CIS Oracle Solaris 10 安全基准 v5.1.0 概览

Solaris10
需积分: 10 2 下载量 30 浏览量 更新于2024-07-25 收藏 2.1MB PDF 举报
"CIS Oracle Solaris 10 Benchmark v5.1.0" 是一份针对Oracle Solaris 10操作系统的安全基准文档，由CIS（Center for Internet Security）发布，旨在提供一套共识性的信息安全产品和服务，以确保全球互联网用户的系统安全。这份文档发布于2012年9月28日，包含了对Solaris 10系统的安全配置建议和推荐。 CIS安全基准条款规定，无论是CIS成员还是非成员，都可以在以下条件下下载、安装和使用这些基准产品： 1. 可以在单台计算机上下载和安装每个SB产品。 2. 可以打印以.txt、.pdf、.doc、.mcw或.rtf格式的SB产品，但每一副本必须完整且保持不变，包括CIS安全基准的使用条款。 然而，使用SB产品时需知悉以下条款和条件： 1. SB产品按原样提供，不包含任何明示或默示的保证。这意味着CIS不保证产品的效果，也不保证其无误，包括但不限于关于其效率或缺失的任何保证。 CIS Oracle Solaris 10 Benchmark v5.1.0文档详细列出了针对Oracle Solaris 10操作系统的安全控制措施，旨在增强系统的安全性，防止未经授权的访问、保护数据隐私、确保系统的稳定性和可靠性。这些控制措施可能涉及系统配置、用户管理、网络服务、权限设置、日志记录等多个方面。 例如，文档可能会建议： - 使用强密码策略，包括密码长度、复杂性要求以及定期更换密码。 - 关闭不必要的网络服务，减少攻击面。 - 设置正确的文件权限，防止敏感数据被未授权访问。 - 启用审计功能，以便追踪和调查潜在的安全事件。 - 定期更新系统补丁，以修复已知的安全漏洞。 - 配置防火墙规则以限制进出流量。 - 确保系统用户遵循最小权限原则，只给予完成工作任务所需的最小权限。 通过遵循这些基准，管理员可以确保他们的Solaris 10系统符合行业最佳实践，从而降低被攻击的风险，提高整体的信息安全水平。这份文档对于任何使用或管理Solaris 10系统的组织来说都是一个宝贵的资源，因为它提供了一套清晰的指南来加强系统安全。

CIS_Solaris_10_Benchmark_v5.0.0

2011-08-17 上传
Table of Contents Table of Contents ................................................................................................................................................. 4 Overview ................................................................................................................................................................. 8 Consensus Guidance ....................................................................................................................................... 8 Intended Audience .......................................................................................................................................... 8 Acknowledgements ........................................................................................................................................ 9 Typographic Conventions .......................................................................................................................... 10 Configuration Levels ................................................................................................................................... 10 Level-I Benchmark settings/actions ................................................................................................. 10 Level-II Benchmark settings/actions................................................................................................ 10 Scoring Status ................................................................................................................................................ 10 Scorable ....................................................................................................................................................... 10 Not Scorable .............................................................................................................................................. 11 Identification Table ..................................................................................................................................... 11 Assumptions and Recommendations .................................................................................................... 11 OS Platform ................................................................................................................................................ 11 System State .............................................................................................................................................. 11 Test Actions ............................................................................................................................................... 11 Shell Environment ................................................................................................................................... 12 Order of Operations ................................................................................................................................ 12 Backup Key Files ...................................................................................................................................... 12 Create /opt/CIS Directory (optional) .......................................................................................... 12 Benchmark Items .............................................................................................................................................. 13 1. Install Updates, Patches and Additional Software ....................................................................... 13 1.1 Use the Latest OS Release .............................................................................................................. 13 1.2 Apply Latest OS Patches ................................................................................................................. 14 1.3 Install Solaris Encryption Kit ....................................................................................................... 15 2. Restrict Services ....................................................................................................................................... 17 2.1 Establish a Secure Baseline .......................................................................................................... 17 2.2 Disable Unnecessary Local Services .......................................................................................... 18 2.2.1 Disable Local CDE ToolTalk Database Server ............................................................... 19 2.2.2 Disable Local CDE Calendar Manager .............................................................................. 19 2.2.3 Disable Local Graphical Login Environment ................................................................. 20 2.2.4 Disable Local sendmail Service .......................................................................................... 21 2.2.5 Disable Local Web Console .................................................................................................. 22 2.2.6 Disable Local WBEM ............................................................................................................... 22 2.2.7 Disable Local BSD Print Protocol Adapter ..................................................................... 23 2.3 Disable Other Services .................................................................................................................... 24 2.3.1 Disable RPC Encryption Key ................................................................................................ 24 2.3.2 Disable NIS Server Daemons ............................................................................................... 25 2.3.3 Disable NIS Client Daemons................................................................................................. 26 2.3.4 Disable NIS+ Daemons ........................................................................................................... 26 2.3.5 Disable LDAP Cache Manager ............................................................................................. 27 2.3.6 Disable Kerberos TGT Expiration Warning ................................................................... 28 2.3.7 Disable Generic Security Services (GSS) Daemons ..................................................... 28 2.3.8 Disable Volume Manager ...................................................................................................... 29 2.3.9 Disable Samba Support .......................................................................................................... 30 2.3.10 Disable automount Daemon......................................................................................... 31 2.3.11 Disable Apache Services ................................................................................................... 32 2.3.12 Disable Solaris Volume Manager Services ................................................................. 33 2.3.13 Disable Solaris Volume Manager GUI .......................................................................... 34 2.3.14 Disable Local RPC Port Mapping Service ................................................................... 35 2.4 Configure TCP Wrappers ............................................................................................................... 36 3. Kernel Tuning ........................................................................................................................................... 38 3.1 Restrict Core Dumps to Protected Directory ......................................................................... 38 3.2 Enable Stack Protection ................................................................................................................. 39 3.3 Enable Strong TCP Sequence Number Generation .............................................................. 40 3.4 Modify Network Parameters ........................................................................................................ 41 3.4.1 Disable Source Packet Forwarding ................................................................................... 44 3.4.2 Disable Broadcast Packet Forwarding............................................................................. 45 3.4.3 Disable Response to ICMP Timestamp Requests ........................................................ 46 3.4.4 Disable Response to ICMP Broadcast Timestamp Requests ................................... 47 3.4.5 Disable Response to ICMP Netmask Requests ............................................................. 48 3.4.6 Disable ICMPv6 Redirect Messages .................................................................................. 50 3.4.7 Disable Response to Broadcast ICMPv4 Echo Request ............................................. 51 3.4.8 Disable Response to Multicast Echo Request ............................................................... 52 3.4.9 Set Interval for Scanning IRE_CACHE .............................................................................. 53 3.4.10 Ignore ICMP Redirect Messages .................................................................................... 55 3.4.11 Set Strict Multihoming ....................................................................................................... 56 3.4.12 Disable ICMPv4 Redirect Messages .............................................................................. 57 3.4.13 Set ARP Cleanup Interval .................................................................................................. 59 3.4.14 Disable TCP Reverse IP Source Routing ..................................................................... 60 Set Maximum Number of Half-open TCP Connections ...................................................... 61 3.4.15 ............................................................................................................................................................ 61 3.4.16 Set Maximum Number of Incoming Connections.................................................... 62 3.4.17 Lock down dtspcd(8) ................................................................................................... 64 3.5 Disable Network Routing .............................................................................................................. 65 4. Logging ........................................................................................................................................................ 66 4.1 Enable inetd Connection Logging ............................................................................................... 66 4.2 Enable FTP daemon Logging ........................................................................................................ 67 4.3 Enable Debug Level Daemon Logging ...................................................................................... 68 4.4 Capture syslog AUTH Messages.............................................................................................. 69 4.5 Enable Login Records ..................................................................................................................... 70 4.6 Capture All Failed Login Attempts ............................................................................................. 71 4.7 Enable cron Logging ........................................................................................................................ 71 4.8 Enable System Accounting ............................................................................................................ 72 4.9 Enable Kernel Level Auditing ...................................................................................................... 73 5. File/Directory Permissions/Access .................................................................................................. 76 5.1 Set daemon umask ........................................................................................................................... 76 5.2 Restrict Set-UID on User Mounted Devices ............................................................................ 77 5.3 Set Sticky Bit on World Writable Directories ........................................................................ 78 6. System Access, Authentication, and Authorization ..................................................................... 79 6.1 Disable login: Prompts on Serial Ports ............................................................................... 79 6.2 Disable "nobody" Access for RPC Encryption Key Storage Service .............................. 80 6.3 Configure SSH.................................................................................................................................... 80 6.3.1 Set SSH Protocol to 2 .............................................................................................................. 81 6.3.2 Disable SSH X11Forwarding ................................................................................................ 82 6.3.3 Set SSH MaxAuthTries to 3 ................................................................................................... 83 6.3.4 Set SSH MaxAuthTriesLog to 0 ........................................................................................... 84 6.3.5 Set SSH IgnoreRhosts to yes ................................................................................................ 85 6.3.6 Set SSH RhostsAuthentication to no ................................................................................. 86 6.3.7 Set SSH RhostsRSAAuthentication to no......................................................................... 87 6.3.8 Disable SSH root login ............................................................................................................ 87 6.3.9 Set SSH PermitEmptyPasswords to no ............................................................................ 88 6.3.10 Set SSH Banner ..................................................................................................................... 89 6.4 Disable .rhosts Support in /etc/pam.conf ............................................................................... 90 6.5 Restrict FTP Use ............................................................................................................................... 91 6.6 Set Delay between Failed Login Attempts to 4 ..................................................................... 92 6.7 Set Default Screen Lock for CDE Users ..................................................................................... 93 6.8 Set Default Screen Lock for GNOME Users ............................................................................. 94 6.9 Restrict at/cron to Authorized Users ....................................................................................... 95 6.10 Restrict root Login to System Console .............................................................................. 96 6.11 Set Retry Limit for Account Lockout ..................................................................................... 97 6.12 Set EEPROM Security Mode and Log Failed Access ........................................................ 98 6.13 Secure the GRUB Menu ............................................................................................................ 100 7. User Accounts and Environment ...................................................................................................... 101 7.1 Disable System Accounts ............................................................................................................. 101 7.2 Set Password Expiration Parameters on Active Accounts ............................................. 103 7.3 Set Strong Password Creation Policies .................................................................................. 104 7.4 Set Default Group for root Account ...................................................................................... 106 7.5 Change Home Directory for root Account ........................................................................ 107 7.6 Set Default umask for Users ....................................................................................................... 108 7.7 Set Default umask for FTP Users .............................................................................................. 109 7.8 Set "mesg n" as Default for All Users ....................................................................................... 110 7.9 Lock Inactive User Accounts ...................................................................................................... 111 8. Warning Banners ................................................................................................................................... 112 8.1 Create Warnings for Standard Login Services..................................................................... 113 8.2 Create Warning Banner for CDE Users .................................................................................. 114 8.3 Create Warning Banner for GNOME Users ........................................................................... 115 8.4 Create Warning Banner for FTP daemon .............................................................................. 116 8.5 Check Banner Setting for telnet is Null ............................................................................. 117 9. System Maintenance ............................................................................................................................. 117 9.1 Check for Remote Consoles ........................................................................................................ 118 9.2 Verify System File Permissions ................................................................................................. 118 9.3 Ensure Password Fields are Not Empty ................................................................................ 119 9.4 Verify No Legacy “+” Entries Exist in passwd, shadow, and group Files ............. 120 9.5 Verify No UID 0 Accounts Exist Other than root ................................................................ 120 9.6 Ensure root PATH Integrity ........................................................................................................ 121 9.7 Check Permissions on User Home Directories .................................................................... 122 9.8 Check User Dot File Permissions .............................................................................................. 123 9.9 Check Permissions on User .netrc Files ............................................................................ 124 9.10 Check for Presence of User .rhosts Files............................................................................ 125 9.11 Check Groups in /etc/passwd ............................................................................................... 126 9.12 Check That Users Are Assigned Home Directories ....................................................... 127 9.13 Check That Defined Home Directories Exist .................................................................... 128 9.14 Check User Home Directory Ownership ........................................................................... 130 9.15 Check for Duplicate UIDs ......................................................................................................... 131 9.16 Check for Duplicate GIDs ......................................................................................................... 132 9.17 Check That Reserved UIDs Are Assigned to System Accounts ................................. 132 9.18 Check for Duplicate User Names .......................................................................................... 133 9.19 Check for Duplicate Group Names ....................................................................................... 134 9.20 Check for Presence of User .netrc Files .............................................................................. 135 9.21 Check for Presence of User .forward Files ........................................................................ 136 9.22 Find World Writable Files ....................................................................................................... 137 9.23 Find SUID/SGID System Executables ................................................................................. 137 9.24 Find Un-owned Files and Directories ................................................................................. 138 9.25 Find Files and Directories with Extended Attributes ................................................... 139 Appendix A: File Backup Script .................................................................................................................. 141 Appendix B: Service Manifest for /lib/svc/method/cis_netconfig.sh ........................................ 142 Appendix C: Additional Security Notes .................................................................................................. 144 SN.1 Enable process accounting at boot time ............................................................................ 144 SN.2 Use full path names in /etc/dfs/dfstab file ...................................................................... 145 SN.3 Restrict access to power management functions .......................................................... 145 SN.4 Restrict access to sys-suspend feature .............................................................................. 146 SN.5 Create symlinks for dangerous files .................................................................................... 147 SN.7 Remove Support for Internet Services (inetd) ............................................................... 148 Appendix D: Application Notes ................................................................................................................... 150 AN.1 Samba: Enable SSH Port Forwarding in Web Admin Tool ......................................... 150 AN.2 Samba: Set Secure Permissions on smb.conf File...................................................... 150 AN.3 Samba: Set Group Ownership of smb.conf File .......................................................... 151 AN.4 Samba: Set Secure Permissions on smbpasswd File ................................................... 152 AN.5 Samba: Set Group Ownership of smbpasswd File ....................................................... 152 AN.6 Samba: Set Secure smb.conf File Options ......................................................................... 153 AN.7 sendmail: Set Secure Logfile Ownership to the root User ....................................... 154 AN.8 sendmail: Set Secure Permissions on Log File ................................................................ 154 Appendix E: References ................................................................................................................................ 156 Appendix F: Change History ........................................................................................................................ 159

CIS benchmarks.rar

2020-04-17 上传
CIS_Oracle_Solaris_11.4_Benchmark_v1.0.0.pdf CIS_PostgreSQL_12_Benchmark_v1.0.0.pdf CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v2.2.0.pdf CIS_Red_Hat_Enterprise_Linux_8_Benchmark_v1.0.0.pdf CIS_Security...

CIS_CentOS_Linux_7_Benchmark_v3.0.0.pdf

2021-12-16 上传
CIS_CentOS_Linux_7_Benchmark_v3.0.0.

shapenetcore_partanno_segmentation_benchmark_v0_normal

2023-05-12 上传
ShapenetCore_partanno_segmentation_benchmark_v0_normal是一个图像识别的基准数据集。这个数据集是用于训练模型来识别不同物品的部分，并将其分割成不同的区域。该数据集同时包含来自不同角度的3D坐标数据，标签和...

#define STATE_MAIN_MENU 0 #define STATE_BENCHMARK_RUN 1 #define STATE_BENCHMARK_RESULT 2

2023-06-09 上传
这是一个C语言的宏定义，它定义了三个常量：STATE_MAIN_MENU的值为0，STATE_BENCHMARK_RUN的值为1，STATE_BENCHMARK_RESULT的值为2。这些常量可以在代码中被引用，方便程序员在编写代码时使用它们。一般来说，程序中...

ImportError: cannot import name 'cv2_util' from 'maskrcnn_benchmark.utils' (/media/islab/TRAIN_4TB/xiaominew/maskscoring_rcnn/maskrcnn_benchmark/utils/__init__.py)

2023-06-01 上传
这个错误通常是由于 maskrcnn_benchmark 中的某些模块无法导入导致的。可能的原因包括： 1. 您的环境中缺少必需的依赖项。请确保您的环境中已安装所有必需的依赖项，并且它们的版本与 maskrcnn_benchmark 要求的...

*** [.pio\build\esp32s3box\src\ChappieBsp\Lvgl\demos\benchmark\assets\img_benchmark_cogwheel_chroma_keyed.c.o] Error 1 ***

2024-07-14 上传
".pio/build/esp32s3box/src/ChappieBsp/Lvgl/demos/benchmark/assets/img_benchmark_cogwheel_chroma_keyed.c.o"是一个文件名，表明在编译过程中，名为"img_benchmark_cogwheel_chroma_keyed.c"的源文件的object...

怎么在服务器中安装maskrcnn_benchmark

2024-09-13 上传
在服务器中安装maskrcnn_benchmark通常遵循以下步骤： 1. **系统环境检查**： 确保服务器操作系统为Linux，maskrcnn_benchmark通常在Linux环境下开发和运行。 2. **安装依赖库**： maskrcnn_benchmark依赖于多个...

vscode链接远程服务器后，怎么在服务器中安装maskrcnn_benchmark

2024-09-13 上传
在Visual Studio Code (VSCode) 中链接到远程服务器后，安装`maskrcnn_benchmark`通常涉及以下步骤： 1. **连接到远程服务器**： 使用VSCode的远程开发扩展（例如Remote - SSH），你可以通过SSH连接到远程服务器。...

解释error: argument --run_benchmark: invalid literal_eval value: 'Tru'

2023-05-25 上传
这个错误通常是由于在运行带有 `--run_benchmark` 参数的脚本时输入的参数值不合法引起的。`--run_benchmark` 是一个布尔类型参数，它的值应该是 `True` 或 `False` ，但是在这个错误中，值是 'Tru'，这个值是无效的...
小神兽爱山楂
  • 粉丝: 1
  • 资源: 32
上传资源 快速赚钱

最新资源