CIS_Solaris_10_Benchmark_v5.0.0_depthmap软件资源-CSDN文库

需积分: 16 179 浏览量 2011-08-17 11:33:53 上传评论收藏 2.77MB PDF 举报

Table of Contents Table of Contents ................................................................................................................................................. 4 Overview ................................................................................................................................................................. 8 Consensus Guidance ....................................................................................................................................... 8 Intended Audience .......................................................................................................................................... 8 Acknowledgements ........................................................................................................................................ 9 Typographic Conventions .......................................................................................................................... 10 Configuration Levels ................................................................................................................................... 10 Level-I Benchmark settings/actions ................................................................................................. 10 Level-II Benchmark settings/actions................................................................................................ 10 Scoring Status ................................................................................................................................................ 10 Scorable ....................................................................................................................................................... 10 Not Scorable .............................................................................................................................................. 11 Identification Table ..................................................................................................................................... 11 Assumptions and Recommendations .................................................................................................... 11 OS Platform ................................................................................................................................................ 11 System State .............................................................................................................................................. 11 Test Actions ............................................................................................................................................... 11 Shell Environment ................................................................................................................................... 12 Order of Operations ................................................................................................................................ 12 Backup Key Files ...................................................................................................................................... 12 Create /opt/CIS Directory (optional) .......................................................................................... 12 Benchmark Items .............................................................................................................................................. 13 1. Install Updates, Patches and Additional Software ....................................................................... 13 1.1 Use the Latest OS Release .............................................................................................................. 13 1.2 Apply Latest OS Patches ................................................................................................................. 14 1.3 Install Solaris Encryption Kit ....................................................................................................... 15 2. Restrict Services ....................................................................................................................................... 17 2.1 Establish a Secure Baseline .......................................................................................................... 17 2.2 Disable Unnecessary Local Services .......................................................................................... 18 2.2.1 Disable Local CDE ToolTalk Database Server ............................................................... 19 2.2.2 Disable Local CDE Calendar Manager .............................................................................. 19 2.2.3 Disable Local Graphical Login Environment ................................................................. 20 2.2.4 Disable Local sendmail Service .......................................................................................... 21 2.2.5 Disable Local Web Console .................................................................................................. 22 2.2.6 Disable Local WBEM ............................................................................................................... 22 2.2.7 Disable Local BSD Print Protocol Adapter ..................................................................... 23 2.3 Disable Other Services .................................................................................................................... 24 2.3.1 Disable RPC Encryption Key ................................................................................................ 24 2.3.2 Disable NIS Server Daemons ............................................................................................... 25 2.3.3 Disable NIS Client Daemons................................................................................................. 26 2.3.4 Disable NIS+ Daemons ........................................................................................................... 26 2.3.5 Disable LDAP Cache Manager ............................................................................................. 27 2.3.6 Disable Kerberos TGT Expiration Warning ................................................................... 28 2.3.7 Disable Generic Security Services (GSS) Daemons ..................................................... 28 2.3.8 Disable Volume Manager ...................................................................................................... 29 2.3.9 Disable Samba Support .......................................................................................................... 30 2.3.10 Disable automount Daemon......................................................................................... 31 2.3.11 Disable Apache Services ................................................................................................... 32 2.3.12 Disable Solaris Volume Manager Services ................................................................. 33 2.3.13 Disable Solaris Volume Manager GUI .......................................................................... 34 2.3.14 Disable Local RPC Port Mapping Service ................................................................... 35 2.4 Configure TCP Wrappers ............................................................................................................... 36 3. Kernel Tuning ........................................................................................................................................... 38 3.1 Restrict Core Dumps to Protected Directory ......................................................................... 38 3.2 Enable Stack Protection ................................................................................................................. 39 3.3 Enable Strong TCP Sequence Number Generation .............................................................. 40 3.4 Modify Network Parameters ........................................................................................................ 41 3.4.1 Disable Source Packet Forwarding ................................................................................... 44 3.4.2 Disable Broadcast Packet Forwarding............................................................................. 45 3.4.3 Disable Response to ICMP Timestamp Requests ........................................................ 46 3.4.4 Disable Response to ICMP Broadcast Timestamp Requests ................................... 47 3.4.5 Disable Response to ICMP Netmask Requests ............................................................. 48 3.4.6 Disable ICMPv6 Redirect Messages .................................................................................. 50 3.4.7 Disable Response to Broadcast ICMPv4 Echo Request ............................................. 51 3.4.8 Disable Response to Multicast Echo Request ............................................................... 52 3.4.9 Set Interval for Scanning IRE_CACHE .............................................................................. 53 3.4.10 Ignore ICMP Redirect Messages .................................................................................... 55 3.4.11 Set Strict Multihoming ....................................................................................................... 56 3.4.12 Disable ICMPv4 Redirect Messages .............................................................................. 57 3.4.13 Set ARP Cleanup Interval .................................................................................................. 59 3.4.14 Disable TCP Reverse IP Source Routing ..................................................................... 60 Set Maximum Number of Half-open TCP Connections ...................................................... 61 3.4.15 ............................................................................................................................................................ 61 3.4.16 Set Maximum Number of Incoming Connections.................................................... 62 3.4.17 Lock down dtspcd(8) ................................................................................................... 64 3.5 Disable Network Routing .............................................................................................................. 65 4. Logging ........................................................................................................................................................ 66 4.1 Enable inetd Connection Logging ............................................................................................... 66 4.2 Enable FTP daemon Logging ........................................................................................................ 67 4.3 Enable Debug Level Daemon Logging ...................................................................................... 68 4.4 Capture syslog AUTH Messages.............................................................................................. 69 4.5 Enable Login Records ..................................................................................................................... 70 4.6 Capture All Failed Login Attempts ............................................................................................. 71 4.7 Enable cron Logging ........................................................................................................................ 71 4.8 Enable System Accounting ............................................................................................................ 72 4.9 Enable Kernel Level Auditing ...................................................................................................... 73 5. File/Directory Permissions/Access .................................................................................................. 76 5.1 Set daemon umask ........................................................................................................................... 76 5.2 Restrict Set-UID on User Mounted Devices ............................................................................ 77 5.3 Set Sticky Bit on World Writable Directories ........................................................................ 78 6. System Access, Authentication, and Authorization ..................................................................... 79 6.1 Disable login: Prompts on Serial Ports ............................................................................... 79 6.2 Disable "nobody" Access for RPC Encryption Key Storage Service .............................. 80 6.3 Configure SSH.................................................................................................................................... 80 6.3.1 Set SSH Protocol to 2 .............................................................................................................. 81 6.3.2 Disable SSH X11Forwarding ................................................................................................ 82 6.3.3 Set SSH MaxAuthTries to 3 ................................................................................................... 83 6.3.4 Set SSH MaxAuthTriesLog to 0 ........................................................................................... 84 6.3.5 Set SSH IgnoreRhosts to yes ................................................................................................ 85 6.3.6 Set SSH RhostsAuthentication to no ................................................................................. 86 6.3.7 Set SSH RhostsRSAAuthentication to no......................................................................... 87 6.3.8 Disable SSH root login ............................................................................................................ 87 6.3.9 Set SSH PermitEmptyPasswords to no ............................................................................ 88 6.3.10 Set SSH Banner ..................................................................................................................... 89 6.4 Disable .rhosts Support in /etc/pam.conf ............................................................................... 90 6.5 Restrict FTP Use ............................................................................................................................... 91 6.6 Set Delay between Failed Login Attempts to 4 ..................................................................... 92 6.7 Set Default Screen Lock for CDE Users ..................................................................................... 93 6.8 Set Default Screen Lock for GNOME Users ............................................................................. 94 6.9 Restrict at/cron to Authorized Users ....................................................................................... 95 6.10 Restrict root Login to System Console .............................................................................. 96 6.11 Set Retry Limit for Account Lockout ..................................................................................... 97 6.12 Set EEPROM Security Mode and Log Failed Access ........................................................ 98 6.13 Secure the GRUB Menu ............................................................................................................ 100 7. User Accounts and Environment ...................................................................................................... 101 7.1 Disable System Accounts ............................................................................................................. 101 7.2 Set Password Expiration Parameters on Active Accounts ............................................. 103 7.3 Set Strong Password Creation Policies .................................................................................. 104 7.4 Set Default Group for root Account ...................................................................................... 106 7.5 Change Home Directory for root Account ........................................................................ 107 7.6 Set Default umask for Users ....................................................................................................... 108 7.7 Set Default umask for FTP Users .............................................................................................. 109 7.8 Set "mesg n" as Default for All Users ....................................................................................... 110 7.9 Lock Inactive User Accounts ...................................................................................................... 111 8. Warning Banners ................................................................................................................................... 112 8.1 Create Warnings for Standard Login Services..................................................................... 113 8.2 Create Warning Banner for CDE Users .................................................................................. 114 8.3 Create Warning Banner for GNOME Users ........................................................................... 115 8.4 Create Warning Banner for FTP daemon .............................................................................. 116 8.5 Check Banner Setting for telnet is Null ............................................................................. 117 9. System Maintenance ............................................................................................................................. 117 9.1 Check for Remote Consoles ........................................................................................................ 118 9.2 Verify System File Permissions ................................................................................................. 118 9.3 Ensure Password Fields are Not Empty ................................................................................ 119 9.4 Verify No Legacy “+” Entries Exist in passwd, shadow, and group Files ............. 120 9.5 Verify No UID 0 Accounts Exist Other than root ................................................................ 120 9.6 Ensure root PATH Integrity ........................................................................................................ 121 9.7 Check Permissions on User Home Directories .................................................................... 122 9.8 Check User Dot File Permissions .............................................................................................. 123 9.9 Check Permissions on User .netrc Files ............................................................................ 124 9.10 Check for Presence of User .rhosts Files............................................................................ 125 9.11 Check Groups in /etc/passwd ............................................................................................... 126 9.12 Check That Users Are Assigned Home Directories ....................................................... 127 9.13 Check That Defined Home Directories Exist .................................................................... 128 9.14 Check User Home Directory Ownership ........................................................................... 130 9.15 Check for Duplicate UIDs ......................................................................................................... 131 9.16 Check for Duplicate GIDs ......................................................................................................... 132 9.17 Check That Reserved UIDs Are Assigned to System Accounts ................................. 132 9.18 Check for Duplicate User Names .......................................................................................... 133 9.19 Check for Duplicate Group Names ....................................................................................... 134 9.20 Check for Presence of User .netrc Files .............................................................................. 135 9.21 Check for Presence of User .forward Files ........................................................................ 136 9.22 Find World Writable Files ....................................................................................................... 137 9.23 Find SUID/SGID System Executables ................................................................................. 137 9.24 Find Un-owned Files and Directories ................................................................................. 138 9.25 Find Files and Directories with Extended Attributes ................................................... 139 Appendix A: File Backup Script .................................................................................................................. 141 Appendix B: Service Manifest for /lib/svc/method/cis_netconfig.sh ........................................ 142 Appendix C: Additional Security Notes .................................................................................................. 144 SN.1 Enable process accounting at boot time ............................................................................ 144 SN.2 Use full path names in /etc/dfs/dfstab file ...................................................................... 145 SN.3 Restrict access to power management functions .......................................................... 145 SN.4 Restrict access to sys-suspend feature .............................................................................. 146 SN.5 Create symlinks for dangerous files .................................................................................... 147 SN.7 Remove Support for Internet Services (inetd) ............................................................... 148 Appendix D: Application Notes ................................................................................................................... 150 AN.1 Samba: Enable SSH Port Forwarding in Web Admin Tool ......................................... 150 AN.2 Samba: Set Secure Permissions on smb.conf File...................................................... 150 AN.3 Samba: Set Group Ownership of smb.conf File .......................................................... 151 AN.4 Samba: Set Secure Permissions on smbpasswd File ................................................... 152 AN.5 Samba: Set Group Ownership of smbpasswd File ....................................................... 152 AN.6 Samba: Set Secure smb.conf File Options ......................................................................... 153 AN.7 sendmail: Set Secure Logfile Ownership to the root User ....................................... 154 AN.8 sendmail: Set Secure Permissions on Log File ................................................................ 154 Appendix E: References ................................................................................................................................ 156 Appendix F: Change History ........................................................................................................................ 159

资源推荐

资源详情

资源评论

Security Configuration Benchmark For

Version 5.0.0

July 9th, 2010

Solaris 10 11/06 through 10/09

http://cisecurity.org

feedback@cisecurity.org

2 | P a g e

Background.

CIS provides benchmarks, scoring tools, software, data, information, suggestions, ideas, and other services and

materials from the CIS website or elsewhere (“Products”) as a public service to Internet users worldwide.

Recommendations contained in the Products (“Recommendations”) result from a consensus-building process that

involves many security experts and are generally generic in nature. The Recommendations are intended to provide

helpful information to organizations attempting to evaluate or improve the security of their networks, systems and

devices. Proper use of the Recommendations requires careful analysis and adaptation to specific user requirements.

The Recommendations are not in any way intended to be a “quick fix” for anyone’s information security needs.

No representations, warranties and covenants.

CIS makes no representations, warranties or covenants whatsoever as to (i) the positive or negative effect of the

Products or the Recommendations on the operation or the security of any particular network, computer system,

network device, software, hardware, or any component of any of the foregoing or (ii) the accuracy, reliability,

timeliness or completeness of any Product or Recommendation. CIS is providing the Products and the

Recommendations “as is” and “as available” without representations, warranties or covenants of any kind.

User agreements.

By using the Products and/or the Recommendations, I and/or my organization (“we”) agree and acknowledge that:

No network, system, device, hardware, software or component can be made fully secure;

We are using the Products and the Recommendations solely at our own risk;

We are not compensating CIS to assume any liabilities associated with our use of the Products or the

Recommendations, even risks that result from CIS’s negligence or failure to perform;

We have the sole responsibility to evaluate the risks and benefits of the Products and Recommendations to us and

to adapt the Products and the Recommendations to our particular circumstances and requirements;

Neither CIS, nor any CIS Party (defined below) has any responsibility to make any corrections, updates, upgrades or

bug fixes or to notify us if it chooses at it sole option to do so; and

Neither CIS nor any CIS Party has or will have any liability to us whatsoever (whether based in contract, tort, strict

liability or otherwise) for any direct, indirect, incidental, consequential, or special damages (including without

limitation loss of profits, loss of sales, loss of or damage to reputation, loss of customers, loss of software, data,

information or emails, loss of privacy, loss of use of any computer or other equipment, business interruption,

wasted management or other staff resources or claims of any kind against us from third parties) arising out of or in

any way connected with our use of or our inability to use any of the Products or Recommendations (even if CIS has

been advised of the possibility of such damages), including without limitation any liability associated with

infringement of intellectual property, defects, bugs, errors, omissions, viruses, worms, backdoors, Trojan horses or

other harmful items.

Grant of limited rights.

CIS hereby grants each user the following rights, but only so long as the user complies with all of the terms of these

Agreed Terms of Use:

Except to the extent that we may have received additional authorization pursuant to a written agreement with CIS,

each user may download, install and use each of the Products on a single computer;

Each user may print one or more copies of any Product or any component of a Product that is in a .txt, .pdf, .doc,

.mcw, or .rtf format, provided that all such copies are printed in full and are kept intact, including without limitation

the text of this Agreed Terms of Use in its entirety.

3 | P a g e

Retention of intellectual property rights; limitations on distribution.

The Products are protected by copyright and other intellectual property laws and by international treaties. We

acknowledge and agree that we are not acquiring title to any intellectual property rights in the Products and that

full title and all ownership rights to the Products will remain the exclusive property of CIS or CIS Parties. CIS

reserves all rights not expressly granted to users in the preceding section entitled “Grant of limited rights.” Subject

to the paragraph entitled “Special Rules” (which includes a waiver, granted to some classes of CIS Members, of

certain limitations in this paragraph), and except as we may have otherwise agreed in a written agreement with CIS,

we agree that we will not (i) decompile, disassemble, reverse engineer, or otherwise attempt to derive the source

code for any software Product that is not already in the form of source code; (ii) distribute, redistribute, encumber,

sell, rent, lease, lend, sublicense, or otherwise transfer or exploit rights to any Product or any component of a

Product; (iii) post any Product or any component of a Product on any website, bulletin board, ftp server,

newsgroup, or other similar mechanism or device, without regard to whether such mechanism or device is internal

or external, (iv) remove or alter trademark, logo, copyright or other proprietary notices, legends, symbols or labels

in any Product or any component of a Product; (v) remove these Agreed Terms of Use from, or alter these Agreed

of a Product with any derivative works based directly on a Product or any component of a Product; (vii) use any

Product or any component of a Product with other products or applications that are directly and specifically

dependent on such Product or any component for any part of their functionality, or (viii) represent or claim a

particular level of compliance with a CIS Benchmark, scoring tool or other Product. We will not facilitate or

otherwise aid other individuals or entities in any of the activities listed in this paragraph.

We hereby agree to indemnify, defend and hold CIS and all of its officers, directors, members, contributors,

employees, authors, developers, agents, affiliates, licensors, information and service providers, software suppliers,

hardware suppliers, and all other persons who aided CIS in the creation, development or maintenance of the

Products or Recommendations (“CIS Parties”) harmless from and against any and all liability, losses, costs and

expenses (including attorneys' fees and court costs) incurred by CIS or any CIS Party in connection with any claim

arising out of any violation by us of the preceding paragraph, including without limitation CIS’s right, at our

expense, to assume the exclusive defense and control of any matter subject to this indemnification, and in such case,

we agree to cooperate with CIS in its defense of such claim. We further agree that all CIS Parties are third-party

beneficiaries of our undertakings in these Agreed Terms of Use.

Special rules.

CIS has created and will from time to time create special rules for its members and for other persons and

organizations with which CIS has a written contractual relationship. Those special rules will override and supersede

these Agreed Terms of Use with respect to the users who are covered by the special rules. CIS hereby grants each

CIS Security Consulting or Software Vendor Member and each CIS Organizational User Member, but only so long as

such Member remains in good standing with CIS and complies with all of the terms of these Agreed Terms of Use,

the right to distribute the Products and Recommendations within such Member’s own organization, whether by

manual or electronic means. Each such Member acknowledges and agrees that the foregoing grant is subject to the

terms of such Member’s membership arrangement with CIS and may, therefore, be modified or terminated by CIS at

any time.

Choice of law; jurisdiction; venue.

We acknowledge and agree that these Agreed Terms of Use will be governed by and construed in accordance with

the laws of the State of Maryland, that any action at law or in equity arising out of or relating to these Agreed Terms

of Use shall be filed only in the courts located in the State of Maryland, that we hereby consent and submit to the

personal jurisdiction of such courts for the purposes of litigating any such action. If any of these Agreed Terms of

Use shall be determined to be unlawful, void, or for any reason unenforceable, then such terms shall be deemed

severable and shall not affect the validity and enforceability of any remaining provisions. We acknowledge and

agree that we have read these Agreed Terms of Use in their entirety, understand them and agree to be bound by

them in all respects.

Table of Contents

Table of Contents .................................................................................................................................................. 4

Overview .................................................................................................................................................................. 8

Consensus Guidance ........................................................................................................................................ 8

Intended Audience ........................................................................................................................................... 8

Acknowledgements ......................................................................................................................................... 9

Typographic Conventions .......................................................................................................................... 10

Configuration Levels .................................................................................................................................... 10

Level-I Benchmark settings/actions ................................................................................................. 10

Level-II Benchmark settings/actions................................................................................................ 10

Scoring Status ................................................................................................................................................. 10

Scorable ........................................................................................................................................................ 10

Not Scorable ............................................................................................................................................... 11

Identification Table ...................................................................................................................................... 11

Assumptions and Recommendations .................................................................................................... 11

OS Platform ................................................................................................................................................. 11

System State ............................................................................................................................................... 11

Test Actions ................................................................................................................................................ 11

Shell Environment .................................................................................................................................... 12

Order of Operations ................................................................................................................................. 12

Backup Key Files ....................................................................................................................................... 12

Create /opt/CIS Directory (optional) .......................................................................................... 12

Benchmark Items ............................................................................................................................................... 13

1. Install Updates, Patches and Additional Software ....................................................................... 13

1.1 Use the Latest OS Release .............................................................................................................. 13

1.2 Apply Latest OS Patches ................................................................................................................. 14

1.3 Install Solaris Encryption Kit ....................................................................................................... 15

2. Restrict Services ........................................................................................................................................ 17

2.1 Establish a Secure Baseline .......................................................................................................... 17

2.2 Disable Unnecessary Local Services .......................................................................................... 18

2.2.1 Disable Local CDE ToolTalk Database Server ............................................................... 19

2.2.2 Disable Local CDE Calendar Manager .............................................................................. 19

2.2.3 Disable Local Graphical Login Environment ................................................................. 20

2.2.4 Disable Local sendmail Service .......................................................................................... 21

2.2.5 Disable Local Web Console .................................................................................................. 22

2.2.6 Disable Local WBEM ............................................................................................................... 22

2.2.7 Disable Local BSD Print Protocol Adapter ..................................................................... 23

2.3 Disable Other Services .................................................................................................................... 24

2.3.1 Disable RPC Encryption Key ................................................................................................ 24

2.3.2 Disable NIS Server Daemons ............................................................................................... 25

2.3.3 Disable NIS Client Daemons................................................................................................. 26

2.3.4 Disable NIS+ Daemons ........................................................................................................... 26

2.3.5 Disable LDAP Cache Manager ............................................................................................. 27

2.3.6 Disable Kerberos TGT Expiration Warning ................................................................... 28

5 | P a g e

2.3.7 Disable Generic Security Services (GSS) Daemons ..................................................... 28

2.3.8 Disable Volume Manager ...................................................................................................... 29

2.3.9 Disable Samba Support .......................................................................................................... 30

2.3.10 Disable automount Daemon......................................................................................... 31

2.3.11 Disable Apache Services ................................................................................................... 32

2.3.12 Disable Solaris Volume Manager Services ................................................................. 33

2.3.13 Disable Solaris Volume Manager GUI .......................................................................... 34

2.3.14 Disable Local RPC Port Mapping Service ................................................................... 35

2.4 Configure TCP Wrappers ............................................................................................................... 36

3. Kernel Tuning ............................................................................................................................................ 38

3.1 Restrict Core Dumps to Protected Directory ......................................................................... 38

3.2 Enable Stack Protection ................................................................................................................. 39

3.3 Enable Strong TCP Sequence Number Generation .............................................................. 40

3.4 Modify Network Parameters ........................................................................................................ 41

3.4.1 Disable Source Packet Forwarding ................................................................................... 44

3.4.2 Disable Broadcast Packet Forwarding............................................................................. 45

3.4.3 Disable Response to ICMP Timestamp Requests ........................................................ 46

3.4.4 Disable Response to ICMP Broadcast Timestamp Requests ................................... 47

3.4.5 Disable Response to ICMP Netmask Requests ............................................................. 48

3.4.6 Disable ICMPv6 Redirect Messages .................................................................................. 50

3.4.7 Disable Response to Broadcast ICMPv4 Echo Request ............................................. 51

3.4.8 Disable Response to Multicast Echo Request ............................................................... 52

3.4.9 Set Interval for Scanning IRE_CACHE .............................................................................. 53

3.4.10 Ignore ICMP Redirect Messages .................................................................................... 55

3.4.11 Set Strict Multihoming ....................................................................................................... 56

3.4.12 Disable ICMPv4 Redirect Messages .............................................................................. 57

3.4.13 Set ARP Cleanup Interval .................................................................................................. 59

3.4.14 Disable TCP Reverse IP Source Routing ..................................................................... 60

Set Maximum Number of Half-open TCP Connections ...................................................... 61

3.4.15 ............................................................................................................................................................. 61

3.4.16 Set Maximum Number of Incoming Connections.................................................... 62

3.4.17 Lock down dtspcd(8) ................................................................................................... 64

3.5 Disable Network Routing .............................................................................................................. 65

4. Logging ......................................................................................................................................................... 66

4.1 Enable inetd Connection Logging ............................................................................................... 66

4.2 Enable FTP daemon Logging ........................................................................................................ 67

4.3 Enable Debug Level Daemon Logging ...................................................................................... 68

4.4 Capture syslog AUTH Messages.............................................................................................. 69

4.5 Enable Login Records ..................................................................................................................... 70

4.6 Capture All Failed Login Attempts ............................................................................................. 71

4.7 Enable cron Logging ........................................................................................................................ 71

4.8 Enable System Accounting ............................................................................................................ 72

4.9 Enable Kernel Level Auditing ...................................................................................................... 73

5. File/Directory Permissions/Access .................................................................................................. 76

5.1 Set daemon umask ........................................................................................................................... 76

剩余159页未读，继续阅读

评论收藏

内容反馈

青蛙咕啦咕啦

粉丝: 1
资源: 2

CIS_Solaris_10_Benchmark_v5.0.0

最新资源