RHEL 7 STIG — Free Checklist (24 Items) | TickYouOff

24 items · Security · Hard difficulty · 4 hours

Essential RHEL 7 STIG hardening steps to secure and audit your system.

• Update system packages and apply security patches

  Run yum update and reboot if kernel or core packages were updated.

• Configure SELinux to enforcing mode and persist settings

  Ensure /etc/selinux/config has SELINUX=enforcing and relabel if changed.

• Configure SSH daemon settings

  Edit /etc/ssh/sshd_config and restart sshd after changes.

• Disable root login via SSH (PermitRootLogin no)

  Set PermitRootLogin no in sshd_config to prevent direct root access.

• Enforce SSH Protocol 2 and strong ciphers

  Ensure Protocol 2 and specify strong Ciphers/KexAlgorithms/MACs.

• Disable empty passwords and increase SSH logging

  Set PermitEmptyPasswords no and LogLevel INFO in sshd_config.

• Enable and configure firewalld to restrict inbound traffic

  Open only required ports and set default zone to drop or deny.

• Identify unnecessary services to disable

  Inventory active services with systemctl list-units --type=service.

• List active system services for review

  Use systemctl or chkconfig to gather services running at boot.

• Stop and disable identified unwanted services

  Use systemctl stop <svc> && systemctl disable <svc> for each service.

• Set password complexity and aging policies

  Configure pam_pwquality and /etc/login.defs for min length and aging.

• Configure sudoers to restrict elevated access

  Remove NOPASSWD entries and limit sudo to necessary users/groups.

• Secure file permissions for critical system files

  Verify ownership and permissions for /etc/passwd, /etc/shadow, /etc/gshadow.

• Verify /etc/shadow and /etc/passwd permissions

  Ensure /etc/shadow is 0000/600 and owned by root:root as appropriate.

• Enable and configure auditd to capture system events

  Start auditd and enable service; persist rules in /etc/audit/rules.d.

• Add audit rules for privileged actions and system calls

  Include rules for su/sudo, permission changes, and network configuration.

• Install SCAP content and DISA RHEL7 STIG XCCDF/OVAL

  Obtain DISA SCAP/XCCDF content and install openscap/oscanner packages.

• Run OpenSCAP or SCAP scan and generate a compliance report

  Execute oscap xccdf eval and save HTML/XML results for review.

• Review scan results and apply STIG remediations by severity

  Prioritize high-severity findings, patch, and update configs; re-scan after fixes.

• Configure system time synchronization (chrony or ntpd)

  Ensure accurate time with chronyd enabled and configured to trusted NTP servers.

• Remove or disable legacy/unneeded network protocols and daemons

  Uninstall or disable telnet, ftp, rsh and other legacy services.

• Restrict cron and at usage to authorized users

  Validate /etc/cron.allow, /etc/cron.deny and /etc/at.allow settings.

• Backup configuration files and document changes

  Store copies of altered files and record change rationale and dates.

• Schedule regular compliance scans and routine updates

  Automate periodic SCAP scans and patching cadence to maintain compliance.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.