Common Security Configuration Issues Ops Face During GB/T 22239-2019 (Level‑2/3) Compliance

Problem Background

GB/T 22239‑2019 (China’s graded protection) requires critical information infrastructure operators to meet defined security requirements. During compliance audits, assessors provide a remediation checklist containing many high‑risk items that must be addressed individually.

Scope

The guide targets operations engineers preparing for Level‑2/3 compliance on CentOS 7/8 and Ubuntu 20.04. Each remediation item includes the standard requirement, typical audit finding, concrete configuration steps and verification commands.

Category 1 – Identity Authentication

1.1 Password Complexity

Requirement: passwords must be unique, contain mixed case, digits, special characters and be changed regularly. Typical finding: minimum length < 8 or missing character‑class checks.

Remediation (CentOS/RHEL):

# Install libpwquality
sudo yum install -y libpwquality
# Edit /etc/security/pwquality.conf
sudo vi /etc/security/pwquality.conf
# Example entries
minlen = 12
 dcredit = -1   # at least one digit
 ucredit = -1   # at least one uppercase
 lcredit = -1   # at least one lowercase
 ocredit = -1   # at least one special
 maxrepeat = 2  # max consecutive identical chars
 minclass = 4   # require four character classes
 difok = 3      # new password must differ by 3 chars

# Password history (prevent reuse of last 5 passwords)
sudo vi /etc/pam.d/common-password   # Ubuntu
password    requisite     pam_pwhistory.so remember=5
# Password expiration (Ubuntu example)
sudo vi /etc/login.defs
PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_WARN_AGE   7

Verification: attempt to set a simple password (e.g., 123456) and confirm it is rejected; grep the configuration files for the parameters.

1.2 Unique Account IDs

Requirement: each login must have a unique identifier; no non‑root account may have UID 0.

# Detect non‑root UID 0
awk -F: '($3 == 0) {print $1}' /etc/passwd
# Find duplicate UIDs
cut -d: -f3 /etc/passwd | sort | uniq -d
# Find duplicate usernames
cut -d: -f1 /etc/passwd | sort | uniq -d
# Remove duplicate account (replace <duplicate_username> with the actual name)
sudo userdel -r <duplicate_username>

1.3 sudo Privilege Control

Requirement: limit default accounts, disable direct root login.

# Verify wheel group has sudo rights
sudo grep wheel /etc/sudoers
# Disable root SSH login
sudo vi /etc/ssh/sshd_config
PermitRootLogin no
# Remove NOPASSWD entries
sudo grep NOPASSWD /etc/sudoers
sudo grep NOPASSWD /etc/sudoers.d/*
# Delete unnecessary default accounts
sudo userdel games
sudo userdel lp
# List accounts with valid shells
sudo awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") {print $1}' /etc/passwd

Category 2 – Access Control

2.1 Access‑Control Policy

Requirement: configure policies that restrict user permissions. Typical finding: missing or incomplete policy.

# Restrict SSH users and groups
sudo vi /etc/ssh/sshd_config
AllowUsers admin deploy
AllowGroups sudo
# Set restrictive default file permissions
sudo vi /etc/profile
umask 0027
# Enforce wheel group for su
sudo vi /etc/pam.d/su
auth required pam_wheel.so use_uid

2.2 Mandatory Access Control (SELinux/AppArmor)

Requirement: enable OS‑level MAC based on data classification. Typical finding: SELinux disabled or in permissive mode.

Remediation (CentOS/RHEL):

# Install SELinux policy packages
sudo yum install -y selinux-policy selinux-policy-targeted
# Set enforcing mode
sudo sed -i 's/SELINUX=disabled/SELINUX=enforcing/g' /etc/selinux/config
sudo setenforce 1
# Example booleans
sudo setsebool -P httpd_can_network_connect 1
sudo setsebool -P nis_enabled 1

Remediation (Ubuntu):

# Install AppArmor utilities
sudo apt-get install -y apparmor-utils
# Enforce all profiles
sudo aa-enforce /etc/apparmor.d/*

Category 3 – Security Auditing

3.1 Audit Policy

Requirement: enable audit, record user actions and system events with timestamps, user, event type and result. Typical finding: incomplete audit rules, missing storage policy.

# Install and start auditd (CentOS/RHEL)
sudo yum install -y audit
sudo systemctl enable auditd
sudo systemctl start auditd
# Define audit rules
sudo vi /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/ssh/sshd_config -k sshd_config
-w /etc/sudoers -p wa -k sudoers
-w /usr/bin/rm -p x -k delete
# Configure log size and rotation
sudo vi /etc/audit/auditd.conf
max_log_file = 50
max_log_file_action = ROTATE
num_logs = 5

Verification: use ausearch -k identity and ausearch -i to view logged events; create a test user and confirm that password changes are recorded.

3.2 Log Storage and Backup

Requirement: protect audit records and back them up regularly.

# Forward logs to a remote syslog server
sudo vi /etc/rsyslog.conf
*.* @@log-server-ip:514
# Configure logrotate for syslog
sudo vi /etc/logrotate.d/syslog
/var/log/secure {
    daily
    rotate 90
    compress
    missingok
    notifempty
}
# Adjust auditd retention
sudo vi /etc/audit/auditd.conf
num_logs = 10
max_log_file = 100

Category 4 – Intrusion Prevention

4.1 Disable Unnecessary Services

Requirement: close services and protocols that are not needed.

# List running services
systemctl list-units --type=service --state=running
# Disable telnet
sudo systemctl stop telnet.socket
sudo systemctl disable telnet.socket
# Disable FTP
sudo systemctl stop vsftpd
sudo systemctl disable vsftpd
# Verify listening ports
ss -tunapl | grep LISTEN

4.2 Limit ICMP

Requirement: restrict ICMP to prevent flood attacks.

# iptables rate‑limit echo requests
sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 4 -j ACCEPT
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
# firewalld ICMP blocks
sudo firewall-cmd --permanent --add-icmp-block=echo-reply
sudo firewall-cmd --permanent --add-icmp-block=echo-request
sudo firewall-cmd --reload
# sysctl hardening
sudo vi /etc/sysctl.conf
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
sudo sysctl -p

4.3 Intrusion Detection Tools

Requirement: deploy IDS/IPS.

# Install AIDE (file integrity)
sudo yum install -y aide
sudo aide --init
# Install rkhunter (rootkit detection)
sudo yum install -y rkhunter
sudo rkhunter --update
# Install ClamAV (malware scanning)
sudo yum install -y clamav
sudo freshclam

Category 5 – Resource Control

5.1 User Resource Limits

Requirement: limit per‑user/process resources to prevent exhaustion attacks.

# /etc/security/limits.conf
* soft nproc 4096
* hard nproc 8192
* soft nofile 65535
* hard nofile 65535
* soft core 0
* hard core 0
root soft nproc unlimited
root hard nproc unlimited
root soft nofile unlimited
root hard nofile unlimited
# Enable PAM limits module (Ubuntu example)
sudo vi /etc/pam.d/common-session
session required pam_limits.so
# Systemd defaults (optional)
sudo vi /etc/systemd/system.conf
DefaultLimitNOFILE=65535
DefaultLimitNPROC=4096

5.2 Auto‑Logout on Idle

Requirement: disconnect idle terminals.

# SSH timeout settings
sudo vi /etc/ssh/sshd_config
ClientAliveInterval 300
ClientAliveCountMax 2
# Bash auto‑logout
sudo vi /etc/profile.d/auto-logout.sh
TMOUT=600
export TMOUT
readonly TMOUT

Category 6 – Data Confidentiality

6.1 Data‑in‑Transit Encryption

Requirement: use cryptography for network traffic.

# Disable insecure services
sudo systemctl stop telnet.socket
sudo systemctl disable telnet.socket
sudo systemctl stop vsftpd
sudo systemctl disable vsftpd
# Enforce HTTPS in Nginx (example)
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers on;

6.2 Data‑at‑Rest Encryption

Requirement: encrypt stored data and secrets.

# Encrypt configuration files with Ansible Vault
ansible-vault encrypt my_secret_file.yml
# Store database passwords in environment variables
export MYSQL_ROOT_PASSWORD=xxx
# Kubernetes Secret example
kubectl create secret generic db-creds --from-literal=username=admin --from-literal=password=xxx
# Full‑disk encryption with LUKS
sudo cryptsetup luksFormat /dev/sdb1
sudo cryptsetup open /dev/sdb1 encrypted_disk
sudo mkfs.ext4 /dev/mapper/encrypted_disk

Remediation Workflow

Classify each audit item (identity authentication, access control, security auditing, intrusion prevention, resource control, data confidentiality).

Prioritize by risk level; address high‑risk items first.

Test remediation steps in a staging environment.

Record configuration changes for auditability.

Apply changes to production with rollback plans.

Verify effectiveness using the provided commands.

Request re‑assessment from the audit agency.