The following OS setting changes are applied to strengthen security. You can revert to the original settings if necessary.
Note that Hitachi Vantara does not take responsibility for, or support any interactions between, third-party programs and these OS settings.
- /etc/modprobe.d/CIS.conf
Additional settings:
install cramfs /bin/true install freevxfs /bin/true install jffs2 /bin/true install hfs /bin/true install hfsplus /bin/true install squashfs /bin/true install udf /bin/true install vfat /bin/true install dccp /bin/true install sctp /bin/true install rds /bin/true install tipc /bin/true - /etc/fstab
Original settings:
/dev/mapper/ol-home /home xfs defaults 0 0
Additional settings:
/dev/mapper/ol-home /home xfs defaults,nodev 0 0
- /etc/sysctl.conf
Additional settings:
net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 net.ipv4.icmp_echo_ignore_broadcasts = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.tcp_syncookies = 1 net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.default.accept_ra = 0 kernel.randomize_va_space = 2 net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 fs.suid_dumpable = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.ip_forward = 0
- /etc/motd, /etc/issue, /etc/issue.net
Additional settings:
Authorized uses only. All activity may be monitored and reported.
Note: The default lines that identify the system name and kernel version for the login prompt in /etc/issue and /etc/issue.net have been removed.