Guide to the Secure Configuration of Red Hat Enterprise Linux 9
with profile PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 9Ensures PCI-DSS v3.2.1 security configuration settings are applied.
https://www.open-scap.org/security-policies/scap-security-guide
scap-security-guide
package which is developed at
https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Profile Information
Profile Title | PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 9 |
---|---|
Profile ID | xccdf_org.ssgproject.content_profile_pci-dss |
CPE Platforms
- cpe:/o:redhat:enterprise_linux:9
Revision History
Current version: 0.1.56
- draft (as of 2021-05-26)
Table of Contents
Checklist
Group Guide to the Secure Configuration of Red Hat Enterprise Linux 9 Group contains 3 groups and 4 rules | ||||||||||||||||||||||||||||||||||||||
Group System Settings Group contains 2 groups and 4 rules | ||||||||||||||||||||||||||||||||||||||
[ref]
Contains rules that check correct system settings. | ||||||||||||||||||||||||||||||||||||||
Group Configure Syslog Group contains 1 group and 4 rules | ||||||||||||||||||||||||||||||||||||||
[ref]
The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
In Red Hat Enterprise Linux 9, rsyslog has replaced ksyslogd as the syslog daemon of choice, and it includes some additional security features such as reliable, connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server. This section discusses how to configure rsyslog for best effect, and how to use tools provided with the system to maintain and monitor logs. | ||||||||||||||||||||||||||||||||||||||
Group Ensure Proper Configuration of Log Files Group contains 3 rules | ||||||||||||||||||||||||||||||||||||||
[ref]
The file /etc/rsyslog.conf controls where log message are written.
These are controlled by lines called rules, which consist of a
selector and an action.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Red Hat Enterprise Linux 9 are:
*.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg * uucp,news.crit /var/log/spooler local7.* /var/log/boot.logSee the man page rsyslog.conf(5) for more information.
Note that the rsyslog daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file /etc/rsyslog.conf and add or edit the following line:
$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | ||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||
|