SLES 15 — Implemented CIS Rules
This page lists every CIS Benchmark rule ImageFactory automates for SLES 15, exactly as implemented by the hardening tasks. See CIS Benchmarks for background on Level 1 vs. Level 2, and CIS Hardening Exceptions for rules that are intentionally not automated.
Level 1 (147 rules)
Section 1 — Initial Setup
| Rule ID | Title |
|---|---|
| 1.1.1.1 | Ensure cramfs kernel module is not available |
| 1.1.1.2 | Ensure freevxfs kernel module is not available |
| 1.1.1.4 | Ensure hfsplus kernel module is not available |
| 1.1.2.1.1 | Ensure /tmp is configured |
| 1.1.2.1.2 | Ensure nodev option set on /tmp partition |
| 1.1.2.1.3 | Ensure nosuid option set on /tmp partition |
| 1.1.2.1.4 | Ensure noexec option set on /tmp partition |
| 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition |
| 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition |
| 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition |
| 1.1.2.3.2 | Ensure nodev option set on /home partition |
| 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition |
| 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition |
| 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition |
| 1.1.22 | Ensure sticky bit is set on all world-writable directories |
| 1.2.1.2 | Ensure gpgcheck is globally activated |
| 1.3.1.1 | Ensure AppArmor is installed |
| 1.3.1.2 | Ensure AppArmor is enabled in the bootloader configuration |
| 1.3.1.3 | Ensure all AppArmor Profiles are in enforce or complain mode |
| 1.4.2 | Ensure access to bootloader config is configured |
| 1.5.1 | Ensure address space layout randomization is enabled |
| 1.5.2 | Ensure core dumps are restricted |
| 1.5.3 | Ensure prelink is disabled |
| 1.6.1 | Ensure crypto-policies-scripts package is installed |
| 1.6.4 | Ensure system wide crypto policy disables sha1 hash and signature support |
| 1.6.5 | Ensure system wide crypto policy disables macs less than 128 bits |
| 1.6.6 | Ensure system wide crypto policy disables cbc for ssh |
| 1.6.7 | Ensure system wide crypto policy disables chacha20-poly1305 for ssh |
| 1.7.1 | Ensure /etc/motd is configured |
| 1.7.2 | Ensure local login warning banner is configured properly |
| 1.7.3 | Ensure remote login warning banner is configured properly |
| 1.7.4 | Ensure permissions on /etc/motd are configured |
| 1.7.5 | Ensure permissions on /etc/issue are configured |
| 1.7.6 | Ensure permissions on /etc/issue.net are configured |
| 1.8.1 | Ensure GNOME Display Manager is removed |
Section 2 — Services
| Rule ID | Title |
|---|---|
| 2.1.1 | Ensure autofs services are not in use |
| 2.1.3 | Ensure dhcp server services are not in use |
| 2.1.4 | Ensure dns server services are not in use |
| 2.1.6 | Ensure samba file server services are not in use |
| 2.1.8 | Ensure ftp server services are not in use |
| 2.1.9 | Ensure message access server services are not in use |
| 2.1.12 | Ensure print server services are not in use |
| 2.1.13 | Ensure rpcbind services are not in use |
| 2.1.14 | Ensure rsync services are not in use |
| 2.1.15 | Ensure snmp services are not in use |
| 2.1.16 | Ensure telnet server services are not in use |
| 2.1.17 | Ensure tftp server services are not in use |
| 2.1.18 | Ensure web proxy server services are not in use |
| 2.1.19 | Ensure web server services are not in use |
| 2.1.20 | Ensure xinetd services are not in use |
| 2.1.22 | Ensure mail transfer agents are configured for local-only mode |
| 2.2.1 | Ensure ftp client is not installed |
| 2.2.2 | Ensure avahi daemon services are not in use |
| 2.2.4 | Ensure telnet client is not installed |
| 2.2.5 | Ensure tftp client is not installed |
| 2.3.1.1 | Ensure a single time synchronization daemon is in use |
| 2.3.3.1 | Ensure chrony is configured |
| 2.3.3.2 | Ensure chrony is enabled and running |
| 2.4.1.1 | Ensure cron daemon is enabled and active |
| 2.4.1.2 | Ensure permissions on /etc/crontab are configured |
| 2.4.1.3 | Ensure permissions on /etc/cron.hourly are configured |
| 2.4.1.4 | Ensure permissions on /etc/cron.daily are configured |
| 2.4.1.5 | Ensure permissions on /etc/cron.weekly are configured |
| 2.4.1.6 | Ensure permissions on /etc/cron.monthly are configured |
| 2.4.1.7 | Ensure permissions on /etc/cron.d are configured |
| 2.4.1.8 | Ensure crontab is restricted to authorized users |
| 2.4.2.1 | Ensure at is restricted to authorized users |
Section 3 — Network Configuration
| Rule ID | Title |
|---|---|
| 3.1.2 | Ensure bluetooth services are not in use |
| 3.3.1 | Ensure IP forwarding is disabled |
| 3.3.2 | Ensure packet redirect sending is disabled |
| 3.3.3 | Ensure bogus ICMP responses are ignored |
| 3.3.4 | Ensure broadcast ICMP requests are ignored |
| 3.3.5 | Ensure ICMP redirects are not accepted |
| 3.3.6 | Ensure secure ICMP redirects are not accepted |
| 3.3.7 | Ensure Reverse Path Filtering is enabled |
| 3.3.8 | Ensure source routed packets are not accepted |
| 3.3.9 | Ensure suspicious packets are logged |
| 3.3.10 | Ensure TCP SYN Cookies is enabled |
| 3.3.11 | Ensure IPv6 router advertisements are not accepted |
Section 4
| Rule ID | Title |
|---|---|
| 4.1.1 | Ensure a single firewall configuration utility is in use |
| 4.2.1 | Ensure firewalld is installed |
| 4.2.2 | Ensure firewalld drops unnecessary services and ports |
| 4.2.3 | Ensure firewalld loopback traffic is configured |
| 4.2.4 | Ensure default zone is set |
| 4.2.5 | Ensure firewalld service is enabled and running |
Section 5
| Rule ID | Title |
|---|---|
| 5.1.1 | Ensure permissions on /etc/ssh/sshd_config are configured |
| 5.1.2 | Ensure permissions on SSH private host key files are configured |
| 5.1.3 | Ensure permissions on SSH public host key files are configured |
| 5.1.5 | Ensure sshd KexAlgorithms is configured |
| 5.1.6 | Ensure sshd MACs are configured |
| 5.1.7 | Ensure sshd access is configured |
| 5.1.8 | Ensure sshd Banner is configured |
| 5.1.9 | Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured |
| 5.1.10 | Ensure sshd DisableForwarding is enabled |
| 5.1.12 | Ensure sshd HostbasedAuthentication is disabled |
| 5.1.13 | Ensure sshd IgnoreRhosts is enabled |
| 5.1.14 | Ensure sshd LoginGraceTime is configured |
| 5.1.15 | Ensure sshd LogLevel is configured |
| 5.1.16 | Ensure sshd MaxAuthTries is configured |
| 5.1.17 | Ensure sshd MaxStartups is configured |
| 5.1.18 | Ensure sshd MaxSessions is configured |
| 5.1.19 | Ensure sshd PermitEmptyPasswords is disabled |
| 5.1.20 | Ensure sshd PermitRootLogin is disabled |
| 5.1.21 | Ensure sshd PermitUserEnvironment is disabled |
| 5.1.22 | Ensure sshd UsePAM is enabled |
| 5.2.1 | Ensure sudo is installed |
| 5.2.2 | Ensure sudo commands use pty |
| 5.2.3 | Ensure sudo log file exists |
| 5.2.7 | Ensure access to the su command is restricted |
| 5.3.1.1 | Ensure latest version of pam is installed |
| 5.3.2.1 | Configure pam_faillock module |
| 5.3.2.2 | Configure pam_pwquality module |
| 5.3.2.3 | Configure pam_pwhistory module |
| 5.3.2.3.3 | Ensure pam_pwhistory includes use_authtok |
| 5.3.2.4 | Configure pam_unix module |
| 5.3.2.7 | Ensure password quality is enforced for the root user |
| 5.4.1 | Configure shadow password suite parameters | VMvare root user |
| 5.4.1.1 | Ensure password expiration is configured |
| 5.4.1.2 | Ensure minimum password days is configured |
| 5.4.1.3 | Ensure password expiration warning days is configured |
| 5.4.1.5 | Ensure inactive password lock is configured |
| 5.4.2.5 | Ensure root account access is controlled |
| 5.4.2.6 | Ensure default user umask is configured |
| 5.4.2.7 | Ensure system accounts do not have a valid login shell |
| 5.4.2.8 | Ensure accounts without a valid login shell are locked |
| 5.4.3.2 | Ensure default user shell timeout is configured |
| 5.5.1.1 | Ensure root is the only GID 0 account |
Section 6
| Rule ID | Title |
|---|---|
| 6.1.1 | Ensure AIDE is installed |
| 6.1.2 | Ensure filesystem integrity is regularly checked |
| 6.1.3 | Ensure cryptographic mechanisms are used to protect the integrity of audit tools |
| 6.2.2 | Create /etc/systemd/journald.conf if it does not exist |
| 6.2.2.3 | Ensure journald Compress is configured |
| 6.2.2.4 | Ensure journald Storage is configured |
| 6.2.3 | Ensure permissions on all logfiles are configured |
| 6.2.3.2 | Ensure rsyslog is installed |
| 6.2.3.3 | Ensure rsyslog default file permissions configured |
| 6.2.3.4 | Ensure journald is configured to send logs to rsyslog |
| 6.2.4.1 | Ensure access to all logfiles has been configured |
Section 7
| Rule ID | Title |
|---|---|
| 7.1.1 | Ensure access to /etc/passwd is configured |
| 7.1.2 | Ensure access to /etc/passwd- is configured |
| 7.1.3 | Ensure access to /etc/group is configured |
| 7.1.4 | Ensure access to /etc/group- is configured |
| 7.1.5 | Ensure access to /etc/shadow is configured |
| 7.1.6 | Ensure access to /etc/shadow- is configured |
| 7.1.7 | Ensure access on /etc/gshadow is configured |
| 7.1.8 | Ensure access to /etc/gshadow- is configured |
| 7.3.1 | Ensure users' home directories permissions are 750 or more restrictive |
Level 2 (37 rules)
Section 1 — Initial Setup
| Rule ID | Title |
|---|---|
| 1.1.1.6 | Ensure overlayfs kernel module is not available |
| 1.1.1.7 | Ensure squashfs kernel module is not available |
| 1.1.1.8 | Ensure mounting of udf filesystems is disabled |
Section 3 — Network Configuration
| Rule ID | Title |
|---|---|
| 3.1.1 | Ensure IPv6 status is identified |
| 3.2.1 | Ensure dccp kernel module is not available |
| 3.2.2 | Ensure tipc kernel module is not available |
| 3.2.3 | Ensure rds kernel module is not available |
| 3.2.4 | Ensure sctp kernel module is not available |
Section 5
| Rule ID | Title |
|---|---|
| 5.1.10 | Ensure sshd DisableForwarding is enabled |
Section 6
| Rule ID | Title |
|---|---|
| 6.3.1.1 | Ensure auditd packages are installed |
| 6.3.1.2 | Ensure auditing for processes that start prior to auditd is enabled |
| 6.3.1.3 | Ensure audit_backlog_limit is sufficient |
| 6.3.2.1 | Ensure audit log storage size is configured |
| 6.3.2.2 | Ensure audit logs are not automatically deleted |
| 6.3.2.3 | Ensure system is disabled when audit logs are full |
| 6.3.3.1 | Ensure changes to system administration scope (sudoers) is collected |
| 6.3.3.2 | Ensure actions as another user are always logged |
| 6.3.3.3 | Ensure events that modify the sudo log file are collected |
| 6.3.3.4 | Ensure events that modify date and time information are collected |
| 6.3.3.5 | Ensure events that modify the system's network environment are collected |
| 6.3.3.6 | Ensure use of privileged commands are collected |
| 6.3.3.7 | Ensure unsuccessful file access attempts are collected |
| 6.3.3.8 | Ensure events that modify user/group information are collected |
| 6.3.3.9 | Ensure discretionary access control permission modification events are collected |
| 6.3.3.10 | Ensure successful file system mounts are collected |
| 6.3.3.11 | Ensure session initiation information is collected |
| 6.3.3.12 | Ensure login and logout events are collected |
| 6.3.3.13 | Ensure file deletion events by users are collected |
| 6.3.3.14 | Ensure events that modify the system's Mandatory Access Controls are collected |
| 6.3.3.15 | 6.3.3.15 - 6.3.3.17 | Ensure successful and unsuccessful attempts to use the chcon command are recorded |
| 6.3.3.16 | 6.3.3.15 - 6.3.3.17 | Ensure successful and unsuccessful attempts to use the chcon command are recorded |
| 6.3.3.17 | 6.3.3.15 - 6.3.3.17 | Ensure successful and unsuccessful attempts to use the chcon command are recorded |
| 6.3.3.18 | Ensure successful and unsuccessful attempts to use the usermod command are recorded |
| 6.3.3.19 | Ensure kernel module loading unloading and modification is collected |
| 6.3.3.20 | Ensure the audit configuration is immutable |
| 6.3.4.3 | Ensure audit log files owner is configured |
| 6.3.4.4 | Ensure audit log files group owner is configured |