run OpenSCAP security test




Using the most restrictive Debian profile:

Install the ntp service
Enable the ntp service

We use sdwdate.


We don’t use SSH.

Disable unauthenticated repositories in APT configuration
Ensure that official distribution repositories are used
Ensure System Log Files Have Correct Permissions
Ensure Log Files Are Owned By Appropriate User
Ensure Log Files Are Owned By Appropriate Group

Done, although we could restrict some other less important logs:

/var/log/alternatives.log 644
/var/log/apparmor 755
/var/log/apt 755
/var/log/bootclockrandomization.log 775
/var/log/dpkg.log 644
/var/log/faillog 644
/var/log/fontconfig.log 644
/var/log/lastlog 664
/var/log/openvpn 755
/var/log/sdwdate.log 644
/var/log/wtmp 664
/var/log/Xorg.0.log 644
/var/log/Xorg.0.log.old 644

We can remove all “other” access to these. Maybe even all “other” access to /var/log/.

Enable syslog-ng Service
Ensure syslog-ng is Installed

There’s no use for this.


See the related phabricator ticket.

Uninstall the nis package
Uninstall the inet-based telnet server
Uninstall the ntpdate package
Uninstall the ssl compliant telnet server
Uninstall the telnet server
Install the cron service
Install the auditd service
Enable the auditd service
Enable rsyslog Service
Ensure rsyslog is Installed
Ensure Users Re-Authenticate for Privilege Escalation
Disallow creating symlinks to a file you not own
IOMMU configuration directive
Verify Permissions and ownership on {gshadow,shadow,group,passwd} File
Verify that local System.map file (if exists) is readable only by root
Disable Core Dumps for SUID programs
Enable Randomized Layout of Virtual Address Space

All done except we shred System.map instead.

1 Like
[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Contributors] [Investors] [Priority Support] [Professional Support]