What changed in SUSE Linux Enterprise Server 12 STIG V3R5V3R5 changes

Check text

Verify the SUSE operating system is a vendor-supported release. Use the following command to verify the SUSE operating system is a vendor-supported release: # cat /etc/os-release NAME="SLES" VERSION="12" Current End of Life for SLES 12 General Support iswas 31 Oct 2024 and Long-term Support isends until 31 Oct 2027. If the release is not supported by the vendor, this is a finding.

Discussion

A SUSE operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it willis not be possible to resolve security issues discovered in the system software. Release Released General Support Long Term Support 12.1 15 Dec 2015 31 May 2017 31 May 2020 12.2 08 Nov 2016 31 Mar 2018 31 Mar 2021 12.3 07 Sep 2017 30 Jun 2019 30 Jun 2022 12.4 12 Dec 2018 30 Jun 2020 30 Jun 2023 12.5 09 Dec 2019 31 Oct 2024 31 Oct 2027

V-217101 in V3R5

Check text

Verify the SUSE operating system enforces a minimum time period between password changes for each user account of one day or greater. Check the minimum time period between password changes for each user account with the following command: > sudo awk -F: '$4 &lt 1 {print $1 ":" $4}' /etc/shadow smithjdosuser:1 If any results are returned that are not associated with a system account, this is a finding.

V-217129 in V3R5

Check text

Verify that the SUSESLES operating12 systemzypper tool zypper has gpgcheck enabled. Check that zypper has gpgcheck enabled with the following command: > grep -i '^gpgcheck' /etc/zypp/zypp.conf gpgcheck = 1 If "gpgcheck" is set to "0", "off", "no", or "false", this is a finding.

Fix text

Configure that the SUSESLES operating12 systemzypper tool zypper to enable gpgcheck. Add by editing or addingmodify the following line toin the "/etc/zypp/zypp.conf" file or remove the line completely ensuring that the default zypper setting is enabled: gpgcheck = 1on

Discussion

Changes to any software components can have significant effects on the overall security of theSLES SUSE operating system12. This requirement ensures the software has not been tampered with and has been provided by a trusted vendor. Accordingly, patches, service packs, device drivers, or SUSESLES operating12 system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. TheSLES SUSE12 operating system should not have to verify the software again. This requirement does not mandate DoDDOD certificates for this purpose; however, the certificate used to verify the software must be from an approved Certificationcertification Authorityauthority (CA). For zypper on SUSE Linux Enterprise systems, GPG signature checking is enabled by default for all repositories, even if it is not explicitly set in /etc/zypp/zypp.conf or individual .repo files. The presence of the gpgcheck setting in repository files (like gpgcheck=1) or a global zypp.conf entry would override this default behavior if you wanted to disable it (e.g., gpgcheck=0), but its absence simply means the default is in effect.

V-217153 in V3R5

Check text

Verify SUSE operating system local interactive users on the system have a home directory assigned. Check for missing local interactive user home directories with the following command: > sudo pwck -r user 'smithjdosuser': directory '/home/smithjdosuser' does not exist Ask the Systemsystem Administratoradministrator (SA) if any users found without home directories are local interactive users. If the SA is unable to provide a response, check for users with a User Identifier (UID) of 1000 or greater with the following command: > sudo awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd If any interactive users do not have a home directory assigned, this is a finding.

Fix text

Assign home directories to all SUSE operating system local interactive users that currently do not have a home directory assigned. Assign a home directory to users via the usermod command: > sudo usermod -d /home/smithjdosuser smithjdosuser

V-217170 in V3R5

Check text

Verify the assigned home directory of all SUSE operating system local interactive users on the system exists. Check the home directory assignment for all local interactive non-privileged users on the system with the following command: # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $6}' /etc/passwd smithjdosuser /home/smithjdosuser Note: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information. Check that all referenced home directories exist with the following command: # pwck -r user 'smithjdosuser': directory '/home/smithjdosuser' does not exist If any home directories referenced in "/etc/passwd" are returned as not defined, this is a finding.

Fix text

Create home directories to all SUSE operating system local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": Note: The example will be for the user smithjdosuser, who has a home directory of "/home/smithjdosuser", a UID of "smithjdosuser", and a Group Identifier (GID) of "users assigned" in "/etc/passwd". # mkdir /home/smithjdosuser # chown smithjdosuser /home/smithjdosuser # chgrp users /home/smithjdosuser # chmod 0750 /home/smithjdosuser

V-217172 in V3R5

Check text

Verify the assigned home directory of all SUSE operating system local interactive users has a mode of "0750" or less permissive. Check the home directory assignment for all non-privileged users on the system with the following command: Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) -rwxr-x--- 1 smithjdosuser users 18 Mar 5 17:06 /home/smithjdosuser If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.

Fix text

Change the mode of SUSE operating system local interactive user's home directories to "0750". To change the mode of a local interactive user's home directory, use the following command: Note: The example will be for the user "smithjdosuser". # chmod 0750 /home/smithjdosuser

V-217173 in V3R5

Check text

Verify the assigned home directory of all SUSE operating system local interactive users is group-owned by that user's primary GID. Check the home directory assignment for all non-privilegednonprivileged users on the system with the following command: Note: This may miss local interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information. The returned directory "/home/smithjdosuser" is used as an example. # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $4, $6}' /etc/passwd 250 /home/smithjdosuser Check the user's primary group with the following command: # grep users /etc/group users:x:250:smithjdosuser,jonesjdoduser,jacksonsnsauser If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.

Fix text

Change the group owner of a SUSE operating system local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command: Note: The example will be for the user "smithjdosuser", who has a home directory of "/home/smithjdosuser", and has a primary group of users. # chgrp users /home/smithjdosuser

V-217174 in V3R5

Check text

Verify that all SUSE operating system local initialization files have a mode of "0740" or less permissive. Check the mode on all SUSE operating system local initialization files with the following command: Note: The example will be for the user "smithjdosuser", who has a home directory of "/home/smithjdosuser". # ls -al /home/smithjdosuser/.* | more -rwxr-xr-x 1 smithjdosuser users 896 Mar 10 2011 .profile -rwxr-xr-x 1 smithjdosuser users 497 Jan 6 2007 .login -rwxr-xr-x 1 smithjdosuser users 886 Jan 6 2007 .something If any local initialization files have a mode more permissive than "0740", this is a finding.

Fix text

Set the mode of SUSE operating system local initialization files to "0740" with the following command: Note: The example will be for the smithjdosuser user, who has a home directory of "/home/smithjdosuser". # chmod 0740 /home/smithjdosuser/.&ltINIT_FILE>

V-217175 in V3R5

Check text

Verify that all SUSE operating system local interactive user initialization files executable search path statements do not contain statements that will reference a working directory other than the user's home directory. Check the executable search path statement for all operating system local interactive user initialization files in the user's home directory with the following commands: Note: The example will be for the user "smithjdosuser", who has a home directory of "/home/smithjdosuser". # sudo grep -i path= /home/smithjdosuser/.* /home/smithjdosuser/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin If any local interactive user initialization files have executable search path statements that include directories outside of their home directory, and the additional path statements are not documented with the Informationinformation Systemsystem Securitysecurity Officerofficer (ISSO) as an operational requirement, this is a finding.

Discussion

The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Informationinformation Systemsystem Securitysecurity Officerofficer (ISSO).

V-217176 in V3R5

Check text

Verify that a separate file system/partition has been created for SUSE operating system non-privilegednonprivileged local interactive user home directories. Check the home directory assignment for all non-privilegednonprivileged users (those with a UID greater than 1000) on the system with the following command: # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6, $7}' /etc/passwd adamsjdisauser 1002 /home/adamsjdisauser /bin/bash jacksonmdoduser 1003 /home/jacksonmdoduser /bin/bash smithjdosuser 1001 /home/smithjdosuser /bin/bash The output of the command will give the directory/partition that contains the home directories for the non-privilegednonprivileged users on the system (in this example, /home) and user's shell. All accounts with a valid shell (such as /bin/bash) are considered interactive users. Check that a file system/partition has been created for the non-privilegednonprivileged interactive users with the following command: Note: The partition of /home is used in the example. # grep /home /etc/fstab UUID=333ada18 /home ext4 noatime,nobarrier,nodev 1 2 If a separate entry for the file system/partition that contains the non-privilegednonprivileged interactive users' home directories does not exist, this is a finding.

Fix text

Create a separate file system/partition for SUSE operating system non-privilegednonprivileged local interactive user home directories. Migrate the non-privileged local interactive user home directories onto the separate file system/partition.

V-217184 in V3R5