermitEmptyPasswords[\\s]+[nN][oO][\\s]*$" string_required : NO system : "SunOS" type : FILE_CONTENT_CHECK description : "6.12 Limit Consecutive Login Attempts for SSH" info : "The 'MaxAuthTries' parameter in the /etc/ssh/sshd_config file specifies the maximum number of authentication attempts permitted per connection. By restricting the number of failed authentication attempts before the server terminates the connection, malicious users are blocked from gaining access to the host by using repetitive brute-force login exploits. Rationale: By setting the authentication login limit to a low value this will disconnect the attacker and force a reconnect, which severely limits the speed of such brute force attacks." solution : "Perform the following to implement the recommended state: # awk '/MaxAuthTries/ { $1 = \"MaxAuthTries\"; $2 = \"6\" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh" reference : "800-171|3.1.8,800-53|AC-7a.,CIS_Recommendation|6.12,CN-L3|8.1.4.1(b),CSCv6|16.7,CSCv7|5.1,ITSG-33|AC-7a.,LEVEL|1S,NESA|T5.5.1,NIAv2|AM24,TBA-FIISB|45.1.2,TBA-FIISB|45.2.1,TBA-FIISB|45.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/ssh/sshd_config" regex : "^[\\s]*MaxAuthTries[\\s]" expect : "^[\\s]*MaxAuthTries[\\s]+[1-3][\\s]*$" string_required : NO system : "SunOS" type : FILE_CONTENT_CHECK description : "6.13 Disable X11 Forwarding for SSH" info : "The X11 Forwarding parameter defined within the /etc/ssh/sshd_config file specifies whether or not X11 Forwarding via SSH is enabled on the server: The Secure Shell service provides an encrypted 'tunnel' for the data traffic passing through it. While commonly used to substitute for clear-text, CLI-based remote connections such as telnet, Secure Shell can be used to forward an 'X Window' session through the encrypted tunnel, allowing the remote user to have a GUI interface. Rationale: As enabling X11Forwarding on the host can permit a malicious user to secretly open another X11 connection to another remote client during the session and perform unobtrusive activities such as keystroke monitoring, if the X11 services are not required for the system's intended function, it should be disabled or restricted as appropriate to the user's needs." solution : "Perform the following to implement the recommended state: # cp /etc/ssh/sshd_config /etc/ssh/sshd_config.orig # awk '/^X11Forwarding / { $2 = \"no\" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh" reference : "800-171|3.4.2,800-53|CM-6b.,CIP|007-6-R1,CIS_Recommendation|6.13,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|9.2,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/ssh/sshd_config" regex : "^[\\s]*X11Forwarding[\\s]" expect : "^[\\s]*X11Forwarding[\\s]+[nN][oO][\\s]*$" type : FILE_CHECK description : "Check that the keyserv file exists" file : "/etc/default/keyserv" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.14 Disable \"nobody\" Access for RPC Encryption Key Storage Service" info : "This action listed prevents keyserv from using default keys for the nobody user, effectively stopping the nobody user from accessing information via Secure RPC. Rationale: If login by the user nobody is allowed for secure RPC, there is an increased risk of system compromise. If keyserv holds a private key for the nobody user, it will be used by key_encryptsession to compute a magic phrase which can be easily recovered by a malicious user." solution : "Perform the following to implement the recommended state: # cd /etc/default # cp keyserv keyserv.orig # awk '/ENABLE_NOBODY_KEYS=/ { $1 = \"ENABLE_NOBODY_KEYS=NO\" } { print }' keyserv > keyserv.CIS # mv keyserv.CIS keyserv" reference : "800-171|3.4.2,800-171|3.13.10,800-53|CM-6b.,800-53|SC-12.,CIS_Recommendation|6.14,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|16.8,CSF|PR.IP-1,ISO/IEC-27001|A.10.1.2,ITSG-33|CM-6b.,ITSG-33|SC-12,ITSG-33|SC-12a.,LEVEL|1S,NESA|T3.2.1,NESA|T7.4.1,NESA|T7.4.2,NIAv2|CY2,NIAv2|CY8,NIAv2|CY9,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/keyserv" regex : "^[\\s]*ENABLE_NOBODY_KEYS" expect : "^[\\s]*ENABLE_NOBODY_KEYS[\\s]*=[\\s]*[nN][oO][\\s]*$" description : "6.14 Disable \"nobody\" Access for RPC Encryption Key Storage Service" info : "This action listed prevents keyserv from using default keys for the nobody user, effectively stopping the nobody user from accessing information via Secure RPC. Rationale: If login by the user nobody is allowed for secure RPC, there is an increased risk of system compromise. If keyserv holds a private key for the nobody user, it will be used by key_encryptsession to compute a magic phrase which can be easily recovered by a malicious user." solution : "Perform the following to implement the recommended state: # cd /etc/default # cp keyserv keyserv.orig # awk '/ENABLE_NOBODY_KEYS=/ { $1 = \"ENABLE_NOBODY_KEYS=NO\" } { print }' keyserv > keyserv.CIS # mv keyserv.CIS keyserv" reference : "800-171|3.4.2,800-171|3.13.10,800-53|CM-6b.,800-53|SC-12.,CIS_Recommendation|6.14,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|16.8,CSF|PR.IP-1,ISO/IEC-27001|A.10.1.2,ITSG-33|CM-6b.,ITSG-33|SC-12,ITSG-33|SC-12a.,LEVEL|1S,NESA|T3.2.1,NESA|T7.4.1,NESA|T7.4.2,NIAv2|CY2,NIAv2|CY8,NIAv2|CY9,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" type : CMD_EXEC description : "Check for i386 based architecture" cmd : "/usr/bin/uname -p" expect : "i386" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.15 Secure the GRUB Menu (Intel)" info : "GRUB is a boot loader for x64 based systems that permits loading an OS image from any location. Oracle x64 systems support the use of a GRUB Menu password for the console. Rationale: The flexibility that GRUB provides creates a security risk if its configuration is modified by an unauthorized user. The failsafe menu entry needs to be secured in the same environments that require securing the systems firmware to avoid unauthorized removable media boots. Setting the GRUB Menu password helps prevent attackers with physical access to the system console from booting off some external device (such as a CD- ROM or floppy) and subverting the security of the system. The actions described in this section will ensure you cannot get to failsafe or any of the GRUB command line options without first entering the password." solution : "Run the following command to generate your password hash: # /usr/lib/grub2/bios/bin/grub-mkpasswd-pbkdf2 Enter password: Reenter password: PBKDF2 hash of your password is Create the file /usr/lib/grub2/bios/etc/grub.d/01\_password: #!/bin/sh /usr/bin/cat > /rpool/boot/grub/password.cfg< EOF /usr/bin/chmod 600 /rpool/boot/grub/password.cfg /usr/bin/echo 'source /@/boot/grub/password.cfg' Run the following to finalize the password configuration and set menu timeout: # /usr/bin/chmod 700 /usr/lib/grub2/bios/etc/grub.d/01_password # /usr/sbin/bootadm set-menu timeout=30 Changes will take effect on the next reboot." reference : "800-53|SI-7(9),CIS_Recommendation|6.15,CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|5.1,CSF|PR.DS-6,ITSG-33|SI-7,ITSG-33|SI-7a.,LEVEL|1S,NESA|T3.4.1,NESA|T7.3.2,NESA|T7.3.3,QCSC-v1|3.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/rpool/boot/grub/grub.cfg" regex : "^[\\s]*source[\\s]/@/boot/grub/password.cfg[\\s]*$" expect : "^[\\s]*source[\\s]/@/boot/grub/password.cfg[\\s]*$" description : "6.15 Secure the GRUB Menu (Intel)" info : "GRUB is a boot loader for x64 based systems that permits loading an OS image from any location. Oracle x64 systems support the use of a GRUB Menu password for the console. Rationale: The flexibility that GRUB provides creates a security risk if its configuration is modified by an unauthorized user. The failsafe menu entry needs to be secured in the same environments that require securing the systems firmware to avoid unauthorized removable media boots. Setting the GRUB Menu password helps prevent attackers with physical access to the system console from booting off some external device (such as a CD- ROM or floppy) and subverting the security of the system. The actions described in this section will ensure you cannot get to failsafe or any of the GRUB command line options without first entering the password." solution : "Run the following command to generate your password hash: # /usr/lib/grub2/bios/bin/grub-mkpasswd-pbkdf2 Enter password: Reenter password: PBKDF2 hash of your password is Create the file /usr/lib/grub2/bios/etc/grub.d/01\_password: #!/bin/sh /usr/bin/cat > /rpool/boot/grub/password.cfg< EOF /usr/bin/chmod 600 /rpool/boot/grub/password.cfg /usr/bin/echo 'source /@/boot/grub/password.cfg' Run the following to finalize the password configuration and set menu timeout: # /usr/bin/chmod 700 /usr/lib/grub2/bios/etc/grub.d/01_password # /usr/sbin/bootadm set-menu timeout=30 Changes will take effect on the next reboot." reference : "800-53|SI-7(9),CIS_Recommendation|6.15,CN-L3|8.1.2.3,CN-L3|8.1.4.6,CSCv7|5.1,CSF|PR.DS-6,ITSG-33|SI-7,ITSG-33|SI-7a.,LEVEL|1S,NESA|T3.4.1,NESA|T7.3.2,NESA|T7.3.3,QCSC-v1|3.2" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.16 Restrict root Login to System Console" info : "Privileged access to the system via root must be accountable to a particular user. Rationale: Use an authorized mechanism such as RBAC and the su command to provide administrative access to unprivileged accounts. These mechanisms provide an audit trail in the event of problems." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/CONSOLE=/ { print \"CONSOLE=/dev/console\"; next }; { print }' login > login.CIS # mv login.CIS login" reference : "800-171|3.1.5,800-53|AC-6(3),CIS_Recommendation|6.16,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|16.8,CSF|PR.AC-4,ISO/IEC-27001|A.9.1.2,ISO/IEC-27001|A.9.4.4,ITSG-33|AC-6(3),LEVEL|1S,NESA|T5.1.1,NESA|T5.5.4,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/login" regex : "^[\\s]*[^#]*CONSOLE[\\s]*=.*" expect : "CONSOLE[\\s]*=[\\s]*/dev/console" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.17 Set Retry Limit for Account Lockout - RETRIES" info : "The RETRIES parameter is the number of failed login attempts a user is allowed before being disconnected from the system and forced to reconnect. When LOCK_AFTER_RETRIES is set in /etc/security/policy.conf, then the user's account is locked after this many failed retries (the account can only be unlocked by the administrator using the command: passwd -u . The account lockout threshold (RETRIES parameter) restricts the number of failed login attempts allowed before requiring the offending account be locked. The lockout requirement will help block malicious users from gaining access to the host via automated, repetitive brute-force login exploits--trying different passwords until one fits a user name. Rationale: Setting the failed login limit to an appropriate value locks the user account, which will severely limit the speed of such attacks, making it much more likely that the attacker's pattern will be noticed and the offending source address and/or port blocked, so this should be set according to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/RETRIES=/ { $1 = \"RETRIES=3\" } { print }' login >login.CIS # mv login.CIS login # cd /etc/security # awk '/LOCK_AFTER_RETRIES=/ { $1 = \"LOCK_AFTER_RETRIES=YES\" } { print }' policy.conf > policy.conf.CIS # mv policy.conf.CIS policy.conf # svcadm restart svc:/system/name-service/cache Be careful when enabling these settings as they can create a denial-of-service situation for legitimate users and applications. Account lockout can be disabled for specific users via the usermod command. For example, the following command disables account lock specifically for the oracle account: # usermod -K lock_after_retries=no oracle Note: The root role is configured in this manner by default to prevent accidental lock out. Notes: The action specified here sets the lockout limit at 3, which complies with NSA/DISA recommendations, but may be too restrictive for some organizations." reference : "800-171|3.1.8,800-53|AC-7a.,CIS_Recommendation|6.17,CN-L3|8.1.4.1(b),CSCv6|16.7,CSCv7|16.7,ITSG-33|AC-7a.,LEVEL|1S,NESA|T5.5.1,NIAv2|AM24,TBA-FIISB|45.1.2,TBA-FIISB|45.2.1,TBA-FIISB|45.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/login" regex : "^[\\s]*RETRIES[\\s]*=" expect : "^[\\s]*RETRIES[\\s]*=[\\s]*[1-3][\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "6.17 Set Retry Limit for Account Lockout - LOCK_AFTER_RETRIES" info : "The RETRIES parameter is the number of failed login attempts a user is allowed before being disconnected from the system and forced to reconnect. When LOCK_AFTER_RETRIES is set in /etc/security/policy.conf, then the user's account is locked after this many failed retries (the account can only be unlocked by the administrator using the command: passwd -u . The account lockout threshold (RETRIES parameter) restricts the number of failed login attempts allowed before requiring the offending account be locked. The lockout requirement will help block malicious users from gaining access to the host via automated, repetitive brute-force login exploits--trying different passwords until one fits a user name. Rationale: Setting the failed login limit to an appropriate value locks the user account, which will severely limit the speed of such attacks, making it much more likely that the attacker's pattern will be noticed and the offending source address and/or port blocked, so this should be set according to the needs of the user." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/RETRIES=/ { $1 = \"RETRIES=3\" } { print }' login >login.CIS # mv login.CIS login # cd /etc/security # awk '/LOCK_AFTER_RETRIES=/ { $1 = \"LOCK_AFTER_RETRIES=YES\" } { print }' policy.conf > policy.conf.CIS # mv policy.conf.CIS policy.conf # svcadm restart svc:/system/name-service/cache Be careful when enabling these settings as they can create a denial-of-service situation for legitimate users and applications. Account lockout can be disabled for specific users via the usermod command. For example, the following command disables account lock specifically for the oracle account: # usermod -K lock_after_retries=no oracle Note: The root role is configured in this manner by default to prevent accidental lock out. Notes: The action specified here sets the lockout limit at 3, which complies with NSA/DISA recommendations, but may be too restrictive for some organizations." reference : "800-171|3.1.8,800-53|AC-7a.,CIS_Recommendation|6.17,CN-L3|8.1.4.1(b),CSCv6|16.7,CSCv7|16.7,ITSG-33|AC-7a.,LEVEL|1S,NESA|T5.5.1,NIAv2|AM24,TBA-FIISB|45.1.2,TBA-FIISB|45.2.1,TBA-FIISB|45.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/security/policy.conf" regex : "^[\\s]*LOCK_AFTER_RETRIES[\\s]*=" expect : "^[\\s]*LOCK_AFTER_RETRIES[\\s]*=[\\s]*[yY][eE][sS][\\s]*$" system : "SunOS" type : CMD_EXEC description : "7.1 Set Password Expiration Parameters on Active Accounts - Accounts" info : "The characteristics of an operating system that make 'user identification' via password a secure and workable solution is the combination of settings chosen. By requiring that a series of password-choices be security-centric, it reduces the risk of a malicious user breaking the password through dictionary/brute force attacks or fortuitous guessing based upon 'social engineering.' A basic password security strategy is requiring a new password to be chosen every 45-90 days, so that repeated attempts to gain entry by brute-force tactics will fail when a new password is chosen, which requires starting over again to break the new password. Rationale: The commands for this item set all active accounts (except the root account) to force password changes every 91 days (13 weeks), and then prevent password changes for seven days (one week), thereafter. Users will begin receiving warnings 7 days (1 week) before their password expires. Sites also have the option of expiring idle accounts after a certain number of days (see the on-line manual page for the usermod command, particularly the -f option)." solution : "Perform the following to implement the recommended state: # logins -ox | awk -F: '($1 == \"root\" || $8 == \"LK\" || $8 == \"NL\") { next } ; { cmd = \"passwd\" } ; ($11 < 91) { cmd = cmd \" -x 91\" } ($10 < 7) { cmd = cmd \" -n 7\" } ($12 < 28) { cmd = cmd \" -w 28\" } (cmd != \"passwd\") { print cmd \" \" $1 }' > /etc/CISupd_accounts # /sbin/sh /etc/CISupd_accounts # rm -f /etc/CISupd_accounts # cd /etc/default # cp passwd passwd.orig # grep -v WEEKS passwd > passwd.CIS # cat <> passwd.CIS MAXWEEKS=13 MINWEEKS=1 WARNWEEKS=1 EODefaults # mv passwd.CIS passwd Notes: Since /etc/default/passwd sets defaults in terms of number of weeks (even though the actual values on user accounts are kept in terms of days), it is probably best to choose interval values that are multiples of 7." reference : "800-171|3.5.2,800-53|IA-5(1)(d),CIP|007-6-R5.6,CIS_Recommendation|7.1,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|16.10,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(d),LEVEL|1S,NESA|T5.2.3,NIAv2|AM20,NIAv2|AM21,PCI-DSSv3.1|8.2.4,PCI-DSSv3.2|8.2.4,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/logins -ox | /usr/bin/awk -F: 'BEGIN { c=0 } ( $1 != \"root\" && $8 != \"LK\" && $8 != \"NL\" && ( $10 < 7 || $11 > 91 || $12 < 7 )) { print; c++ } END { if (c == 0) print \"none\" }'" expect : "^[\\s]*none[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.1 Set Password Expiration Parameters on Active Accounts - MAXWEEKS" info : "The characteristics of an operating system that make 'user identification' via password a secure and workable solution is the combination of settings chosen. By requiring that a series of password-choices be security-centric, it reduces the risk of a malicious user breaking the password through dictionary/brute force attacks or fortuitous guessing based upon 'social engineering.' A basic password security strategy is requiring a new password to be chosen every 45-90 days, so that repeated attempts to gain entry by brute-force tactics will fail when a new password is chosen, which requires starting over again to break the new password. Rationale: The commands for this item set all active accounts (except the root account) to force password changes every 91 days (13 weeks), and then prevent password changes for seven days (one week), thereafter. Users will begin receiving warnings 7 days (1 week) before their password expires. Sites also have the option of expiring idle accounts after a certain number of days (see the on-line manual page for the usermod command, particularly the -f option)." solution : "Perform the following to implement the recommended state: # logins -ox | awk -F: '($1 == \"root\" || $8 == \"LK\" || $8 == \"NL\") { next } ; { cmd = \"passwd\" } ; ($11 < 91) { cmd = cmd \" -x 91\" } ($10 < 7) { cmd = cmd \" -n 7\" } ($12 < 28) { cmd = cmd \" -w 28\" } (cmd != \"passwd\") { print cmd \" \" $1 }' > /etc/CISupd_accounts # /sbin/sh /etc/CISupd_accounts # rm -f /etc/CISupd_accounts # cd /etc/default # cp passwd passwd.orig # grep -v WEEKS passwd > passwd.CIS # cat <> passwd.CIS MAXWEEKS=13 MINWEEKS=1 WARNWEEKS=1 EODefaults # mv passwd.CIS passwd Notes: Since /etc/default/passwd sets defaults in terms of number of weeks (even though the actual values on user accounts are kept in terms of days), it is probably best to choose interval values that are multiples of 7." reference : "800-171|3.5.2,800-53|IA-5(1)(d),CIP|007-6-R5.6,CIS_Recommendation|7.1,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|16.10,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(d),LEVEL|1S,NESA|T5.2.3,NIAv2|AM20,NIAv2|AM21,PCI-DSSv3.1|8.2.4,PCI-DSSv3.2|8.2.4,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MAXWEEKS[\\s]*=" expect : "^[\\s]*MAXWEEKS[\\s]*=[\\s]*(13|1[0-2]|[1-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.1 Set Password Expiration Parameters on Active Accounts - MINWEEKS" info : "The characteristics of an operating system that make 'user identification' via password a secure and workable solution is the combination of settings chosen. By requiring that a series of password-choices be security-centric, it reduces the risk of a malicious user breaking the password through dictionary/brute force attacks or fortuitous guessing based upon 'social engineering.' A basic password security strategy is requiring a new password to be chosen every 45-90 days, so that repeated attempts to gain entry by brute-force tactics will fail when a new password is chosen, which requires starting over again to break the new password. Rationale: The commands for this item set all active accounts (except the root account) to force password changes every 91 days (13 weeks), and then prevent password changes for seven days (one week), thereafter. Users will begin receiving warnings 7 days (1 week) before their password expires. Sites also have the option of expiring idle accounts after a certain number of days (see the on-line manual page for the usermod command, particularly the -f option)." solution : "Perform the following to implement the recommended state: # logins -ox | awk -F: '($1 == \"root\" || $8 == \"LK\" || $8 == \"NL\") { next } ; { cmd = \"passwd\" } ; ($11 < 91) { cmd = cmd \" -x 91\" } ($10 < 7) { cmd = cmd \" -n 7\" } ($12 < 28) { cmd = cmd \" -w 28\" } (cmd != \"passwd\") { print cmd \" \" $1 }' > /etc/CISupd_accounts # /sbin/sh /etc/CISupd_accounts # rm -f /etc/CISupd_accounts # cd /etc/default # cp passwd passwd.orig # grep -v WEEKS passwd > passwd.CIS # cat <> passwd.CIS MAXWEEKS=13 MINWEEKS=1 WARNWEEKS=1 EODefaults # mv passwd.CIS passwd Notes: Since /etc/default/passwd sets defaults in terms of number of weeks (even though the actual values on user accounts are kept in terms of days), it is probably best to choose interval values that are multiples of 7." reference : "800-171|3.5.2,800-53|IA-5(1)(d),CIP|007-6-R5.6,CIS_Recommendation|7.1,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|16.10,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(d),LEVEL|1S,NESA|T5.2.3,NIAv2|AM20,NIAv2|AM21,PCI-DSSv3.1|8.2.4,PCI-DSSv3.2|8.2.4,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MINWEEKS[\\s]*=" expect : "^[\\s]*MINWEEKS[\\s]*=[\\s]*[1-9][\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.1 Set Password Expiration Parameters on Active Accounts - WARNWEEKS" info : "The characteristics of an operating system that make 'user identification' via password a secure and workable solution is the combination of settings chosen. By requiring that a series of password-choices be security-centric, it reduces the risk of a malicious user breaking the password through dictionary/brute force attacks or fortuitous guessing based upon 'social engineering.' A basic password security strategy is requiring a new password to be chosen every 45-90 days, so that repeated attempts to gain entry by brute-force tactics will fail when a new password is chosen, which requires starting over again to break the new password. Rationale: The commands for this item set all active accounts (except the root account) to force password changes every 91 days (13 weeks), and then prevent password changes for seven days (one week), thereafter. Users will begin receiving warnings 7 days (1 week) before their password expires. Sites also have the option of expiring idle accounts after a certain number of days (see the on-line manual page for the usermod command, particularly the -f option)." solution : "Perform the following to implement the recommended state: # logins -ox | awk -F: '($1 == \"root\" || $8 == \"LK\" || $8 == \"NL\") { next } ; { cmd = \"passwd\" } ; ($11 < 91) { cmd = cmd \" -x 91\" } ($10 < 7) { cmd = cmd \" -n 7\" } ($12 < 28) { cmd = cmd \" -w 28\" } (cmd != \"passwd\") { print cmd \" \" $1 }' > /etc/CISupd_accounts # /sbin/sh /etc/CISupd_accounts # rm -f /etc/CISupd_accounts # cd /etc/default # cp passwd passwd.orig # grep -v WEEKS passwd > passwd.CIS # cat <> passwd.CIS MAXWEEKS=13 MINWEEKS=1 WARNWEEKS=1 EODefaults # mv passwd.CIS passwd Notes: Since /etc/default/passwd sets defaults in terms of number of weeks (even though the actual values on user accounts are kept in terms of days), it is probably best to choose interval values that are multiples of 7." reference : "800-171|3.5.2,800-53|IA-5(1)(d),CIP|007-6-R5.6,CIS_Recommendation|7.1,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|16.10,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(d),LEVEL|1S,NESA|T5.2.3,NIAv2|AM20,NIAv2|AM21,PCI-DSSv3.1|8.2.4,PCI-DSSv3.2|8.2.4,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.2" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*WARNWEEKS[\\s]*=" expect : "^[\\s]*WARNWEEKS[\\s]*=[\\s]*[1-4][\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - PASSLENGTH" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=24\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*PASSLENGTH[\\s]*=" # Note: Variable @PASSLENGTH@ replaced with "(1[4-9]|[2-9][0-9])" in field "expect". expect : "^[\\s]*PASSLENGTH[\\s]*=[\\s]*(1[4-9]|[2-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - NAMECHECK" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*NAMECHECK[\\s]*=" # Note: Variable @NAMECHECK@ replaced with "YES" in field "expect". expect : "^[\\s]*NAMECHECK[\\s]*=[\\s]*YES[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - HISTORY" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.8,800-53|IA-5(1)(e),CIS_Recommendation|7.2,CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(e),LEVEL|1S,NESA|T5.2.3,NIAv2|AM22c,PCI-DSSv3.1|8.2.5,PCI-DSSv3.2|8.2.5,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*HISTORY[\\s]*=" # Note: Variable @HISTORY@ replaced with "(1[4-9]|[2-9][0-9])" in field "expect". expect : "^[\\s]*HISTORY[\\s]*=[\\s]*(1[4-9]|[2-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - MINDIFF" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(b),CIS_Recommendation|7.2,CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(b),LEVEL|1S,NESA|T5.2.3,NIAv2|AM22d,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MINDIFF[\\s]*=" # Note: Variable @MINDIFF@ replaced with "([3-9]|[1-9][0-9])" in field "expect". expect : "^[\\s]*MINDIFF[\\s]*=[\\s]*([3-9]|[1-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - MINUPPER" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MINUPPER[\\s]*=" # Note: Variable @MINUPPER@ replaced with "([1-9]|[1-9][0-9])" in field "expect". expect : "^[\\s]*MINUPPER[\\s]*=[\\s]*([1-9]|[1-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - MINLOWER" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MINLOWER[\\s]*=" # Note: Variable @MINLOWER@ replaced with "([1-9]|[1-9][0-9])" in field "expect". expect : "^[\\s]*MINLOWER[\\s]*=[\\s]*([1-9]|[1-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - MINSPECIAL" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MINSPECIAL[\\s]*=" # Note: Variable @MINSPECIAL@ replaced with "([1-9]|[1-9][0-9])" in field "expect". expect : "^[\\s]*MINSPECIAL[\\s]*=[\\s]*([1-9]|[1-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - MINDIGIT" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MINDIGIT[\\s]*=" # Note: Variable @MINDIGIT@ replaced with "([1-9]|[1-9][0-9])" in field "expect". expect : "^[\\s]*MINDIGIT[\\s]*=[\\s]*([1-9]|[1-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - MAXREPEATS" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*MAXREPEATS[\\s]*=" # Note: Variable @MAXREPEATS@ replaced with "([1-9]|[1-9][0-9])" in field "expect". expect : "^[\\s]*MAXREPEATS[\\s]*=[\\s]*([1-9]|[1-9][0-9])[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - WHITESPACE" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*WHITESPACE[\\s]*=" # Note: Variable @WHITESPACE@ replaced with "YES" in field "expect". expect : "^[\\s]*WHITESPACE[\\s]*=[\\s]*YES[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - DICTIONDBDIR" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*DICTIONDBDIR[\\s]*=" # Note: Variable @DICTIONDBDIR@ replaced with "/var/passwd" in field "expect". expect : "^[\\s]*DICTIONDBDIR[\\s]*=[\\s]*/var/passwd[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.2 Set Strong Password Creation Policies - DICTIONLIST" info : "The variables in the /etc/default/passwd file indicate various strategies for creating differences required between an old and a new password. As requiring users to select a specific numbers of differences between the characters in the existing password and the new one can strengthen the password by increasing the symbol-set space, to further increase the difficulty of breaking any password by brute-force attacks, these values should be set as appropriate to the needs of the user. Rationale: Administrators may wish to add site-specific dictionaries to the DICTIONLIST parameter. Warning: Sites often have differing opinions on the optimal value of the HISTORY parameter (how many previous passwords to remember per user in order to prevent re- use). The values specified here are in compliance with NSA/DISA requirements. If this is too restrictive for your site, you may wish to set a HISTORY value of 4 and a MAXREPEATS of 2. Consult your local security rules for guidance." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/PASSLENGTH=/ { $1 = \"PASSLENGTH=14\" }; /NAMECHECK=/ { $1 = \"NAMECHECK=YES\" }; /HISTORY=/ { $1 = \"HISTORY=10\" }; /MINDIFF=/ { $1 = \"MINDIFF=3\" }; /MINUPPER=/ { $1 = \"MINUPPER=1\" }; /MINLOWER=/ { $1 = \"MINLOWER=1\" }; /MINSPECIAL=/ { $1 = \"MINSPECIAL=1\" }; /MINDIGIT=/ { $1 = \"MINDIGIT=1\" }; /MAXREPEATS=/ { $1 = \"MAXREPEATS=1\" }; /WHITESPACE=/ { $1 = \"WHITESPACE=YES\" }; /DICTIONDBDIR=/ { $1 = \"DICTIONDBDIR=/var/passwd\" }; /DICTIONLIST=/ { $1 = \"DICTIONLIST=/usr/share/lib/dict/words\" }; { print }' passwd > passwd.CIS # mv passwd.CIS passwd" reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|7.2,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/passwd" regex : "^[\\s]*DICTIONLIST[\\s]*=" # Note: Variable @DICTIONLIST@ replaced with "/usr/share/lib/dict/words" in field "expect". expect : "^[\\s]*DICTIONLIST[\\s]*=[\\s]*/usr/share/lib/dict/words[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.3 Set Default umask for users" info : "The default umask(1) determines the permissions of files created by users. The user creating the file has the discretion of making their files and directories readable by others via the chmod(1) command. Users who wish to allow their files and directories to be readable by others by default may choose a different default umaskby inserting the umaskcommand into the standard shell configuration files ( .profile, .cshrc, etc.) in their home directories. Rationale: Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions. A default umask setting of 077 causes files and directories created by users to not be readable by any other user on the system. A umask of 027 would allow files and directories readable by users in the same Unix group, while a umask of 022 would make files readable by every user on the system." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/#UMASK=/ { $1 = \"UMASK=027\" } { print }' login > login.CIS # mv login.CIS login" reference : "800-171|3.1.1,800-53|AC-3(4)(d),CIS_Recommendation|7.3,CN-L3|8.1.4.2(f),CN-L3|8.1.4.11(b),CN-L3|8.1.10.2(c),CN-L3|8.5.3.1,CN-L3|8.5.4.1(a),CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ISO/IEC-27001|A.9.4.1,ISO/IEC-27001|A.9.4.5,ITSG-33|AC-3(4),LEVEL|1S,NESA|T4.2.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.2,NESA|T7.5.3,NIAv2|AM3,NIAv2|SS29,QCSC-v1|3.2,QCSC-v1|5.2.2,QCSC-v1|13.2,TBA-FIISB|31.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/login" regex : "^[\\s]*UMASK[\\s]*=" expect : "^[\\s]*UMASK[\\s]*=[\\s]*0[2367]7[\\s]*$" type : CMD_EXEC description : "Check for FTP Service online" cmd : "/usr/bin/svcs -Ho state svc:/network/ftp:default" expect : "^online$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.4 Set Default ob体育 Creation Mask for FTP Users" info : "If FTP is permitted, set a strong, default file creation mask to apply to files created by the FTP server. Rationale: Many users assume that the FTP server will use their system file creation mask; generally it does not. This setting ensures that files transmitted over FTP use a strong file creation mask." solution : "Perform the following to implement the recommended state: # cd /etc # if [ \"`grep '^Umask' proftpd.conf`\" ]; then awk '/^Umask/ { $2 = \"027\" } { print }' proftpd.conf > proftpd.conf.CIS mv proftpd.conf.CIS proftpd.conf else echo \"Umask 027\" >> proftpd.conf fi" reference : "800-171|3.1.1,800-53|AC-3(4)(d),CIS_Recommendation|7.4,CN-L3|8.1.4.2(f),CN-L3|8.1.4.11(b),CN-L3|8.1.10.2(c),CN-L3|8.5.3.1,CN-L3|8.5.4.1(a),CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ISO/IEC-27001|A.9.4.1,ISO/IEC-27001|A.9.4.5,ITSG-33|AC-3(4),LEVEL|1S,NESA|T4.2.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.2,NESA|T7.5.3,NIAv2|AM3,NIAv2|SS29,QCSC-v1|3.2,QCSC-v1|5.2.2,QCSC-v1|13.2,TBA-FIISB|31.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/proftpd.conf" regex : "^[\\s]*Umask[\\s]*" expect : "^[\\s]*Umask[\\s]*0[2-7]7[\\s]*$" description : "7.4 Set Default ob体育 Creation Mask for FTP Users" info : "If FTP is permitted, set a strong, default file creation mask to apply to files created by the FTP server. Rationale: Many users assume that the FTP server will use their system file creation mask; generally it does not. This setting ensures that files transmitted over FTP use a strong file creation mask." solution : "Perform the following to implement the recommended state: # cd /etc # if [ \"`grep '^Umask' proftpd.conf`\" ]; then awk '/^Umask/ { $2 = \"027\" } { print }' proftpd.conf > proftpd.conf.CIS mv proftpd.conf.CIS proftpd.conf else echo \"Umask 027\" >> proftpd.conf fi" reference : "800-171|3.1.1,800-53|AC-3(4)(d),CIS_Recommendation|7.4,CN-L3|8.1.4.2(f),CN-L3|8.1.4.11(b),CN-L3|8.1.10.2(c),CN-L3|8.5.3.1,CN-L3|8.5.4.1(a),CSCv7|14.6,CSF|PR.AC-4,CSF|PR.PT-3,ISO/IEC-27001|A.9.4.1,ISO/IEC-27001|A.9.4.5,ITSG-33|AC-3(4),LEVEL|1S,NESA|T4.2.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.2,NESA|T7.5.3,NIAv2|AM3,NIAv2|SS29,QCSC-v1|3.2,QCSC-v1|5.2.2,QCSC-v1|13.2,TBA-FIISB|31.1" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.5 Set \"mesg n\" as Default for All Users - login" info : "The \"mesg n\" command blocks attempts to use the write or talk commands to contact users at their terminals, but has the side effect of slightly strengthening permissions on the user's tty device. Rationale: Since write and talk are no longer widely used at most sites, the incremental security increase is worth the loss of functionality." solution : "Perform the following to implement the recommended state: # cd /etc # for file in profile .login ; do if [ \"`grep mesg $file`\" ]; then awk '$1 == \"mesg\" { $2 = \"n\" } { print }' $file > $file.CIS mv $file.CIS $file else echo mesg n >> $file fi done" reference : "800-171|3.4.2,800-53|CM-6b.,CIP|007-6-R1,CIS_Recommendation|7.5,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|9.2,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/.login" regex : "^[\\s]*mesg[\\s]" expect : "^[\\s]*mesg[\\s]+n[\\s]*$" system : "SunOS" type : FILE_CONTENT_CHECK description : "7.5 Set \"mesg n\" as Default for All Users - profile" info : "The \"mesg n\" command blocks attempts to use the write or talk commands to contact users at their terminals, but has the side effect of slightly strengthening permissions on the user's tty device. Rationale: Since write and talk are no longer widely used at most sites, the incremental security increase is worth the loss of functionality." solution : "Perform the following to implement the recommended state: # cd /etc # for file in profile .login ; do if [ \"`grep mesg $file`\" ]; then awk '$1 == \"mesg\" { $2 = \"n\" } { print }' $file > $file.CIS mv $file.CIS $file else echo mesg n >> $file fi done" reference : "800-171|3.4.2,800-53|CM-6b.,CIP|007-6-R1,CIS_Recommendation|7.5,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|9.2,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/profile" regex : "^[\\s]*mesg[\\s]" expect : "^[\\s]*mesg[\\s]+n[\\s]*$" system : "SunOS" type : CMD_EXEC description : "7.6 Lock Inactive User Accounts" info : "Guidelines published by the U.S. Department of Defense specify that user accounts must be locked out after 35 days of inactivity. This number may vary based on the particular site's policy. Rationale: Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies." solution : "Perform the following to implement the recommended state: # useradd -D -f 35 To set this policy on a user account, use the command(s): # usermod -f 35 [name] To set this policy on a role account, use the command(s): # rolemod -f 35 [name]" reference : "800-171|3.1.1,800-53|AC-2(3),CIP|004-6-R5,CIS_Recommendation|7.6,CN-L3|7.1.3.2(e),CN-L3|8.1.4.2(c),CSCv6|16.1,CSCv6|16.6,CSCv7|16.9,CSF|PR.AC-1,CSF|PR.AC-4,ISO/IEC-27001|A.9.2.1,ISO/IEC-27001|A.9.2.6,ITSG-33|AC-2(3),LEVEL|1S,NIAv2|AM26,PCI-DSSv3.1|8.1.4,PCI-DSSv3.2|8.1.4,QCSC-v1|5.2.2,QCSC-v1|8.2.1,QCSC-v1|13.2,QCSC-v1|15.2,TBA-FIISB|36.2.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/useradd -D | /usr/bin/xargs -n 1 | /usr/bin/grep inactive | /usr/bin/awk -F= '{ print $2 }'" expect : "^[\\s]*([1-9]|[1-2][0-9]|3[0-5])[\\s]*$" type : BANNER_CHECK description : "8.1 Create Warnings for Standard Login Services - motd banner" info : "The contents of the /etc/issue file are displayed prior to the login prompt on the system's console and serial devices and also prior to logins via telnet and Secure Shell. The contents of the /etc/motd file are generally displayed after all successful logins, regardless from where the user is logging in. Rationale: Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. As implementing a logon banner to deter inappropriate use and can provide a foundation for legal action against abuse, this warning content should be set as appropriate. Consult with your organization's legal counsel for the appropriate wording as the examples below are for demonstration purposes only." solution : "Perform the following to implement the recommended state: # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/motd # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue # chown root:root /etc/issue # chmod 644 /etc/issue" reference : "800-171|3.1.9,800-53|AC-8,CIS_Recommendation|8.1,CSCv7|5.1,ITSG-33|AC-8,LEVEL|1S,NESA|M1.3.6,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/motd" # Note: Variable @BANNER_TEXT@ replaced with "All activities performed on this system will be monitored." in field "content". content : "All activities performed on this system will be monitored." type : FILE_CHECK description : "8.1 Create Warnings for Standard Login Services - motd permissions" info : "The contents of the /etc/issue file are displayed prior to the login prompt on the system's console and serial devices and also prior to logins via telnet and Secure Shell. The contents of the /etc/motd file are generally displayed after all successful logins, regardless from where the user is logging in. Rationale: Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. As implementing a logon banner to deter inappropriate use and can provide a foundation for legal action against abuse, this warning content should be set as appropriate. Consult with your organization's legal counsel for the appropriate wording as the examples below are for demonstration purposes only." solution : "Perform the following to implement the recommended state: # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/motd # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue # chown root:root /etc/issue # chmod 644 /etc/issue" reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|8.1,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/motd" owner : "root" mask : "133" group : "sys" || "root" type : BANNER_CHECK description : "8.1 Create Warnings for Standard Login Services - issue banner" info : "The contents of the /etc/issue file are displayed prior to the login prompt on the system's console and serial devices and also prior to logins via telnet and Secure Shell. The contents of the /etc/motd file are generally displayed after all successful logins, regardless from where the user is logging in. Rationale: Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. As implementing a logon banner to deter inappropriate use and can provide a foundation for legal action against abuse, this warning content should be set as appropriate. Consult with your organization's legal counsel for the appropriate wording as the examples below are for demonstration purposes only." solution : "Perform the following to implement the recommended state: # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/motd # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue # chown root:root /etc/issue # chmod 644 /etc/issue" reference : "800-171|3.1.9,800-53|AC-8,CIS_Recommendation|8.1,CSCv7|5.1,ITSG-33|AC-8,LEVEL|1S,NESA|M1.3.6,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/issue" # Note: Variable @BANNER_TEXT@ replaced with "All activities performed on this system will be monitored." in field "content". content : "All activities performed on this system will be monitored." system : "SunOS" type : FILE_CHECK description : "8.1 Create Warnings for Standard Login Services - issue permissions" info : "The contents of the /etc/issue file are displayed prior to the login prompt on the system's console and serial devices and also prior to logins via telnet and Secure Shell. The contents of the /etc/motd file are generally displayed after all successful logins, regardless from where the user is logging in. Rationale: Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. As implementing a logon banner to deter inappropriate use and can provide a foundation for legal action against abuse, this warning content should be set as appropriate. Consult with your organization's legal counsel for the appropriate wording as the examples below are for demonstration purposes only." solution : "Perform the following to implement the recommended state: # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/motd # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue # chown root:root /etc/issue # chmod 644 /etc/issue" reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|8.1,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|5.1,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/issue" owner : "root" mask : "133" group : "sys" || "root" type : CMD_EXEC description : "Check for FTP Service online" cmd : "/usr/bin/svcs -Ho state svc:/network/ftp:default" expect : "^online$" system : "SunOS" type : FILE_CONTENT_CHECK description : "8.2 Enable a Warning Banner for the FTP service" info : "The action for this item sets a warning message for FTP users before they log in. Rationale: If FTP is permitted for use in your environment, it is important to ensure that Warning Banners inform users who are attempting to access the system of their legal status regarding using the system. The text below is a generic sample only, so consult with your organization's legal counsel for the appropriate wording." solution : "Perform the following to implement the recommended state: # echo \"DisplayConnect /etc/issue\" >> /etc/proftpd.conf # svcadm restart ftp" reference : "800-171|3.1.9,800-53|AC-8a.,CIS_Recommendation|8.2,CSCv7|5.1,ITSG-33|AC-8a.,LEVEL|1S,NESA|M5.2.5,NESA|T5.5.1,NIAv2|AM10a,NIAv2|AM10b,NIAv2|AM10c,NIAv2|AM10d,NIAv2|AM10e,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/proftpd.conf" regex : "^[\\s]*DisplayConnect[\\s]*" expect : "^[\\s]*DisplayConnect[\\s]+/etc/issue[\\s]*$" description : "8.2 Enable a Warning Banner for the FTP service" info : "The action for this item sets a warning message for FTP users before they log in. Rationale: If FTP is permitted for use in your environment, it is important to ensure that Warning Banners inform users who are attempting to access the system of their legal status regarding using the system. The text below is a generic sample only, so consult with your organization's legal counsel for the appropriate wording." solution : "Perform the following to implement the recommended state: # echo \"DisplayConnect /etc/issue\" >> /etc/proftpd.conf # svcadm restart ftp" reference : "800-171|3.1.9,800-53|AC-8a.,CIS_Recommendation|8.2,CSCv7|5.1,ITSG-33|AC-8a.,LEVEL|1S,NESA|M5.2.5,NESA|T5.5.1,NIAv2|AM10a,NIAv2|AM10b,NIAv2|AM10c,NIAv2|AM10d,NIAv2|AM10e,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" system : "SunOS" type : FILE_CONTENT_CHECK description : "8.3 Enable a Warning Banner for the SSH Service" info : "The contents of the Banner string in the /etc/ssh/sshd_config file are sent to the remote user before authentication is allowed, requiring that the user read the legal caution. Rationale: Performing these steps will ensure the appropriate legal caution is displayed to any user accessing the system via SSH." solution : "Perform the following to implement the recommended state: # awk '/^#Banner/ { $1 = \"Banner\" } { print }' /etc/ssh/sshd_config > /etc/ssh/sshd_config.CIS # mv /etc/ssh/sshd_config.CIS /etc/ssh/sshd_config # svcadm restart svc:/network/ssh" reference : "800-171|3.1.9,800-53|AC-8a.,CIS_Recommendation|8.3,CSCv7|5.1,ITSG-33|AC-8a.,LEVEL|1S,NESA|M5.2.5,NESA|T5.5.1,NIAv2|AM10a,NIAv2|AM10b,NIAv2|AM10c,NIAv2|AM10d,NIAv2|AM10e,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/ssh/sshd_config" regex : "^[\\s]*Banner[\\s]" expect : "^[\\s]*Banner[\\s]+/etc/issue[\\s]*$" type : CMD_EXEC description : "Gnome installed" cmd : "/usr/bin/pkg list consolidation/desktop/gnome-incorporation" expect : "^consolidation/desktop/gnome-incorporation" system : "SunOS" type : FILE_CONTENT_CHECK description : "8.4 Enable a Warning Banner for the GNOME Service" info : "The GNOME Display Manager is used for login session management. See the manual page gdm(1) for more information on configuration of the settings, which can be user or group specific. Rationale: The remediation action for this item sets a pre-login warning message for GDM users. Additional methods can be employed to display a similar message to a user post- authentication. For more information, see the Oracle Solaris 11 Security Guidelines document." solution : "Perform the following to implement the recommended state: Edit the /etc/gdm/Init/Default file to add the following content before the last line of the file. /usr/bin/zenity --text-info --width=800 --height=300 --title=\"Security Message\" --filename=/etc/issue" reference : "800-171|3.1.9,800-53|AC-8a.,CIS_Recommendation|8.4,CSCv7|5.1,ITSG-33|AC-8a.,LEVEL|1S,NESA|M5.2.5,NESA|T5.5.1,NIAv2|AM10a,NIAv2|AM10b,NIAv2|AM10c,NIAv2|AM10d,NIAv2|AM10e,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/gdm/Init/Default" regex : "Security[\\s]+Message" expect : "--filename[\\s]*=[\\s]*/etc/issue" description : "8.4 Enable a Warning Banner for the GNOME Service" info : "The GNOME Display Manager is used for login session management. See the manual page gdm(1) for more information on configuration of the settings, which can be user or group specific. Rationale: The remediation action for this item sets a pre-login warning message for GDM users. Additional methods can be employed to display a similar message to a user post- authentication. For more information, see the Oracle Solaris 11 Security Guidelines document." solution : "Perform the following to implement the recommended state: Edit the /etc/gdm/Init/Default file to add the following content before the last line of the file. /usr/bin/zenity --text-info --width=800 --height=300 --title=\"Security Message\" --filename=/etc/issue" reference : "800-171|3.1.9,800-53|AC-8a.,CIS_Recommendation|8.4,CSCv7|5.1,ITSG-33|AC-8a.,LEVEL|1S,NESA|M5.2.5,NESA|T5.5.1,NIAv2|AM10a,NIAv2|AM10b,NIAv2|AM10c,NIAv2|AM10d,NIAv2|AM10e,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" type : FILE_CONTENT_CHECK description : "8.5 Check that the Banner Setting for telnet is Null" info : "The BANNER variable in the file /etc/default/telnetd can be used to display text before the telnet login prompt. Traditionally, it has been used to display the OS level of the target system. Rationale: The warning banner provides information that can be used in reconnaissance for an attack. By default, this file is distributed with the BANNER variable set to null. It is not necessary to create a separate warning banner for telnet if a warning is set in the /etc/issue file. As telnet is an insecure protocol, it should be disabled and all remote administrative/user connections take place by Secure Shell." solution : "Perform the following to implement the recommended state: # cd /etc/default # awk '/^BANNER=/ { $1 = \"BANNER=\" }; { print }' telnetd > telnetd.CIS # mv telnetd.CIS telnetd" reference : "800-171|3.1.9,800-53|AC-8a.,CIS_Recommendation|8.5,CSCv7|5.1,ITSG-33|AC-8a.,LEVEL|1S,NESA|M5.2.5,NESA|T5.5.1,NIAv2|AM10a,NIAv2|AM10b,NIAv2|AM10c,NIAv2|AM10d,NIAv2|AM10e,TBA-FIISB|45.2.4" see_also : "https://workbench.cisecurity.org/files/2582" file : "/etc/default/telnetd" regex : "^[\\s]*BANNER[\\s]*=" expect : "^[\\s]*BANNER[\\s]*=[\\s]*(\"\")?[\\s]*$" system : "SunOS" type : CMD_EXEC description : "9.1 Check for Remote Consoles" info : "The consadm command can be used to select or display alternate console devices. Rationale: Since the system console has special properties to handle emergency situations, it is important to ensure that the console is in a physically secure location and that unauthorized consoles have not been defined. The \"consadm -p\" command displays any alternate consoles that have been defined as auxiliary across reboots. If no remote consoles have been defined, there will be no output from this command." solution : "Perform the following to implement the recommended state: # /usr/sbin/consadm [-d device...]" reference : "800-171|3.1.5,800-53|AC-6(3),CIS_Recommendation|9.1,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|1.6,CSF|PR.AC-4,ISO/IEC-27001|A.9.1.2,ISO/IEC-27001|A.9.4.4,ITSG-33|AC-6(3),LEVEL|1S,NESA|T5.1.1,NESA|T5.5.4,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/sbin/consadm -p | /usr/bin/awk '{ print } END { if(NR == 0) print \"none\" }'" expect : "none" description : "9.2 Check for Duplicate User Names" info : "Although the useradd program will not let you create a duplicate user name, it is possible for an administrator to manually modify passwd(4) and change the user name. Rationale: If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in passwd(4). For example, if \"test4\" has a UID of 1000 and a subsequent \"test4\" entry has a UID of 2000, logging in as \"test4\" will use UID 1000. Effectively, the UID is shared, which is a potential security problem." solution : "Correct or justify any items discovered in the Audit step. Determine if there are any duplicate user names, and work with their respective owners to determine the best course of action in accordance with site policy." reference : "800-171|3.5.5,800-171|3.5.6,800-53|IA-4d.,CIS_Recommendation|9.2,CN-L3|8.1.4.1(a),CSCv7|16.6,CSCv7|16.7,CSCv7|16.8,CSF|PR.AC-1,ITSG-33|IA-4d.,LEVEL|1S,NESA|T5.5.2,NIAv2|AM14a,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|5" see_also : "https://workbench.cisecurity.org/files/2582" name : "passwd_duplicate_username" system : "SunOS" type : CMD_EXEC description : "9.3 Check That Defined Home Directories Exist" info : "Users can be defined to have a home directory in passwd(4), even if the directory does not actually exist. Rationale: If the user's home directory does not exist, the user will be placed in \"/\" and will not be able to write any files or have local environment variables set." solution : "Correct or justify any items discovered in the Audit step. Determine if there exists any users whose home directories do not exist, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|9.3,CN-L3|8.1.10.6(d),CSCv7|14.6,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/logins -xo | while read line; do user=`echo ${line} | /usr/bin/awk -F: '{ print $1 }'`; home=`echo ${line} | /usr/bin/awk -F: '{ print $6 }'`; if [ ! -d \"${home}\" ]; then echo ${user}; fi; done | /usr/bin/awk '{ print } END { if(NR==0){ print \"all user directories exist\" } }'" expect : "^all user directories exist[\\s]*$" system : "SunOS" type : CMD_EXEC description : "9.4 Verify System Account Default Passwords" info : "There are a number of accounts provided with the Solaris OS that are used to manage applications and are not intended to provide an interactive shell. These accounts are delivered either in a locked or non-login state. Oracle does not support nor recommend changing the passwords associated with these accounts. Rationale: System accounts, such as bin, lpd, and sys have special purposes and privileges. By default, these accounts are configured as either locked or non-login. This status should be verified to ensure that these accounts have not accidentally or intentionally been enabled." solution : "To lock a single account, use the command: # passwd -d [username] # passwd -l [username] To configure a single account to be non-login, use the command: # passwd -d [username] # passwd -N [username]" reference : "800-171|3.1.1,800-53|AC-2f.,CIS_Recommendation|9.4,CN-L3|7.1.3.2(d),CSCv7|16.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|PR.AC-1,CSF|PR.AC-4,ISO/IEC-27001|A.9.2.1,ITSG-33|AC-2f.,LEVEL|1S,NESA|M4.4.3,NESA|T5.2.1,NIAv2|SS14d,QCSC-v1|5.2.2,QCSC-v1|8.2.1,QCSC-v1|13.2,QCSC-v1|15.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "for user in $(logins -s | /usr/bin/awk '{ print $1 }'); do if [ \"${user}\" != \"root\" ]; then stat=`/usr/bin/passwd -s ${user} | /usr/bin/awk '{ print $2 }'`; if [ \"${stat}\" != \"LK\" ] && [ \"${stat}\" != \"NL\" ]; then echo \"Account ${user} is not locked or non-login.\"; fi; fi; done | /usr/bin/awk '{ print } END { if(NR==0){ print \"none\" } }'" expect : "none" system : "SunOS" type : CMD_EXEC description : "9.5 Verify System ob体育 Permissions" info : "The pkg verify and command checks the accuracy of installed directory structures and files. Rationale: It is important to ensure that system files and directories are maintained with the permissions they were intended to have from the OS vendor (Oracle)." solution : "Correct or justify any items discovered in the Audit step. Perform the following to set correct any identified package errors: # pkg fix Exercise caution in running this command as it may reverse modifications implemented previously including some of those recommended by this document. Rather than use this command broadly, it is recommended that it be used more tactically to correct specific package problems when possible." reference : "800-53|SI-7(1),CIS_Recommendation|9.5,CN-L3|7.1.3.5(b),CSCv7|14.6,CSF|PR.DS-6,ITSG-33|SI-7(1),LEVEL|1NS,NESA|T7.3.3,QCSC-v1|3.2,SWIFT-CSCv1|6.2" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/pkg verify | /usr/bin/awk '{ print } END { if (NR == 0) print \"none\"; }'" expect : "^none$" # Note: Variable @PKG_CMD_TIMEOUT@ replaced with "900" in field "timeout". timeout : "1800" system : "SunOS" type : CMD_EXEC description : "9.6 Ensure Password Fields are Not Empty" info : "The pkg verify and command checks the accuracy of installed directory structures and files. Rationale: It is important to ensure that system files and directories are maintained with the permissions they were intended to have from the OS vendor (Oracle)." solution : "Use the passwd -l command to lock accounts that are not permitted to execute commands . Use the passwd -N command to set accounts to be non-login." reference : "800-171|3.5.7,800-53|IA-5(1)(a),CIP|007-6-R5.5,CIS_Recommendation|9.6,CN-L3|7.1.2.7(e),CN-L3|7.1.3.1(b),CSCv7|4.4,CSF|PR.AC-1,HIPAA|164.308(a)(5)(ii)(D),ISO/IEC-27001|A.9.4.3,ITSG-33|IA-5(1)(a),LEVEL|1S,NESA|T5.2.3,NIAv2|AM19a,NIAv2|AM19b,NIAv2|AM19c,NIAv2|AM19d,NIAv2|AM22a,PCI-DSSv3.1|8.2.3,PCI-DSSv3.2|8.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|4.1,TBA-FIISB|26.2.1,TBA-FIISB|26.2.4" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/logins -p | /usr/bin/awk '{ print } END { if (NR == 0) print \"none\" }'" expect : "none" description : "9.7 Verify No UID 0 Accounts Exist Other than root" info : "Any account with UID 0 has superuser rights on the system. Rationale: This access must be limited to only the default root role and be made accessible from the system console only. Administrative access granted to an unprivileged account should use an approved mechanism such as RBAC." solution : "Disable or delete any other 0 UID entries that are displayed; there should be only one root account. Finer granularity access control for administrative access can be obtained by using the Solaris Role-Based Access Control (RBAC) mechanism. RBAC configurations should be monitored via user_attr(4) to make sure that privileges are managed appropriately." reference : "800-171|3.1.5,800-53|AC-6(5),CIS_Recommendation|9.7,CN-L3|8.1.10.6(a),CSCv6|5.1,CSCv7|4.3,CSF|PR.AC-4,ISO/IEC-27001|A.9.2.3,ITSG-33|AC-6(5),LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.6.1,NIAv2|AM32,NIAv2|AM33,NIAv2|VL3a,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|1.2,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "passwd_zero_uid" description : "9.8 Ensure root PATH Integrity - dot in root path" info : "The root user can execute any command on the system and could be tricked into executing programs if the PATH is not set correctly. Rationale: Including the current working directory (.) or any other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a malcode, such as a Trojan horse program." solution : "Correct or justify any items discovered in the Audit step." reference : "800-171|3.4.7,800-53|CM-7(2),CIS_Recommendation|9.8,CSCv6|8.4,CSCv7|2.6,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7(2),LEVEL|1S,NIAv2|SS15a,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "dot_in_root_path_variable" description : "9.8 Ensure root PATH Integrity - writable dirs in root path" info : "The root user can execute any command on the system and could be tricked into executing programs if the PATH is not set correctly. Rationale: Including the current working directory (.) or any other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a malcode, such as a Trojan horse program." solution : "Correct or justify any items discovered in the Audit step." reference : "800-171|3.1.5,800-53|AC-6.,CIS_Recommendation|9.8,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|2.6,CSF|PR.AC-4,CSF|PR.DS-5,ITSG-33|AC-6,LEVEL|1S,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|7.1.2,PCI-DSSv3.2|7.1.2,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|13.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "writeable_dirs_in_root_path_variable" system : "SunOS" type : CMD_EXEC description : "9.9 Check Permissions on User Home Directories" info : "While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Rationale: Group or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges." solution : "Correct or justify any items discovered in the Audit step. Determine if any user directory permissions are world-readable, writable, or executable, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|9.9,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|14.6,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/logins -ox | /usr/bin/awk -F: '($8 == \"PS\") { print $6 }' | while read dir; do /usr/bin/find ${dir} -type d -prune \\( -perm -g+w -o -perm -o+r -o -perm -o+w -o -perm -o+x \\) -ls; done | /usr/bin/awk '{ print } END { if (NR==0) print \"none\" }'" expect : "^none[\\s]*$" system : "SunOS" type : CMD_EXEC description : "9.10 Check Permissions on User \".\" (Hidden) ob体育s" info : "While the system administrator can establish secure permissions for users' \"dot\" files, the users can easily override these. Rationale: Group or world-writable user configuration files may enable malicious users to steal or modify other users' data or to gain another user's system privileges." solution : "Correct or justify any items discovered in the Audit step. Determine if any user hidden files are world-readable or writable, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|9.10,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|14.6,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "for dir in `/usr/bin/logins -ox | /usr/bin/awk -F: '($8 == \"PS\") { print $6 }'`; do /usr/bin/find ${dir}/.[A-Za-z0-9-_]* \\! -type l \\( -perm -20 -o -perm -02 \\) -ls; done | /usr/bin/awk '{ print } END { if (NR==0) print \"none\" }'" expect : "^none[\\s]*$" system : "SunOS" type : CMD_EXEC description : "9.11 Check Permissions on User .netrc ob体育s" info : "While the system administrator can establish secure permissions for users' .netrc files, the users can easily override these. Rationale: .netrc files may contain unencrypted passwords that can be used to attack other systems." solution : "Correct or justify any items discovered in the Audit step. Determine if any user .netrc files are group- or world-readable or writable, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|9.11,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|14.6,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "for dir in `/usr/bin/logins -ox | /usr/bin/awk -F: '($8 == \"PS\") { print $6 }'`; do /usr/bin/find ${dir}/.netrc \\! -type l \\( -perm -20 -o -perm -02 \\) -ls; done | /usr/bin/awk '{ print } END { if (NR==0) print \"none\" }'" expect : "^none[\\s]*$" system : "SunOS" type : FILE_CHECK_NOT description : "9.12 Check for Presence of User .rhosts ob体育s" info : "While no .rhosts files are shipped with Solaris, users can easily create them. Rationale: This action is only meaningful if .rhosts support is permitted in the PAM configuration. Even though the .rhosts files are ineffective if support is disabled in the PAM configuration, they may have been brought over from other systems and could contain information useful to an attacker for those other systems." solution : "Correct or justify any items discovered in the Audit step. Determine if any user .rhosts files are present in user directories and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|9.12,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|16.4,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "~/.rhosts" description : "9.13 Check Groups in passwd" info : "Over time, system administration errors and changes can lead to groups being defined in passwd but not in group. Rationale: Groups defined in passwd but not in group file pose a threat to system security since group permissions are not properly managed." solution : "Correct or justify any items discovered in the Audit step. Determine if any groups are in passwd but not in group, and work with those users or group owners to determine the best course of action in accordance with site policy." reference : "800-171|3.1.1,800-53|AC-2c.,CIS_Recommendation|9.13,CN-L3|7.1.3.2(d),CSCv7|16.6,CSCv7|16.7,CSCv7|16.8,CSF|DE.CM-1,CSF|DE.CM-3,CSF|PR.AC-1,CSF|PR.AC-4,ISO/IEC-27001|A.9.2.1,ITSG-33|AC-2c.,LEVEL|1S,NESA|T5.2.1,NESA|T5.2.2,NIAv2|AM28,NIAv2|NS5j,NIAv2|SS14e,QCSC-v1|5.2.2,QCSC-v1|8.2.1,QCSC-v1|13.2,QCSC-v1|15.2" see_also : "https://workbench.cisecurity.org/files/2582" name : "passwd_invalid_gid" description : "9.14 Check That Users Are Assigned Home Directories" info : "passwd defines a home directory that each user is placed in upon login. If there is no defined home directory, a user will be placed in / and will not be able to write any files or have local environment variables set. Rationale: All users must be assigned a home directory in passwd." solution : "Correct or justify any items discovered in the Audit step. Determine if there exists any users who are in passwd but do not have a home directory, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|9.14,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|14.6,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "accounts_without_home_dir" description : "9.15 Check User Home Directory Ownership" info : "The user home directory is space defined for the particular user to set local environment variables and to store personal files. Rationale: Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory." solution : "Correct or justify any items discovered in the Audit step. Determine if there exists any users whose home directory is not properly owned, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.4.2,800-53|CM-6b.,CIS_Recommendation|9.15,CN-L3|8.1.10.6(d),CSCv6|3.1,CSCv7|14.6,CSF|PR.IP-1,ITSG-33|CM-6b.,LEVEL|1S,NESA|T3.2.1,PCI-DSSv3.1|2.2.4,PCI-DSSv3.2|2.2.4,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "accounts_bad_home_permissions" description : "9.16 Check for Duplicate UIDs" info : "Although the useradd program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually modify passwd and change the UID field. Rationale: Users must be assigned unique UIDs for accountability and to ensure appropriate access protections." solution : "Correct or justify any items discovered in the Audit step. Determine if there exists any users who share a common UID, and work with those users to determine the best course of action in accordance with site policy." reference : "800-171|3.5.5,800-171|3.5.6,800-53|IA-4d.,CIS_Recommendation|9.16,CN-L3|8.1.4.1(a),CSCv7|4.4,CSF|PR.AC-1,ITSG-33|IA-4d.,LEVEL|1S,NESA|T5.5.2,NIAv2|AM14a,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|5" see_also : "https://workbench.cisecurity.org/files/2582" name : "passwd_duplicate_uid" description : "9.17 Check for Duplicate GIDs" info : "Although the groupadd program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually modify group and change the GID field. Rationale: User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections." solution : "Correct or justify any items discovered in the Audit step. Determine if there exists any duplicate group identifiers, and work with each respective group owner to remediate this issue and ensure that the group ownership of their files are set to an appropriate value." reference : "800-171|3.5.5,800-171|3.5.6,800-53|IA-4d.,CIS_Recommendation|9.17,CN-L3|8.1.4.1(a),CSCv7|14.6,CSF|PR.AC-1,ITSG-33|IA-4d.,LEVEL|1S,NESA|T5.5.2,NIAv2|AM14a,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|5" see_also : "https://workbench.cisecurity.org/files/2582" name : "group_duplicate_gid" description : "9.18 Check for Duplicate Group Names" info : "Although the groupadd program will not let you create a duplicate group name, it is possible for an administrator to manually modify group and change the group name. Rationale: If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in group. Effectively, the GID is shared, which is a security risk." solution : "Correct or justify any items discovered in the Audit step. Determine if there are any duplicate group names, and work with their respective owners to determine the best course of action in accordance with site policy." reference : "800-171|3.5.5,800-171|3.5.6,800-53|IA-4d.,CIS_Recommendation|9.18,CN-L3|8.1.4.1(a),CSCv7|14.6,CSF|PR.AC-1,ITSG-33|IA-4d.,LEVEL|1S,NESA|T5.5.2,NIAv2|AM14a,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|5" see_also : "https://workbench.cisecurity.org/files/2582" name : "group_duplicate_name" system : "Linux" type : FILE_CHECK_NOT description : "9.19 Check for Presence of User .netrc ob体育s" info : "The .netrc file contains data for logging into a remote host for file transfers via FTP. Rationale: The .netrc file presents a significant security risk since it stores passwords in unencrypted form." solution : "Correct or justify any items discovered in the Audit step. Determine if any .netrc files exist, and work with the owner to determine the best course of action in accordance with site policy." reference : "800-171|3.5.2,800-53|IA-5(7),CIP|007-6-R1,CIS_Recommendation|9.19,CSCv6|9.1,CSCv7|16.4,CSF|PR.AC-1,ITSG-33|IA-5(7),LEVEL|1S,NESA|T5.2.3,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|5.2.2,QCSC-v1|13.2,SWIFT-CSCv1|2.3,TBA-FIISB|26.1" see_also : "https://workbench.cisecurity.org/files/2582" file : "~/.netrc" system : "SunOS" type : FILE_CHECK_NOT description : "9.20 Check for Presence of User .forward ob体育s" info : "The .forward file specifies an email address to which a user's mail is forwarded. Rationale: Use of the .forward file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. The .forward file also poses a secondary risk as it can be used to execute commands that may perform unintended actions." solution : "Correct or justify any items discovered in the Audit step. Determine if any .forward files exist, and work with the owner to determine the best course of action in accordance with site policy." reference : "800-171|3.4.6,800-171|3.4.7,800-53|CM-7b.,CIP|007-6-R1,CIS_Recommendation|9.20,CN-L3|7.1.3.5(c),CN-L3|7.1.3.7(d),CN-L3|8.1.4.4(b),CSCv6|9.1,CSCv7|2.6,CSF|PR.IP-1,CSF|PR.PT-3,ITSG-33|CM-7a.,LEVEL|1S,NIAv2|SS13b,NIAv2|SS14a,NIAv2|SS14c,PCI-DSSv3.1|2.2.2,PCI-DSSv3.1|2.2.3,PCI-DSSv3.2|2.2.2,PCI-DSSv3.2|2.2.3,QCSC-v1|3.2,SWIFT-CSCv1|2.3" see_also : "https://workbench.cisecurity.org/files/2582" file : "~/.forward" system : "SunOS" description : "9.21 Find World Writable ob体育s" info : "Unix-based systems support variable settings to control access to files. World-writable files are the least secure. See the chmod man page for more information. Rationale: Data in world-writable files can be read, modified, and potentially compromised by any user on the system. World-writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity." solution : "Correct or justify any items discovered in the Audit step. Determine the existence of any \"write access\" given for the \"other\" category (chmod o-w ), and work with the owner to determine the best course of action in accordance with site policy." reference : "800-171|3.1.5,800-53|AC-6.,CIS_Recommendation|9.21,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|14.6,CSF|PR.AC-4,CSF|PR.DS-5,ITSG-33|AC-6,LEVEL|1NS,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,PCI-DSSv3.1|7.1.2,PCI-DSSv3.2|7.1.2,QCSC-v1|5.2.2,QCSC-v1|6.2,QCSC-v1|13.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "find_world_writeable_files" ignore : "/system/*" system : "SunOS" description : "9.22 Find SUID/SGID System Executables" info : "The owner of a file can set the file's permissions to run with the owner's or group's permissions, even if the user running the program is not the owner or a member of the group. The most common reason for a SUID/SGID program is to enable users to perform functions (such as changing their password), which requires root privileges. Rationale: There are valid reasons for SUID/SGID programs, but it is important to identify and review such programs to ensure they are legitimate. NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance." solution : "Correct or justify any items discovered in the Audit step. Determine the existence of any set-UID programs that do not belong on the system, and work with the owner (or system administrator) to determine the best course of action in accordance with site policy. Digital signatures on the Solaris Set-UID binaries can be verified with the elfsign utility, such as this example: # elfsign verify -e /usr/bin/su elfsign: verification of /usr/bin/su passed." reference : "800-171|3.1.5,800-53|AC-6(8),CIS_Recommendation|9.22,CN-L3|7.1.3.2(b),CN-L3|7.1.3.2(g),CN-L3|8.1.4.2(d),CN-L3|8.1.10.6(a),CSCv7|2.6,CSF|PR.AC-4,ITSG-33|AC-6,LEVEL|1NS,NESA|T5.1.1,NESA|T5.2.2,NESA|T5.4.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.3,NIAv2|AM1,NIAv2|AM23f,NIAv2|SS13c,NIAv2|SS15c,QCSC-v1|5.2.2,QCSC-v1|6.2,SWIFT-CSCv1|5.1,TBA-FIISB|31.4.2,TBA-FIISB|31.4.3" see_also : "https://workbench.cisecurity.org/files/2582" name : "find_suid_sgid_files" severity : MEDIUM system : "SunOS" description : "9.23 Find Un-owned ob体育s and Directories" info : "Sometimes when administrators delete users from the password file they neglect to remove all files owned by those users from the system. Rationale: A new user who is assigned the deleted user's user ID or group ID may then end up \"owning\" these files, and thus have more access on the system than was intended." solution : "Correct or justify any items discovered in the Audit step. Determine the existence of any files that are not attributed to current users or groups on the system, and determine the best course of action in accordance with site policy. Note that the Solaris OS is shipped with all files appropriately owned." reference : "800-53|AC-16(3),CIS_Recommendation|9.23,CSCv7|2.6,CSF|PR.AC-4,ISO/IEC-27001|A.8.2.1,ISO/IEC-27001|A.8.2.2,ITSG-33|AC-16(3),LEVEL|1S,NESA|T1.3.2,NESA|T1.3.3,NIAv2|SS28,QCSC-v1|5.2.2,QCSC-v1|13.2" see_also : "https://workbench.cisecurity.org/files/2582" name : "find_orphan_files" system : "SunOS" type : CMD_EXEC description : "9.24 Find ob体育s and Directories with Extended Attributes" info : "Extended attributes are implemented as files in a \"shadow\" file system that is not generally visible via normal administration commands without special arguments. Rationale: Attackers or malicious users could \"hide\" information, exploits, etc. in extended attribute areas. Since extended attributes are rarely used, it is important to find files with extended attributes set." solution : "Correct or justify any items discovered in the Audit step. Determine the existence of any files having extended file attributes, and determine the best course of action in accordance with site policy. Note that the Solaris OS does not ship with files that have extended attributes." reference : "800-171|3.1.1,800-53|AC-3(4)(d),CIS_Recommendation|9.24,CN-L3|8.1.4.2(f),CN-L3|8.1.4.11(b),CN-L3|8.1.10.2(c),CN-L3|8.5.3.1,CN-L3|8.5.4.1(a),CSCv7|2.6,CSF|PR.AC-4,CSF|PR.PT-3,ISO/IEC-27001|A.9.4.1,ISO/IEC-27001|A.9.4.5,ITSG-33|AC-3(4),LEVEL|1S,NESA|T4.2.1,NESA|T5.4.4,NESA|T5.4.5,NESA|T5.5.4,NESA|T5.6.1,NESA|T7.5.2,NESA|T7.5.3,NIAv2|AM3,NIAv2|SS29,QCSC-v1|3.2,QCSC-v1|5.2.2,QCSC-v1|13.2,TBA-FIISB|31.1" see_also : "https://workbench.cisecurity.org/files/2582" cmd : "/usr/bin/find / \\( -fstype nfs -o -fstype cachefs -o -fstype autofs -o -fstype ctfs -o -fstype mntfs -o -fstype objfs -o -fstype proc \\) -prune -o \\( -nouser -o -nogroup \\) -ls | /usr/bin/awk '{ print } END { if (NR == 0) print \"none\"; }'" expect : "^none$" description : "CIS_Oracle_Solaris_11.4_L1_v1.0.0.audit from CIS Oracle Solaris 11.4 Benchmark v1.0.0" info : "NOTE: Nessus has not identified that the chosen audit applies to the target device." see_also : "https://workbench.cisecurity.org/files/2582"