https://secscan.acron.pl/ 2026-08-31T08:49:06+00:00 https://secscan.acron.pl/ https://secscan.acron.pl/lib/tpl/bootstrap3/images/favicon.ico text/html 2017-05-06T15:25:44+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/1?rev=1494077144&do=diff 1.1.1 Disable unused filesystems List of content 1 index Description A number of uncommon filesystem types are supported under Linux. Removing support for unneeded filesystem types reduces the local attack surface of the system. If a filesystem type is not needed it should be disabled. Native Linux file systems are designed to ensure that built-in security controls function as expected. Non-native filesystems can lead to unexpected consequences to both the security and functionality of the s… text/html 2017-05-04T04:04:44+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/2?rev=1493863484&do=diff 1.1.2 Ensure separate partition exists for /tmp (Scored) Profile Applicability Description The /tmp directory is a world-writable directory used for temporary storage by all users and some applications. Rationale Since the /tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making text/html 2017-05-05T17:40:02+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/3?rev=1493998802&do=diff 1.1.3 Ensure nodev option set on /tmp partition (Scored) Profile Applicability Description The nodev mount option specifies that the filesystem cannot contain special devices. Rationale Since the /tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices in text/html 2017-05-05T18:29:10+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/4?rev=1494001750&do=diff 1.1.4 Ensure nosuid option set on /tmp partition (Scored) Profile Applicability Description The nosuid mount option specifies that the filesystem cannot contain setuid files. Rationale Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot create text/html 2017-05-05T18:57:16+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/5?rev=1494003436&do=diff 1.1.5 Ensure noexec option set on /tmp partition (Scored) Profile Applicability Description The noexec mount option specifies that the filesystem cannot contain executable binaries. Rationale Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from text/html 2017-05-05T19:10:38+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/6?rev=1494004238&do=diff 1.1.6 Ensure separate partition exists for /var (Scored) Profile Applicability Description The /var directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable. text/html 2017-05-05T19:29:14+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/7?rev=1494005354&do=diff 1.1.7 Ensure separate partition exists for /var/tmp (Scored) Profile Applicability Description The /var/tmp directory is a world-writable directory used for temporary storage by all users and some applications. Rationale Since the /var/tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making text/html 2017-05-05T19:18:28+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/8?rev=1494004708&do=diff 1.1.8 Ensure nodev option set on /var/tmp partition (Scored) Profile Applicability Description The nodev mount option specifies that the filesystem cannot contain special devices. Rationale Since the /var/tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices in text/html 2017-05-05T19:36:44+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/9?rev=1494005804&do=diff 1.1.9 Ensure nosuid option set on /var/tmp partition (Scored) Profile Applicability Description The nosuid mount option specifies that the filesystem cannot contain setuid files. Rationale Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot create text/html 2017-05-05T19:41:20+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/10?rev=1494006080&do=diff 1.1.10 Ensure noexec option set on /var/tmp partition (Scored) Profile Applicability Description The noexec mount option specifies that the filesystem cannot contain executable binaries. Rationale Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from text/html 2017-05-05T20:18:20+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/11?rev=1494008300&do=diff 1.1.11 Ensure separate partition exists for /var/log (Scored) Profile Applicability Description The /var/log directory is used by system services to store log data . Rationale There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data. text/html 2017-05-05T20:28:56+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/12?rev=1494008936&do=diff 1.1.12 Ensure separate partition exists for /var/log/audit (Scored) Profile Applicability Description The auditing daemon, auditd, stores log data in the /var/log/audit directory. Rationale There are two important reasons to ensure that data gathered by text/html 2017-05-05T20:36:42+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/13?rev=1494009402&do=diff 1.1.13 Ensure separate partition exists for /home (Scored) Profile Applicability Description The /home directory is used to support disk storage needs of local users. Rationale If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under text/html 2017-05-05T20:41:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/14?rev=1494009660&do=diff 1.1.14 Ensure nodev option set on /home partition (Scored) Profile Applicability Description The nodev mount option specifies that the filesystem cannot contain special devices. Rationale Since the user partitions are not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices. text/html 2017-05-05T20:46:28+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/15?rev=1494009988&do=diff 1.1.15 Ensure nodev option set on /dev/shm partition (Scored) Profile Applicability Description The nodev mount option specifies that the filesystem cannot contain special devices. Rationale Since the /dev/shm filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in text/html 2017-05-05T21:17:32+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/16?rev=1494011852&do=diff 1.1.16 Ensure nosuid option set on /dev/shm partition (Scored) Profile Applicability Description The nosuid mount option specifies that the filesystem cannot contain setuid files. Rationale Setting this option on a file system prevents users from introducing privileged programs onto the system and allowing non-root users to execute them. text/html 2017-05-05T21:22:50+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/17?rev=1494012170&do=diff 1.1.17 Ensure noexec option set on /dev/shm partition (Scored) Profile Applicability Description The noexec mount option specifies that the filesystem cannot contain executable binaries. Rationale Setting this option on a file system prevents users from executing programs from shared memory. This deters users from introducing potentially malicious software on the system. text/html 2017-05-05T21:31:38+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/18?rev=1494012698&do=diff 1.1.18 Ensure nodev option set on removable media partitions (Not Scored) Profile Applicability Description The nodev mount option specifies that the filesystem cannot contain special devices. Rationale Removable media containing character and block special devices could be used to circumvent security controls by allowing non-root users to access sensitive device files such as text/html 2017-05-05T21:33:08+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/19?rev=1494012788&do=diff 1.1.19 Ensure nosuid option set on removable media partitions (Not Scored) Profile Applicability Description The nosuid mount option specifies that the filesystem cannot contain setuid files. Rationale Setting this option on a file system prevents users from introducing privileged programs onto the system and allowing non-root users to execute them. text/html 2017-05-05T21:37:36+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/20?rev=1494013056&do=diff 1.1.20 Ensure noexec option set on removable media partitions (Not Scored) Profile Applicability Description The noexec mount option specifies that the filesystem cannot contain executable binaries. Rationale Setting this option on a file system prevents users from executing programs from the removable media. This deters users from being able to introduce potentially malicious software on the system. text/html 2017-05-05T21:40:28+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/21?rev=1494013228&do=diff 1.1.21 Ensure sticky bit is set on all world-writable directories (Scored) Profile Applicability Description Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them. text/html 2017-05-05T22:26:38+00:00 Anonymous (anonymous@undisclosed.example.com) https://secscan.acron.pl/centos7/1/1/22?rev=1494015998&do=diff 1.1.22 Disable Automounting (Scored) Profile Applicability Description autofs allows automatic mounting of devices, typically including CD/DVDs and USB drives. Rationale With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.