/policy/cis_debian_linux_rcl.txt

https://bitbucket.org/oscarschneider/ossec-rules · Plain Text · 212 lines · 142 code · 70 blank · 0 comment · 0 complexity · dc51c441300bc6c9a9ba9b98419009cb MD5 · raw file 

    

  1. # @(#) $Id: cis_debian_linux_rcl.txt,v 1.2 2008/07/10 18:03:00 dcid Exp $
    2. 

  2. #
    3. 

  3. # OSSEC Linux Audit - (C) 2008 Daniel B. Cid - dcid@ossec.net
    4. 

  4. #
    5. 

  5. # Released under the same license as OSSEC.
    6. 

  6. # More details at the LICENSE file included with OSSEC or online
    7. 

  7. # at: http://www.ossec.net/en/licensing.html
    8. 

  8. #
    9. 

  9. # [Application name] [any or all] [reference]
    10. 

  10. # type:<entry name>;
    11. 

  11. #
    12. 

  12. # Type can be:
    13. 

  13. #             - f (for file or directory)
    14. 

  14. #             - p (process running)
    15. 

  15. #             - d (any file inside the directory)
    16. 

  16. #
    17. 

  17. # Additional values:
    18. 

  18. # For the registry , use "->" to look for a specific entry and another
    19. 

  19. # "->" to look for the value.
    20. 

  20. # For files, use "->" to look for a specific value in the file.
    21. 

  21. #
    22. 

  22. # Values can be preceeded by: =: (for equal) - default
    23. 

  23. #                             r: (for ossec regexes)
    24. 

  24. #                             >: (for strcmp greater)
    25. 

  25. #                             <: (for strcmp  lower)
    26. 

  26. # Multiple patterns can be specified by using " && " between them.
    27. 

  27. # (All of them must match for it to return true).
    28. 

  28. 

  29. 

  30. # CIS Checks for Debian/Ubuntu
    31. 

  31. # Based on Center for Internet Security Benchmark for Debian Linux v1.0
    32. 

  32. 

  33. 

  34. # Main one. Only valid for Debian/Ubuntu.
    35. 

  35. [CIS - Testing against the CIS Debian Linux Benchmark v1.0] [all required] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    36. 

  36. f:/etc/debian_version;
    37. 

  37. f:/proc/sys/kernel/ostype -> Linux;
    38. 

  38. 

  39. 

  40. 

  41. # Section 1.4 - Partition scheme.
    42. 

  42. [CIS - Debian Linux 1.4 - Robust partition scheme - /tmp is not on its own partition] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    43. 

  43. f:/etc/fstab -> !r:/tmp;
    44. 

  44. 

  45. [CIS - Debian Linux 1.4 - Robust partition scheme - /opt is not on its own partition] [all] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    46. 

  46. f:/opt;
    47. 

  47. f:/etc/fstab -> !r:/opt;
    48. 

  48. 

  49. [CIS - Debian Linux 1.4 - Robust partition scheme - /var is not on its own partition] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    50. 

  50. f:/etc/fstab -> !r:/var;
    51. 

  51. 

  52. 

  53. 

  54. # Section 2.3 - SSH configuration
    55. 

  55. [CIS - Debian Linux 2.3 - SSH Configuration - Protocol version 1 enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    56. 

  56. f:/etc/ssh/sshd_config -> !r:^# && r:Protocol\.+1;
    57. 

  57. 

  58. [CIS - Debian Linux 2.3 - SSH Configuration - IgnoreRHosts disabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    59. 

  59. f:/etc/ssh/sshd_config -> !r:^# && r:IgnoreRhosts\.+no;
    60. 

  60. 

  61. [CIS - Debian Linux 2.3 - SSH Configuration - Empty passwords permitted] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    62. 

  62. f:/etc/ssh/sshd_config -> !r:^# && r:^PermitEmptyPasswords\.+yes;
    63. 

  63. 

  64. [CIS - Debian Linux 2.3 - SSH Configuration - Host based authentication enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    65. 

  65. f:/etc/ssh/sshd_config -> !r:^# && r:HostbasedAuthentication\.+yes;
    66. 

  66. 

  67. [CIS - Debian Linux 2.3 - SSH Configuration - Root login allowed] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    68. 

  68. f:/etc/ssh/sshd_config -> !r:^# && r:PermitRootLogin\.+yes;
    69. 

  69. 

  70. 

  71. 

  72. # Section 2.4 Enable system accounting
    73. 

  73. [CIS - Debian Linux 2.4 - System Accounting - Sysstat not installed] [all] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    74. 

  74. f:!/etc/default/sysstat;
    75. 

  75. f:!/var/log/sysstat;
    76. 

  76. 

  77. [CIS - Debian Linux 2.4 - System Accounting - Sysstat not enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    78. 

  78. f:!/etc/default/sysstat;
    79. 

  79. f:/etc/default/sysstat -> !r:^# && r:ENABLED="false";
    80. 

  80. 

  81. 

  82. 

  83. # Section 2.5 Install and run Bastille
    84. 

  84. [CIS - Debian Linux 2.5 - System harderning - Bastille is not installed] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    85. 

  85. f:!/etc/Bastille;
    86. 

  86. 

  87. 

  88. 

  89. # Section 2.6 Ensure sources.list Sanity
    90. 

  90. [CIS - Debian Linux 2.6 - Sources list sanity - Security updates not enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    91. 

  91. f:!/etc/apt/sources.list;
    92. 

  92. f:!/etc/apt/sources.list -> !r:^# && r:http://security.debian|http://security.ubuntu;
    93. 

  93. 

  94. 

  95. 

  96. # Section 3 - Minimize inetd services
    97. 

  97. [CIS - Debian Linux 3.3 - Telnet enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    98. 

  98. f:/etc/inetd.conf -> !r:^# && r:telnet;
    99. 

  99. 

  100. [CIS - Debian Linux 3.4 - FTP enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    101. 

  101. f:/etc/inetd.conf -> !r:^# && r:/ftp;
    102. 

  102. 

  103. [CIS - Debian Linux 3.5 - rsh/rlogin/rcp enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    104. 

  104. f:/etc/inetd.conf -> !r:^# && r:shell|login;
    105. 

  105. 

  106. [CIS - Debian Linux 3.6 - tftpd enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    107. 

  107. f:/etc/inetd.conf -> !r:^# && r:tftp;
    108. 

  108. 

  109. [CIS - Debian Linux 3.7 - imap enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    110. 

  110. f:/etc/inetd.conf -> !r:^# && r:imap;
    111. 

  111. 

  112. [CIS - Debian Linux 3.8 - pop3 enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    113. 

  113. f:/etc/inetd.conf -> !r:^# && r:pop;
    114. 

  114. 

  115. [CIS - Debian Linux 3.9 - Ident enabled on inetd] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    116. 

  116. f:/etc/inetd.conf -> !r:^# && r:ident;
    117. 

  117. 

  118. 

  119. 

  120. # Section 4 - Minimize boot services
    121. 

  121. [CIS - Debian Linux 4.1 - Disable inetd - Inetd enabled but no services running] [all] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    122. 

  122. p:inetd;
    123. 

  123. f:!/etc/inetd.conf -> !r:^# && r:wait;
    124. 

  124. 

  125. [CIS - Debian Linux 4.3 - GUI login enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    126. 

  126. f:/etc/inittab -> !r:^# && r:id:5;
    127. 

  127. 

  128. [CIS - Debian Linux 4.6 - Disable standard boot services - Samba Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    129. 

  129. f:/etc/init.d/samba;
    130. 

  130. 

  131. [CIS - Debian Linux 4.7 - Disable standard boot services - NFS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    132. 

  132. f:/etc/init.d/nfs-common;
    133. 

  133. f:/etc/init.d/nfs-user-server;
    134. 

  134. f:/etc/init.d/nfs-kernel-server;
    135. 

  135. 

  136. [CIS - Debian Linux 4.9 - Disable standard boot services - NIS Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    137. 

  137. f:/etc/init.d/nis;
    138. 

  138. 

  139. [CIS - Debian Linux 4.13 - Disable standard boot services - Web server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    140. 

  140. f:/etc/init.d/apache;
    141. 

  141. f:/etc/init.d/apache2;
    142. 

  142. 

  143. [CIS - Debian Linux 4.15 - Disable standard boot services - DNS server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    144. 

  144. f:/etc/init.d/bind;
    145. 

  145. 

  146. [CIS - Debian Linux 4.16 - Disable standard boot services - MySQL server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    147. 

  147. f:/etc/init.d/mysql;
    148. 

  148. 

  149. [CIS - Debian Linux 4.16 - Disable standard boot services - PostgreSQL server Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    150. 

  150. f:/etc/init.d/postgresql;
    151. 

  151. 

  152. [CIS - Debian Linux 4.17 - Disable standard boot services - Webmin Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    153. 

  153. f:/etc/init.d/webmin;
    154. 

  154. 

  155. [CIS - Debian Linux 4.18 - Disable standard boot services - Squid Enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    156. 

  156. f:/etc/init.d/squid;
    157. 

  157. 

  158. 

  159. 

  160. # Section 5 - Kernel tuning
    161. 

  161. [CIS - Debian Linux 5.1 - Network parameters - Source routing accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    162. 

  162. f:/proc/sys/net/ipv4/conf/all/accept_source_route -> 1;
    163. 

  163. 

  164. [CIS - Debian Linux 5.1 - Network parameters - ICMP broadcasts accepted] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    165. 

  165. f:/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts -> 0;
    166. 

  166. 

  167. [CIS - Debian Linux 5.2 - Network parameters - IP Forwarding enabled] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    168. 

  168. f:/proc/sys/net/ipv4/ip_forward -> 1;
    169. 

  169. f:/proc/sys/net/ipv6/ip_forward -> 1;
    170. 

  170. 

  171. 

  172. 

  173. # Section 7 - Permissions
    174. 

  174. [CIS - Debian Linux 7.1 - Partition /var without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    175. 

  175. f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/var && !r:nodev;
    176. 

  176. 

  177. [CIS - Debian Linux 7.1 - Partition /tmp without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    178. 

  178. f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/tmp && !r:nodev;
    179. 

  179. 

  180. [CIS - Debian Linux 7.1 - Partition /opt without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    181. 

  181. f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/opt && !r:nodev;
    182. 

  182. 

  183. [CIS - Debian Linux 7.1 - Partition /home without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    184. 

  184. f:/etc/fstab -> !r:^# && r:ext2|ext3 && r:/home && !r:nodev ;
    185. 

  185. 

  186. [CIS - Debian Linux 7.2 - Removable partition /media without 'nodev' set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    187. 

  187. f:/etc/fstab -> !r:^# && r:/media && !r:nodev;
    188. 

  188. 

  189. [CIS - Debian Linux 7.2 - Removable partition /media without 'nosuid' set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    190. 

  190. f:/etc/fstab -> !r:^# && r:/media && !r:nosuid;
    191. 

  191. 

  192. [CIS - Debian Linux 7.3 - User-mounted removable partition /media] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    193. 

  193. f:/etc/fstab -> !r:^# && r:/media && r:user;
    194. 

  194. 

  195. 

  196. 

  197. # Section 8 - Access and authentication
    198. 

  198. [CIS - Debian Linux 8.8 - LILO Password not set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    199. 

  199. f:/etc/lilo.conf -> !r:^# && !r:restricted;
    200. 

  200. f:/etc/lilo.conf -> !r:^# && !r:password=;
    201. 

  201. 

  202. [CIS - Debian Linux 8.8 - GRUB Password not set] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    203. 

  203. f:/boot/grub/menu.lst -> !r:^# && !r:password;
    204. 

  204. 

  205. [CIS - Debian Linux 9.2 - Account with empty password present] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    206. 

  206. f:/etc/shadow -> r:^\w+::;
    207. 

  207. 

  208. [CIS - Debian Linux 13.11 - Non-root account with uid 0] [any] [http://www.ossec.net/wiki/index.php/CIS_DebianLinux]
    209. 

  209. f:/etc/passwd -> !r:^# && !r:^root: && r:^\w+:\w+:0:;
    210. 

  210. 

  211. 

  212. # EOF
    213.