Oracle Solaris Security Policy

with profile Solaris Baseline Security Policy
Oracle Solaris Compliance baseline and recommended settings for general purpose operating systems installations.
Profile TitleSolaris Baseline Security Policy
Profile IDBaseline

Revision History

Current version: 1.13942

  • accepted

Platforms

  • cpe:/o:oracle:solaris:11

Table of Contents

  1. Verify the OS configuration
  2. Verify file system information.
  3. Enable required services
  4. Tune kernel and network parameters
  5. Verify user configuration
  6. Check various system configuration items
  7. Verify audit configuration

Checklist

contains 141 rules

Verify the OS configurationgroup

The Oracle Solaris OS is installed with packages from a repository. The packages must arrive on the target system unmodified, and a set of protections for default services and executables be put in place.
For more information, see:

  • Installation Guide (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=IOSUI)
  • Security Guidelines (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=SYSADV7)

In this section, you verify package integrity, ensure that the booted system is protected, and verify that default OS protections are in place.

contains 3 rules

Package integrity is verifiedrule

Run 'pkg verify' to check that all installed Oracle Solaris software matches the packaging database and that ownership, permissions and content are correct.

Remediation description:
'pkg verify' has produced errors. Rerun the command and evaluate the errors. As appropriate, based on errors found, you should run 'pkg fix <package-fmri>' See the pkg(1) man page.
Remediation script:

    # pkg verify
    followed by
    # pkg fix <package-fmri>

The OS version is currentrule

Systems should be kept up to date to ensure that the latest security and operational updates are installed. You can run 'pkg update -n' to check the current state of the system against the configured repositories.

Remediation description:
The system is not up to date. Update the system.
Remediation script:

    # pkg update

Package signature checking is globally activatedrule

Package signature checking should be globally activated.

Remediation description:
The package signature policy should not be set to "ignore". See the pkg(1) man page.
Remediation script:

    #  pkg set-property signature-policy verify

Verify file system information.group

Oracle Solaris uses the ZFS file system by default. ZFS is robust, scalable, and easy to administer. ZFS can lay out filesystems over multiple devices, keeps the file system state consistent on disk, and verifies the data and metadata by using a user-selectable checksum algorithm. ZFS filesystems can hold zettabytes of data, and this data can be encrypted, compressed, mirrored, and backed up easily.
For more information, see http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=ZFSADMIN.
In this section, you ensure that no UFS filesystems are on the system, and that permissions on sensitive files are set correctly. You also protect the system from rogue files.

contains 4 rules

All local filesystems are ZFSrule

ZFS is the default filesystem for Oracle Solaris. On most systems other filesystem types should not be mounted. See the zfs(7FS) man page.

Remediation description:
Unmount any foreign file systems, such as UFS and HSFS. See the umount(1M) man page.
Remediation script:

    # umount <UFS-filesystem>
    # umount <HSFS-filesystem>>

Find and list .forward filesrule

.forward files can provide easy transport of information outside the firewall or outside the user's home directory.

Remediation description:
Remove inappropriate .forward files
Remediation script:

    # rm </path/to/.forward>

Find and list .netrc filesrule

The .netrc file contains data for logging in to a remote host over the network for file transfers by FTP.

Remediation description:
Remove unneeded .netrc files
Remediation script:

    # rm </path/to/.netrc>

Find and list .rhosts filesrule

.rhosts files can provide easy access to remote hosts by bypassing the password requirement. These files should be removed.

Remediation description:
While rhosts-based login is also preventable on the remote host, it is best to remove any .rhosts files from user's home directories.
Remediation script:

    # rm </path/to/.rhost>

Enable required servicesgroup

The Service Management Facility (SMF) provides an infrastructure to ease application and system service management. SMF augments the traditional UNIX startup scripts, init run levels, and configuration files. Management information for each service is stored in a configuration repository, which provides a simplified way to manage each service.
For more information, see the Service Management Facility Guide (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=SVSVF).
Services that a system requires to function as a standalone system are enabled by default. In this section, you ensure that these services are still enabled.

contains 92 rules

Service svc:/system/coreadm is enabledrule

The coreadm service manages the core files that are produced by processes that terminate abnormally. See the core(4) and coreadm(1M) man pages.

Remediation description:
Use coreadm(1M) to configure the coreadm service, then enable the service.
Remediation script:

    # svcadm enable coreadm

Service svc:/system/cron is enabledrule

The cron service manages the cron(1M) command, which runs processes that execute commands at specified dates and times. See the at(1), crontab(1), and cron(1M) man pages.

Remediation description:
Configure your cron services, then enable the service.
Remediation script:

    # svcadm enable cron

Service svc:/system/cryptosvc is enabledrule

The cryptosvc service manages the use of cryptographic mechanisms from the Cryptographic Framework feature of Oracle Solaris. See the cryptoadm(1M) man page.

Remediation description:
Enable the cryptosvc service.
Remediation script:

    # svcadm enable cryptosvc

Service svc:/system/dbus is enabledrule

The dbus service manages the D-Bus message bus daemon. Programs use the message bus daemon to exchange messages with one another. For example, the Hardware Abstraction Layer (HAL) uses dbus. See the dbus-daemon(1) and hal(5) man pages.

Remediation description:
Enable the dbus service.
Remediation script:

    # svcadm enable dbus

Service svc:/system/hal is enabled in global zonerule

The Hardware Abstraction Layer (HAL) service manages dynamic hardware configuration changes. See the hal(5) man page. This service only runs in the global zone.

Remediation description:
Enable the hal service.
Remediation script:

    # svcadm enable hal

Service svc:/system/identity:domain is enabledrule

The identity:domain service instance manages system identity. See the domainname(1M) man page.

Remediation description:
Enable the identity:domain service.
Remediation script:

    # svcadm enable identity:domain

Service svc:/system/intrd is enabled in global zonerule

The interrupt balancer (intrd) service monitors the assignments between interrupts and CPUs to ensure optimal performance. See the intrd(1M) man page. This service only runs in the global zone.

Remediation description:
Enable the intrd service.
Remediation script:

    # svcadm enable intrd

Service svc:/system/keymap is enabled in global zonerule

The keymap service manages the default configuration of the keyboard. See the kbd(1) man page. This service only runs in the global zone.

Remediation description:
Enable the keymap service.
Remediation script:

    # svcadm enable keymap

Service svc:/system/picl is enabled in global zonerule

The platform information and control (picl) service manages the publishing of platform configuration information that can respond to client requests for information about the configuration. See the picld(1M) and prtcpicl(1M) man pages. This service only runs in the global zone.

Remediation description:
Enable the picl service.
Remediation script:

    # svcadm enable picl

Service svc:/system/scheduler is enabled in global zonerule

The system/scheduler service manages the process scheduler. See the dispadmin(1M) man page. This service only runs in the global zone.

Remediation description:
Enable the system/scheduler service.
Remediation script:

    # svcadm enable system/scheduler

Service svc:/system/system-log is enabledrule

The system-log service reads and forwards system messages to the appropriate log files or users. See the syslogd(1M) and rsyslogd(1M) man pages.

Remediation description:
The system-log service has two instances, rsyslog and default. The rsyslog instance is installed with the pkg:/system/rsyslog package. Enable the system-log:rsyslog or system-log:default service.
Remediation script:

    # svcadm enable system/system-log:default 

    or

    # svcadm enable system/system-log:rsyslog

Service svc:/system/utmp is enabledrule

The utmp service manages a table of processes, detects when a process has terminated, and updates the table. See the utmpd(1M) man page.

Remediation description:
Enable the utmp service.
Remediation script:

    # svcadm enable system/utmp

Service svc:/system/zones is enabled in global zonerule

The zones service manages the autoboot and graceful shutdown of zones. See the zones(5) and zonecfg(1M) man pages. This service only runs in the global zone.

Remediation description:
Enable the zones service.
Remediation script:

    # svcadm enable system/zones

Service svc:/system/zones-install is enabledrule

The zones-install service manages the auto-installation of zones.

Remediation description:
Enable the zones-install service.
Remediation script:

    # svcadm enable system/zones-install

Service svc:/network/rpc/bind is enabledrule

The rpc/bind service manages the conversion of RPC program numbers to universal addresses. See the rpcbind(1M) man page.

Remediation description:
Enable the rpc/bind service.
Remediation script:

    # svcadm enable rpc/bind

Service svc:/system/name-service/switch is enabledrule

The name-service/switch service manages the databases that contain information about hosts, users, and groups. See the nsswitch.conf(4) man page.

Remediation description:
Enable the name-service/switch service.
Remediation script:

    # svcadm enable name-service/switch

Service svc:/system/name-service/cache is enabledrule

The name-service/cache service manages the caching of name service information. See the nscd(1M) man page.

Remediation description:
Enable the name-service/cache service.
Remediation script:

    # svcadm enable name-service/cache

Service svc:/network/nfs/status is disabled or not installedrule

The NFS status monitor service interacts with lockd(1M) to provide the crash and recovery functions for the locking services on NFS.

Remediation description:
Disable this service if the system is not an NFS client or server.
Remediation script:

    # svcadm disable svc:/network/nfs/status

Service svc:/network/nfs/nlockmgr is disabled or not installedrule

The NFS lock manager supports record locking operations on NFS files in NFSv2 and NFSv3. See the lockd(1M) and sharectl(1M) man pages.

Remediation description:
Disable the service if you are either 1) not using NFS at all or 2) using NFSv4.
Remediation script:

    # svcadm disable svc:/network/nfs/nlockmgr

Service svc:/network/nfs/client:default is in disabled staterule

The NFS client service is needed only if the system is mounting NFS file systems specified in /etc/vfstab.

If the system is not mounting file systems specified there, the service can be disabled or its package uninstalled. See the mount_nfs(1M) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/nfs/client:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/nfs/client:default
Remediation script:

    nfs_client_fmri=svc:/network/nfs/client:default
    policy_nfs_client=disabled
    if [ $policy_nfs_client == enabled ]; then
            svcadm enable -s $nfs_client_fmri
    else
            svcadm disable -s $nfs_client_fmri
    fi

Service svc:/network/nfs/server:default is in disabled staterule

The NFS Server service handles client file system requests over NFS version 2, 3, and 4.

If this system is not an NFS server, this service should be disabled or its package uninstalled. See the nfsd(1M) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/nfs/server:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/nfs/server:default
Remediation script:

    nfs_server_fmri=svc:/network/nfs/server:default
    policy_nfs_server=disabled
    if [ $policy_nfs_server == enabled ]; then
            svcadm enable -s $nfs_server_fmri
    else
            svcadm disable -s $nfs_server_fmri
    fi

Service svc:/network/nfs/fedfs-client:default is in disabled staterule

The Federated Filesystem (FedFS) client service manages defaults and connection information for LDAP servers that store FedFS information.

If this system is not using FedFS for DNS SRV records or LDAP-based referrals, this service must be disabled or its package uninstalled. See the nsdbparams(1M) and fedfs(5) man pages.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/nfs/fedfs-client:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/nfs/fedfs-client:default
Remediation script:

    fedfs_client_fmri=svc:/network/nfs/fedfs-client:default
    policy_fedfs_client=disabled
    if [ $policy_fedfs_client == enabled ]; then
            svcadm enable -s $fedfs_client_fmri
    else
            svcadm disable -s $fedfs_client_fmri
    fi

Service svc:/network/nfs/rquota is disabled or not installedrule

The remote quota server returns quotas for a user of a local file system which is mounted over NFS. The results are used by quota(1M) to display user quotas for remote file systems. The rquotad(1M) daemon is normally invoked by inetd(1M).

Remediation description:
Disable the rquota service. It provides information about the network to potentially malicious users.
Remediation script:

    # svcadm disable svc:/network/nfs/rquota

Service svc:/network/nfs/cbd:default is in disabled staterule

The NFS cbd service manages communication endpoints for the NFS Version 4 protocol. The nfs4cbd(1M) daemon runs on the NFS Version 4 client and creates a listener port for callbacks.

If this system is not an NFS server, this service should be disabled or its package uninstalled.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/nfs/cbd:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/nfs/cbd:default
Remediation script:

    nfs_cbd_fmri=svc:/network/nfs/cbd:default
    policy_nfs_cbd=disabled
    if [ $policy_nfs_cbd == enabled ]; then
            svcadm enable -s $nfs_cbd_fmri
    else
            svcadm disable -s $nfs_cbd_fmri
    fi

Service svc:/network/nfs/mapid:default is in disabled staterule

The NFS user and group ID mapping daemon service maps to and from NFS version 4 owner and owner_group identification attributes and local UID and GID numbers used by both the NFS version 4 client and server. See the nfsmapid(1M) man page.

If this system is not an NFS server, this service should be disabled or its package uninstalled.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/nfs/mapid:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/nfs/mapid:default
Remediation script:

    nfs_mapid_fmri=svc:/network/nfs/mapid:default
    policy_nfs_mapid=disabled
    if [ $policy_nfs_mapid == enabled ]; then
            svcadm enable -s $nfs_mapid_fmri
    else
            svcadm disable -s $nfs_mapid_fmri
    fi

Service svc:/network/smb/client is disabled or not installedrule

The SMB/CIFS client allows an Oracle Solaris system to natively mount file systems by means of SMB shares from SMB enabled servers such as a Windows system. See the mount_smbfs(1M) man page.

Remediation description:
Uninstall the pkg:/system/file-system/smb package or disable the service.
Remediation script:

    # pkg uninstall file-system/smb

    or

    # svcadm disable smb/client

Service svc:/network/ftp:default is in disabled staterule

The FTP service provides unencrypted file transfer service and uses plain text authentication. The secure copy program (scp(1)) program should be used instead of FTP as it provides encrypted authentication and file transfer.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/ftp:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/ftp:default
Remediation script:

    ftp_fmri=svc:/network/ftp:default
    policy_ftp=disabled
    if [ $policy_ftp == enabled ]; then
            svcadm enable -s $ftp_fmri
    else
            svcadm disable -s $ftp_fmri
    fi

Service svc:/network/ssh:default is in enabled staterule

The ssh service manages the Secure Shell (ssh) daemon, which provides secure encrypted communications between two untrusted hosts over an insecure network. By default, ssh is the only network service that can send and receive network packets on a newly-installed Oracle Solaris system. See the sshd(1M) man page.

This policy requires that the service be enabled.

Remediation description:

To manually remediate this failure, set the service state to enabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/ssh:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/ssh:default
Remediation script:

    ssh_fmri=svc:/network/ssh:default
    policy_ssh=enabled
    if [ $policy_ssh == enabled ]; then
            svcadm enable -s $ssh_fmri
    else
            svcadm disable -s $ssh_fmri
    fi

Service svc:/network/smtp:sendmail is enabledrule

The sendmail service should be running. Otherwise, important system mail to root will not be delivered. If receipt of remote mail is not required, sendmail should be in local_only mode. See check OSC-68505-sendmail-local-only to verify that sendmail is running in local_only mode. See the sendmail(1M) man page.

Remediation description:
Enable the smtp:sendmail service.
Remediation script:

    # svcadm enable smtp:sendmail

Service svc:/network/sendmail-client is enabledrule

The sendmail-client service manages email on a client. The sendmail-client service needs to be running to ensure delivery of mail to local accounts such as root. See the sendmail(1M) man page.

Remediation description:
Enable the sendmail-client service.
Remediation script:

    # svcadm enable sendmail-client

Service svc:/network/inetd is enabledrule

The inetd service manages the restarting of inet services. See the inetd(1M) man page.

Remediation description:
Enable the inetd service.
Remediation script:

    # svcadm enable inetd

Service svc:/system/filesystem/autofs:default is in enabled staterule

The autofs service manages the mount points for the automount(1M) daemon.

This policy requires that the service be enabled.

Remediation description:

To manually remediate this failure, set the service state to enabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/system/filesystem/autofs:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/system/filesystem/autofs:default
Remediation script:

    autofs_fmri=svc:/system/filesystem/autofs:default
    policy_autofs=enabled
    if [ $policy_autofs == enabled ]; then
            svcadm enable -s $autofs_fmri
    else
            svcadm disable -s $autofs_fmri
    fi

Service svc:/system/power management is enabled in global zonerule

The system/power service manages the power management configuration of an Oracle Solaris system. See the poweradm(1M) man page. This service only runs in the global zone.

Remediation description:
Enable the power management service.
Remediation script:

    # svcadm enable system/power

Service svc:/network/dns/multicast:default is in disabled staterule

Multicast DNS (mDNS) implements DNS in a small network where no conventional DNS server has been installed. DNS Service Discovery (DNS-SD) extends multicast DNS to also provide simple service discovery (network browsing). This service is disabled by default, because while it can ease finding hosts and servers, it can also provide information about the network to malicious users. See the named(1M) and mdnsd(1M) man pages.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/dns/multicast:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/dns/multicast:default
Remediation script:

    tcp_dns_multicast_fmri=svc:/network/dns/multicast:default
    policy_tcp_dns_multicast=disabled
    if [ $policy_tcp_dns_multicast == enabled ]; then
            svcadm enable -s $tcp_dns_multicast_fmri
    else
            svcadm disable -s $tcp_dns_multicast_fmri
    fi

Service svc:/network/dhcp-server:default is in disabled staterule

By default, the dhcp-server service is not installed. If you are not using this system as a DHCP server, you should not install or enable the service.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/dhcp-server:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/dhcp-server:default
Remediation script:

    dhcp_server_fmri=svc:/network/dhcp-server:default
    policy_dhcp_server=disabled
    if [ $policy_dhcp_server == enabled ]; then
            svcadm enable -s $dhcp_server_fmri
    else
            svcadm disable -s $dhcp_server_fmri
    fi

Service svc:/network/rarp:default is in disabled staterule

This legacy service responds to DARPA reverse address resolution protocol (RARP) requests. Historically, RARP was used by machines at boot time to discover their Internet Protocol (IP) address. By default, this service is not installed. See the rarpd(1M) and rarp(7P) man pages.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/rarp:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/rarp:default
Remediation script:

    rarp_fmri=svc:/network/rarp:default
    policy_rarp=disabled
    if [ $policy_rarp == enabled ]; then
            svcadm enable -s $rarp_fmri
    else
            svcadm disable -s $rarp_fmri
    fi

Service svc:/network/slp:default is in disabled staterule

This legacy service provides common server functionality for the Service Location Protocol (SLP) versions 1 and 2, as defined by IETF in RFC 2165 and RFC 2608. SLP discovers and selects network services. By default, this service is not enabled. See the slpd(1M), slp.conf(4), and slp(7P) man pages.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/slp:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/slp:default
Remediation script:

    slp_fmri=svc:/network/slp:default
    policy_slp=disabled
    if [ $policy_slp == enabled ]; then
            svcadm enable -s $slp_fmri
    else
            svcadm disable -s $slp_fmri
    fi

Service svc:/network/security/kadmin:default is in disabled staterule

The Kerberos administration daemon service runs on the master key distribution center (KDC), which stores the principal and policy databases. This service should not be run on a system that is not a KDC. See the kadmind(1M) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/security/kadmin:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/security/kadmin:default
Remediation script:

    kadmin_fmri=svc:/network/security/kadmin:default
    policy_kadmin=disabled
    if [ $policy_kadmin == enabled ]; then
            svcadm enable -s $kadmin_fmri
    else
            svcadm disable -s $kadmin_fmri
    fi

Service svc:/network/security/krb5_prop:default is in disabled staterule

The Kerberos propagation daemon runs on slave KDC servers to update the database from the master KDC. See the kpropd(1M) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/security/krb5_prop:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/security/krb5_prop:default
Remediation script:

    krb5_prop_fmri=svc:/network/security/krb5_prop:default
    policy_krb5_prop=disabled
    if [ $policy_krb5_prop == enabled ]; then
            svcadm enable -s $krb5_prop_fmri
    else
            svcadm disable -s $krb5_prop_fmri
    fi

Service svc:/network/security/krb5kdc:default is in disabled staterule

The Kerberos key distribution center service manages Kerberos tickets on the master and slave KDCs. See the krb5kdc(1M) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/security/krb5kdc:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/security/krb5kdc:default
Remediation script:

    krb5kdc_fmri=svc:/network/security/krb5kdc:default
    policy_krb5kdc=disabled
    if [ $policy_krb5kdc == enabled ]; then
            svcadm enable -s $krb5kdc_fmri
    else
            svcadm disable -s $krb5kdc_fmri
    fi

Service svc:/application/management/net-snmp:default is in disabled staterule

The Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment. The net-snmp SNMP daemon processes requests from SNMP management software. See the snmpd(8) and snmp_config(5) man pages.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/application/management/net-snmp:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/application/management/net-snmp:default
Remediation script:

    snmp_fmri=svc:/application/management/net-snmp:default
    policy_snmp=disabled
    if [ $policy_snmp == enabled ]; then
            svcadm enable -s $snmp_fmri
    else
            svcadm disable -s $snmp_fmri
    fi

Service svc:/application/cups/in-lpd:default is in disabled staterule

This service supports the CUPS Line Printer Daemon (LPD) for legacy client systems that use the LPD protocol. By default, this service is not installed. See the cups-lpd(8) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/application/cups/in-lpd:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/application/cups/in-lpd:default
Remediation script:

    lpd_fmri=svc:/application/cups/in-lpd:default
    policy_lpd=disabled
    if [ $policy_lpd == enabled ]; then
            svcadm enable -s $lpd_fmri
    else
            svcadm disable -s $lpd_fmri
    fi

Service svc:/network/finger is disabled or not installedrule

This legacy service enables users to display information about local and remote users. By default, this service is not installed as part of solaris-small-server. It is however installed as part of solaris-large-server. This service is almost never needed and either should be removed or at least, disabled. See the fingerd(1M) and finger(1) man pages.

Remediation description:
Uninstall the pkg:/service/network/finger and pkg:/network/finger packages or disable the service.
Remediation script:

    # svcadm disable finger

    or

    # pkg uninstall pkg:/service/network/finger
    # pkg uninstall pkg:/network/finger

Service svc:/network/login:rlogin is disabled or not installedrule

This legacy service enables users to log in remotely. By default, this service is not installed as part of solaris-small-server. See the rlogind(1M) and rlogin(1) man pages.

Remediation description:
Uninstall the pkg:/service/network/legacy-remote-utilities package or disable the service.
Remediation script:

    # svcadm disable network/login:rlogin

    or

    # pkg uninstall pkg:/service/network/legacy-remote-utilities

Service svc:/network/login:klogin is disabled or not installedrule

This service enables users to log in remotely with Kerberos authentication. By default, this service is not installed. See the rlogind(1M) and rlogin(1) man pages.

Remediation description:
Uninstall the pkg:/service/network/legacy-remote-utilities package or disable the service.
Remediation script:

    # svcadm disable network/login:klogin

Service svc:/network/login:eklogin is disabled or not installedrule

This service enables users to log in remotely with Kerberos authentication over an encrypted line. By default, this service is not installed. See the rlogind(1M) and rlogin(1) man pages.

Remediation description:
Uninstall the pkg:/service/network/legacy-remote-utilities package or disable the service.
Remediation script:

    # svcadm disable network/login:eklogin

Service svc:/network/shell:default is disabled or not installedrule

The remote shell daemon provides remote execution facilities with authentication based on Kerberos V5 or privileged port numbers. The Secure Shell service, svc:/network/ssh, is the best choice for remote execution. See the rshd(1M) and sshd(1M) man pages.

Remediation description:
Disable this service or uninstall the package. To view the contents of the package, run the 'pkg contents legacy-remote-utilities' command.
Remediation script:

    # pkg uninstall legacy-remote-utilities

    or

    # svcadm disable svc:/network/shell:default

Service svc:/network/shell:kshell is disabled or not installedrule

The remote shell daemon provides remote execution facilities with authentication based on Kerberos V5 or privileged port numbers. The Secure Shell service, svc:/network/ssh, is the best choice for remote execution. See the rshd(1M) and sshd(1M) man pages.

Remediation description:
Disable this service or uninstall the package. To view the contents of the package, run the 'pkg contents legacy-remote-utilities' command.
Remediation script:

    # pkg uninstall legacy-remote-utilities

    or

    # svcadm disable svc:/network/shell:kshell

Service svc:/network/telnet is disabled or not installedrule

This legacy service supports the DARPA standard TELNET virtual terminal protocol to connect to a remote system over the TELNET port. By default, this service is not installed. See the telnetd(1M) and telnet(1) man pages.

Remediation description:
Uninstall the telnet packages or disable the service.
Remediation script:

    # pkg uninstall pkg:/network/telnet
    # pkg uninstall pkg:/service/network/telnet

    or

    # svcadm disable telnet

Service svc:/network/uucp is disabled or not installedrule

This legacy service, UNIX to UNIX copy, provides a user interface for requesting file copy operations, typically used when constant connectivity is not possible. By default, this service is not installed. See the uucpd(1M) and uucp(1C) man pages.

Remediation description:
Uninstall the uucp package or disable the service.
Remediation script:

    # pkg uninstall pkg:/service/network/uucp

    or

    # svcadm disable network/uucp

Service svc:/network/chargen:stream is disabled or not installedrule

This legacy service provides the server side of the Character Generator Protocol (RFC 864) for TCP. See the in.chargend(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/chargen:dgram is disabled or not installedrule

This legacy service provides the server side of the Character Generator Protocol (RFC 864) for UDP. See the in.chargend(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/daytime:stream is disabled or not installedrule

This legacy service provides the server side of the Daytime Protocol (RFC 867) for TCP. See the in.daytimed(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/daytime:dgram is disabled or not installedrule

This legacy service provides the server side of the Daytime Protocol (RFC 867) for UDP. See the in.daytimed(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/discard:stream is disabled or not installedrule

This legacy service provides the server side of the Discard Protocol (RFC 863) for TCP. See the in.discardd(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/discard:dgram is disabled or not installedrule

This legacy service provides the server side of the Discard Protocol (RFC 863) for UDP. See the in.discardd(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/echo:stream is disabled or not installedrule

This legacy service provides the server side of the Echo Protocol (RFC 862) for TCP. See the in.echod(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/echo:dgram is disabled or not installedrule

This legacy service provides the server side of the Echo Protocol (RFC 862) for UDP. See the in.echod(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/time:stream is disabled or not installedrule

This legacy service provides the server side of the Time Protocol (RFC 868) for TCP. See the in.timed(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/time:dgram is disabled or not installedrule

This legacy service provides the server side of the Time Protocol (RFC 868) for UDP. See the in.timed(1M) man page.

Remediation description:
Remove the legacy-network-services package. To view the contents of the package, run the 'pkg contents legacy-network-services' command.
Remediation script:

    # pkg uninstall legacy-network-services

Service svc:/network/comsat is disabled or not installedrule

This legacy service process listens for reports of incoming mail and notifies interested users. By default, this service is not installed as part of solaris-small-server. See the comsat(1M) man page.

Remediation description:
Uninstall the pkg:/service/network/comsat package or disable the service.
Remediation script:

    # pkg uninstall network/comsat

    or

    # svcadm disable comsat

Service svc:/network/rexec is disabled or not installedrule

This legacy service provides remote execution facilities with authentication based on user names and passwords. See the in.rexecd(1M) and rexec(3C) man pages.

Remediation description:
Disable the rexec service. You can also uninstall the legacy-remote-utilities package. To view the contents of the package, run the 'pkg contents legacy-remote-utilities' command.
Remediation script:

    # pkg uninstall service/network/legacy-remote-utilities

    or

    # svcadm disable network/rexec:default

Service svc:/network/talk is disabled or not installedrule

This legacy program enables two-way, screen-oriented communication. For more information, see the talk(1) and mesg(1) man pages.

Remediation description:
Disable talk(1) by using the mesg(1) command.
Remediation script:

    # mesg -n

Service svc:/network/stdiscover is disabled or not installedrule

This legacy program is used to locate the service tag listener. For more information, see the in.stdiscover(1M) man page.

Remediation description:
Disable the stdiscover service.
Remediation script:

    # svcadm disable stdiscover:default

Service svc:/network/stlisten is disabled or not installedrule

This legacy program is used to listen for discovery probes. See the in.stlisten(1M) man page.

Remediation description:
Disable the stlisten service.
Remediation script:

    # svcadm disable stlisten:default

Service svc:/network/rpc/gss is enabled if and only if Kerberos is configuredrule

The generic security service (gss) service manages the generation and validation of Generic Security Service Application Program Interface (GSS-API) security tokens. The gssd(1M) daemon operates between the kernel rpc and the GSS-API. Kerberos uses this service.

Remediation description:
Disable the rpc/gss service if Kerberos is not configured and not in use.
Remediation script:

    # svcadm enable rpc/gss

Service svc:/network/rpc/rstat is disabled or not installedrule

This legacy service displays performance data from a remote system. By default, this service is not installed. See the rstatd(1M) and rstat(3RPC) man pages.

Remediation description:
Uninstall the pkg:/service/network/legacy-remote-utilities package or disable the service.
Remediation script:

    # pkg uninstall legacy-remote-utilities

    or

    # svcadm disable rpc/rstat

Service svc:/network/rpc/rusers is disabled or not installedrule

This legacy service displays information about users on a remote system. By default, this service is not installed. See the rusersd(1M) and rusers(1) man pages.

Remediation description:
Uninstall the pkg:/service/network/legacy-remote-utilities package or disable the service.
Remediation script:

    # pkg uninstall legacy-remote-utilities

    or

    # svcadm disable rpc/rusers

Service svc:/network/rpc/meta is disabled or not installedrule

This legacy service uses an rpc(4) daemon to manage local copies of metadevice diskset information. By default, this service is not installed. See the rpc.metad(1M) man page.

Remediation description:
Uninstall the package or disable the service.
Remediation script:

    # pkg uninstall storage/svm

    or

    # svcadm disable rpc/meta

Service svc:/network/rpc/metamed is disabled or not installedrule

This legacy service manages mediator information for 2-string high availability configurations. See the rpc.metamedd(1M) man page.

Remediation description:
Uninstall the package or disable the service.
Remediation script:

    # pkg uninstall storage/svm

    or

    # svcadm disable rpc/metamed

Service svc:/network/rpc/metamh is disabled or not installedrule

This legacy service uses an rpc(4) daemon to manage multi-hosted disks. By default, this service is not installed. See the rpc.metamhd(1M) man page.

Remediation description:
Uninstall the package or disable the service.
Remediation script:

    # pkg uninstall storage/svm

    or

    # svcadm disable rpc/metamh

Service svc:/network/rpc/rex is disabled or not installedrule

This program is the Oracle Solaris RPC server for remote program execution. If this service is enabled, the daemon is started by inetd(1M) whenever a remote execution request is made. See the rpc.rexd(1M) man page.

Remediation description:
Disable the rex service.
Remediation script:

    # svcadm disable rpc/rex:default

Service svc:/network/rpc/spray is disabled or not installedrule

This program is a server that records the packets sent by spray(1M). See the rpc.sprayd(1M) man page.

Remediation description:
Disable the spray service.
Remediation script:

    # pkg uninstall service/diagnostic/spray

    or

    # svcadm disable rpc/spray:default

Service svc:/network/rpc/wall is disabled or not installedrule

This program broadcasts messages to all logged-in users. See the rpc.rwalld(1M) and wall(1M) man pages.

Remediation description:
Disable the wall service.
Remediation script:

    # pkg uninstall legacy-remote-utilities

    or

    # svcadm disable rpc/wall:default

Service svc:/system/avahi-bridge-dsd is disabled or not installedrule

This program provides an object-oriented interface to DBUS-enabled applications. See the avahi-daemon-bridge-dsd(1) man page.

Remediation description:
Disable the avahi-bridge-dsd service.
Remediation script:

    # svcadm disable system/avahi-bridge-dsd:default

Service cde-ttdbserver is enabled, or not installedrule

The rpc.ttdbserver service is part of the Common Desktop Environment (CDE) which predates the use of GNOME in Solaris. If you are running CDE, then you should enable its services. You should have good reasons to choose CDE over GNOME as your desktop environment.

Remediation description:
If installed, this service should be enabled.
Remediation script:

    # svcadm enable rpc/ttdbserver

Service svc:/application/graphical-login/gdm:default is in disabled staterule

The GNOME Display Manager manages the displays on a system, including the console display, attached displays, XDMCP displays, and virtual terminals.

If a windowing display is not needed, this service should be disabled. If a windowing display is needed and installed, this service should be enabled. See the gdm(1M) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/application/graphical-login/gdm:default
  2. To set the service to enabled run: 
              # svcadm enable svc:/application/graphical-login/gdm:default
Remediation script:

    gdm_fmri=svc:/application/graphical-login/gdm:default
    policy_gdm=disabled
    if [ $policy_gdm == enabled ]; then
            svcadm enable -s $gdm_fmri
    else
            svcadm disable -s $gdm_fmri
    fi

Service cde-calendar-manager is enabled, or not installedrule

The cde-calendar-manager service is part of the Common Desktop Environment (CDE) which predates the use of GNOME in Solaris. If you are running CDE, then you should enable its services. You should have good reasons to choose CDE over GNOME as your desktop environment.

Remediation description:
If installed, this service should be enabled.
Remediation script:

    # svcadm enable svc:/network/rpc/cde-calendar-manager:default

Service svc:/application/x11/xfs is disabled or not installedrule

This program provides fonts to X Window System display servers. The server is usually run by inetd(1M). See the xfs(1) and fsadmin(1) man pages.

Remediation description:
Disable the xfs service.
Remediation script:

    # svcadm disable svc:/application/x11/xfs:default

Service xvnc-inetd is enabled, or not installedrule

The xvnc-inetd service runs the X VNC server from inetd(1M). See the Xvnc(1) man page.

Remediation description:
To run Xvnc from inetd, this service must be enabled.
Remediation script:

    # svcadm enable application/x11/xvnc-inetd

The GNOME desktop has suitable screensaver settingsrule

The timeout parameter for the xscreensaver application specifies the amount of time that the keyboard and mouse can be inactive before a password-protected screensaver appears. See the xscreensaver(1) man page.

Remediation description:
A screensaver timeout provides protection for a desktop that has not been locked by an absent user. To help prevent session hijacking, the timeout value should be set to a fairly short interval.
Remediation script:

    # cd /usr/share/X11/app-defaults
    # cp XScreenSaver XScreenSaver.orig
    # pfedit XScreenSaver
    *timeout:       0:10:00
    *lockTimeout:   0:00:00
    *lock:    True

The NIS client service is disabled or not installedrule

By default, NIS client software is not installed. NIS is an RPC-based naming service that does not conform to current security requirements, so can be less secure than the LDAP naming service. See the nis(5) and ypbind(1M) man pages.

Remediation description:
Disable the NIS client service if it is not on a network with an NIS server.
Remediation script:

    # svcadm disable svc:/network/nis/client

The NIS server service is disabled or not installedrule

By default, NIS server software is not installed. NIS is an RPC-based naming service that does not conform to current security requirements, that can be less secure than the LDAP naming service. See the nis(5) and ypserv(1M) man pages.

Remediation description:
Disable the NIS server service if it is not being used to distribute system and user configuration information.
Remediation script:

    # svcadm disable svc:/network/nis/server

The r-protocols services are disabled in PAMrule

By default, legacy services such as the r-protocols, rlogin(1) and rsh(1), are not installed. Their services, however, are defined in /etc/pam.d. See the pam.d(4) man page.

Remediation description:
If you remove the service definitions from /etc/pam.d, these services would use the "other" service if these legacy services were enabled. Therefore, specify pam_deny.so.1 as the module for the authentication stack for the r-protocol services in the /etc/pam.d directory.
Remediation script:

    # cd /etc/pam.d
    # cp rlogin rlogin.orig
    # pfedit rlogin
    auth definitive    pam_deny.so.1
    auth sufficient    pam_deny.so.1
    auth required    pam_deny.so.1
    # cp rsh rsh.orig
    # pfedit rsh
    auth definitive         pam_deny.so.1
    auth sufficient         pam_deny.so.1
    auth required           pam_deny.so.1

Service svc:/network/http:apache22 is in disabled staterule

This program provides Apache web server services by using the Apache hypertext transfer protocol (http). See the httpd(8) man page.

This policy requires that the service be disabled.

Remediation description:

To manually remediate this failure, set the service state to disabled using the appropriate command.

  1. To set the service to disabled run: 
              # svcadm disable svc:/network/http:apache22
  2. To set the service to enabled run: 
              # svcadm enable svc:/network/http:apache22
Remediation script:

    apache_fmri=svc:/network/http:apache22
    policy_apache=disabled
    if [ $policy_apache == enabled ]; then
            svcadm enable -s $apache_fmri
    else
            svcadm disable -s $apache_fmri
    fi

Service svc:/network/rpc/keyserv is disabled or not installedrule

keyserv is a daemon that is used for storing the private encryption keys of each user logged into the system. These encryption keys are used for accessing secure network services such as secure NFS. For more information, see the keyserv(1M) man page.

Remediation description:
Disable the keyserv service.
Remediation script:

    # svcadm disable network/rpc/keyserv:default

ssh(1) is the only service binding a listener to non-loopback addressesrule

By default, ssh(1) is the only network service that can send and receive network packets on a newly-installed Oracle Solaris system. Of course, most useful servers will have some additional service such as a web server on port 80, etc. Also, rpcbind, if it is online, should be configured to listen only for local connections. See the sshd(1M) and rpcbind(1M) man pages.

Remediation description:

Disable any unneeded services listening on the network. 

        # svcadm disable <FMRI for unneeded service>

Additionally, rpcbind should be set to local only mode so that it does not respond to remote requests, using: 

        # /usr/sbin/svccfg -s svc:/network/rpc/bind:default setprop config/local_only = boolean: true
        # svcadm refresh svc:/network/rpc/bind:default
Remediation script:

ssh(1) requires passwordsrule

Logins without a password put the system at risk. In the default remote login service, Secure Shell, the PermitEmptyPasswords parameter in the /etc/ssh/sshd_config file should remain set to no. See the sshd_config(4) man page.

Remediation description:
Ensure that PermitEmptyPasswords value in the /etc/ssh/sshd_config file has not been changed. The default value is no. If you reset the value, restart the ssh service.
Remediation script:

    # cd /etc/ssh
    # grep PermitEmpty sshd_config
    ...
    PermitEmptyPasswords no

    # svcadm restart svc:/network/ssh

rhost-based authentication in ssh(1) is disabledrule

rhost-based authentication in Secure Shell allows users to remotely log in without supplying a password. The IgnoreRhosts parameter specifies whether .rhosts and .shosts files can be used rather than a password. See the sshd_config(4) and hosts.equiv(4) man pages.

Remediation description:
Ensure that the default value of IgnoreRhosts has not been changed. If the parameter is not in the /etc/ssh/sshd_config file, the value is yes. If IgnoreRhosts is in the file, set its value to yes. Secure Shell parameters are case-sensitive. If you reset the value, restart the ssh service.
Remediation script:

    # pfedit /etc/ssh/sshd_config
    IgnoreRhosts    yes

    # svcadm restart svc:/network/ssh

root login by using ssh(1) is disabledrule

By default, remote root logins are not permitted because root is a role and roles cannot log in. If root has been changed to a user, the default value of the PermitRootLogin parameter in the /etc/ssh/sshd_config file prevents root from remotely logging in. See the sshd_config(4) man page.

Remediation description:
If root is a user on your system, ensure that the value of PermitRootLogin has not been changed to yes. If you reset the value, restart the ssh service.
Remediation script:

    # pfedit /etc/ssh/sshd_config
    PermitRootLogin no

    # svcadm restart svc:/network/ssh

Service svc:/network/smtp:sendmail only listens on loopbackrule

Check that sendmail listens in local_only mode. This is also called listens on loopback. See the sendmail(1M) and svccfg(1M) man pages

Remediation description:
Set the service to listen in local_only mode.
Remediation script:

    #  svccfg -s svc:/network/smtp:sendmail setprop \
    config/local_only = astring: "true"

The umask(1) for SMF services is 022rule

Files that the Service Management Facility (SMF) creates should be created with 644 file permissions.

Remediation description:
Set the umask for SMF services to 022.
Remediation script:

    # svccfg -s svc:/system/environment:init setprop umask/umask = astring: "022"

Tune kernel and network parametersgroup

Oracle Solaris is a multithreaded, scalable UNIX operating system that runs on SPARC and x86 processors. It is self-adjusting to system load and requires minimal tuning. Kernel and network variables are tuned to secure values by default. In some cases, however, tuning is necessary.
For more information, see:

  • Tunables Parameters (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=SOLTUNEPARAMREF)
  • Network Security Guide (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=NWSEC)

In this section, you verify that a TCP/IP kernel variable is still set to its default value, and that you modify network tunables for security reasons.

contains 9 rules

Directed broadcasts are not forwardedrule

By default, Oracle Solaris forwards broadcast packets. To reduce the possibility of broadcast flooding, change the default. Note that you are also disabling broadcast pings.

Remediation description:
Directed broadcasts are manged using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix
    # ipadm set-prop -p _forward_directed_broadcasts=0 ip
    or
    # ipadm reset-prop -p _forward_directed_broadcasts ip

Responses to ICMP netmask requests are disabledrule

To prevent the dissemination of information about the network topology, disable these responses if they are currently enabled.

Remediation description:
Responses to ICMP netmask requests are managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix, use
    # ipadm set-prop -p _respond_to_address_mask_broadcast=0 ip
    or
    # ipadm set-prop -p _respond_to_address_mask_broadcast ip

Responses to ICMP broadcast timestamp requests are disabledrule

To prevent the dissemination of information about the network topology, disable these responses if they are currently enabled.

Remediation description:
Responses to ICMP broadcast timestamp requests are managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix, use
    # ipadm set-prop -p _respond_to_timestamp_broadcast=o ip
    or
    # ipadm reset-prop -p _respond_to_timestamp_broadcast ip

Responses to ICMP timestamp requests are disabledrule

The default value removes additional CPU demands on systems and prevents the dissemination of information about the network.

Remediation description:
Responses to ICMP timestamp requests are managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix
    # ipadm set-prop -p _respond_to_timestamp=0 ip
    or
    # ipadm reset-prop -p _respond_to_timestamp ip

Source-routed packets are not forwardedrule

To prevent DOS attacks from spoofed packets, ensure that source-routed packets are not forwarded. The default is not to forward them.

Remediation description:
Forwarding of source-routed packets is managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix, use
    # ipadm set-prop -p _forward_src_routed=0 ipv4
    and
    # ipadm set-prop -p _forward_src_routed=0 ipv6

TCP reverse source routing is disabledrule

The default value prevents packets from bypassing network security measures. Source-routed packets allow the source of the packet to suggest a path different from the path configured on the router. Note - This parameter might be set to 1 for diagnostic purposes. After diagnosis is complete, return the value to 0.

Remediation description:
TCP reverse source routing is managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix
    # ipadm set-prop -p _rev_src_routes=0 tcp
    or
    # ipadm reset-prop -p _rev_src_routes tcp

The maximum number of half-open TCP connections is set to the defaultrule

Setting the maximum half-open TCP connections to 4096 per IP address per port helps to defend against SYN flood denial of service attacks. 1024 is the default.

Remediation description:
The maximum number of half-open TCP connections is managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix
    # ipadm set-prop -p _conn_req_max_q0=1024 tcp

The maximum number of waiting TCP connections is set to the defaultrule

Setting the maximun number of queued incoming connections TCP to at least 1024 can help prevent certain Distributed Denial of Service (DDoS) attacks. The default is 128.

Remediation description:
The maximum number of waiting TCP connections is managed using the ipadm command. See the ipadm(1M) man page.
Remediation script:

    To fix
    # ipadm set-prop -p _conn_req_max_q=128 tcp

Strong TCP packet sequence numberingrule

Ensure that the TCP initial sequence number generation parameter complies with RFC 6528 (http://www.ietf.org/rfc/rfc6528.txt).

Remediation description:
TCP initial sequence number generation parameters are set in the /etc/default/inetinit file using the TCP_STRONG_ISS parameter which should be set to 2.
Remediation script:

    # pfedit /etc/default/inetinit
    ...
    TCP_STRONG_ISS=2
    ...

Verify user configurationgroup

Each user at a site must have a unique login and ID, and be assigned a home directory. User passwords must be as secure as possible, and their files at creation must be protected from modification by other users. User configuration should protect regular users and prevent or discourage malicious users.
For more information, see the User Rights guide (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=OSSUP).
In this section, you verify password constraints and other user configuration features. You also correct role configuration, verify that system accounts are still correctly configured, and check for duplicate and unknown users.

contains 25 rules

DICTIONBDIR is set to /var/passwdrule

DICTIONBDIR in the /etc/default/passwd file points to the /var/passwd dictionary by default. A password dictionary can strengthen users' password selection by preventing the use of common words or letter combinations. The passwd command performs dictionary lookups in the dictionary that DICTIONBDIR indicates. See the passwd(1) man page.

Remediation description:
In the /etc/default/passwd file, set the DICTIONBDIR variable to /var/passwd.
Remediation script:

    # pfedit /etc/default/passwd
    ...
    # Compliance to the PCI-DSS benchmark is /var/passwd
    #DICTIONBDIR=
    DICTIONBDIR=/var/passwd
    ...

Passwords are hashed with a secure algorithmrule

The hash used is determined by values of CRYPT_ALGORITHMS_ALLOW and CRYPT_DEFAULT set in /etc/security/policy.conf file. The value for SHA-256 is "5", and the value for SHA-512 is "6". To confirm properly set, the second field in the /etc/shadow file indicates the algorithm that was used to create the password hash. If the algorithm is set to SHA-256, the entry begins with "$5$" If the algorithm is set to SHA-512, the entry begins with "$6$" See the crypt.conf(4) and policy.conf(4) man pages.

Remediation description:
Save the /etc/security/policy.conf file to a new name. Edit original policy.conf file to accept 5 (and 6 if desired) as values for allowed algorithms, and 5 (or 6 if desired, and if added as allowed) as the value for the default algorithm. Set the password for your users, or set a deadline for password change. After setting the password, or after the deadline, verify the $5$ or $6$ prefix for the second field of the users' entries in /etc/shadow file. Once verified, you can safely remove the saved policy.conf file.
Remediation script:

    # cd /etc/security
    # cp policy.conf policy.conf.save
    # pfedit policy.conf
    CRYPT_ALGORITHMS_ALLOW=5
    CRYPT_DEFAULT=5

    # passwd <username>
    New Password: xxxxxxxx
    Re-enter new Password: xxxxxxxx

    # grep <username> /etc/shadow
    <username>:$5$xxxxx::::::10 xxxxx

    # cp policy.conf.save policy.conf

Passwords allow repeat charactersrule

MAXREPEATS in the `/etc/default/passwd file allows users to repeat characters in passwords. The default is 0, which permits repeated characters. Any other value indicates how many characters can be repeated. See the passwd(1) man page.

Remediation description:
In the /etc/default/passwd file, set the MAXREPEATS variable to 0.
Remediation script:

    # pfedit /etc/default/passwd
    ...
    # Compliance to the PCI-DSS benchmark is 0 which is the default
    #MAXREPEATS=1   /** not default value **/
    MAXREPEATS=0
    ...

Passwords must have at least 2 alphabetic charactersrule

MINALPHA in the /etc/default/passwd file indicates the minimum number of alphabetic characters that passwords must contain. Alphabetic characters provide more values than numeric or special characters, so allow for more variation. The default value is 2.

The policy states the password must have a minimum of 2 alphabetic characters. See the passwd(1) man page.

Remediation description:

Edit the /etc/default/passwd file, set the MINALPHA parameter to the policy minimum password alphabetic character count, which is 2. 

      # pfedit /etc/default/passwd
      MINALPHA=2
Remediation script:

    cfgfile=/etc/default/passwd
    cfgfile_tmp=`mktemp`
    var_c_cnt=`grep -c "^# *MINALPHA=" $cfgfile`
    var_cnt=`grep -c "^ *MINALPHA=" $cfgfile`
    policy=2
    if [ $var_cnt -ge 1 ];then
            sed -e 's/^ *MINALPHA=.*/MINALPHA='$policy'/' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    elif [ $var_c_cnt -ge 1 ];then
            sed '/^# *MINALPHA=.*/a\
MINALPHA='$policy'' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    else
            echo "MINALPHA=$policy" >> $cfgfile
    fi
    rm -f $cfgfile_tmp

Passwords must differ by at least 3 charactersrule

MINDIFF in the /etc/default/passwd file indicates the minimum number of characters that a password must differ from the previous value.

The policy states the password must be at least a minimum of 3 characters different.

Remediation description:

Edit the /etc/default/passwd file, set the MINDIFF parameter to the policy minimum password character difference, which is 3. 

      # pfedit /etc/default/passwd
      MINDIFF=3
Remediation script:

    cfgfile=/etc/default/passwd
    cfgfile_tmp=`mktemp`
    var_c_cnt=`grep -c "^# *MINDIFF=" $cfgfile`
    var_cnt=`grep -c "^ *MINDIFF=" $cfgfile`
    policy=3
    if [ $var_cnt -ge 1 ];then
            sed -e 's/^ *MINDIFF=.*/MINDIFF='$policy'/' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    elif [ $var_c_cnt -ge 1 ];then
            sed '/^# *MINDIFF=.*/a\
MINDIFF='$policy'' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    else
            echo "MINDIFF=$policy" >> $cfgfile
    fi
    rm -f $cfgfile_tmp

Passwords must have at least 0 lower-case charactersrule

MINLOWER in the /etc/default/passwd file indicates the minimum number of lower-case characters that a password must have.

The policy states the password must have a minimum of 0 lower-case characters.

Remediation description:

Edit the /etc/default/passwd file, set the MINLOWER parameter to the policy minimum password lower-case character count, which is 0. 

      # pfedit /etc/default/passwd
      MINLOWER=0
Remediation script:

    cfgfile=/etc/default/passwd
    cfgfile_tmp=`mktemp`
    var_c_cnt=`grep -c "^# *MINLOWER=" $cfgfile`
    var_cnt=`grep -c "^ *MINLOWER=" $cfgfile`
    policy=0
    if [ $var_cnt -ge 1 ];then
            sed -e 's/^ *MINLOWER=.*/MINLOWER='$policy'/' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    elif [ $var_c_cnt -ge 1 ];then
            sed '/^# *MINLOWER=.*/a\
MINLOWER='$policy'' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    else
            echo "MINLOWER=$policy" >> $cfgfile
    fi
    rm -f $cfgfile_tmp

Passwords require at least 1 non-alphabetic charactersrule

MINNONALPHA in the /etc/default/passwd file indicates the minimum number of non-alphabetic characters that a password must contain. Non-alphabetic characters provide some protection against dictionary-based password attacks. The default is 0.

The policy states the password must have a minimum of 1 non-alphabetic characters. See the passwd(1) man page.

Remediation description:

Edit the /etc/default/passwd file, set the MINNONALPHA parameter to the policy minimum password non-alphabetic character count, which is 1. 

      # pfedit /etc/default/passwd
      MINNONALPHA=1
Remediation script:

    cfgfile=/etc/default/passwd
    cfgfile_tmp=`mktemp`
    var_c_cnt=`grep -c "^# *MINNONALPHA=" $cfgfile`
    var_cnt=`grep -c "^ *MINNONALPHA=" $cfgfile`
    policy=1
    if [ $var_cnt -ge 1 ];then
            sed -e 's/^ *MINNONALPHA=.*/MINNONALPHA='$policy'/' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    elif [ $var_c_cnt -ge 1 ];then
            sed '/^# *MINNONALPHA=.*/a\
MINNONALPHA='$policy'' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    else
            echo "MINNONALPHA=$policy" >> $cfgfile
    fi
    rm -f $cfgfile_tmp

Passwords must have at least 0 special charactersrule

MINSPECIAL in the /etc/default/passwd file indicates the minimum number of special characters that a password must have.

The policy states the password must have a minimum of 0 special characters.

Remediation description:

Edit the /etc/default/passwd file, set the MINSPECIAL parameter to the policy minimum password special character count, which is 0. 

      # pfedit /etc/default/passwd
      MINSPECIAL=0
Remediation script:

    cfgfile=/etc/default/passwd
    cfgfile_tmp=`mktemp`
    var_c_cnt=`grep -c "^# *MINSPECIAL=" $cfgfile`
    var_cnt=`grep -c "^ *MINSPECIAL=" $cfgfile`
    policy=0
    if [ $var_cnt -ge 1 ];then
            sed -e 's/^ *MINSPECIAL=.*/MINSPECIAL='$policy'/' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    elif [ $var_c_cnt -ge 1 ];then
            sed '/^# *MINSPECIAL=.*/a\
MINSPECIAL='$policy'' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    else
            echo "MINSPECIAL=$policy" >> $cfgfile
    fi
    rm -f $cfgfile_tmp

NAMECHECK for passwords is set to YESrule

NAMECHECK in the /etc/default/passwd file indicates whether login names are checked in the files naming service. The default, YES, prevents malicious users from using a login name that is not in a local file. See the passwd(1) man page.

Remediation description:
In the /etc/default/passwd file, set the NAMECHECK variable to YES.
Remediation script:

    # pfedit /etc/default/passwd
    ...
    # Compliance to the PCI-DSS benchmark is YES which is the default
    #NAMECHECK=NO  /** not default value **/
    NAMECHECK=YES
    ...

Passwords must be at least 8 characters longrule

PASSLENGTH in the /etc/default/passwd file indicates the minimum number of characters that a password must contain. A longer password length plus a strong password hashing algorithm provides some protection against password attacks.

The policy states the password must be at least a minimum of 8 characters long.

Remediation description:

Edit the /etc/default/passwd file, set the PASSLENGTH parameter to the policy minimum password length, which is 8. 

      # pfedit /etc/default/passwd
      PASSLENGTH=8
Remediation script:

    cfgfile=/etc/default/passwd
    cfgfile_tmp=`mktemp`
    var_c_cnt=`grep -c "^# *PASSLENGTH=" $cfgfile`
    var_cnt=`grep -c "^ *PASSLENGTH=" $cfgfile`
    policy=8
    if [ $var_cnt -ge 1 ];then
            sed -e 's/^ *PASSLENGTH=.*/PASSLENGTH='$policy'/' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    elif [ $var_c_cnt -ge 1 ];then
            sed '/^# *PASSLENGTH=.*/a\
PASSLENGTH='$policy'' $cfgfile > $cfgfile_tmp
            cp $cfgfile_tmp $cfgfile
    else
            echo "PASSLENGTH=$policy" >> $cfgfile
    fi
    rm -f $cfgfile_tmp

Passwords require at least six charactersrule

PASSLENGTH in the /etc/default/login file indicates the minimum number of characters that a password must contain. A longer password length plus a strong password hashing algorithm provide some protection against password attacks. The default in Oracle Solaris 11 is 6.

This test is deprecated. It is included solely for compatibility with existing tailorings, and is planned to be removed in a future release. Use test OSC-46000 to enforce a minimum password length, and adjust the required length by configuring the value for OSCV-46000.

Remediation description:
In the /etc/default/login file, set the PASSLENGTH variable to 6.
Remediation script:

    # pfedit /etc/default/login
    ...
    # Compliance to the Baseline profile for Oracle Solaris 11 is 6
    #PASSLENGTH=6
    ...

Passwords allow whitespacerule

WHITESPACE in the /etc/default/login file indicates whether passwords can include the space character. The space character provides some protection against dictionary-based password attacks. The default is YES. See the passwd(1) man page.

Remediation description:
In the /etc/default/login file, set the WHITESPACE variable to YES.
Remediation script:

    # pfedit /etc/default/login
    ...
    # Compliance to the PCI-DSS benchmark is YES which is the default
    #WHITESPACE=NO   /** not default value **/
    WHITESPACE=YES
    ...

Role details are unchangedrule

Oracle Solaris ships with Role Based Access Control (RBAC). This feature enables administrators to delegate specific, limited, additional privileges and authorizations to individual users to administer parts of the system without giving them access to the root account. The provided rights databases should not be changed directly. To add rights to roles, use the roleadd and rolemod commands. These commands add entries to the /etc/user_attr file. See the profiles(1), auths(1), roles(1), rbac(5), roleadd(1M), rolemod(1M), and user_attr(4) man pages.

Remediation description:
The files in /etc/user_attr.d/ should not be changed; changes and additions should be made using the roleadd(1M), rolemod(1M), profiles(1), auths(1), and usermod(1M) commands.
Remediation script:

    # pkg revert /etc/user_attr.d/<changed file>

    Then

    # roleadd <role>
    # rolemod <role>

Logins require passwordsrule

PASSREQ in the /etc/default/login file indicates whether logins require passwords. Passwords are required for defense against computer attacks. The default is YES. See the login(1) man page.

Remediation description:
In the /etc/default/login file, set the PASSREQ variable to YES.
Remediation script:

    # pfedit /etc/default/login
    ...
    # Compliance to the PCI-DSS benchmark is YES which is the default
    #PASSREQ=NO   /** not default value **/
    PASSREQ=YES
    ...

shadow(4) password fields are not emptyrule

The second field in the /etc/shadow file contains passwords. When creating roles, you can easily forget to assign a password. See the shadow(4) and passwd(1) man pages.

Remediation description:
Assign a password, or remove the account. When creating roles, you can easily forget to assign a password.
Remediation script:

    # userdel <account-with-no-password>

    or

    # passwd <account-with-no-password>>
    New Password: xxxxxxxx
    Re-enter new Password: xxxxxxxx

Local users are assigned home directoriesrule

Users need a place to store and create files. A home directory enables a user to place configuration files, such as the .profile file, and ongoing work in a directory that is owned by the user.

Remediation description:
Local users should have a local home directory created automatically when useradd(1M) is run with the correct options. Run 'useradd -D' to see the default "basedir" home directory location. See the useradd(1M) man page.
Remediation script:

    # useradd -m <login>

root is the only user with UID=0rule

The UID of 0 has superuser privileges. Only root should have those privileges.

Remediation description:
Either remove additional UID=0 accounts or assign different UIDs to them.
Remediation script:

    # userdel <duplicate UID username>

    or

    # usermod -u <new UID> <login>

All groups specified in /etc/passwd are defined in /etc/grouprule

Users are assigned to at least one group and can be assigned to secondary groups. All groups must be defined in the /etc/group file.

Remediation description:
All groups which are assigned to users must be defined in /etc/group. See the man pages for group(4), groupadd(1M), groupmod(1M), and groupdel(1M).
Remediation script:

    # groupadd <missing-group>

Home directories for all users existrule

Users need a place to store and create files. A home directory enables a user to place configuration files, such as the .profile file, and ongoing work in a directory that is owned by the user.

Remediation description:
Local users should have a local home directory created automatically when useradd(1M) is run with the correct options. Run 'useradd -D' to see the default "basedir" home directory location. See the useradd(1M) man page.
Remediation script:

    # useradd -m <login>

Reserved system accounts remain unusedrule

Accounts whose ID is 100 or less are system accounts. These accounts should not be replaced or reconfigured.

Remediation description:
Users should not be assigned UIDs less than 100 and existing system accounts should not be renamed or renumbered. Undo any changes that have made involving these accounts. See the usermod(1M) man page.
Remediation script:

    # usermod <options> <username>

Find and list duplicate GIDsrule

Groups, like users, are unique. Duplicate group IDs must be removed.

Remediation description:
When duplicate GIDs are identified, use groupmod or groupdel to eliminate the duplicates. See the man pages for group(4), groupadd(1M), groupmod(1M), and groupdel(1M).
Remediation script:

    # groupmod -<options> <group>

Find and list duplicate group namesrule

Groups, like users, are unique. Duplicate group names must be removed.

Remediation description:
When duplicate group names are identified, use groupmod or groupdel to eliminate the duplicates. See the man pages for group(4), groupadd(1M), groupmod(1M), and groupdel(1M).
Remediation script:

    # groupmod -<options> <group>

Find and list duplicate UIDsrule

Users are identified by IDs, which must be unique. Duplicate user IDs must be removed.

Remediation description:
When duplicate UIDs are identified, use usermod or userdel to eliminate the duplicates. See the man pages for passwd(4), useradd(1M), usermod(1M), and userdel(1M).
Remediation script:

    # usermod -<options> <username>

Find and list duplicate usernamesrule

Users log in by name, which must be unique. Duplicate user names must be removed.

Remediation description:
When duplicate user names are identified, use usermod or userdel to eliminate the duplicates. See the man pages for passwd(4), useradd(1M), usermod(1M), and userdel(1M).
Remediation script:

    # usermod -<options> <username>

Default system accounts are lockedrule

Oracle Solaris is installed with correctly configured system accounts. These accounts should not be modified.

Remediation description:
Certain system accounts, such as aiuser, dladm, etc. are shipped as "locked" and should remain that way. Use 'passwd -l' to lock accounts that need to be locked.
Remediation script:

    # passwd -l <username>

Check various system configuration itemsgroup

contains 7 rules

The default user UMASK is 022rule

UMASK in the /etc/default/login file indicates the permissions on user files at creation. This value should not allow group or world write. The default value is 022, which allows group and world to read files owned by a user. See the login(1) man page.

Remediation description:
In the /etc/default/login file, set the UMASK variable to 022.
Remediation script:

    # pfedit /etc/default/login
    ...
    # Compliance to the PCI-DSS benchmark is 022 which is the default
    #UMASK=077   /** not default value **/
    UMASK=022
    ...

root access is console-onlyrule

The root account should not be able to log in remotely, and its actions should be monitored. See the login(1) man page.

Remediation description:
Ensure that the default value of CONSOLE=/dev/console has not been changed in the /etc/default/login file.
Remediation script:

    # If CONSOLE is set, root can only log in on that device.
    # grep CONSOLE /etc/default/login
    CONSOLE=/dev/console

DISABLETIME is set for loginsrule

DISABLETIME in the /etc/default/login file is set to 20 by default. Any value greater than zero indicates the seconds before a login prompt appears after RETRIES failed login attempts. This delay can mitigate rapid-fire, brute force attacks on passwords. See the login(1) man page.

Remediation description:
In the /etc/default/login file, set the DISABLETIME variable to 20.
Remediation script:

    # pfedit /etc/default/login
    ...
    # Compliance to the PCI-DSS benchmark is 20 which is the default
    #DISABLETIME=6   /** not default value **/
    DISABLETIME=20
    ...

SLEEPTIME following an invalid login attempt is set to 4rule

SLEEPTIME in the /etc/default/login file is set to 4 by default. This number indicates the number of seconds that elapse before the "login incorrect" message appears after an incorrect password is typed. The maximum number is 5. This delay can mitigate rapid-fire, brute force attacks on passwords. See the login(1) man page.

Remediation description:
In the /etc/default/login file, set the SLEEPTIME variable to 4.
Remediation script:

    # pfedit /etc/default/login
    ...
    # Compliance to the PCI-DSS benchmark is 4 which is the default
    #SLEEPTIME=1 /**not default value**/
    SLEEPTIME=4
    ...

Address Space Layout Randomization (ASLR) is enabledrule

Oracle Solaris tags many of its userland binaries to enable Address Space Layout Randomization (ASLR). ASLR randomizes the starting address of key parts of an address space. This security defense mechanism can cause Return Oriented Programming (ROP) attacks to fail when they try to exploit software vulnerabilities. See the sxadm(1M) man page.
Zones inherit this randomized layout for their processes. Because the use of ASLR might not be optimal for all binaries, the use of ASLR is configurable at the zone level and at the binary level.

Remediation description:
Restore ASLR to the default configuration.

To manually remediate this failure, perform the following actions:

  1. Use sxadm to enable aslr by restoring default settings. 
    	  # sxadm delcust aslr
	  # sxadm enable aslr
  2. Check that aslr is enabled. 
    	  # sxadm get all aslr
	EXTENSION           PROPERTY                      VALUE
	aslr                model                         tagged-files
Remediation script:

    svcadm enable -s svc:/system/security/security-extensions:default
    sxadm delcust aslr
    sxadm enable aslr

Stacks are non-executablerule

Programs read and write data on the stack. Typically, they execute from read-only portions of memory that are specifically designated for code. Some attacks that cause buffers on the stack to overflow try to insert new code on the stack and cause the program to execute it. This security extension removes execute permission from the stack memory, preventing these attacks from succeeding. See the sxadm(1M) man page.
Properly written programs function correctly without using executable stacks.

Remediation description:

To manually remediate this failure, perform the following actions:

  1. Use sxadm to enable nxstack and logging by restoring default settings. 
    	  # sxadm delcust nxstack
	  # sxadm enable nxstack
  2. Check that nxstack is enabled and logging. 
    	  # sxadm get all nxstack
	EXTENSION           PROPERTY                      VALUE
	nxstack             model                         all
	--                  log                           enable
Remediation script:

    svcadm enable -s svc:/system/security/security-extensions:default
    sxadm delcust nxstack
    sxadm enable nxstack

Heaps are non-executablerule

Programs read and write data on the heap. Typically, they execute from read-only portions of memory that are specifically designated for code. Some attacks that cause buffers on the heap to overflow try to insert new code on the heap and cause the program to execute it. Removing execute permission from the heap memory prevents these attacks from succeeding. Properly written programs may function correctly without using executable heaps, but some older programs may rely on heap execution. Setting model=tagged-files (or default) ensures that unexpected heap execution attempts are prevented and enabling the nxheap log ensures that such attempts are recorded.

Remediation description:

To manually remediate this failure, perform the following actions:

  1. Use sxadm to enable nxheap and logging. 
    	  # sxadm delcust nxheap
	  # sxadm enable nxheap
  2. Check that nxheap is enabled and logging. 
    	  # sxadm get all nxheap
	EXTENSION           PROPERTY                      VALUE
	nxheap              model                         tagged-files
	--                  log                           enable
Remediation script:

    svcadm enable -s svc:/system/security/security-extensions:default
    sxadm delcust nxheap
    sxadm enable nxheap

Verify audit configurationgroup

Auditing is the collecting of data about the use of system resources. The audit data provides a record of security-related system events. This data can then be used to assign responsibility for actions that take place on a host.
Auditing helps to detect potential security breaches by revealing suspicious or abnormal patterns of system usage. Auditing also provides a means to trace suspect actions back to a particular user, thus serving as a deterrent. Users who know that their activities are being audited are less likely to attempt malicious activities.
For more information, see the Auditing Guide (http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=OSMAA).
In this section, you ensure that the system is collecting the information that is required by your site security policy.

contains 1 rule

Check all default audit propertiesrule

Check all default audit properties